Texas Instruments SimpleLink CC2640 User manual

SimpleLink™ Bluetooth® low energy
CC2640 wireless MCU
Over-the-Air Download User’s Guide
For BLE-Stack™ Version: 2.2.1

Table of Contents
Table of Contents
1 Read this Section First........................................................................................................................... 6
1.1 Document Updates ....................................................................................................................... 6
1.2 Legacy OAD Versions .................................................................................................................... 6
1.3 Supported OAD Downloaders....................................................................................................... 6
1.4 Additional Resources .................................................................................................................... 6
2 Revision History .................................................................................................................................... 6
3 References ............................................................................................................................................ 7
4 Definitions, Abbreviations, Acronyms .................................................................................................. 7
5 Purpose ................................................................................................................................................. 8
6 Scope..................................................................................................................................................... 8
7 OAD Concept Overview......................................................................................................................... 9
7.1 OAD Types..................................................................................................................................... 9
7.2 OAD Topology Overview ............................................................................................................... 9
7.3 OAD Image Metadata .................................................................................................................10
7.3.1 CRC and CRC Shadow .......................................................................................................... 11
7.3.2 Version ................................................................................................................................ 11
7.3.3 Length .................................................................................................................................11
7.3.4 User Identification (UID) .....................................................................................................12
7.3.5 Start Address....................................................................................................................... 12
7.3.6 Image Type..........................................................................................................................12
7.3.7 Image State .........................................................................................................................13
7.4 OAD Service Description .............................................................................................................13
7.4.1 OAD Image Identify (0xFFC1) ..............................................................................................14
7.4.2 OAD Image Block Characteristic (0xFFC2)........................................................................... 15
7.4.3 OAD Image Count Characteristic (0xFFC3)..........................................................................15
7.4.4 OAD Image Status (0xFFC4) ................................................................................................16
7.5 OAD Process................................................................................................................................16
7.5.1 Initiation of the On-chip OAD Process ................................................................................ 16
7.5.2 Image Block Transfers ......................................................................................................... 18

7.5.3 Completion of the On-chip OAD Process ............................................................................ 18
7.6 OAD Reset Service....................................................................................................................... 18
7.6.1 OAD Reset (0xFFD1) ............................................................................................................ 18
7.7 Bootloader ..................................................................................................................................19
8 Off- Chip OAD...................................................................................................................................... 19
8.1 Constraints and Requirements for Off-chip OAD........................................................................19
8.2 Out of box demo (Off-chip OAD) ................................................................................................ 20
8.3 OAD Target.................................................................................................................................. 22
8.3.1 Overview of OAD Target for Off-chip OAD .........................................................................22
8.3.2 BIM for Off-chip OAD .......................................................................................................... 23
8.4 Building Off-chip OAD ................................................................................................................. 24
8.4.1 Building BIM........................................................................................................................24
8.4.2 Building the BLE Stack......................................................................................................... 25
8.4.3 Building the Application Image ...........................................................................................25
8.5 Considerations for Off-chip OAD ................................................................................................28
8.5.1 Adjusting Off-chip Flash Memory Layout ...........................................................................28
8.5.2 Conditions for Rejecting Metadata.....................................................................................28
9 On-Chip OAD.......................................................................................................................................28
9.1 Constraints and Requirements for On-chip OAD........................................................................28
9.2 Out of box demo ......................................................................................................................... 29
9.3 OAD Target.................................................................................................................................. 31
9.3.1 Overview of OAD Target for On-chip OAD.......................................................................... 31
9.3.2 BIM for On-chip OAD .......................................................................................................... 32
9.4 Building On-chip OAD .................................................................................................................33
9.4.1 Building BIM........................................................................................................................33
9.4.2 Building the BLE Stack......................................................................................................... 33
9.4.3 Building the OAD Target Application ..................................................................................34
9.4.4 Building OAD Image B .........................................................................................................34
9.5 Considerations for On-chip OAD.................................................................................................38
9.5.1 Adjusting Stack and Application Sizes.................................................................................38
9.5.2 Conditions for Rejecting Metadata..................................................................................... 38
10 Appendix .........................................................................................................................................38
10.1 Installing Python .........................................................................................................................38

