View TMP95FY64_5537088.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

toshiba under development TMP95FY64 95fy64_10e.doc 1 99/01/19 11:43 cmos 16-bit microcontroller TMP95FY64f 1. TMP95FY64f basic specification 1.1 outline and feature TMP95FY64 is high-speed advanced 16-bit microcontroller developed for controlling medium to large-scale equipment. TMP95FY64 has 256k-byte flash memory which can be rewritten and erased on board. TMP95FY64 is housed in qfp-100pin package. device characteristics are as follows: (1 ) original high speed 16-bit cpu(900/h cpu) tlcs-90/900 instruction mnemonic upward compatible. 16m-byte linear address space general-purpose registers and register bank system 16-bit multiplication/ division and bit transfer/arithmetic instructions micro dma :4 channels(640ns/2bytes at 25mhz) (2 ) minimum instruction execution time:160ns at 25mhz (3 ) internal ram:8kbyte internal rom :256kbyte flash memory (4 ) external memory expansion can be expanded up to 16m byte (for both programs and data) am8/16pin (select the external data bus width) can mix 8- and 16-bit external data buses. ....... dynamic data bus sizing (5 ) 8-bit timer:8 channels including event counter function(2 channels) (6 ) 16-bit timer/event counter:2 channels (7 ) serial interface:3 channels (8 ) 10-bit a/d converter:8 channels (9 ) 8-bit d/a converter:2 channels (10) watchdog timer (11) chip select/wait controller :4 blocks (12) interrupt functions :45-interrupt sources 9-cpu interrupts ..... swi instruction, and illegal instruction 26-internal interrupts .....7-level priority can be set. 10-external interrupts .....7-level priority can be set. (13) i/o ports : single chip mode 81 pins multi chip mode 55 pins(at am8/16="h") (14) standby function :4 halt mode(run,idle2,idle1,stop) (15) operating voltage : vcc = 4.5 to 5.5v (16) package :100pin qfp(lffp100-p-1414-0.50c:thickness 2.4mm)
toshiba under development TMP95FY64 95fy64_10e.doc 2 99/01/19 11:43 970514ebk1 toshiba is continually working to improve the quality and the reliability of its products. nevertheless, semiconductor devices in general can malfunction or fail due to their inherent electrical sensitivity and vulnerability to physical stress. it is the responsibility of the buyer, when utilizing toshiba products, to observe standards of safety, and to avoid situations in which a malfuction or failure of a toshiba product could cause loss of human life,bodily injury or damage to property. in developing your designs, please ensure that toshiba products are used within specified operating ranges as set forth in the most recent products specifications. also, please keep in mind the precautions and conditions set forth in the toshiba semiconductor reliability handbook. usp 4,382,279 owned by bull cp8 the products described in this document are subject to foreign exchange and foreign trade laws. the information contained herein is presented only as a guide for the applications of our products. no responsibility is assumed by toshiba corporation or others. the information contained herein is subject to change without notice.
toshiba under development TMP95FY64 95fy64_10e.doc 3 99/01/19 11:43 an0 - an2(pa0 - pa2) an4 - an7(pa4 - pa7) vrefl vrefh avcc avss (p00 - p07)d0 -d7 (p10 - p17)d8 -d15 (p20 - p27)a16 -a23 (p30 - p37)a8 -a15 (p40 - p47)a0 -a7 int0(p56) daout0 ,1 ti0/ int1(p70) to1(p71) to3/ int2(p72) ti4/ int3(p73) to5(p74) to7/ int4(p75) 10bit 8ch a/d converter osc 8bit 2ch d/a converter port 0 port 1 port 2 watchdog timer port 3 port 4 port 5 8kb ram cs/wait controller (4-block) interrupt controller 256kb flash 16bit timer (timer8) 2kb boot rom 16bit timer (timer9) 8bit timer (timer6) 8bit timer (timer7) 8bit timer (timer4) 8bit timer (timer5) 8bit timer (timer2) 8bit timer (timer3) 8bit timer (timer0) 8bit timer (timer1) serial i/o (ch.0) serial i/o (ch.1) serial i/o (ch.2) tia/ int7(p94) toa/ tob(p96) tib/ int8(p95) ti8/ int5(p90) ti9/ int6(p91) to9(p93) to8(p92) x1 x2 clk vcc[3] vss[3] an3/ adtrg(pa3) txd0(p80) sclk0/ cts0(p82) rxd0(p80) txd1(p83) sclk1/ cts1(p85) rxd1(p84) txd2(p86) sclk2/ cts2(p57) rxd2(p87) nmi cs3(p63) cs2(p62) cs1(p61) cs0(p60) wait(p55) busak(p54) busrq(p53) hwr(p52) wr(p51) rd(p50) reset ea am8/16 a w xwa c b xbc l h e d xde xhl ix xix iy xiy sp iz xsp xiz 32bit f 900/h cpu sr pc figure 1 TMP95FY64 block diagram
