My customer are using F28022 for automotive application, they have bootloader code and APP code, for each time power on, software will check one flag stored in flash to decide whether jump to the bootloader code or to APP code, that is when this flag is 0x55BB, then it will jump to the APP code, otherwise will jump to bootloader code.
in normal application, when run in APP code and receive update code command by Uart from other MCU, then will change the flag from 0x55BB to 0x55AA by using FLASH API function in software, then will do watchdog reset. after reset, the code will jump to bootloader code.
The issue is that actually when there is no update code command by Uart from other MCU, there also have possibility that the flag which should remain 0x55BB was changed to 0x55AA. they found about 5 cases have this issue in the hundred of thousand product that work in several months, it is not easy to reproduce this issue. in the Uart communication, there have a lot of safety mechanism like CRC, cmd id check, data length check to ensure the data communication is safety.
customer do not know how to fix this issue, did we have any other customer that have similar issue? any suggestion for this?