10.2 TI OAD Image Tool (Python)........................................................................................................ 39
10.2.1 Download the tool .............................................................................................................. 39
10.2.2 Dependencies......................................................................................................................39
10.2.3 Using the tool......................................................................................................................39
10.2.4 Building a Production Image ...............................................................................................41
10.2.5 Automating the script .........................................................................................................43
10.3 RTOS RCFG Section...................................................................................................................... 44
10.4 Additional updates...................................................................................................................... 44
11 Troubleshooting Guide ...................................................................................................................44
11.1 General Troubleshooting Guide Prior to BIM ............................................................................. 44
11.2 Downloaded OAD Image Isn’t Starting .......................................................................................45
11.3 OAD_CRC_ERR Randomly Occurs ...............................................................................................45
11.4 Should External Flash be Used During OAD?..............................................................................45
11.5 Building Super Hex Files.............................................................................................................. 45
11.6 Mobile Application Can’t Perform OAD......................................................................................45
11.7 OAD_TARGET’s Merge.bat Reports Data Overlapped ................................................................ 46
11.8 Individually Flashing Hex Files for On-Chip OAD - App doesn’t work!........................................46
Table of Figures/Diagrams
Figure 1. Two Types of OAD.......................................................................................................................... 9
Figure 2. OAD Downloader and Target .......................................................................................................10
Figure 3. Metadata description................................................................................................................... 11
Figure 4. Off-chip OAD Image Types ........................................................................................................... 12
Figure 5. OAD Service Overview .................................................................................................................13
Figure 6. OAD Service Description .............................................................................................................. 14
Figure 7. Reject Notification in Sniffer Capture ..........................................................................................15
Figure 8. Successful OAD Initiation Sniffer Capture....................................................................................15
Figure 9. Block Request/Response Sniffer Capture .................................................................................... 15
Figure 10. OAD Status Codes ......................................................................................................................16
Figure 11. OAD Sequence Diagram............................................................................................................. 17
Figure 12. OAD Reset Service......................................................................................................................18
Figure 13. Off-chip OAD Target Memory Partition .....................................................................................22
Figure 14. Functional Overview of Off-chip BIM......................................................................................... 24
Figure 15. On-chip OAD Target Memory Partition .....................................................................................31
Figure 16. Functional Overview of On-chip BIM.........................................................................................32
Figure 17. SmartRF Flash Programmer 2 ....................................................................................................34

Figure 18. OAD Image Tool Arguments.......................................................................................................40
Figure 19. OAD Image Tool Output............................................................................................................. 41
Figure 20. OnChip OAD Production Image Example invocation. ................................................................42
Figure 21. OffChip OAD Production Image Example invocation................................................................. 42
Figure 22. IAR Post-build step.....................................................................................................................43
Figure 23. CCS Post-build step .................................................................................................................... 44

1Read this Section First
1.1 Document Updates
This document is constantly being improved. For the best user experience, please ensure that you are
using the latest version. Newer revisions will be posted online on the OAD User's Guide wiki page.
1.2 Legacy OAD Versions
Prior to the BLE-Stack v2.2.0 release, there were three versions of OAD supported by the SDK:
1. Off chip OAD with preserved page 0 using BIM
2. Off chip OAD without preserved page 0 using Baseloader
3. On chip OAD using BIM
In BLE-Stack SDK versions prior to 2.2.0, the SensorTag embedded project supported the baseloader
(Method 2) from above. In conjunction with the embedded project, the SensorTag mobile applications
(iOS, Android) only supported the baseloader method (Method 2). This method has been discontinued*
as of BLE-Stack v2.2.0, all projects (including the SensorTag) have now standardized on Methods 1 and 3.
This guide (and its previous versions) will describe the BIM based on On-chip and Off-chip methods
(Method 1 and Method 3 above).
*The baseloader method has been discontinued because there is a risk where a device may become
bricked (require wired JTAG access to recover) if a power loss is experienced while updating page 0*
1.3 Supported OAD Downloaders
As mentioned above, the SensorTag mobile applications supported the baseloader method prior to BLE-
Stack v2.2.0. These applications are in the process of being updated to support BIM based methods. For
the best out of box experience, TI recommends that customers use BLE Device Monitor v2.1.5 or later as
their OAD downloader, as it supports all OAD methods mentioned above.
1.4 Additional Resources
For hands on training using OAD as well as guidance on the out of the box demos, please refer to the
OAD Simple Link Academy module (coming soon):
http://software-dl.ti.com/lprf/simplelink_academy/overview.html
2Revision History
Date
Author’s
Name
Doc
Revision
Section(s)
Summary
12/17/14
SP
1.0
5, 6, 7, 8, 9, 13, 14
Edited for correctness
2/16/2015
SP
2.0
Finalization
7/14/2015
CK
2.1
All
Reorganized chapters / Added Off-chip OAD
/ Removed OAD Manager / Added
downloading methods / Added compiler
dependencies / Added sequence diagrams