toshiba under development TMP95FY64 95fy64_10e.doc 4 99/01/19 11:43 1.2 pin assignment and pin functions 1.2.1 pin assignment pin pin name pin name pin no. no. 63 vcc p27/a23 64 62 vss p26/a22 65 61 am8/16 p25/a21 66 60 p17/d15 p24/a20 67 59 p16/d14 p23/a19 68 58 p15/d13 p22/a18 69 57 p14/d12 p21/a17 70 56 p13/d11 p20/a16 71 55 p12/d10 p37/a15 72 54 p11/d9 p36/a14 73 53 p10/d8 p35/a13 74 52 p07/d7 p34/a12 75 51 p06/d6 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 p33/a11 76 76 50 50 p05/d5 p32/a10 77 77 49 49 p04/d4 p31/a9 78 78 48 48 p03/d3 boot/p30/a8 79 79 47 47 p02/d2 p47/a7 80 80 46 46 p01/d1 p46/a6 81 81 45 45 p00/d0 p45/a5 82 82 44 44 vcc p44/a4 83 83 43 43 p96/toa/tob p43/a3 84 84 42 42 p95/tib/int8 p42/a2 85 85 41 41 p94/tia/int7 p41/a1 86 86 TMP95FY64f 40 40 p93/to9 p40/a0 87 87 39 39 p92/to8 p50/rd 88 88 top view 38 38 p91/ti9/int6 p51/wr 89 89 37 37 p90/ti8/int5 p52/hwr 90 90 lqfp100-p-1414-0.50c 36 36 p75/to7/int4 vss 91 91 35 35 p74/to5 pa0/an0 92 92 34 34 p73/ti4/int3 pa1/an1 93 93 33 33 p72/to3/int2 pa2/an2 94 94 32 32 p71/to1 pa3/an3/adtrg 95 95 31 31 p70/ti0/int1 pa4/an4 96 96 30 30 reset pa5/an5 97 97 29 29 ea pa6/an6 98 98 28 28 x2 pa7/an7 99 99 27 27 x1 vrefh 100 100 26 26 vss 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 vrefl 1 25 vcc avss 2 24 clk avcc 3 23 p63/cs3 daout0 4 22 p62/cs2 daout1 5 21 p61/cs1 nmi 6 20 p60/cs0 p53/busrq 7 19 p87/rxd2 p54/busak 8 18 p86/txd2 p55/wait 9 17 p85/sclk1/cts1 p56/int0 10 16 p84/rxd1 p57/sclk2/cts2 11 15 p83/txd1 p80/txd0 12 14 p82/sclk0/cts0 p81/rxd0 13 TMP95FY64 pin assignment
toshiba under development TMP95FY64 95fy64_10e.doc 5 99/01/19 11:43 2.2 pin name and functions the names of input/output pins and their functions are described below. table 2.2 pin names and functions. table 2.2 pin names and functions(1/4) pin name number of pins i/o functions p00 to p07 8 i/o port 0 :i/o ports that allow i/o to be selected on a bit basis. /d0 to d7 i/o data :0 to 7 for data bus p10 to p17 8 i/o port 1 :i/o ports that allow i/o to be selected on a bit basis. /d8 to d15 i/o data :8 to 15 for data bus p20 to p27 8 i/o port 1 :i/o ports that allow i/o to be selected on a bit basis. /a16 to a23 output address :16 to 23 for address bus p30 1 i/o port 30 : i/o port /a8 output address : 8 for address bus /boot input setting pin for single boot mode. pull-up with external resister. p31 to p37 7 i/o port 3 :i/o ports that allow i/o to be selected on a bit basis. /a9 to a15 output address :9 to 15 for address bus p40 to p47 8 i/o port 4 :i/o ports that allow i/o to be selected on a bit basis. /a0 to a7 output address :0 to 7 for address bus p50 1 output port 50 :output port /rd output read :strobe signal for reading external memory. (when p5=0, p5fc=1, strobe signal output at all read timing.) p51 1 output port 51 :output port /wr output write :strobe signal for writing data on pins d0 to 7. p52 1 i/o port 52 :i/o port(with pull-up resistor) /hwr output high write :strobe signal for writing data on pins d8 to 15. p53 1 i/o port 53 :i/o port(with pull-up resistor) /busrq input bus request :signal used to request bus release to external bus. p54 1 i/o port 54 :i/o port(with pull-up resistor) /busak output bus acknowledge :signal indicating bus release. p55 1 i/o port 55 : i/o port(with pull-up resistor) /wait input wait :pin used to request cpu bus wait. p56 1 i/o port 56 : i/o port(with pull-up resistor) /int0 input interrupt request pin 0:interrupt request pin with programmable level/rising edge.
