Skip to main content
E
emachabeeinnotag
Associate II
November 25, 2025
Solved

ST67W update over the air

  • November 25, 2025
  • 5 replies
  • 302 views

Hi,

I'm working on a new PCBA design and it will require firmware update over the air of a STM32H563.

The ST67W will be used in access point mode at all times.

Is it possible to use the ST67W to update a target MCU? Is it done using the built-in bootloader? Is UART or SPI used for it? Can I also update the ST67W's firmware over the air as well?

I'm in the PCBA design phase and I want to ensure that all of the required data lines are connected properly, as well as the BOOT0 pin.

Any example would be helpful as well.

Thanks,

Étienne Machabée

Best answer by EPASZ.1

A reason for this is probably that the binary on the NCP is not updated to the same version as the host FW. The 0x5501 value was used in the initial SW in modules shipped after the release.

I'd suggest updating the binary, using to the attached scripts in \Projects\ST67W6X_Scripts\Binaries - described in https://wiki.st.com/stm32mcu/wiki/Connectivity:Wi-Fi_MCU_Hardware_Setup#Flashing_the_ST67W611M1_using_QConn_Flash_with_an_STM32_host. 

5 replies

T
TarikAb
Technical Moderator
November 25, 2025

Hi emachabeeinnotag,

FOTA update for both the ST67 and the host is possible. Refer to the STM32U575 example on GitHub and the project description on wiki for more details.

Regards,

 

In order to give better visibility on the answered topics, please click on 'Accept as Solution' on the reply which solved your issue or answered your question.
    E
    emachabeeinnotagAuthor
    Associate II
    November 25, 2025

    Hi Tarik,

    the example only mentions the ST67 connecting to an AP. Is there a limitation preventing it from being used in AP mode?

    I want to know this before ordering the 2 test boards and start trying it on my side.

    The device will be used in a remote location with no access to the internet. The device will be in hotspot/AP mode, on which a PC will be used to upload the firmware on it.

    Thanks,

    Étienne Machabée

      T
      TarikAb
      Technical Moderator
      December 1, 2025

      We don't have an example project for FOTA with the ST67 in AP mode, but we think it should work.

      In order to give better visibility on the answered topics, please click on 'Accept as Solution' on the reply which solved your issue or answered your question.
      E
      emachabeeinnotagAuthor
      Associate II
      December 2, 2025

      Hi @TarikAb ,

      I'm giving it a try right now using a STM32H573I-DK and the X-NUCELO-67W61M1.

      I cannot get the H573 to send data over the SPI port.

      emachabeeinnotag_0-1764633661610.png

      This is causing a failure for the start of the FOTA app.

      I'm trying currently in station mode, before trying to switch to AP mode.

      I did rework the ST67W board to use the on-board 32.768khz crystal which fixed one of the issues that was seen on the ST67W's UART interface.

      The pins are matching for SPI using the Arduino header. I am using software pins for RDY and for NSS.

      From my reading of the generated code, the SPI2 didn't seem to get initialized.

      I did try initalizing it before the MX_ST67W6X_Init by using MX_SPI2_Init without success.

      Any pointers to a solution?

      My target MCU is the STM32H573 which is why I'm testing on the associated discovery kit.

      Thanks,

      Étienne Machabée

      E
      emachabeeinnotagAuthor
      Associate II
      December 2, 2025

      Got some progress,

      I fixed the interrupts and intialization for SPI2. Now I get the module to communicate but the driver expects 0x55AA as the first magic code for the header, and I receive 0x5501 instead.

      I did clock the SPI clock to 1.43 MHz due to instability at a higher clock.

      emachabeeinnotag_0-1764706173069.png

      The datasheet dosen't mention this magic constant, nor 0x55AA seems to be a "word" in the AT protocol.

      Here is a logic analyzer capture of the data exchanged between the 2:

      emachabeeinnotag_1-1764706263626.png

      I also captured the UART traffic between the ST67W and the STM32H573.

