Verify the Exact Firmware Image Used in Production

A programmer can successfully write the wrong file. A green result therefore needs two separate meanings: the correct production image was selected, and the intended target received it under the approved programming procedure. Treat image identity as part of the manufacturing record rather than as a filename someone recognizes.

Freeze a programming bundle

Package the image with its project or device configuration, memory map assumptions, programming tool version and a release identifier. Record a cryptographic digest of the approved image. If a build produces bootloader, application and external flash files, identify each component and its destination. A digest identifies bytes; it does not establish that the bytes were approved.

Avoid a station workflow that silently reuses whichever project or data file an operator opened last. SEGGER’s Flasher CLI guidance recommends explicitly selecting the project and data file and distinguishes programming operations and their returned status. Apply that principle to the actual programmer selected for the product.

Define success before running the station

List the required operations in order, such as connection, identification, erase where appropriate, write, verification and configuration of protection settings. Confirm the sequence against device documentation. Some settings change later access, so an apparently convenient order may prevent a subsequent check.

Specify how the station handles a failed connection, interrupted power and failed verification. Do not translate every nonzero tool result into a generic retry. Preserve the detailed result and quarantine the unit when the process cannot determine its final state. A retry is a new attempt that should remain visible in the record.

Verify identity at more than one level

Capture the target identity where the hardware supports it, the image digest, configuration identifier, station and outcome. If the application exposes a software version, check it after booting, but do not rely on that string alone. Two binaries can display the same version string while containing different data or build options.

For example, a product variant may use the same application and a different calibration region. Define whether that region is preserved, initialized or programmed separately. Otherwise a successful whole-device erase can destroy information that the application version check never examines.

Challenge the station deliberately

Use controlled trials with an incorrect image selection, disconnected target and an intentional verification failure where supported. Confirm that none creates a passing product record. Retain an example passing record and examples of expected failure records. The useful outcome is a traceable relationship between one physical assembly and the exact approved programming bundle, including any subsequent reprogramming.