toshiba under development TMP95FY64 95fy64_10e.doc 6 99/01/19 11:43 table 2.2 pin names and functions(2/4) pin name number of pins i/o functions p57 1 i/o port 57:i/o port(with pull-up resistor) /sclk2 i/o serial clock i/o 2 /cts2 input serial data send enable 2(clear to send) p60 1 output port 60 :output port /cs0 output chip select 0:output 0 when address is within specified address. p61 1 output port 61 :output port /cs1 output chip select 1:output 0 when address is within specified address. p62 1 output port 62 :output port /cs2 output chip select 2:output 0 when address is within specified address. p63 1 output port 63 :output port /cs3 output chip select 3:output 0 when address is within specified address. p70 1 i/o port 70:i/o port /ti0 input timer input 0 /int1 input interrupt request pin 1:interrupt request pin with rising edge. p71 1 i/o port 71:i/o port /to1 output timer out 1:timer 0 or timer 1 output p72 1 i/o port 72:i/o port /to3 output timer output 3:timer 2 or timer 3 output /int2 input interrupt request pin 2 :interrupt request pin with rising edge. p73 1 i/o port 73:i/o port /ti4 input timer input 4:timer 4 input /int3 input interrupt request pin 3 :interrupt request pin with rising edge. p74 1 i/o port 74:i/o port /to5 output timer output 5:timer 4 or timer 5 output p75 1 i/o port 75:i/o port /to7 output timer output 7:timer 6 or timer 7 output /int4 input interrupt request pin 4 :interrupt request pin with rising edge. p80 1 i/o port 80:i/o port(with pull-up resistor) /txd0 output serial send data 0 p81 1 i/o port 81:i/o port(with pull-up resistor) /rxd0 input serial receive data 0 p82 1 i/o port 82:i/o port(with pull-up resistor) /sclk0 i/o serial clock i/o 0 /cts0 input serial data send enable 0(clear to send)
toshiba under development TMP95FY64 95fy64_10e.doc 7 99/01/19 11:43 table2.2 pin names and function(3/4) pin name number of pins i/o function p83 1 i/o port 83:i/o port(with pull-up resistor) /txd1 output serial send data 1 p84 1 i/o port 84:i/o port(with pull-up resistor) /rxd1 input serial receive data 1 p85 1 i/o port 85:i/o port(with pull-up resistor) /sclk1 i/o serial clock i/o 1 /cts1 input serial data send enable 1(clear to send) p86 1 i/o port 86:i/o port(with pull-up resistor) /txd2 output serial send data 2 p87 1 i/o port 87:i/o port(with pull-up resistor) /rxd2 input serial receive data 2 p90 1 i/o port 90:i/o port /ti8 input timer input 8:timer 8 input /int5 input interrupt request pin 5:interrupt request pin with programmable rising/falling edge. p91 1 i/o port 91:i/o port /ti9 input timer input 9:timer 8 input /int6 input interrupt request pin 6 :interrupt request pin with rising edge. p92 1 i/o port 92:i/o port /to8 output timer output 8:timer 8 output p93 1 i/o port 93:i/o port /to9 output timer output 9:timer 8 output p94 1 i/o port 94:i/o port /tia input timer input a :timer 9 input /int7 input interrupt request pin 7:interrupt request pin with programmable rising/falling edge. p95 1 i/o port 95:i/o port /tib input timer input b :timer 9 input /int8 input interrupt request pin 8 :interrupt request pin with rising edge. p96 1 i/o port 96:i/o port /toa output timer output a :timer 9 output /tob output timer output b :timer 9 output pa0 to pa2 3 input port a0 to a2:input port /an0 to an2 input analog input 0 to 2:input to a/d converter pa3 1 input port a3:input port /an3 input analog input 3:input to a/d converter /adtrg input external a/d conversion start trigger input
toshiba under development TMP95FY64 95fy64_10e.doc 8 99/01/19 11:43 table 2.2 pin names and function(4/4) pin name number of pin i/o function pa4 to pa7 4 input port a4 to a7:input port /an4 to an7 input analog input 4 to 7:input to a/d converter daout0 1 output d/a output 0:d/a converter 0 analog current output pin daout1 1 output d/a output 1:d/a converter 1 analog current output pin nmi 1 input non- maskable interrupt request pin :interrupt request pin with programmable falling/both edge. clk 1 output clock output :outputs external input clock x1 divided by 4. pulled up during reset. ea 1 input external access :connect to vcc when single chip mode. connect to gnd when multi chip mode. am8/16 1 input address mode :external data bus width selection pin. set to 0 when using fixed 16-bit external bus or dual 8/16-bit external bus. set to 1 with 8-bit external bus fixed. reset 1 input reset:initializes lsi(with pull-up resistor) vrefh 1 input reference voltage input pin for a/d converter (h) vrefl 1 input reference voltage input pin for a/d converter (l) avcc 1 a/d and d/a converter power supply pin avss 1 a/d and d/a converter ground pin (0v) x1 / x2 2 input/output oscillator connecting pins vcc3 power supply pin (+5v) vss 3 ground pin (0v) note 1: apart from reset pin, the pull-up resistors can be disconnected by software. note 2: connect all vcc and avcc pins to power supply and all vss and avss pins to gnd.
toshiba under development TMP95FY64 95fy64_10e.doc 9 99/01/19 11:43 3. operation the TMP95FY64 is the mcu which includes 256k byte flash rom and 8k byte ram, and has operates as the same way as the tmp95cs64 which includes 64k byte mask rom and 2k byte ram. please refer to the tmp95cs64 data sheets for the function not described here. 3.1 operation mode the TMP95FY64 has a single chip mode and a single boot mode. each mode is set by pin status after reset. single chip mode: normal operating mode. the device starts executing program on internal flash memory after reset. single boot mode: internal flash memory re-programming mode with serial(uart) interface. internal boot rom starts and on-board re-write program is executed after reset. table 3.1(1) operation mode setting table mode setting input pin operation mode reset clk boot ea single chip h single boot open(pulled-up during reset) l h 3.2 memory map the memory map and capacity of built in flash rom and ram are different from tmp95cs64. the figure 3.2(1) shows memory map and cpu addressing mode area on single chip mode. the figure 3.2(2) shows memory map on each operating mode.