      \0\0

      Build:12:05:38,Oct 24 2024
      Version of used components:
      Version: component_version_btblecontroller_1.6.50
      Version: component_version_btprofile_1.7.6
      Version: component_version_macsw_1.6.22
      Version: component_version_phyrf_out-of-git-phyrf
      Version: component_version_bthost_1.6.5
      Version: component_version_sdk_2.0.48
      Current chip device version: 1
      ======== flash cfg ========
      flash size 0x00400000
      jedec id 0xC46016
      mid 0xC4
      iomode 0x04
      clk delay 0x01
      clk invert 0x01
      read reg cmd0 0x05
      read reg cmd1 0x35
      write reg cmd0 0x01
      write reg cmd1 0x31
      qe write len 0x01
      cread support 0x01
      cread code 0xA0
      burst wrap cmd 0x77
      ===========================
      dynamic memory init success, ocram heap size = 210 Kbyte
      sig1:ffffffff
      sig2:0000f32f
      cgen1:00031895
      SOC:10 RT:10 AON:10
      app_len=1493152
      lp_len=24448
      image_len=1517600
      rc32k_coarse_trim task enable, freq_mtimer must be 1MHz!
      rc32k_coarse_trim: mtimer_us:50001, rtc_us:50110
      rc32k_coarse_trim: retry_cnt:1, ppm:2179, continue...
      rc32k_coarse_trim: mtimer_us:49999, rtc_us:49988
      rc32k_coarse_trim: retry_cnt:2, ppm:-220, finish!
      rc32k coarse trim success!, total time:124ms
      rc32k_coarse_trim: set lp_32k ready!
      rc32k_coarse_trim: rc32k code:249
      app version in efuse is: 0
      app version in application is: 0, not less than app version in efuse, the application should run up
      app version in efuse is: 0
      \x1B[0mqcc74x />\x1B[0m\x1B[0m[I][rfparam] xtal value 40000000
      \x1B[0m[I][rfparam] dcdc_trim value 4
      \x1B[0m[I][rfparam] icx value 19
      \x1B[0m[I][rfparam] iptat value 25
      \x1B[0m[I][rfparam] tmp_mp use default value 35
      \x1B[0m[I][rfparam] pwr_mode is bf
      Empty slot:1
      \x1B[0m[I][rfparam] efuse wlan pwr_offset[14]: 4,4,4,4,4,4,4,4,4,4,5,5,5,5,
      \x1B[0m[I][rfparam] tlv wlan pwr_offset[14]: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,
      \x1B[0m[I][rfparam] wlan pwr_offset[14]: 4,4,4,4,4,4,4,4,4,4,5,5,5,5,
      Empty slot:1
      \x1B[0m[I][rfparam] efuse wlan lp pwr_offset[14]: 4,5,5,6,6,7,7,7,8,8,8,9,9,9,
      \x1B[0m[I][rfparam] tlv wlan lp pwr_offset[14]: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,
      \x1B[0m[I][rfparam] wlan lp pwr_offset[14]: 4,5,5,6,6,7,7,7,8,8,8,9,9,9,
      Empty slot:1
      \x1B[0m[I][rfparam] efuse bz pwr_offset[5]: 3,3,3,3,5,
      \x1B[0m[I][rfparam] tlv bz pwr_offset[5]: 0,0,0,0,0,
      \x1B[0m[I][rfparam] bz pwr_offset[5]: 3,3,3,3,5,
      \x1B[0m[I][rfparam] pwr_11b[4]: 20,20,20,20,
      \x1B[0m[I][rfparam] pwr_11g[8]: 18,18,18,18,18,18,16,16,
      \x1B[0m[I][rfparam] pwr_11n_ht20[8]: 18,18,18,18,18,16,15,15,
      \x1B[0m[I][rfparam] pwr_11n_ht40[8]: 18,18,18,18,18,16,15,14,
      \x1B[0m[I][rfparam] pwr_11ac_vht20[10]: 18,18,18,18,18,16,15,15,15,14,
      \x1B[0m[I][rfparam] pwr_11ac_vht40[10]: 18,18,18,18,18,16,15,14,14,13,
      \x1B[0m[I][rfparam] pwr_11ax_he20[12]: 18,18,18,18,18,16,15,15,15,14,13,13,
      \x1B[0m[I][rfparam] pwr_11ax_he40[12]: 18,18,18,18,18,16,15,14,14,13,12,12,
      \x1B[0m[I][rfparam] capcode mode is MF
      Empty slot:1
      \x1B[0m[I][rfparam] efuse capcode_in 42,capcode_out 42
      \x1B[0m[I][rfparam] capcode_in 42,capcode_out 42
      \x1B[0m[I][rfparam] tcal.en_tcal = 0
      \x1B[0m[I][rfparam] tcal.linear_or_follow = 1
      \x1B[0m[I][rfparam] tcal.Tchannels[5]: 2412,2427,2442,2457,2472,
      \x1B[0m[I][rfparam] tcal.Tchannel_os[5]: 180,168,163,160,157,
      \x1B[0m[I][rfparam] tcal.Tchannel_os_low[5]: 199,186,170,165,160,
      \x1B[0m[I][rfparam] tcal.Troom_os = -1
      \x1B[0m[I][rfparam] pwr_ble = 13
      \x1B[0m[I][rfparam] pwr_bt[3]: 10,8,8,
      \x1B[0m[I][rfparam] pwr_zigbee = 13
      \x1B[0m[I][rfparam] country_code = 1
      \x1B[0m[I][rfparam] en_tcap = 0
      \x1B[0m[I][rfparam] tcap_tsen[10]: -3,-4,20,39,39,40,41,42,43,44,
      \x1B[0m[I][rfparam] tcap_cap[11]: 28,29,30,31,32,33,34,35,36,37,38,
      Active Partition[0] consumed 596 Bytes
      ======= PtTable_Config @0x62fda2c8=======
      magicCode 0x54504642; version 0x0000; entryCnt 8; age 0; crc32 0xE38928F3
      idx type device active_index name Address[0] Address[1] Length[0] Length[1] age
      [00] 16 0 0 Boot2 0x00000000 0x00000000 0x0000e000 0x00000000 0
      [01] 00 0 0 FW 0x00010000 0x00210000 0x00200000 0x00168000 0
      [02] 10 0 0 mfg 0x00210000 0x00000000 0x00168000 0x00000000 0
      [03] 02 0 0 media 0x00378000 0x00000000 0x00071000 0x00000000 0
      [04] 03 0 0 PSM 0x003e9000 0x00000000 0x00008000 0x00000000 0
      [05] 04 0 0 KEY 0x003f1000 0x00000000 0x00002000 0x00000000 0
      [06] 05 0 0 DATA 0x003f3000 0x00000000 0x00005000 0x00000000 0
      [07] 06 0 0 factory 0x003f8000 0x00000000 0x00008000 0x00000000 0
      [MTD] >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x003e9000(4100096)
      size 0x00008000(32Kbytes)
      xip_addr 0xa03d8000
      [MTD] <<<<<< Hanlde info End <<<<<<
