AN3154

Application note
CAN protocol used in the STM32 bootloader

Introduction
This application note describes the CAN protocol used in the STM32 microcontroller
bootloader. It details each supported command.
This document applies to the STM32 products embedding bootloader versions V3.x, V7.x
and V9.x, as specified in STM32 microcontroller system memory boot mode (AN2606)
available on www.st.com. These products are listed in Table 1, and are referred to as
STM32 throughout the document.
For more information about the CAN hardware resources and requirements for the
bootloader of the used device, refer to the already mentioned AN2606.

Table 1. Applicable products

Type Part number or product series

STM32F1 Series
STM32F2 Series
Microcontrollers STM32F4 Series
STM32F7 Series
STM32L4 Series

December 2019 AN3154 Rev 7 1/33

www.st.com
Contents AN3154

Contents

1 Bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2 CAN settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3 Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

3.1 Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2 Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . .11
3.3 Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.4 Speed command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.5 Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.6 Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.7 Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.8 Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.9 Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.10 Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.11 Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.12 Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

4 Bootloader protocol version evolution . . . . . . . . . . . . . . . . . . . . . . . . . 31

5 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

2/33 AN3154 Rev 7

AN3154 List of tables

List of tables

Table 1. Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Table 2. CAN bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Table 3. Bootloader protocol versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Table 4. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

AN3154 Rev 7 3/33

3
List of figures AN3154

List of figures

Figure 1. Bootloader for STM32 with CAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Figure 2. Check HSE frequency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Figure 3. CAN frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Figure 4. Get command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Figure 5. Get command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Figure 6. Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 11
Figure 7. Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 12
Figure 8. Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Figure 9. Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Figure 10. Speed command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Figure 11. Speed command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Figure 12. Read memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Figure 13. Read memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Figure 14. Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Figure 15. Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Figure 16. Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Figure 17. Write memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Figure 18. Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 19. Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Figure 20. Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Figure 21. Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Figure 22. Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 23. Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 24. Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 25. Readout Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 26. Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Figure 27. Readout Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

4/33 AN3154 Rev 7

AN3154 Bootloader code sequence

1 Bootloader code sequence

Figure 1. Bootloader for STM32 with CAN

Frame detected(1)
on CANx_Rx pin

Check HSE frequency

Wait for a
command
Command
GET cmd received GO cmd

GET cmd RD cmd (optional) GO cmd

routine routine Routines for routine
loading
into RAM

JP to_Address

ai17754b

1. It is recommended to send a frame with a Standard ID = 0x79.

Once the system memory boot mode is entered and the STM32 device (based on Arm®(a)
cores) has been configured (for more details refer to AN2606), the bootloader code waits for
a frame on the CANx_Rx pin. When a detection occurs the CAN bootloader firmware starts
to check the external clock frequency.
Figure 2 shows the flowchart of the frequency check.

a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

AN3154 Rev 7 5/33

32
Bootloader code sequence AN3154

Figure 2. Check HSE frequency

Start check HSE frequency

HSE measured with HSI
No HSE measurement (1)
and Timer (1)

Configure CAN baudrate at 125 Kbps Configure external Oscillator mode

Assuming that HSE = 8 MHz (System Clock = 60 MHz)
Initialize timeout at ~1.5 ms Initialize timeout at ~3 ms

Message Message
received with stdID=0x79 Yes Yes
received with stdID=0x79
and without frame error? and without frame error
?
No No

No No
Decrement timeout Decrement timeout
Timeout = 0x0 ? Timeout=0x0?

Yes Yes
Configure CAN baudrate at 125Kbps
Assuming that HSE = 25MHz Generate System Reset
Initialize timeout at ~1.5 ms

Message
Yes
received with stdID=0x79
and without frame error
?

No

No
Decrement timeout
Timeout = 0x0 ?

Yes
Configure CAN baudrate at 125Kbps
Assuming that HSE = 14.7456MHz
Initialize timeout at ~1.5 ms

Message
received with stdID=0x79 Yes
and without frame error
?
No

No
Decrement timeout
Timeout = 0x0 ?
Yes

Enter an infinite loop, waiting for any

Generate System Reset
CAN bootloader command.
ai15704c

1. For some devices the HSE frequency is calculated using HSI oscillator connected to a timer. For other
devices this measurement is not implemented. For the devices without HSE frequency measurement, only
the flow represented on the left is executed, while for the devices with HSE frequency measurement only
the flow on the right is executed. To know the flow for the used device refer to AN2606.