toshiba under development TMP95FY64 95fy64_10e.doc 10 99/01/19 11:43 000000h internal i/o (160 byte) 0000a0h internal ram (8k byte) 000100h 0020a0h 010000h fc0000h ffff00h ffffffh external memory ( = internal area ) figure 3.2(1 )TMP95FY64 memory map(single chip mode) internal flash (256k byte) vector table (256 byte) direct area(n) 64kbyte area ( nn) 16mbyte area ( r32) (- r32) ( r32+) ( r32+d8/16) ( r32+r8/16) ( nnn) 000000h 0000a0h 0020a0h 010000h fc0000h 04ffffh fff800h ffffffh ffffffh single boot mode single chip mode internal i/o internal i/o internal ram internal ram internal flash internal flash internal boot rom 000000h 0000a0h 0020a0h ( = internal area ) figure 3.2(2 )TMP95FY64 memory map on each operating mode
toshiba under development TMP95FY64 95fy64_10e.doc 11 99/01/19 11:43 3.3 flash memory the TMP95FY64 has flash memory which can be erased and programmed on 5v single voltage. erase and program of flash memory are operated by jedec standard command. after command input, programming and erasing are automatically operated. the erase function has a chip erase, a block erase, and a plural block erase. feature: program/erase voltage block erasing architecture vcc=5v +/-10% 16k byte x 1/8k byte x 2/ configuration 32k byte x 1/64k byte x 3 256k x 8 bit/128k x 16 bit(256k byte) mode control function jedec standard command auto-programming flash memory type auto-chip erasing 29f200t auto-block erasing block protect/id read are not supported. auto-multi-block erasing data polling/toggle bit block configuration: internal interface: xx0000h 64kbyte 64kbyte 64kbyte 32kbyte 8kbyte 8kbyte xx : depend on operating mode. xxffffh 16kbyte figure 3.3(1 )block configuration of flash memory decoder figure 3.3(2 )flash memory internal interface mode flash memory dq15/a-1 - dq0 a0 d15 - d0 a23 - a18 a17 - a1 reset byte a16 - a0 cpu ce we oe wr rd hwr single chip : fc0000h to ffffffh single boot : 010000h to 04ffffh rdy/bsy
toshiba under development TMP95FY64 95fy64_10e.doc 12 99/01/19 11:43 command sequence :flash memory access by internal cpu 1st bus write cycle 2nd bus write cycle 3rd bus write cycle 4th bus read/write cycle 5th bus write cycle 6th bus write cycle command sequence bus cycle addr. data addr. data addr. data addr. data addr. data addr. data read/reset 1 xxxxxh f0h read/reset 3 xaaaah aah x5554h 55h xaaaah f0h ra rd auto- program 4 xaaaah aah x5554h 55h xaaaah a0h pa pd auto- chip erase 6 xaaaah aah x5554h 55h xaaaah 80h xaaaah aah x5554h 55h xaaaah 10h auto- block erase 6 xaaaah aah x5554h 55h xaaaah 80h xaaaah aah x5554h 55h ba 30h cpu address command address cpuaddress:a23 to a0 addr. a23 to a16 a15 a14 a13 a12 a11 a10 a9 a8 a7 a6 a5 a4 a3 a2 a1 a0 xxxxxh x x x x x x x x x x x x x x x 0 xaaaah 1 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 x5554h flash memory address area 0 1 0 1 0 1 0 1 0 1 0 1 0 1 0 0 f0h ,aah,55h,a0h,80h,10h,30h:command data. write to dq7 to dq0. ra :read address rd :read data output pa :program address pd :program data input ba :block address hardware sequence flag :flash memory access by internal cpu status dq7 dq6 dq5 dq3 auto-program dq7 inverted toggle 0 0 auto-erase(on erasing hold time) 0 toggle 0 0 executing automatic operation. auto-erase 0 toggle 0 1 auto-program dq7 inverted toggle 1 1 time out(automatic operation failed) auto-erase 0 toggle 1 1 note : dq8 to dq15, dq0to dq2 are don ? t care. block erase address table :flash memory access by internal cpu address address area block a17 a16 a15 a14 a13 single chip single boot size ba0 l l x x x fc0000h - fcffffh 010000h - 01ffffh 64k byte ba1 l h x x x fd0000h - fdffffh 020000h - 02ffffh 64k byte ba2 h l x x x fe0000h - feffffh 030000h - 03ffffh 64k byte ba3 h h l x x ff0000h - ff7fffh 040000h - 047fffh 32k byte ba4 h h h l l ff8000h - ff9fffh 048000h - 049fffh 8k byte ba5 h h h l h ffa000h - ffbfffh 04a000h - 04bfffh 8k byte ba6 h h h h x ffc000h - ffffffh 04c000h - 04ffffh 16k byte data read by each byte or word. data write by each even address/word.