      \x1B[0m[I][LFS] Found valid PSM partition, XIP addr a03d8000, flash addr 003e9000, size 32768
      \x1B[0m[I][LFS] mount success
      [141][ramsync.c +337] lramsync_init slave
      [MTD] >>>>>> Hanlde info Dump >>>>>>
      name media
      id 0
      offset 0x00378000(3637248)
      size 0x00071000(452Kbytes)
      xip_addr 0xa0367000
      [MTD] <<<<<< Hanlde info End <<<<<<
      \x1B[0m[I][LFS] Found valid PSM partition, XIP addr a0367000, flash addr 00378000, size 462848
      \x1B[0m[I][LFS] mount success
      'SYSMSG' (1) read failed
      0xAA/0x01 0x55/0x55 0x00/0x00 0x00/0x00 0x00/0x00 0x00/0x00 0x00/0x01 0x00/0x00Part number:C6AFDBD111400004
      'WIFIAPMAC' (6) read failed
      Read slot:0
      get ap mac: 42:82:7b:00:2d:70
      'WIFISTAMAC' (6) read failed
      Read slot:0
      get sta mac: 40:82:7b:00:2d:70
      'WIFIMODE' (1) read failed
      'WIFISTA' (178) read failed
      'RECONN' (4) read failed
      'WIFILAPOPT' (8) read failed
      'WIFIAP' (100) read failed
      'DHCP' (1) read failed
      'DHCPSERVER' (4) read failed
      'WIFIAUTOCONN' (1) read failed
      'WIFIAPPROTO' (1) read failed
      'WIFISTAPROTO' (1) read failed
      'WIFIAPIP' (12) read failed
      'WIFISTAIP' (12) read failed
      'WIFICOUNTRY' (4) read failed
      'WIFIHOSTNAME' (28) read failed
      xtal32k_check_entry task enable, freq_mtimer must be 1MHz!
      --------------------------- use passive crystal.
      xtal32k_check: delay 100 ms
      'NETSOCK' (80) read failed
      'NETRECONNINTV' (2) read failed
      'NETTRANSLINK' (142) read failed
      'NETSSLCONF' (480) read failed
      'IPV6' (1) read failed
      'DNS' (16) read failed
      'MQTT_SSL' (96) read failed
      'BLENAME' (33) read failed
      \x9Av6.20.0.0 - build: sd Nov 22 2021 21:10:20
      \x9Aextra component version:
      ceva_freertos
      mbedtls
      ceva_wpa_supplicant
      ceva_lwip
      \x1B[0m[I][MAIN] [APP] [EVT] wifi_event_handler, CODE_WIFI_ON_INIT_DONE
      wifi_mgmr_set_country_code:code = Wd
      \x1B[0m[I][MAIN] [APP] [EVT] wifi_event_handler, CODE_WIFI_ON_MGMR_DONE
      xtal32k_check: start check
      xtal32k_check: mtimer_us:9987, rtc_us:0
      xtal32k_check: retry_cnt:1, diff_us:-9987, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:2, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:3, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:4, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:5, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:6, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:7, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:8, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:9, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:10, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:11, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:12, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:13, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:14, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:15, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:16, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:17, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:18, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:19, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:20, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9995, rtc_us:0
      xtal32k_check: retry_cnt:21, diff_us:-9995, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:22, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:23, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:24, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:25, diff_us:-9993, continue...
      xtal32K_check: reset xtal32k regulator
      xtal32k_check: mtimer_us:9886, rtc_us:0
      xtal32k_check: retry_cnt:26, diff_us:-9886, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:27, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:28, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:29, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:30, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9990, rtc_us:0
      xtal32k_check: retry_cnt:31, diff_us:-9990, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:32, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:33, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:34, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:35, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:36, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:37, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:38, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:39, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:40, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:41, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:42, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:43, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:44, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:45, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:46, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