How NOR flash memory powers reliable FOTA updates

By Scott Heo, Infineon Technologies 

From connected to protected: How NOR flash memory powers reliable firmware OTA updates

As connected products grow more capable, keeping their software current has become a baseline expectation — not a differentiator. Firmware over-the-air (FOTA) updates are the mechanism that makes this possible: deploying new features, fixing vulnerabilities, and meeting evolving regulations without a factory recall or a service visit. But behind every successful FOTA is a hardware decision that rarely gets the attention it deserves: choosing the right flash memory.

This article breaks down the key architectures, update mechanisms, and security requirements that make FOTA work reliably in the field.

Flash memory configurations for FOTA

FOTA architectures are typically built around one of two memory configurations. The dual-bank internal NOR Flash approach splits the MCU’s on-chip flash into active and passive slots — one running the current firmware, the other receiving the new image. It offers a compact, cost-effective setup for smaller payloads and fast bank switching through address remapping.

The external NOR Flash approach connects dedicated memory to the application processor or MCU via QSPI or OSPI interfaces. With significantly greater capacity, it handles large firmware images, stores multiple backup copies, and enables emergency recovery images. As firmware grows to include RTOS stacks, AI inference engines, and graphics libraries — often tens of megabytes — external NOR Flash is becoming the practical standard for industrial and automotive systems.

Storage architecture for FOTA

Full A/B Update

This involves having two separate memory regions. The full firmware image is programmed to one region, while the other region is used for running the application. Once the update is complete, the application can simply switch to the newly updated region.

Typically, with an internal flash, this means code size is limited as two full firmware images need to be stored. This can be overcome by using external NOR Flash.

There are two ways this can be done:

  1.  In a host controller with internal storage, we must evaluate if this is sufficient to store a full firmware image. If it is, then an external NOR flash of similar storage capacity can be used to store the backup image.
  2. Execute-in-place: In systems with little to no internal storage, we can use a single large external NOR flash that can be partitioned or two separate external NOR flash to store the A/B images. The XIP allows code to be run directly from the external NOR Flash.

Delta updates 

Transmit only the changed code, reducing bandwidth, transfer time, and flash wear cycles — an important benefit as update frequency increases over the product lifecycle. This is a more complex implementation than a full update, as we have to process the changes.

Security and resilience by design

FOTA is not just a logistics challenge — it is a security challenge. Digital signatures verified by a hardware security module (HSM) or TrustZone confirm image integrity before any write operation. Post-write CRC checks validate the stored image. Rollback capability ensures a failed update reverts cleanly to the previous firmware version. Secure boot, anchored in a hardware Root of Trust, ensures only trusted images can execute.

As UNECE WP.29 R155 and R156 establish binding requirements for cybersecurity and software update management across all vehicle categories, these mechanisms have moved from best practice to regulatory obligation. Selecting memory that supports built-in data integrity protection, ECC, and hardware-rooted security — such as Infineon’s SEMPER™ NOR Flash family — simplifies meeting these requirements without adding system complexity.

Conclusion

FOTA is now a foundational requirement for any connected product — from smart industrial controllers to software-defined vehicles. Getting the memory architecture right from the start determines whether those updates are a competitive advantage or a field risk. The right NOR Flash choice — one that balances capacity, performance, and security — is what turns a reliable update strategy into a deployable reality.

Want to learn more about memory solutions for FOTA? Explore the SEMPER™ NOR Flash portfolio