toshiba under development TMP95FY64 95fy64_10e.doc 13 99/01/19 11:43 basic operation: flash memory access with internal cpu this flash memory has two kinds of operation modes of the reading mode and the automatic operation mode roughly dividing. it is possible to move to the automatic operation mode by executing the command sequence in the reading mode. the automatic operation mode inside cannot read the memory data. (1) reading when data is read , the flash memory is set in the reading mode. the flash memory becomes a reading mode at immediately after the power supply turning on and the normal termination of an automatic operation. the reset command described later is used for the return to the reading mode from abnormal termination of an automatic operation, and other modes. (2) command writing this flash memory uses the method of the jedec standard command control. writing in the command register is operated by executing the command sequence for the flash memory. the flash memory latches input address and data to the command register, and executes the operation corresponding to the command. the input of the command data uses dq0-dq7. the input of dq8-dq15 is disregarded. to cancel the command input while inputting the command sequence, the reset command is input. if the reset command is accepted, the flash memory resets the command register, and becomes a reading mode. moreover , when a wrong command sequence is input, the flash memory resets the command register, and becomes a reading mode. (3) reset (reset command) the flash memory does not return to the reading mode when an automatic operation terminates abnormally. in this case , the flash memory is returned to the reading mode by reading/the reset command. moreover, when the command input on the way is canceled, the content of the command register can be cleared by reading/the reset command. (4) automatic program it is necessary to be written in the flash memory every even number address/word byte. the automatic program operation latches the program address/the program data every even number address/word byte at the fourth bus writing cycle of the command cycle. an automatic program begins at time when the program data was latched. when the operation begins , the program and the program verify are automatically operated internally. the operation of an automatic program can be confirmed with the hardware sequence flag. the automatic program operation inside does not accept the input of the command sequence. "1" data cell can be made "0" data by writing in the flash memory. however, "0" data cell cannot be made "1" data. "0" data cell can be made "1" data by the erase operation. when the automatic program operation becomes defective, the flash memory is locked like this mode, and does not return to the reading mode. this state can be confirmed with the hardware sequence flag. it is necessary to reset the flash memory by the reset command. in this case, writing in this address should be defective, and the block which includes this address thereafter not be used. (5) automatic chip erase the automatic chip erase operation begins from the sixth bus writing cycle end at the command cycle. when the operation begins, preprogramming all the addresses to "0" data are executed automatically in the flash memory, and continuously, the erase and erase verify are executed. the state of the automatic chip erase operation can be confirmed with the hardware sequence flag. the automatic chip erase operation inside does not accept the command sequence input. when the automatic erase operation becomes defective, the flash memory is locked like this mode, and does not return to the reading mode. this state can be confirmed with the hardware sequence flag. please reset the flash memory by the reset command. moreover , the block where the defect occurs cannot be detected. it is necessary to stop the use of the device or not to use a defective block detected by the block erase. (6) automatic block erase/automatic multi block erase the automatic block erase begins later in time of the erase holding from the sixth bus writing cycle end at the
toshiba under development TMP95FY64 95fy64_10e.doc 14 99/01/19 11:43 command cycle. when the operation begins, preprogramming all the addresses in selected blocks to "0" data are executed automatically in the flash memory, and continuously, the erase and erase verify are executed. when do the erasure of the plural block , each block address and the automatic block erase command are input in the erase hold time repeating the sixth bus writing cycle. when the command sequences other than the automatic block erase are input during the erase hold time, the flash memory is reset, and becomes a reading mode. the erase hold time is 50us. the counting for the erase hold time is begun at each end of the sixth bus writing cycle. the state of the automatic block erase operation can be confirmed with the hardware sequence flag. the input of other command sequences is not accepted during the automatic block erase. when the automatic block erase operation becomes defective, the flash memory is locked like this mode , and does not return to the reading mode. this state can be confirmed with the hardware sequence flag. please reset the flash memory by the reset command. when the plural block is selected , the block where the defect occurs cannot be detected. the use of the device is discontinued or it is necessary to do the block erasure individually, specify a defective block, and not use a defective block. (7) hardware sequence flag the automatic operation execution of the flash memory can be confirmed with the hardware sequence flag. data can be read while operating automatically according to the same timing as the reading mode. the flash memory automatically returns to the reading mode when an automatic operation is ended. the state of the operation can be confirmed during the automatic operation execution with the hardware sequence flag. moreover , the automatic operation end can be confirmed by the read data's having matched with than the cell data. 1 )dq7 (data polling) an automatic operation of the flash memory can be confirmed by the data polling function. the output of the data polling begins from end of the last bus writing cycle in the automatic operation command sequence. the automatic program operation inside outputs the reversing data of the data written in dq7 , and after an automatic program ends, outputs the cell data of dq7. it is possible to identify the state of operation by reading dq7. the automatic erase operation inside outputs "0" from dq7 , and after this operation ends, outputs "1" (cell data). moreover , when the result of an automatic operation is defective, dq7 outputs the automatic operation data continuously. when data is read , it is necessary to give a written address or an arbitrary block address under the erasure because the flash memory releases the address latch when the operation ends. 2 )dq6 (toggle bit) in addition to the data polling, the toggle bit output function is provided as a method of recognizing the state of an automatic operation. the output of the toggle begins from end of the last bus writing cycle in the automatic operation command sequence. however , the output of the toggle in the automatic block erase operation begins after end of the erase hold time. this toggle outputs to dq6 , and outputs the data of "1" and "0" alternately every reading cycle. when an automatic operation ends , dq6 stops the output of the toggle, and outputs the cell data. when the result of an automatic operation is defective , dq6 continues the toggle output. 3 )dq5 (internal timer excess) when an automatic operation is normally done , the flash memory outputs "0" to dq5. the output of dq5 changes into "1" if the time for which an automatic operation specify in the flash memory is exceeded. this has the possibility that it is shown that an automatic operation did not end normally , and the flash memory is defective. however, when the "1" data is written in the "0" data cell, dq5 outputs "1", and the flash memory is judged to be defective. ("1" data cell can be made "0" data by writing in the flash memory. however, "0" data cell cannot be made "1" data. ) in this case , dq5 does not show the defect of the flash memory . it is shown that use is not correct. the flash memory is locked , and does not return to the reading mode when an
toshiba under development TMP95FY64 95fy64_10e.doc 15 99/01/19 11:43 automatic operation does not end normally. please reset the flash memory by the reset command. 4 )dq3 (block erase timer) the automatic block erase begins later in time of the erase holding(50us) from the sixth bus writing cycle end at the command cycle. the flash memory outputs "0" to dq3 during the block erase hold time, and outputs "1" to dq3 when the erasure begins. when the erase block is added, inputs the additional block erase command during the block erase hold time for the previous block erase. the block erase hold time is reset whenever the block erase command is input, and the flash memory counts a hold time from the beginning. when the result of an automatic operation is defective, dq3 outputs "1". 5 )rdy/bsy (ready/busy) * this function cannot be used because of no connection with internal cpu. (8) flash memory rewriting with internal cpu the flash memory rewriting with internal cpu is done with the above-mentioned command sequence and a hardware sequence flag. however , the memory data is not able to read from the internal flash memory during the automatic operation mode. it is necessary to execute the rewriting program on the outside area of the flash memory. there are two methods of flash memory rewriting with internal cpu. it is a method of using the single boot mode prepared beforehand, and a method of using original user's protocol on the single chip mode (user boot). 1) single boot: it is a method of rewriting the flash memory by built-in boot rom program by starting the microcomputer in the single boot mode. in this mode , the built-in boot rom is mapped in the area where contains the vector table of interrupt, and the boot rom program is executed. moreover , the flash memory is mapped in the different area from the boot rom. the boot rom program operates receiving the rewrite data by the serial transfer, and rewriting the flash memory. single boot is done with the interrupt prohibited. the non maskable interrupt(nmi etc.) also must to be prohibited. please refer to 3.4 single boot mode for details. 2) user boot: it is a method of using the original user's flash memory rewriting program. this mode is operated in the single chip mode (usual operation mode). this mode should execute the flash memory rewriting program on the different address space from the flash memory area. moreover , it is necessary to prohibit all the interrupt including the non maskable interrupt as same as single boot. the flash memory rewriting program is prepared beforehand including the data taking routine for rewriting and the flash memory rewriting routine . in a main program, changing from the usual operation to the flash memory rewriting operation. the flash memory rewriting program which was prepared is transferred to outside the flash memory area and executing. for example , the flash memory rewriting program is transferred from on the flash memory to built-in ram and executing. preparing it in an external memory and executing.