6/33 AN3154 Rev 7

AN3154 CAN settings

Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an
acknowledge byte (0x79) is returned to the host, indicating that the STM32 is ready to
receive commands.

2 CAN settings

The STM32 CAN is compliant with the 2.0A and B (active) specifications with a bit rate up to
1 Mbit/s. It can receive and transmit standard frames with 11-bit identifiers as well as
extended frames with 29-bit identifiers.
Figure 3 shows a CAN frame that uses the standard identifier only.

Figure 3. CAN frame

Inter-frame space
Inter-frame space Data frame (standard identifier) or overload frame
44 + 8 * N

Control field ACK field

Arbitration field Data field CRC field 2
12 6 8*N 16 7

ID DLC CRC EOF

RTR
IDE
r0

ACK
SOF

ai15001

In this application the CAN settings are:

• Standard identifier (not extended)
• Bit rate: at the beginning it is 125 kbps; during runtime it can be changed via the speed
command to achieve a maximum bit rate of 1 Mbps.
The transmit settings (from the STM32 to the host) are:
• Tx mailbox0: On
• Tx mailbox1 and Tx mailbox2: Off
• Tx identifier: (0x00, 0x01, 0x02, v03, 0x11, 0x21, 0x31, 0x43, 0x63, 0x73, 0x82, 0x92)
The receive settings (from the host to the STM32) are:
• Synchronization byte, 0x79, is in the RX identifier and not in the data field.
• RX identifier depends on the command (0x00, 0x01, 0x02, 0x03, 0x11, 0x21, 0x31,
0x43, 0x63, 0x73, 0x82, 0x92)
• Error checking: If the error field (bit [6:4] in the CAN_ESR register) is different from
000b, the message is discarded and a NACK is sent to the host
• In FIFO overrun condition, the message is discarded and a NACK is sent to the host
• Incoming messages can contain from 1 to 8 data bytes.
Note: The CAN bootloader firmware supports only one node at a time. This means that CAN
network management is not supported by the firmware.

AN3154 Rev 7 7/33

32
Bootloader command set AN3154

3 Bootloader command set

The supported commands are listed in Table 2, each of them is described in this section.

Table 2. CAN bootloader commands

Command Command code Command description

Gets the version and the allowed commands

Get(1) 0x00
supported by the current version of the bootloader
Get Version & Gets the bootloader version and the Read Protection
0x01
Read Protection Status(1) status of the Flash memory
Get ID(1) 0x02 Gets the chip ID
The speed command allows the baud rate for CAN
Speed 0x03
run-time to be changed.
Reads up to 256 bytes of memory starting from an
Read Memory(2) 0x11
address specified by the application
Jumps to user application code located in the internal
Go(2) 0x21
Flash memory or in SRAM
Writes up to 256 bytes to the RAM or Flash memory
Write Memory(2) 0x31
starting from an address specified by the application
Erase(2) 0x43 Erases from one to all the Flash memory sectors
Write Protect 0x63 Enables the write protection for some sectors
Disables the write protection for all Flash memory
Write Unprotect 0x73
sectors
Readout Protect(1) 0x82 Enables the read protection
Readout Unprotect(1) 0x92 Disables the read protection
1. Read protection – When the RDP (read protection) option is active, only this limited subset of commands is
available. All other commands are NACK-ed and have no effect on the device. Once the RDP has been
removed, the other commands become active.
2. Refer to STM32 product datasheet and AN2606 to know the memory spaces valid for these commands.

Communication safety
Each packet is either accepted (ACK answer) or discarded (NACK answer):
• ACK message = 0x79
• NACK message = 0x1F

3.1 Get command

The Get command allows the host to get the version of the bootloader and the supported
commands. When the bootloader receives this command, it transmits the bootloader
version and the supported command codes to the host.

8/33 AN3154 Rev 7

AN3154 Bootloader command set

Figure 4. Get command: host side

Start of Get command

Send message with std ID = 00h

Wait for NACK

ACK or NACK

ACK

Receive message: Number of bytes (version + commands)

Receive message: Bootloader version

Receive message: Get command

Receive message: Get Version & Read Protection Status command

Receive message: Get ID command

Receive message: Speed command

Receive message: Read Memory command

Receive message: Go command

Receive message: Write Memory command

Receive message: Erase Memory command

Receive message: Write Protect command

Receive message: Write Unprotect command

Receive message: Readout Protect command

Receive message: Readout Unprotect command

Wait for
ACK or NACK

End of Get command

MS45414V1

The host sends messages as follows:

Command message: Std ID = 0x00, data length code (DLC) = ‘not important’.

