Dual-bank flash versus external SPI flash for zero-downtime updates on 256KB STM32

A small application needs firmware updates without service interruption on an Arduino-compatible STM32 board with 256KB internal flash. The design requires the running image to stay intact while a new image is staged, and a reliable rollback path if the new image fails to boot.

Dual-bank flash uses the MCU’s two banks to hold current and candidate images. The inactive bank can be written while the application runs, and a bank swap is performed on reset via option bytes. This approach halves the usable flash for the application and depends on MCU dual-bank support. An external SPI flash approach keeps the full internal flash for the application and stages the update in external memory, with a small protected bootloader copying a validated image on boot. This adds BOM cost and requires free SPI pins and a custom linker layout.

The unresolved decision concerns atomicity of the bank swap and the size versus hardware cost trade-off under the 256KB limit.

Is the option-byte bank swap documented as atomic, or can power loss during the option byte write leave the device in an undefined boot bank? Does the Arduino_STM32 DualBankFlash library provide a documented mechanism to detect a failed boot and revert to the previous bank without application code? Can a protected bootloader with CRC validation and safe copy fit in a small reserved region while preserving enough internal flash for the application under the 256KB constraint?