toshiba under development TMP95FY64 95fy64_10e.doc 16 99/01/19 11:43 start auto program command sequence auto program end data polling,toggle bit end address? address=address+2 (even address/word access) yes no xaaaah/aah x5554h/55h xaaaah/a0h even program address(a0=0) /programdata(word) auto program command sequence(address/command) auto program
toshiba under development TMP95FY64 95fy64_10e.doc 17 99/01/19 11:43 start auto erase command sequence auto erase end data polling,toggle bit xaaaah/aah x5554h/55h xaaaah/80h auto chip erase command sequence (address/command) xaaaah/aah x5554h/55h xaaaah/80h auto block /multi block erase command sequence (address/command) xaaaah/aah x5554h/55h xaaaah/10h xaaaah/aah x5554h/55h block address/30h block address/30h block address/30h address input at auto multi block erase (under 50us each) auto erase
toshiba under development TMP95FY64 95fy64_10e.doc 18 99/01/19 11:43 start read byte(dq0 to dq7) addr. = va fail end read byte(dq0 to dq7) addr. = va dq7 = data? yes no dq7 = data? dq5 = 1? pass end yes yes no no dq7 data polling start read byte(dq0 to dq7) addr. = va fail end read byte(dq0 to dq7) addr. = va dq6 = toggle? no yes dq6 = toggle? dq5 = 1? pass end no yes yes no dq6 toggle bit va :programmed address at auto program. flash memory address at auto chip erase. selected block address at auto block erase.
toshiba under development TMP95FY64 95fy64_10e.doc 19 99/01/19 11:43 3.4 single boot mode (1) overview TMP95FY64 has the single boot mode as an operation mode to do the on board programming. the boot rom is mapped on the memory space when setting in the single boot mode. the boot rom is a mask rom which does the flash memory rewriting on board. the on board programming is executed by connecting sio of TMP95FY64 (channel 2) and writing tool (controller), and sending the command from the controller side. moreover, the loader function to transfer the program data from the outside to built-in ram of the TMP95FY64 is provided in the boot program built into boot rom. figure 3.4(1) shows the example of connecting the writing controller and the target board. target board txd2 (p86) rxd2 (p87) clk boot (p30) ea vcc vcc pc rs232c ram rom mode control vcc (5v) vcc (5v) vpp (12v) reg. ac 100v program controller open vss reset boot vpp (12v) mcu mode control rx vss tx reset boot mode swiching circuit figure 3.4(1) example of on-board programming connection note 1: the af200(advanced on-board flash microcomputer programmer) made by yokogawa digital computer (ydc) supports on-board programming for this device. refer to the af200 manual for details. contact: yokogawa digital computer corporation micom-system business group instrument business division tel : 81-423-33-6224
toshiba under development TMP95FY64 95fy64_10e.doc 20 99/01/19 11:43 (2) mode setting to execute on-board programming, start the TMP95FY64 in single boot mode as follows: clk = open ea = h boot(p30) = l reset = setting the clk, ea, and boot pins as shown above, and inputting a rising edge to reset pin starts the TMP95FY64 in single boot mode. (3) memory map figure 3.4(2) shows the comparison of memory maps of the single chip mode and the single boot mode. the internal flash memory is mapped from 10000h to 4ffffh for the single boot mode. moreover, the boot rom(mask rom) is mapped from fff800h to ffffffh. ffffff h ffff00 h fc0000 h 0020a0 h 0000a0 h 000000 h interrupt (256byte) vector internal 256kbyte flash memory (external area) internal ram 8kbyte internal i/o 160byte single chip mode ffffff h ffff00 h 050000 h 010000 h 04ffff h fff800 h 0020a0 h 0000a0 h 000000 h interrupt (256byte) vector internal 256kbyte flash memory internal 2kbyte boot mrom internal ram 8kbyte internal i/o 160byte single boot mode (external area) (external area) figure 3.4(2) comparison of memory maps
toshiba under development TMP95FY64 95fy64_10e.doc 21 99/01/19 11:43 (4) interface specifications the sio communication format in the single boot mode is shown below. it is necessary to set the format of the communication on the writing controller side similarly to execute the on board programming. it is possible to change as shown in table 3.4(1) though the baud rate is initialize 9600bps. communication channel : sio channel 2 serial transfer mode : uart mode, full-duplex communication data length : 8 bits parity bit : none stop bit : 1 bit initial baud rate : 9600bps (5) data transfer format table 3.4(1) to (5) show the baud rate change data, the operation command, and the data transfer format respectively. please read together with the following "boot program operation explanation". table 3.4(1) baud rate change data baud rate change data 04h 05h 06h 07h 0ah 18h 28h baud rate( bps) 76800 62500 57600 38400 31250 19200 9600 note : the af200 supports only for 9600, 19200, 31250 and 62500 bps.