AN3154 Rev 7 9/33

32
Bootloader command set AN3154

Figure 5. Get command: device side

Start get command

Received message No
with ID = 0x00?

Yes

Send ACK message Send NACK message

Send 1 message: Number of bytes

(version + commands)

Send 1 message: Bootloader version

Send 12 messages: Supported commands

Send ACK message

End of get command

ai15706

The STM32 sends messages as follows:

Message 1: Std ID = 0x00, DLC = 1, data = 0x79 - ACK

Message 2: Std ID = 0x00, DLC = 1 data = N = 12 = the number of bytes to be sent -1
(1 ≤N + 1 ≤256)
Message 3: Std ID = 0x00, DLC = 1, data = bootloader version (0 < version ≤255)
Message 4: Std ID = 0x00, DLC = 1, data = 0x00 - Get command
Message 5: Std ID = 0x00, DLC = 1, data = 0x01 - Get Version & Read Protection
Status command
Message 6: Std ID = 0x00, DLC = 1, data = 0x02 - Get ID command
Message 7: Std ID = 0x00, DLC = 1, data = 0x03 - Speed command
Message 8: Std ID = 0x00, DLC = 1, data = 0x11 - Read memory command
Message 9: Std ID = 0x00, DLC = 1, data = 0x21 - Go command
Message 10: Std ID = 0x00, DLC = 1, data = 0x31 - Write memory command
Message 11: Std ID = 0x00, DLC = 1, data = 0x43 - Erase memory command
Message 12: Std ID = 0x00, DLC = 1, data = 0x63 - Write Protect command
Message 13: Std ID = 0x00, DLC = 1, data = 0x73 - Write Unprotect command

10/33 AN3154 Rev 7

AN3154 Bootloader command set

Message 14: Std ID = 0x00, DLC = 1, data = 82h - Readout Protect command
Message 15: Std ID = 0x00, DLC = 1, data = 92h - Readout Unprotect command
Message 16: Std ID = 0x00, DLC = 1, data = 0x79 - ACK

3.2 Get Version & Read Protection Status command

The Get Version & Read Protection Status command is used to get the bootloader version
and the read protection status. When the bootloader receives the command, it transmits the
information described below (version and two dummy bytes having value 0x00) to the host.

Figure 6. Get Version & Read Protection Status command: host side
Start GV(1)

Send message with std ID = 0x01

Wait for ACK NACK

or NACK

ACK

Receive 1 message: Bootloader version

Receive 1 message:
2 dummy bytes having value 0x00

Wait for ACK NACK

or NACK

ACK

End of GV(1)
ai15707V2

1. GV = Get Version & Read Protection Status.

The host sends messages as follows:

Command message: Std ID = 0x01, data length code (DLC) = ‘not important’.
ACK Message contain: Std ID = 0x01, DLC = 1, data = 0x79 - ACK

AN3154 Rev 7 11/33

32
Bootloader command set AN3154

Figure 7. Get Version & Read Protection Status command: device side

Start GV (1)

Received message No
Send NACK message
with std ID =
0x01?

Yes

Send ACK byte

Send 1 message: bootloader version

Option message

Send ACK message

End of GV(1) ai15708

1. GV = Get Version & Read Protection Status.

The STM32 sends messages as follows:

Message 1: Std ID = 0x01, DLC = 1, data = ACK

Message 2: Std ID = 0x01, DLC = 1, data[0] = bootloader version (0 < version ≤ 255),
example: 0x10 = Version 1.0
Message 3: Option message 1: Std ID = 0x01, DLC = 2, data = 0x00 (byte1 and byte 2)
Message 4: Std ID = 0x01, DLC = 1, data = ACK

12/33 AN3154 Rev 7

AN3154 Bootloader command set

3.3 Get ID command

The Get ID command is used to get the version of the chip ID (identification). When the
bootloader receives the command, it transmits the product ID to the host.