:47, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:48, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:49, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:50, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:51, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:52, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:53, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:54, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:55, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:56, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:57, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:58, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:59, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:60, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:61, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:62, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:63, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:64, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:65, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:66, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:67, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:68, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9995, rtc_us:0
      xtal32k_check: retry_cnt:69, diff_us:-9995, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:70, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:71, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:72, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:73, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:74, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:75, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:76, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:77, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:78, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:79, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:80, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:81, diff_us:-9991, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:82, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:83, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:84, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:85, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:86, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:87, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:88, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:89, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:90, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:91, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:92, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:93, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:94, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:95, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9995, rtc_us:0
      xtal32k_check: retry_cnt:96, diff_us:-9995, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:97, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9995, rtc_us:0
      xtal32k_check: retry_cnt:98, diff_us:-9995, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:99, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:100, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:101, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:102, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:103, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:104, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:105, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:106, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:107, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:108, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:109, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:110, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:111, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:112, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:113, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:114, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:115, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:116, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:117, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:118, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:119, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:120, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:121, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:122, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:123, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9993, rtc_us:0
      xtal32k_check: retry_cnt:124, diff_us:-9993, continue...
      xtal32k_check: mtimer_us:9991, rtc_us:0
      xtal32k_check: retry_cnt:125, diff_us:-9991, continue...
      xtal32k_check: failure!, total time:3012ms
      xtal32k_check: select rc32k, and xtal32k poweroff
      xtal32k_check: set lp_32k ready!
      xtal32k_check_entry task enable, freq_mtimer must be 1MHz!
      ----------------------- use active crtstal.
      xtal32k_check: delay 100 ms
      \0\0