toshiba under development TMP95FY64 95fy64_10e.doc 22 99/01/19 11:43 operating frequency and baud rate in single boot mode. : TMP95FY64 reference baud rate(bps) 9600 19200 31250 38400 57600 62500 76800 baud rate change data 28h 18h 0ah 07h 06h 05h 04h ref. xtal(mhz) area(mhz) baud rate(bps) (%) (bps) (%) (bps) (%) (bps) (%) (bps) (%) (bps) (%) (bps) (%) 2.4576 2.44 to 2.48 9600 0 19200 0 38400 0 3 2.97 to 3.03 9375 -2.34 3.6864 3.64 to 3.74 9600 0 19200 0 57600 0 4.9152 4.85 to 5.07 9600 0 19200 0 38400 0 76800 0 5 9766 +1.73 19531 +1.72 39063 +1.73 78125 +1.73 6 5.91 to 6.23 9375 -2.34 18750 -2.34 31250 0 6.144 9600 0 19200 0 32000 +2.4 7.3728 7.26 to 7.48 9600 0 19200 0 38400 0 57600 0 8 7.84 to 8.16 9615 +0.16 31250 0 62500 0 9.8304 9.64 to 10.20 9600 0 19200 0 30720 -1.7 38400 0 76800 0 10 9766 +1.73 19531 +1.72 31250 0 39063 +1.73 78125 +1.73 12 11.76 to 12.75 9375 -2.34 18750 -2.34 31250 0 37500 -2.34 62500 0 12.288 9600 0 19200 0 32000 +2.4 38400 0 64000 +2.4 12.5 9766 +1.73 19531 +1.72 32552 +4.17 39063 +1.73 65104 +4.17 14.7456 14.46 to 15.04 9600 0 19200 0 32914 +5.3 38400 0 57600 0 76800 0 16 15.68 to 16.32 9615 +0.16 19231 +0.16 31250 0 62500 0 18 17.64 to 18.36 9375 -2.34 18750 -2.34 31250 0 56250 -2.34 19.6608 19.27 to 20.40 9600 0 19200 0 30720 -1.7 38400 0 61440 -1.7 76800 0 20 9766 +1.73 19531 +1.72 31250 0 39063 +1.73 62500 0 78125 +1.73 21.18 20.76 to 22.56 9193 -4.24 18385 -4.24 30085 -3.73 36771 -4.24 55156 -4.24 22.1184 9600 0 19200 0 31418 +0.54 38400 0 57600 0 24.5760 24.09 to 25.50 9600 0 19200 0 32000 +2.4 38400 0 54857 -4.76 64000 +2.4 76800 0 25 9766 +1.73 19531 +1.72 32552 4.17 39063 1.73 55804 -3.12 65104 +4.17 78125 +1.73 26.88 26.35 to 27.54 9545 -0.57 19091 -0.57 30000 -4 38182 -0.57 27 9588 -0.13 19176 -0.13 30134 -3.57 38352 -0.13 32 31.36 to 32.64 9615 +0.16 19231 +0.16 31250 0 38462 +0.16 55556 -3.55 62500 0 reference frequency : high speed oscillator frequency supported in single boot mode. when the single boot mode is used for programming flash memory, each of reference frequency should be used. area :clock frequency area detected for reference frequency. the single boot would not be executed at the others frequency. note :the auto-detection of mcu operating frequency will be normally done when the total error between transmit baud rate(9600bps) of program controller, oscillator frequency and detecting timing of matching data is under +/-3%. table 3.4(2) operating command data operation command data operating mode 30h flash memory overwrite 60h ram loader 90h flash memory sum
toshiba under development TMP95FY64 95fy64_10e.doc 23 99/01/19 11:43 table 3.4(3) transfer format for boot program : for flash memory overwrite byte number tool to TMP95FY64 transfer baud rate TMP95FY64 to tool transfer boot rom byte 1 byte 2 matching data(5a h ) - 9600bps 9600bps - (baud rate automatic setting) ok: echo back data(5a h ) ng: does not send any data. byte 3 byte 4 baud rate change data - (table3.4(1)) 9600bps 9600bps - ok: echo back data ng: a1 h 3,a2h 3,a3h 3 *1 byte5 byte 6 operating command data (3 0h ) - changed baud rate changed baud rate - ok: echo back data (30 h ) ng: a1 h 3,a2h 3,a3h 3,63h 3 byte 7 changed baud rate - changed baud rate ok: c1 h ng: 64h 3 byte 8 : byte n-2 expanded intel hex format (binary) *2 changed baud rate - byte n-1 - changed baud rate ok: sum(high) ng: does not send any data. *3 byte n - changed baud rate ok: sum(low) ng: does not send any data. *3 byte n+1 (wait for next operating command data.) changed baud rate - *1 : ? xx h 3 ? means that after sending 3 bytes of xxh, the boot program stops operation. *2 : see the notes on expanded intel hex format (binary) given in section . *3 : see notes on sum given in section . 6 5
toshiba under development TMP95FY64 95fy64_10e.doc 24 99/01/19 11:43 table 3.4(4) transfer format for boot program : for ram loader byte number tool to TMP95FY64 transfer data baud rate TMP95FY64 to tool transfer data boot rom byte 1 byte 2 matching data(5 ah ) - 9600bps 9600bps - (baud rate automatic setting) ok : echo back data(5a h ) ng : does not send any data. byte 3 byte 4 baud rate change data - (table 3.4(1)) 9600bps 9600bps - ok : echo back data ng : a1 h 3,a2h 3,a3h 3,62h 3 *1 byte 5 byte 6 operating command data (60 h ) - changed baud rate changed baud rate - ok : echo back data(60h) ng : a1 h 3,a2h 3,a3h 3,63h 3 *1 byte 7 byte 8 bits 23 to 16 of address store password count *2 - changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte 9 byte 10 bits 15 to 08 of address store password count *2 - changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte 11 byte 12 bits 07 to 00 of address store password count *2 - changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte 13 byte 14 bits 23 to 16 of password compare start address *2 - changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte 15 byte 16 bits 15 to 08 of password compare start address *2 - changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte 17 byte 18 bits 07 to 00 of password compare start address *2 - changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte 19 : byte m p assword string *2 changed baud rate changed baud rate - ok : does not send any data. ng : a1 h 3,a2h 3,a3h 3 *1 byte m+1 : byte n-2 expanded intel hex format(binary) *3 - byte n-1 - changed baud rate ok : sum(high) ng : does not send any data. *4 byte n - changed baud rate ok : sum(low) ng : does not send any data. *4 ram - jump to user program start address *1 : ? xx h 3 ? means that after sending 3 bytes of xxh, the boot program stops operation. *2 : see the notes on password given in section . *3 : see the notes on expanded intel hex format (binary) given insection . *4 : see notes on sum given in section . 7 5 6