Figure 8. Get ID command: host side

Start GID (1)

Send message with std ID = 0x02

Wait for ACK NACK

or NACK

ACK

Receive message 1:
data field contains the PID

Wait for ACK NACK

or NACK

ACK

End of GID(1)
ai15710

1. GID = Get ID.

2. PID stands for product ID. Byte 1 is the MSB and byte 2, the LSB of the address. Refer to Section 3.1: Get
command for more details about the PID of the used device.

The host sends messages as follows:

Command message: Std ID = 0x02, data length code (DLC) = ‘not important’.
ACK Message contains: Std ID = 0x02, DLC = 1, data = 0x79 - ACK

AN3154 Rev 7 13/33

32
Bootloader command set AN3154

Figure 9. Get ID command: device side

Start GID (1)

No
Received message Send NACK message
with std ID =
0x02?

Yes

Send ACK message

Send message 1: PID

Send ACK byte

End of GID(1) ai15711

1. GID = Get ID.

2. PID stands for product ID. Byte 1 is the MSB and byte 2 is LSB of the address.

The STM32 sends the bytes as follows:

Message 1: Std ID = 0x02, DLC = 1, data = ACK with DLC except for current message
and ACKs.
Message 2: Std ID = 0x02, DLC = N (the number of bytes – 1. For STM32, N = 1),
data = PID with byte 0 is MSB and byte N is the LSB of the product ID
Message 3: Std ID = 0x02, DLC = 1, data = ACK = 0x79

3.4 Speed command

The speed command allows the baud rate for CAN run-time to be changed. It can be used
only if CAN is the peripheral being used.
A system reset is generated if the CAN receives the correct message but the operation to
set the new baud rate fails, which prevents it from entering or leaving initialization mode.

14/33 AN3154 Rev 7

AN3154 Bootloader command set

Figure 10. Speed command: host side

Start speed command

Send speed message (std ID = 0x03)

NACK
Wait for ACK
or NACK
ACK

Changes the CAN baud rate

according to command sent

Wait for ACK

End of speed ai15712

1. After setting the new baud rate, the bootloader sends the ACK message. Therefore, the host sets its baud
rate while waiting for the ACK.

The host sends the message as follows:

Command message: Std ID = 0x03, DLC = 0x01, data[0] = XXh where XXh takes the
following values depending on the baud rate to be set:
• 0x01: baud rate = 125 kbps
• 0x02: baud rate = 250 kbps
• 0x03: baud rate = 500 kbps
• 0x04: baud rate = 1 Mbps

AN3154 Rev 7 15/33

32
Bootloader command set AN3154

Figure 11. Speed command: device side

Start speed command

Received a message No
with std ID = 0x03
and with valid
data?
Send NACK message
Yes (old baud rate)

Send ACK message

(old baud rate) End of speed command

Changes the CAN baud rate according

to received data (new baud rate)

No
Baudrate set correctly?

Yes Generate system reset

Send ACK message

(new baud rate)

End of speed command

ai15713

The STM32 sends the bytes as follows:

Message 1: Std ID = 0x03, DLC = 1, data[0] = ACK= 0x79: with old baud rate if the
receive message is correct else data[0] = NACK= 0x1F
Message 2: Std ID = 0x03, DLC = 1, data[0] = ACK = 0x79 with new baud rate

16/33 AN3154 Rev 7

AN3154 Bootloader command set

3.5 Read Memory command

The Read Memory command is used to read data from any valid memory address in RAM,
Flash memory and in the information block (System memory or option byte areas).
When the bootloader receives the Read Memory command, it starts to verify the contents of
the message:
• ID of the command is correct or not
• ReadOutProtection is disabled or enabled
• Address to be read is valid or not
If the message content is correct it transmits an ACK message otherwise it transmits a
NACK message.
After sending an ACK message, it transmits the required data to the application
((N + 1) bytes) via (N+1) messages /8 (as each message contains 8 bytes), starting from the
received address.

Figure 12. Read memory command: host side

Start Read memory

Send read message (std ID = 0x11)

NACK
Wait for ACK or NACK

ACK
Send NACK message
Receive (N+1)/8 messages from bootloader

End of Read memory

ai15714

The host sends messages as follows:

Command message:
Std ID = 0x11, DLC = 0x05, data[0] = 0xXX: MSB of the address... data[3] = 0xYY: LSB of
the address, data[4] = N: number of bytes to be read (where 0 < N ≤ 255).

AN3154 Rev 7 17/33

32
Bootloader command set AN3154

Figure 13. Read memory command: device side

Start Read memory

Received message No
with std ID = 0x11?