1/14/2016
ZH
2.1.1
All
Re-organized for user-friendliness /
Separate Off-chip and On-Chip OAD
chapters / Added Appendix chapter
5/17/16
ZH, SML
2.2
All
Update to BLE Stack 2.2
10/21/16
AR
2.2.1
10,11
Update to BLE Stack 2.2.1
3References
1. Texas Instruments CC2640 Bluetooth® low energy Software Developer’s Guide
http://www.ti.com/lit/pdf/swru393
2. OAD User’s Guide Wiki Page
http://processors.wiki.ti.com/index.php/CC2640_OAD_User%27s_Guide
3. BLE Device Monitor User’s Guide
http://processors.wiki.ti.com/index.php/BLE_Device_Monitor_User_Guide
4. BLE Device Monitor Download Link
http://www.ti.com/lit/zip/swrc258
5. SimpleLink Academy
http://software-dl.ti.com/lprf/simplelink_academy/overview.html
4Definitions, Abbreviations, Acronyms
Term
Definition
BIM
Boot Image Manager, the software bootloader
BLE
Bluetooth low energy wireless protocol
CCCD
Client Characteristic Configuration Descriptor
CCFG
Customer Configuration Area, contains lock-bits on flash page 31
CCS
Code Composer Studio
MCU
Microcontroller Unit
OAD
Over the Air Download
RCFG
RTOS in ROM Configuration Table
ROM
Read Only Memory
RTOS
Real Time Operating System
SNV
Simple Non-Volatile storage
TI
Texas Instruments
TI-RTOS
Texas Instruments Real Time Operating System

5Purpose
This document describes the process by which a developer can enable a SimpleLink™ Bluetooth® low
energy CC2640 wireless MCU project and application to successfully implement the TI OAD Profile to
remotely upgrade the image on a CC2640 BLE device, a process further referred to as an Over-the-Air
Download (OAD). This process provides tremendous value to a BLE product solution, as a target device
does not need to be physically accessed to provide a software upgrade. Our purpose here is to make
OAD simple by providing detailed instructions from enabling OAD in an application project to receiving
the new image over the air, verifying its correctness, and running it from the bootloader.
6Scope
This document provides instruction on how to setup a BLE-Stack™ project to be OAD enabled, such as
our example simple_peripheral project for OAD. An overview of the OAD architecture and how to build,
download, and debug the components shall be discussed here as well. Details about the BLE runtime
system on CC26xx devices and the interrupt vector tables will be discussed as is necessary to elucidate
how an OAD build differs from a project which does not provide OAD capability.
There are two different types of OAD. One is On-chip OAD which doesn’t require any additional
hardware and the other is Off-chip OAD which supports a system where an external flash memory is
equipped. In the sample application projects, it is assumed that the hardware is the CC2650 LaunchPad
where 1MB external flash memory is connected to the CC2650 via SPI.
Topics omitted from this document are reducing the size of an application which does not meet the size
limitation (see 9.1), or an On-chip OAD on the BLE stack image or the bootloader. It is important to note
that an On-chip OAD of the application image does not include an upgrade of the BLE Stack image as
well. Also OAD for the sensortag project is not specifically mentioned in this guide since it uses the same
Off-chip OAD method as the simple_peripheral project, see the SensorTag User’s Guide wiki for more
information on the SensorTag:
http://processors.wiki.ti.com/index.php/CC2650_SensorTag_User's_Guide.
Note: On-chip OAD is currently only supported by IAR with CC2640 devices, while Off-chip OAD works
with both IAR and CCS.
NOTE: This kit supports development of Bluetooth low energy applications on the following
SimpleLink wireless MCUs: CC2640 and CC2650. The multi-standard CC2650 wireless MCU
supports Bluetooth low energy as well as other wireless protocols, such as ZigBee® and
6LoWPAN. The CC2640 supports Bluetooth low energy only. All code generated from the
BLE-Stack v2.x SDK is binary compatible and exchangeable with both the CC2650 and
CC2640 wireless MCUs. Throughout this document, CC2640 and CC2650 may be used
interchangeably.
Also, it is assumed that the developer is familiar with the CC2640 Software Developer’s Guide [1],
including the dual-image architecture used by the SDK.
For additional support, please visit the following online resources:
TI Bluetooth LE Wiki-page: www.ti.com/ble-wiki
TI E2E support forum: www.ti.com/ble-forum