      @TarikAb is there additional documentation about the 0x55AA and the specific things outside of the AT protocol for the ST67W?

       

      EPASZ.1
      EPASZ.1Best answer
      ST Employee
      December 4, 2025

      A reason for this is probably that the binary on the NCP is not updated to the same version as the host FW. The 0x5501 value was used in the initial SW in modules shipped after the release.

      I'd suggest updating the binary, using to the attached scripts in \Projects\ST67W6X_Scripts\Binaries - described in https://wiki.st.com/stm32mcu/wiki/Connectivity:Wi-Fi_MCU_Hardware_Setup#Flashing_the_ST67W611M1_using_QConn_Flash_with_an_STM32_host. 

      E
      emachabeeinnotagAuthor
      Associate II
      December 4, 2025

      Hi @EPASZ.1 ,

      thanks for the tip about the firmware.

      I did manage to update it without a Nucleo U575 host! I went with the T2 mission firmware. Is it the correct one?

      QConn_Flash\QConn_Flash_Cmd.exe --port COM8 --config NCP_Binaries\mission_t02_flash_prog_cfg.ini --efuse=NCP_Binaries\efusedata.bin

      We got progress:

      #### Welcome to ST67W6X Wi-Fi FOTA Application #####
      # build: 20:32:07 Dec 2 2025
      --------------- Host info ---------------
      Host FW Version: 1.1.0
      spi rx transaction timeouted
      Failed to receive the remaining bytes
      spi txrx failed, -1
      Failed to do the first transaction
      waiting for spi txn ready timeouted
      sem_if_ready not received
      Could not init Modem handler
      [ERROR] in W6X_Init API
      W61 Init failed
      failed to initialize ST67W6X Driver, 2
      ##### Application end

      emachabeeinnotag_0-1764855538286.png

      I'll keep digging into the code to see if I missed something again.

      Thanks,

      EPASZ.1
      EPASZ.1
      ST Employee
      December 5, 2025

      I guess the better starting option would be to use the T1 binary - it has the full wireless stack on the module. T2 needs to have the LwIP layer implemented on the host MCU. It is described e.g. on the Wiki https://wiki.st.com/stm32mcu/wiki/Connectivity:X-CUBE-ST67W61_Architecture.
      But that should not make a difference in first initialization phase. From your previous description, it is not clear to me if you're using the driver as is provided, or if you're modifying it / writing your own. On the provided SPI log, the CS management seems to be wrong. Also the data from the module are not correct - should be \r\nready\r\n as in this trace

      EPASZ1_0-1764932904576.png

      Can you share your project?

      E
      emachabeeinnotagAuthor
      Associate II
      December 5, 2025

      Hi @EPASZ.1 ,

      I created a new project from scratch and followed this:https://wiki.st.com/stm32mcu/wiki/Connectivity:Wi-Fi_How_to_use_X_CUBE_ST67W61_STM32CubeMx_pack

      I also flashed the T1 firmware as you recommended.

      I now have a functionnal project. I'll try to implement FOTA while in Access Point mode now!

      Thanks!

        Terms & ConditionsAccessibility statement