Yes

ROP inactive? No
Address valid?

Yes

Send ACK message

Send NACK message

Send (N+1)/8 messages to the host

End of Read memory

ai15715

The STM32 sends messages as follows:

ACK message: Std ID = 0x11, DLC = 1, data[0] = ACK if content of the command is correct
else data[0] = NACK
Data message (N+1) / 8: Std ID = 0x11, DLC = Number of Byte, data[0] = 0xXX...
data[Number of Byte - 1] = 0xYY
ACK message: Std ID = 0x11, DLC = 1, data[0] = ACK

3.6 Go command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it starts if the message contains the following valid information:
• ID of the command is correct or not
• ReadOutProtection is disabled or enabled
• branch destination address is valid or not(data[0] is the address MSB and data[3] is
LSB
If the message content is correct it transmits an ACK message, otherwise it transmits a
NACK message.

18/33 AN3154 Rev 7

AN3154 Bootloader command set

After sending an ACK message to the application, the bootloader firmware

• Initializes the registers of the peripherals used by the bootloader to their default reset
values
• Initializes the user application main stack pointer
• Jumps to the memory location programmed in the received ‘address + 4’
(corresponding to the address of the application’s reset handler).
For example, if the received address is 0x0800 0000, the bootloader jumps to the
memory location programmed at address 0x0800 0004.
In general, the host sends the base address where the application to jump to is
programmed.
Note: 1 The Jump to the application works only if the user application sets the vector table correctly
to point to the application address.
2 The valid addresses for the Go command are in RAM or Flash memory (refer to Section 3.1
for more details about the valid memory addresses for the used device). All other addresses
are considered not valid and are NACK-ed by the device.
3 When an application is loaded into RAM and a jump is made to it, the program must be
configured to run with an offset to avoid overlapping with the first area used by the
bootloader firmware (refer to Section 3.1 for more details about the RAM offset for the used
device).

Figure 14. Go command: host side

Start Go command

Send Go message (std ID = 0x21)

Wait for ACK

or NACK

End of Go
ai15716

1. See product datasheet for valid addresses.

The host sends the bytes as follows

Go command message: Std ID = 0x21, DLC = 0x04, data[0] = 0xXX: MSB address,...data[3]
= 0xYY LSB address.

AN3154 Rev 7 19/33

32
Bootloader command set AN3154

Figure 15. Go command: device side

Start Go command

Received message No
with std ID = 0x21?

Yes

ROP inactive? No
Address valid?

Yes

Send ACK message Send NACK message

Jump to user application End of go

ai15717b

The STM32 send the messages as follows:

ACK message: Std ID = 0x21, DLC = 1, data[0] = ACK if content of the command is correct
else data[0] = NACK

3.7 Write Memory command

The Write Memory command is used to write data to any valid memory address (see note)
of RAM, Flash memory, or Option byte area. When the bootloader receives the Write
Memory command, (message with 5 bytes data length, data[0] is the address MSB, data[3]
is the LSB and data[4] is the number of data bytes to be received), it then checks the
received address. For the Option byte area, the start address must be the base address of
the Option byte area (see note) to avoid writing inopportunely in this area.
Note: Refer to Section 3.1 for more details about the valid memory addresses for the used device.
If the received address is valid, the bootloader transmits an ACK message, otherwise it
transmits a NACK message and aborts the command. When the address is valid, the
bootloader:
• Receives the user data (N bytes) so the device receives N/8 messages (each message
contains 8 data bytes)
• Programs the user data into memory starting from the received address
• At the end of the command, if the write operation was successful, the bootloader
transmits the ACK message; otherwise it transmits a NACK message to the application
and aborts the command
The maximum length of the block to be written for the STM32 is 256 bytes.
If the Write Memory command is issued to the Option byte area, all options are erased
before writing the new values, and at the end of the command the bootloader generates a
system Reset to take into account the new configuration of the option byte.

20/33 AN3154 Rev 7

AN3154 Bootloader command set

Note: 1 When writing to the RAM, user must not overlap the memory used by the bootloader
firmware.
2 No error is returned when performing write operations on write protected sectors.