7OAD Concept Overview
This section aims to explain the major concepts involved in the OAD process from a high level. The
concepts here will be expanded on further in the following sections. Some concepts, such as the Boot
Image Manager (BIM) may vary in their implementation details. Wherever possible, the concepts will be
covered in this chapter with their implementation details covered in the following chapters.
7.1 OAD Types
There are two methods of performing an over the air download: On-chip and Off-chip. The key
difference between the two methods is where the downloaded image is to be stored during the OAD. In
On-chip OAD, the downloaded image is written to internal flash, allowing for a single chip OAD solution.
Off-chip OAD stores the downloaded image in an external flash part, requiring a two chip OAD solution.
A graphic showing the different OAD methods is shown below (Figure 1). Each type of OAD has
associated tradeoffs and benefits which will be discussed in their respective sections.
Figure 1. Two Types of OAD
7.2 OAD Topology Overview
Two BLE capable devices are required for performing an OAD. The terms for the devices involved in an
OAD exchange are listed below:
OAD Target: The device whose firmware is being upgraded over the air. This is assumed to be a
CC26xx device running the TI OAD service.

OAD Downloader: The device responsible for accepting an OAD enabled image from the
compiler and transferring it over the air to the OAD target.
OAD roles are independent of the GAP role; they are dependent on which device exposes the OAD
service. The OAD target is always the device that runs the OAD service (GATT server), and the OAD
downloader is always the device that consumes the OAD service (GATT client).
Figure 2. OAD Downloader and Target
.
All provided TI example applications (BLE Device Monitor, mobile applications, etc.) are implemented
such that the OAD Target is a peripheral device, and the OAD Downloader is a central device. For this
reason, other configurations are outside of the scope of this document.
7.3 OAD Image Metadata
There are many points in the OAD process where information must be gathered about images. This
information can be used by the OAD service to determine whether or not an image is acceptable for
download or by the bootloader to determine which image should be run. In order to prevent this
information from being calculated multiple times and to assist in the linking process, all TI OAD images
use a standard 16-byte metadata vector. This metadata vector is embedded at the beginning of the
image, occupying the first 16 bytes before the application code. This section aims to explain the various
fields within the metadata vector and what they mean. The following sections will describe how the
fields are used specifically for On-chip and Off-chip OAD.
Figure 3 below shows a description of the metadata vector.

Field
Size (in bytes)
Description
CRC
2
Cyclic Redundancy Check
CRC Shadow
2
Place holder for CRC
Version
2
Version
Length
2
Length of the image in words*
UID
4
User Identification
Start Address
2
The destination address of the image in words*
Image Type
1
The type of image to be downloaded
State
1
The status of this image
Figure 3. Metadata description
Note that the above fields that are marked with an asterisk * are measured in 32-bit words. For
example, an image length of 0x100 describes an image that is 1024 bytes in size. This OAD word size is
defined by EFL_OAD_ADDR_RESOLUTION for off chip OAD and by HAL_FLASH_WORD_SIZE for on chip
OAD.
7.3.1 CRC and CRC Shadow
The cyclic redundancy check (CRC) is a means to check an image to ensure that it has not become
corrupted. This must be done in two steps. First the CRC must be calculated when the image is
generated from the toolchain, this will be stored in the CRC field in the metadata vector. This initial CRC
will be sent over the air via the OAD service (see section 7.4). Later, the target will need to ensure that
the image has not been corrupted during transfer. The target will then re-calculate the CRC of the
downloaded image; this will be stored in the CRC shadow field of the metadata vector.
If the CRC and CRC shadow are equivalent, the target can assume that the image was not corrupted
while sending over the air.
The algorithm selected for CRC calculations is the CRC-16-CCITT, it is a 16 bit CRC calculation that boasts
a 99.9984% error detection rate in the worst case.
7.3.2 Version
The image version field is used to track revisions of images and ensure upgrade compatibility. Customers
may implement their own versioning scheme. See Section 8.5.2 and Section 9.5.2 how these version
checks are done in Off-chip and On-chip OAD, respectively.
7.3.3 Length
The length field is the length of the image in words, where the word size is defined by
EFL_OAD_ADDR_RESOLUTION and HAL_FLASH_WORD_SIZE for On-chip and Off-chip OAD respectively.
Off-chip OAD customers who are using different external flash parts may need to modify
EFL_OAD_ADDR_RESOLUTION to match the word size of their part. For On-chip OAD, the word size of
the CC2640 is fixed.

