This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

nRF51822 not resetting after DFU bootloader+softdevice

Hello,

This is related to a previous post, but now with new information and a more specific issue to resolve.

We have product in the field based on RF Digital's Simblee BLE module, which uses nRF51822 revision 3. All modules have Simblee's custom DFU bootloader, SoftDevice S110 v8.0.0 and our application flashed and working. Our application was developed using the Simblee library which hides much of the complexity of BLE, including legacy buttonless DFU.

We need to transition from the proprietary Simblee Library and bootloader to our own bootloader and an application developed with Nordic SDK 12.3, still using SoftDevice S110 v8.0.0. Our own bootloader is essentially the dual_bank_ble_s110 dfu bootloader example of SDK 10.0. Using an nRF51 dev kit, I can program our bootloader and S110, then I can DFU images of bootloader+S110 and our new application using nRF Connect (iOS). I use nrfutil v0.5.2 to generate the zip files for legacy DFU. All works well.

Ultimately we will be using DFU over BLE to update to our bootloader, S110 and our new application. I understand that this is done in two steps: 1) bootloader+S110, 2) application. If I program the DK with Simblee's proprietary bootloader and S110, when I then DFU an image that contains our bootloader+S110, following the transfer of the image, the DK does not reset. I have to manually reset the DK so that our bootloader runs and can then proceed with DFU of our application. This complicates the update process for our customers because they will be required to turn off and back on the device following transfer of the bootloader+S110 so that transfer of our application can proceed.

I'm noticing the same behaviour when using a Simblee module programmed via the nRF51 DK.

Any ideas why the module does not reset and run the bootloader following DFU of bootloader+S110? I've attached the custom Simblee bootloader (ota_bootloader_dual_bank.hex).

Many thanks,

Tim

ota_bootloader_dual_bank.hex

  • Hi Einar,

    Thank you for your understandable response.

    I've now discovered that even the proposed solution where the user is required to turn the device off and on does not work. So far, I've been using a Simblee module programmed via a nRF51 dev kit. In order to do this I had to erase the chip (nrfjprog --recover) because it's read protected. Using the Programmer of nRF Connect on Mac, I was able to write the Simblee bootloader, soft device 110, then DFU my bootloader (based on SDK 10 bootloader) plus softdevice 110, then, after manually resetting the dev kit, a new application. Then I could DFU a new version of the application.

    I then tried this using a Simblee that had our current application flashed to it using the Simblee loader and the Arduino IDE used for Simblee development and following DFU of our bootloader and softdevice 110, a manual reset would not cause the device to boot into DFU mode. The device was essentially bricked. There's something proprietary that is loaded when programmed with the Arduino IDE and Simblee's loader.

    Now I'm exploring the possibility of leaving Simblee's bootloader on the devices in the field and simply DFU a new application. To test, I built the s110_with_dfu version of the heart rate service example (ble_app_hrs) of SDK 10. (I built using armgcc.) If I change the FLASH ORIGIN in the linker file (ble_app_hrs_gcc_nrf51.ld) from 0x18000 to 0x1F000, I can DFU the application to a device with Simblee's bootloader. All works. Here's the DFU log from nRF Connect (iOS).

    File Name: hrm.zip
    Parts: 1
    Size: 31 KB
    Soft Device Size: Zero KB
    Bootloader Size: Zero KB
    [Callback] Central Manager did update state to: Powered ON
    Connecting to beam...
    centralManager.connect(peripheral, options: nil)
    [Callback] Central Manager did connect peripheral
    Connected to beam
    Discovering services...
    peripheral.discoverServices(nil)
    Services discovered
    Starting Legacy DFU...
    Connected to beam
    Services discovered
    Legacy DFU Service found
    Discovering characteristics in DFU Service...
    peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
    DFU characteristics discovered
    Reading DFU Version number...
    peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
    Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
    Version number read: 0.1
    Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
    Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
    DFU Control Point notifications enabled
    Application with buttonless update found
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
    [Callback] Central Manager did disconnect peripheral
    Disconnected by the remote device
    Connecting to beam...
    centralManager.connect(peripheral, options: nil)
    [Callback] Central Manager did connect peripheral
    Connected to beam
    Discovering services...
    peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
    Services discovered
    Legacy DFU Service found
    Discovering characteristics in DFU Service...
    peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
    DFU characteristics discovered
    Reading DFU Version number...
    peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
    Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0600
    Version number read: 0.6
    Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
    Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
    DFU Control Point notifications enabled
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Writing image sizes (0b, 0b, 30832b) to characteristic 00001532-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x000000000000000070780000, for: 00001532-1212-EFDE-1523-785FEABCD123, type: .withoutResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Start DFU (Op Code = 1, Upload Mode = 4) request sent
    Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100101
    Response (Op Code = 1, Status = 1) received
    Writing Initialize DFU Parameters...
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0200, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Writing to characteristic 00001532-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0xffffffffffff0000010064002f50, for: 00001532-1212-EFDE-1523-785FEABCD123, type: .withoutResponse)
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0201, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100201
    Response (Op Code = 2, Status = 1) received
    Initialize DFU Parameters completed
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x080c00, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Packet Receipt Notif Req (Op Code = 8, Value = 12) request sent
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x03, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Uploading firmware...
    Sending firmware to DFU Packet characteristic...
    Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100301
    Response (Op Code = 3, Status = 1) received
    Upload completed in 13.11 seconds
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x04, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Validate Firmware (Op Code = 4) request sent
    Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100401
    Response (Op Code = 4, Status = 1) received
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x05, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Activate and Reset (Op Code = 5) request sent
    [Callback] Central Manager did disconnect peripheral
    Disconnected by the remote device