Figure 16. Write Memory command: host side

Start Write memory

Send Write message (std ID = 0x31)

Wait for ACK NACK

or NACK

ACK
If NACK message received
Send the data messages. At same
time, the host checks whether it
received a NACK message

Wait for ACK

or NACK

End of Write memory ai15718

Note: If the start address is invalid, the command is NACK-ed by the device.
The host sends the messages as follows:
Command message: Std ID = 0x31, DLC = 0x05, data[0] = 0xXX: MSB address,..., data[3] =
0xYY: LSB address, data[4] = N-1 (number of bytes to be written - 1), 0 < N ≤ 255).
Then the host sends N/8 message
Data message: Std ID = 0x31, DLC_1 = to 8, data = byte_11, … byte_18…
Data message_M: Std ID = 0x04, DLC_M = 1 to 8, data = byte_m1, …, byte_M8
Note: 1 DLC_1 + DLC_2 + ... DLC_M = 256 maximum
2 After each message the host receives the ACK or NACK message from the device
3 The bootloader does not check the standard ID of the data, so any ID from 0h to 0xFF can
be used. It is recommended to use 0x04.

AN3154 Rev 7 21/33

32
Bootloader command set AN3154

Figure 17. Write memory command: device side

Start Write Memory

Received message No
with stdID=0x31?

Yes

ROP inactive? No
Address valid?

Yes

Send ACK message

Receive the ’data messages’ and If a message is corrupted

temporarily write the data to RAM

Yes
Address in Flash ?

Write the received data to the

No memory from the start address

Yes
Address in RAM ?

Write the received data to the

No RAM from the start address

Yes
Address=0x1FFF F800 ?

Write the keys for Option byte

area access
No Write the received data to Option
area access from start address

Send ACK message

Generate system reset

Send ACK message

Send NACK message

End of Write Memory

MS53180V1

The STM32 sends messages as follows:

ACK message: Std ID = 0x31, DLC = 1, data[0] = ACK if the content of the command is
correct else data[0] = NACK
After each received message, the device will send an ACK if the content of the command is
correct else a NACK. However, as described in Figure 17, after receiving all the 'data
messages' (N/8 messages) and temporarily write the data to RAM, if none of the messages
content is corrupted, the bootloader will write the N bytes at the requested address (Flash
memory, RAM or option byte), then if the write operation is successfully completed, device
will send an ACK message to the host.

22/33 AN3154 Rev 7

AN3154 Bootloader command set

In other terms, after sending the N/8 messages, host will receive two successive ACK; the
first will be sent by the device if the last message of the N/8 is correctly received, and the
second ACK will be sent after writing correctly the N/8 message at the requested address

3.8 Erase Memory command

The Erase Memory command allows the host to erase Flash memory pages. When the
bootloader receives the Erase Memory command and ROP is disabled, it transmits the ACK
message to the host. After the transmission of the ACK message, the bootloader checks if
data[0] is equal to 0xFF, if it is the case a global memory erase operation will be started and
when finished it sends ACK message. Otherwise (data[0] is different from 0xFF), the
bootloader will start the memory page(s) erase as defined by the host, and after each page
erase it sends ACK or NACK message.
Erase Memory command specifications:
1. The bootloader receives a message containing N (the number of pages to be erased
– 1). N = 255 is reserved for global erase requests. For 0 ≤ N ≤ 254, N + 1 pages are
erased.
2. The bootloader receives (N + 1) bytes, each byte containing a page number
Note: No error is returned when performing erase operations on write protected sectors.

Figure 18. Erase Memory command: host side

Start erase memory

Yes Global No
Erase?

Send a message with std

ID = 0x43 and data byte 1
Send a message with std
= 0xFF. The bootloader
ID = 0x43 and data field
takes no account of other
containing sector codes
data in the message

Wait for 2 ACK NACK

or 1 NACK

ACK

End of erase memory

ai15720

The host sends the message as follows:

AN3154 Rev 7 23/33

32
Bootloader command set AN3154

The ID contains the command type (0x43):

• Total erase message: Std ID = 0x43, DLC = 0x01, data = 0xFF.
• Erase sector by sector message: Std ID = 0x43, DLC = 0x01 to 0x08, data = see
product datasheet.
In case of page by page erase, after each message the host receives the ACK or NACK
message from the device.

Figure 19. Erase Memory command: device side

Start Erase Memory

Received message
No
with stdID = 0x43
and ROP?

Yes

Send ACK message

Yes Is byte 1 of the

Data field = 0xFF?