7.3.4 User Identification (UID)
This field is un-used by the TI OAD profile, but the hooks are in place for a customer to add their own
implementation of verifying images based on UID.
For on chip OAD, the convention is that Image A will embed ‘A’, ‘A’, ‘A’, ‘A’ and Image B will embed ‘B’,
‘B’, ‘B’, ‘B’. Off chip images use ‘E’, ‘E’, ‘E’, ‘E’ by default.
7.3.5 Start Address
The start address is the first address where the proposed image is to be stored in internal flash. Similar
to the length field, this is calculated in words. Off-chip OAD solutions put restrictions on the start
address based on image type (more on this in the next section).
Note that for On-chip OAD solutions, this field is reserved in the metadata as they use a fixed start
address that is based on the internal flash memory map (OAD_IMG_D_PAGE).
7.3.6 Image Type
In Off-chip OAD systems with external flash, there are multiple types of images that can be uploaded.
These image types include: App + Stack, App only, Network Processor, or Stack only.
Note: While BLE Stack only upgrades are possible, the user must be sure that the App/Stack boundary
has not changed between the resident OAD image and the proposed OAD image. Since there are no
runtime checks on the App/Stack boundary, a Stack only OAD will overwrite the resident application if
the boundary has grown. Users should exercise care when using this option.
If a boundary change is required (i.e. BLE stack is growing or shrinking), it is recommended that a user
perform a merged update (App+Stack) to ensure that the OAD image is ready to run.
Note that for on chip OAD solutions this field is reserved in the metadata as they determine image
type based on the least significant bit of the image version field as discussed above.
The supported image types are listed below:
Image Type
Value
Description
EFL_OAD_IMG_TYPE_APP
1
An application or application +
stack merged update
EFL_OAD_IMG_TYPE_STACK
2
A stack only update
EFL_OAD_IMG_TYPE_NP
3
A network processor update.
This only applies to the SimpleAP
+ SimpleNP demo
EFL_OAD_IMG_TYPE_FACTORY
4
Describes the permanently
resident production image that
runs on the device before any
OTA updates.
Figure 4. Off-chip OAD Image Types

7.3.7 Image State
The image state is a one byte metadata field that is used only by Off-chip OAD solutions. The state
informs the bootloader whether or not the image is ready to run or currently running. This prevents the
bootloader from copying the same image from external to internal flash on every boot.
Note that for On-chip OAD solutions this field is reserved in the metadata as the OAD reset service
handles switching between images in the bootloader.
7.4 OAD Service Description
The OAD service has been designed to provide a simple and customizable implementation for the
customer. In its most rudimentary form, this service is responsible for accepting/rejecting an OAD
interaction based on image header criteria, storing the image in its appropriate location, and causing a
device reset if the download is successful so that the downloaded application image is run by the BIM.
A screenshot of BLE Device Monitor displaying the OAD service is shown below.
Figure 5. OAD Service Overview
The OAD service is a primary service with four characteristics. The characteristics of the OAD service,
their UUIDs, and descriptions are listed in Figure 6.
Note that the characteristics use the 128-bit TI base UUID of the format F000XXXX-0451-4000-B000-
000000000000 where XXXX is their shortened 16bit UUID. For brevity, this document will refer to the
characteristics by their 16-bit short UUID.
UUID
Name
Description
0xFFC0
OAD Service
OAD service declaration
0xFFC1
Image Identify
Used to send image properties
(metadata) over the air so that
the OAD target device can
determine if it should accept or
reject the proposed image
0xFFC2
Image Block
Actual block of image data along
with offset into the image.
0xFFC3
Image Count
Number of complete images to
be downloaded in the OAD
session