    When I connect to the application (advertises as "Nordic_HRM") and attempt to DFU the same application again, it fails. When it attempts to jump to the bootloader, I think it fails because when the DFU version number is read, it's 0.1 and not 0.6 as expected (see line 50 below). It just continues trying to jump to the bootloader and fails until I manually cancel.

    File Name: hrm.zip
    Parts: 1
    Size: 31 KB
    Soft Device Size: Zero KB
    Bootloader Size: Zero KB
    [Callback] Central Manager did update state to: Powered ON
    Connecting to Nordic_HRM...
    centralManager.connect(peripheral, options: nil)
    [Callback] Central Manager did connect peripheral
    Connected to Nordic_HRM
    Discovering services...
    peripheral.discoverServices(nil)
    Services discovered
    Starting Legacy DFU...
    Connected to Nordic_HRM
    Services discovered
    Legacy DFU Service found
    Discovering characteristics in DFU Service...
    peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
    DFU characteristics discovered
    Reading DFU Version number...
    peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
    Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
    Version number read: 0.1
    Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
    Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
    DFU Control Point notifications enabled
    Application with buttonless update found
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
    [Callback] Central Manager did disconnect peripheral
    Disconnected by the remote device
    Connecting to Nordic_HRM...
    centralManager.connect(peripheral, options: nil)
    [Callback] Central Manager did connect peripheral
    Connected to Nordic_HRM
    Discovering services...
    peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
    Services discovered
    Legacy DFU Service found
    Discovering characteristics in DFU Service...
    peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
    DFU characteristics discovered
    Reading DFU Version number...
    peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
    Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
    Version number read: 0.1
    Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
    Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
    DFU Control Point notifications enabled
    Application with buttonless update found
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
    [Callback] Central Manager did disconnect peripheral
    Disconnected by the remote device
    Connecting to Nordic_HRM...
    centralManager.connect(peripheral, options: nil)
    [Callback] Central Manager did connect peripheral
    Connected to Nordic_HRM
    Discovering services...
    peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
    Services discovered
    Legacy DFU Service found
    Discovering characteristics in DFU Service...
    peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
    DFU characteristics discovered
    Reading DFU Version number...
    peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
    Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
    Version number read: 0.1
    Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
    Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
    DFU Control Point notifications enabled
    Application with buttonless update found
    Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
    peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
    Data written to 00001531-1212-EFDE-1523-785FEABCD123
    Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
    
    .
    .
    .

    I presume there's something different in how a Simblee application with buttonless DFU jumps to the Simblee bootloader compared to how a standard SDK 10 application with buttonless DFU jumps to a standard Nordic SDK 10 bootloader.

    If I can't figure this out, it means we will be able to update our 700 Simblee devices in the field once and only once.

    Is it possible to write an application that reads any location in flash? Could I write an application that reads the MBR, bootloader settings, etc. in hopes of finding the difference(s) so I can account for them in the buttonless DFU support of our application?

    I've contacted the company (AMS) that acquired and discontinued Simblee to see if I could, under non-disclosure, gain access to Simblee proprietary information to solve this. I speculate this will not be possible.

    I realize this is a hard situation. I understand that Simblee was developed with support for Nordic, so I wonder if some helpful information might reside within Nordic. I would be happy to sign a non-disclosure/confidentiality agreement in order to access information to solve my issue.

    Many thanks, Einar, for your help.

    Tim

  • Hi Tim,

    I understand that this is a tricky situation, but I do not see a way we can share information from another customer unless that customer formally agrees to do so. And in that case, it would have to go through the proper channels. 

    Tim said:
    Is it possible to write an application that reads any location in flash? Could I write an application that reads the MBR, bootloader settings, etc. in hopes of finding the difference(s) so I can account for them in the buttonless DFU support of our application?

    Yes, as long as you can program an application that should not be a problem. Some nRF52 devices has support for read protecting using ACL, but that does not exist on the nRF51, so any part of the memory can be read out.

    Einar

  • Thank you Einar. We have decided to move in a different direction, so I no longer need to solve this. Thanks for your understanding of our situation and your effort to support me.

    Tim

Related