Start global erase

No

Erase memory page by page

according to data contained in
Send ACK message the messages data field Send NACK message
Send ACK message after each
page erase

End of erase memory

ai15721V3

The STM32 sends messages as follows:

ACK message: Std ID = 0x43, DLC = 1, data[0] = ACK if content of the command is correct
and ROP is not active else data[0] = NACK.

24/33 AN3154 Rev 7

AN3154 Bootloader command set

3.9 Write Protect command

The Write Protect command is used to enable the write protection for some or all Flash
memory sectors. When the bootloader receives the Write Protect command, it transmits the
ACK message to the host if ROP is disabled else it transmits NACK.
After the transmission of the ACK byte, the bootloader waits to receive the Flash memory
sector codes from the application.
At the end of the Write Protect command, the bootloader transmits the ACK message and
generates a system Reset to take into account the new configuration of the option byte.
Note: 1 Refer to Section 3.1 for more details about the sector size of the used device.
2 The total number of sectors and the sector number to be protected are not checked, this
means that no error is returned when a command is passed with a wrong number of sectors
to be protected, or a wrong sector number.
If a second Write Protect command is executed, the Flash memory sectors protected by the
first command become unprotected, and only the sectors passed within the second Write
Protect command become protected.

Figure 20. Write Protect command: host side

Start WP(1)

Send write protect message (std ID = 0x63)

Wait for ACK NACK

or NACK

ACK
Send message with the sector codes and
the number of sectors to be protected

Wait for ACK NACK

or NACK

ACK
End of WP(1)
ai15722

1. WP = Write Protect.

The host sends messages as follows:

Command message: Std ID = 0x63, DLC = 0x01, data[0] = N (where 0 < N ≤ 255).
Command message: Std ID = 0x63, DLC = 0x01..08, data[0] = N (where 0 < N ≤ 255).
After each message the host receives the ACK or NACK message from the device.

AN3154 Rev 7 25/33

32
Bootloader command set AN3154

Figure 21. Write Protect command: device side

Start WP(1)

Received message No
with std ID = 0x63?
ROP inacttive

Yes
Send ACK message

Receive the sector codes and the

number of sectors to be protected

Yes
Write-protect the requested sectors

Send ACK message Send NACK message

Generate system reset

End of WP(1)
ai15723

1. WP = Write Protect

The STM32 sends messages as follows:

ACK message: Std ID = 0x63, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.

3.10 Write Unprotect command

The Write Unprotect command is used to disable the write protection of all the Flash
memory sectors. When the bootloader receives the Write Unprotect command, it transmits
the ACK message to the host if ROP is disabled, else it transmits NACK. After the
transmission of the ACK message, the bootloader disables the write protection of all the
Flash memory sectors.
At the end of the Write Unprotect command, the bootloader transmits the ACK message and
generates a system Reset to take into account the new configuration of the option byte.

26/33 AN3154 Rev 7

AN3154 Bootloader command set

Figure 22. Write Unprotect command: host side

Start WPUN(1)

Send Write unprotect message (std ID = 0x73)

Wait for ACK NACK

or NACK

ACK

Wait for ACK NACK

or NACK

ACK

End of WPUN(1) ai15724

1. WPUN = Write Unprotect.

The host sends messages as follows:

Command message: Std ID = 0x73, DLC = 0x01, data = 00.

Figure 23. Write Unprotect command: device side

Start WPUN(1)

Received No
message with
ID = 73h?

No
ROP inactive?

Send ACK byte

Remove the protection for the

entire Flash memory

Send ACK byte Send NACK byte

Generate system reset

End of WPUN(1)
ai15725

1. WPUN = Write Unprotect.

AN3154 Rev 7 27/33

32
Bootloader command set AN3154

The STM32 sends messages as follows:

ACK message: Std ID = 0x73, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.

3.11 Readout Protect command

The Readout Protect command is used to enable the Flash memory read protection. When
the bootloader receives the Readout Protect command, it transmits the ACK message to the
host if ROP is disabled else it transmits NACK. After the transmission of the ACK message,
the bootloader enables the read protection for the Flash memory.
At the end of the Readout Protect command, the bootloader transmits the ACK message
and generates a system Reset to take into account the new configuration of the option byte.

Figure 24. Readout Protect command: host side

Start RDP_PRM (1)

Send Readout Protect message (std ID = 0x82)

Wait for ACK NACK

or NACK

ACK

Wait for ACK NACK

or NACK

ACK

End of RDP_PRM(1)
ai15726

1. RDP_PRM = Readout Protect.

The host sends the messages as follows

Command message: Std ID = 0x82, DLC = 0x01, data[0] = 00.