0xFFC4
Image Status
Status of current OAD download
Figure 6. OAD Service Description
The primary method for sending data from the OAD downloader to the OAD target is the GATT writes
with no response message. GATT notifications are the primary method used to send data from the
target to the downloader. This communication scheme was selected to prevent the target device from
having to include the GATT client code required in order to receive notifications from the downloader.
The downloader shall register for notifications from any characteristic with a CCCD (by writing 01:00 to
the CCCD).
Note that both GATT notifications and GATT write with no response are non-acknowledged message
types. This means that in poor RF conditions, the OAD process may not be successful. There is an
inherent tradeoff between the speed of the OAD process and its reliability. Implementing a reliable
OAD communication protocol (with retries, acknowledgments, etc.) is outside the scope of this
document.
For a message sequence chart describing the OAD process in terms OAD service messages exchanged
between the target and downloader please see Figure 11.
7.4.1 OAD Image Identify (0xFFC1)
The Image Identify characteristic is used to exchange image metadata between downloader and target.
The OAD process begins when the downloader sends the 16 byte metadata of the proposed OAD image
to the target. Upon receiving the candidate metadata, the target will do some calculations to determine
whether or not the proposed image should be downloaded. “01:00”shall be written to the CCCD of this
characteristic so that notification for metadata rejection is enabled.
Note that the conditions under which an OAD is accepted vary slightly between the on and off chip
methods. Please see the respective sections for more information about image reject conditions.
If the target accepts the image it will continue the OAD process by sending a notification on the Image
Block characteristic requesting the first block. Otherwise the target will reject the image by sending back
a portion the currently resident image’s metadata. The reject metadata contains the Image Version,
Image version, and User ID fields. For more information about these fields, please refer to the metadata
section.
A sniffer capture of the image identify characteristic being used to reject a candidate OAD image is
shown below. Note that only image version, length, and user ID are contained in the reject notification.

Figure 7. Reject Notification in Sniffer Capture
Alternatively, a successful OAD initiation is shown in Figure 8.
Figure 8. Successful OAD Initiation Sniffer Capture
7.4.2 OAD Image Block Characteristic (0xFFC2)
The OAD Image Block characteristic is used to request and transfer a block of the OAD image. “01:00”
shall be written to the CCCD of this characteristic so that notification for block request is enabled. The
target requests the next block of the image by sending a GATT notification to the downloader with the
requested block number. The downloader will respond (GATT write no response) with the block number
and a 16 byte OAD image block. The image block contains the actual binary data from OAD image offset
by the block number. Figure 9 shows a block request/response sniffer capture.
Figure 9. Block Request/Response Sniffer Capture
In Figure 9 above, the block number field is 2 bytes (little endian) and highlighted in red. The OAD image
block is 16 bytes and highlighted in purple.
7.4.3 OAD Image Count Characteristic (0xFFC3)
The OAD Image Count characteristic is used to set the number of OAD images to be downloaded. This is
used for only Off-chip OAD and the default value of the characteristic is 1. Note On-chip OAD only
supports one image download per session. See On-chip OAD 9.1 for details.

7.4.4 OAD Image Status (0xFFC4)
The OAD image status characteristic is used to report various failures that may occur during the OAD
process. The downloader may use this information to determine why an OAD failed, so that it may
correct for the errors and try again. “01:00”shall be written to the CCCD of this characteristic so that
notification for status update is enabled. There are four OAD status messages that are defined by
default. The OAD status codes are listed in the table below:
OAD Status Code
Value
Description
OAD_SUCCESS
0
OAD succeeded
OAD_CRC_ERR
1
The downloaded image’s CRC
doesn’t match the one
expected from the metadata
OAD_FLASH_ERR
2
The external flash cannot be
opened
OAD_BUFFER_OFL
3
The block number of the
received packet doesn’t
match the one requested. An
overflow has occurred.
Figure 10. OAD Status Codes
The customer may extend these values as needed, and use the OAD_sendStatus() function to send
updates to the downloader.
7.5 OAD Process
This Profile has been designed to provide a simple and customizable OAD Profile for the customer. In its
most rudimentary form, for both On-chip and Off-chip OAD, this profile is responsible for accepting an
OAD interaction based on image header criteria, storing the image onto the flash and causing a device
reset if the download is successful so that the downloaded application image is run by the BIM.
Downloader and OAD Target perform Client role and Server role respectively.
7.5.1 Initiation of the On-chip OAD Process
After establishing a new connection, updating the connection interval for a faster OAD and enabling
notifications of OAD Image Identify and OAD Image Block characteristics on the OAD Target, the
Downloader shall write to the Image Identify characteristic of the OAD Target. The message data will be
the header retrieved from the OAD Image available for OAD.