28/33 AN3154 Rev 7

AN3154 Bootloader command set

Figure 25. Readout Protect command: device side

Start RDP_PRM(1)

Received
No
message with
ID = 0x82?

Yes

No
ROP inactive?

Yes

Send ACK message

Activate Read protection for

Flash memory

Send ACK message Send NACK message

Generate system reset

End of RDP_PRM(1)
ai15727V2

1. RDP_PRM = Readout Protect

The STM32 sends messages as follows:

ACK message: Std ID = 0x82, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.

3.12 Readout Unprotect command

The Readout Unprotect command is used to disable the Flash memory read protection.
When the bootloader receives the Readout Unprotect command, it transmits the ACK
message to the host. After the transmission of the ACK message, the bootloader erases all
the Flash memory sectors and disables the read protection for the entire Flash memory. If
the erase operation is successful, the bootloader deactivates the RDP.
At the end of the Readout Unprotect command, the bootloader transmits an ACK message
and generates a system Reset to take into account the new configuration of the option
bytes.

AN3154 Rev 7 29/33

32
Bootloader command set AN3154

Figure 26. Readout Unprotect command: host side

Start RDU_PRM (1)

Send Readout Unprotect message (std ID = 0x92)

Wait for ACK NACK

or NACK

ACK

Wait for ACK NACK

or NACK

ACK

End of RDU_PRM(1) ai15728

1. RDU_PRM = Readout Unprotect.

The host sends messages as follows

Command message: Std ID = 0x92, DLC = 0x01, data = 00.

Figure 27. Readout Unprotect command: device side

Start RDU_PRM(1)

Received No
message with
ID = 0x92?

Yes
Send ACK message

Disable ROP

Send ACK message Send NACK message

Clear all RAM

Generate system reset

End of RDU_PRM (1)

ai15729b

1. RDU_PRM = Readout Unprotect.

The STM32 sends messages as follows:

ACK message: Std ID = 0x92, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.

30/33 AN3154 Rev 7

AN3154 Bootloader protocol version evolution

4 Bootloader protocol version evolution

Table 3 lists the bootloader versions.

Table 3. Bootloader protocol versions

Version Description

V2.0 Initial bootloader version.

AN3154 Rev 7 31/33

32
Revision history AN3154

5 Revision history

Table 4. Document revision history

Date Revision Changes

09-Mar-2010 1 Initial release.

15-Apr-2011 2 Updated Figure 2: Check HSE frequency and added Note 1.
22-Apr-2011 3 Update Std ID for message 2 in Section 3.4: Speed command.
Updated
Chapter 3.2: Get Version & Read Protection Status command
Figure 6: Get Version & Read Protection Status command: host side
Chapter 3.7: Write Memory command
24-Oct-2012 4
Chapter 3.8: Erase Memory command
Figure 19: Erase Memory command: device side
Chapter 3.9: Write Protect command
Figure 25: Readout Protect command: device side
Updated Table 1: Applicable products and Table 2: CAN bootloader
commands.
Removed Section dedicated to Device-dependent bootloader
02-May-2014 5
parameters.
Updated Section 3.5: Read Memory command and Section 3.7: Write
Memory command.
Updated Introduction, Section 1: Bootloader code sequence and
21-Oct-2016 6 Section 3.1: Get command.
Updated Table 1: Applicable products.
Updated Table 1: Applicable products.
Updated Section 1: Bootloader code sequence, Section 3.6: Go
command and Section 3.7: Write Memory command.
03-Dec-2019 7
Updated Figure 4: Get command: host side and Figure 17: Write
memory command: device side.
Minor text edits across the whole document.

32/33 AN3154 Rev 7

AN3154

IMPORTANT NOTICE – PLEASE READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order
acknowledgement.

Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or
the design of Purchasers’ products.

No license, express or implied, to any intellectual property right is granted by ST herein.

Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.

ST and the ST logo are trademarks of ST. For additional information about ST trademarks, please refer to www.st.com/trademarks. All other
product or service names are the property of their respective owners.

Information in this document supersedes and replaces information previously supplied in any prior versions of this document.

© 2019 STMicroelectronics – All rights reserved

AN3154 Rev 7 33/33

33