Downloader OAD Target
Configure Image Notify Char
Configure Image Block Char
Notification with the next block index from Image Block Char
(the 1st block)
Connection Establishment
Service Discovery of OAD Service
Write to Image Count Char (optional [1])
Write Metadata to Image Notify Char
Validate Metadata
Write requested block with block index to Image Block Char
Write Metadata to
off-chip flash[1]
Notification with the metadata of the current running image
from Image Notify Char (in case verification failed)
Notification with the next block index from Image Block Char
Write requested block with block index to Image Block Char
Notification with the next block index from Image Block Char
(the last block)
Write requested block with block index to Image Block Char
Write the block to
flash[2]
Write the block to
flash[2]
.
.
..
.
.
Write the block to
flash[2]
Read the block from
the image file
Read the block from
the image file
Reset
Read the block from
the image file
Generate metadata
.
.
.
Supervision timeout
[1] Applies only to Off-chip OAD
[2] Writes to on-chip flash if using On-chip OAD and off-chip flash if using Off-chip OAD
Figure 11. OAD Sequence Diagram
Upon receiving the write request to the Image Identify characteristic, the OAD Target will compare the
image available for OAD to its own running image. By default, only the image size and version number,
which implies whether the image is of type A or B, are checked to determine if the new image is
acceptable to download.

If the OAD Target determines that the image available for OAD is acceptable, the OAD Target will initiate
the OAD process by notifying the Image Block Transfer characteristic to the Downloader requesting the
first block of the new image. Otherwise, if the OAD Target finds that the new image does not meet its
criteria to begin the OAD process, it shall respond by notifying the Image Identify characteristic with its
own Image Header data as sign of rejection. In that case, the OAD procedure will end at the moment
where dotted ‘X’s are placed as depicted in Figure 11.
7.5.2 Image Block Transfers
The Image Block Transfer characteristic allows the two devices to request and respond with the OAD
image, one block at a time. The image block size is defined to be 16 bytes –see OAD_BLOCK_SIZE in
oad.h. The OAD Target will request an image block from the Downloader by notifying the OAD Image
Block characteristic with the correct block index. The Downloader shall then respond by writing to the
OAD Image Block characteristic. The message’s data will be the requested block’s index followed by the
corresponding 16-byte block of the image. Whenever the OAD Target is ready to digest another block of
the OAD image, it will notify the Image Block Transfer characteristic with the index of the desired image
block. The Downloader will then respond.
7.5.3 Completion of the On-chip OAD Process
After the OAD Target has received the final image block, it will verify that the image is correctly received
and stored by calculating the CRC over the stored OAD image. The OAD Target will then invalidate its
own image and reset so that the BIM can run the new image in-place. The burden is then on the
Downloader, which will suffer a lost BLE connection to the OAD Target during this verification and
instantiation process, to restart scanning and the to reestablish a connection and verify that the new
image is indeed running.
7.6 OAD Reset Service
The OAD reset service is only used by on chip OAD solutions. It implements a method for invalidating the
currently running image and resetting the device. This must occur because in on chip solutions the
currently running image cannot update itself. More information about the on chip OAD process will be
covered in the on chip OAD chapter. Figure 12 shows an overview of the OAD reset service and it’s
characteristic. Like the OAD service, the reset service uses the 128 bit TI base UUID with a 16 bit short
UUID of 0xFFD0.
Figure 12. OAD Reset Service
7.6.1 OAD Reset (0xFFD1)
The OAD reset is accomplished by invalidating Image B, which forces the bootloader to revert to Image A
until another successful OAD of Image B has occurred. Image B is invalidated by corrupting its CRC. After
the corruption, the reset service immediately invokes a HAL reset to jump to the bootloader. Note that a
GATT write of any value to the reset service will trigger a reset of the device/invalidation of Image B.

7.7 Bootloader
Since a running image cannot update itself, both On-chip and Off-chip OAD methods must employ a
bootloader. A bootloader is a lightweight section of code that is designed to run every time the device
resets, check the validity of newly downloaded images, and if necessary, load the new image into
internal flash. TI’s bootloader implementation is called the Boot Image Manager (BIM). BIM’s
implementation varies slightly for On-chip and Off-chip OAD solutions, thus there is a separate BIM
project for each.
/util/bim –This project implements an On-chip OAD bootloader
/util/bim_extflash –This project implements an Off-chip OAD bootloader
Note: Some BIM projects contain project configurations for a baseloader. This a legacy
implementation of BIM that is no longer used. Please see section 1.2 for more details.
BIM is always linked to page 0 and page 31 of internal flash, and will always link the CCFG section with
it.
8Off- Chip OAD
8.1 Constraints and Requirements for Off-chip OAD
Using the internal flash of CC2640F128, the first page and the last page, or 8kB in total, of flash are
reserved for the flash interrupt vectors and the BIM. The flash page 31 or the last page starting at
address 0x1F000 where BIM is located is shared with the CCFG. Neither the first page nor the BIM is
designed to be upgraded by Off-chip OAD.
An off-chip flash component of at least 120kB plus space for a 16 byte image metadata block is required
for a full flash update. A SPI connection is used to communicate with the off-chip flash component.
The OAD image to be downloaded to the off-chip flash memory can be an application image, a stack
image, a hex merge of application plus stack, an image intended for the upgrade of a network processor,
or any type of image as far as it is supposed to eventually replace any part of the on-chip 120kB area
between the first and the last pages. More than one image can be downloaded before the system reset
followed by BIM’s copying the downloaded images from the off-chip flash memory to the on-chip flash
memory.
Since page 0 cannot be updated in Off-chip OAD, an application must include its own TI-RTOS instance in
flash without dependency on the TI-RTOS ROM implementation (see section 10.3 for more info). Also, it
must include OAD profile so that further OAD upgrades are available when it runs on the on-chip flash
memory since Off-chip OAD doesn’t require any OAD-dedicated application like Image A for On-chip
OAD.
The first and last flash pages must never be attempted to update because a power cycle during an
update of either page could render the device unresponsive until physically reprogrammed.
While On-chip OAD Target receives only one application OAD image, Off-chip OAD Target can receive up
to 3 OAD images. Usually the Downloader generates metadata of OAD images for the Off-chip OAD, but
the Python script can also embed the metadata in the image (see section 10.2 for details). The metadata

is inserted into the beginning of the Off-chip OAD Image when transferred and is also stored separately
in the off-chip flash.
8.2 Out of box demo (Off-chip OAD)
This section will go over the basic steps in building and running the Off-chip OAD simple_peripheral
project that comes with the SDK with IAR IDE.
Software requirements
BLE-Stack SDK v2.2+
Python 2.7.x (v2.7.10 or higher)
Flash Programmer 2
Device Monitor (v2.1.5 or higher)
Hardware requirements
CC2650 LaunchPad (Target)
CC2650 LaunchPad or CC2540 USB Dongle (Downloader)
The basic steps are as follows:
1. Build and download BIM project ($BLE_INSTALL$\examples\util\bim_extflash\cc2640\iar) after
choosing FlashOnly_LP configuration.
2. Open simple_peripheral project in IAR
($BLE_INSTALL$\examples\cc2650lp\simple_peripheral\iar)
a. Build and download the cc2650lp_stack –FlashROM project
b. Build and download cc2650lp_app –FlashOnly_OAD_ExtFlash project
3. Alternatively, the App project should run merge.bat file found in
\examples\cc2650lp\simple_peripheral\iar\app to create a hex merged App+BIM+Stack image
(simple_peripheral_cc2650lp_all.hex). (Note the hex file ending in “all” is used to flash the
device for the first time. Use the other generated hex files for downloading over-the-air, i.e. App
or App+Stack in Step 5 below). Then use Flash Programmer 2 to download the image to the