toshiba under development TMP95FY64 95fy64_10e.doc 25 99/01/19 11:43 table 3.4 (5) transfer format for boot program : for flash memory sum byte number tool to TMP95FY64 transfer data baud rate TMP95FY64 to tool transfer data boot rom byte 1 byte 2 matching data(5a h ) - 9600bps 9600bps - (baud rate automatic setting) ok : echo back data(5a h ) ng : does not send any data byte 3 byte 4 baud rate change data - (table 3.4(1)) 9600bps 9600bps - ok : echo back data ng : a1 h 3,a2h 3,a3h 3,62h 3 *1 byte 5 byte 6 operating command data (90 h ) - changed baud rate changed baud rate - ok : echo back data(90h) ng : a1 h 3,a2h 3,a3h 3,63h 3 *1 byte 7 - changed baud rate ok : sum(high) *2 ng : - byte 8 - changed baud rate ok : sum(low) *2 ng : - byte 9 ( wait for next operating command data ) changed baud rate - *1 : ? xx h 3 ? means that after sending 3 bytes of xxh, the boot program stops operation. *2 : see notes on sum given in section . 5
toshiba under development TMP95FY64 95fy64_10e.doc 26 99/01/19 11:43 (6) operation of boot program starting the TMP95FY64 in single boot mode starts the boot program. the boot program supports the following functions. for details, see the sections on flash memory overwrite command to flash memory sum command below. 1. flash memory overwrite this command erases the flash memory in batches, up to a total of 256 kb. then the command writes data to the specified flash memory address. the controller must send binary write data in expanded intel hex format. if there is no error up to the end record, the function calculates the sum of the 256 kb flash memory and sends the result. 2. ram loader this command transfers the data sent by the controller in expanded intel hex format to the built-in ram. if the transfer is successfully completed, the command calculates the sum and sends the result, and starts execution of the user program. the execution start address is the address received first. this ram loader function enables on-board programming control unique to the user. to execute on-board programming by means of a user program, the above mentioned flash memory command sequence must be used. (the flash memory address area must be matched with address space in the single boot mode.) prior to execution, the ram loader command checks the password reference result. if the password does not match, the ram loader command is not executed. 3. flash memory sum this command calculates the sum of the 256 kb flash memory and returns the result. the boot program does not support an operating command to read data from flash memory. instead, it supports this command. thus, reading the sum enables the user to identify the program revision. flash memory overwrite command (table 3.4 (3)) 1. the data received in byte one are matching data. when the boot program is started in single boot mode, the program enters wait state for matching data. the initial baud rate of the serial channel is automatically set to 9600 bps by receiving of this matching data. the matching data are 5ah. 2. if the data received in byte one are 5ah, 5ah in byte two is sent as echo back data. if the received data are other than 5ah, the boot program sends a three-byte matching error code (61h), then stops operation. 3. the data received in byte three are baud rate change data. the seven baud rate change data are shown in table 3.4 (1). even if the baud rate is not changed, send the initial baud rate data (28h; 9600 bps ). the changed baud rate is valid after echo back data are sent. 4. if the data received in byte three match one of the baud rate change data in table 3.4 (1), the boot program uses byte four to send the received data as echo back data. then the boot program changes the baud rate. if the data received in byte three do not match any of the baud rate change data in table 3.4 (1), the boot program sends a three-byte baud rate change data error code (62h), then stops operation. 5. the data received in byte five are flash memory overwrite command data (30h). 1 3 1
toshiba under development TMP95FY64 95fy64_10e.doc 27 99/01/19 11:43 6. if the data received in byte five match one of the operating command data in table 3.4 (2), the boot program uses byte six to send the received data (30h) as echo back data, then calls the flash memory overwrite processing routine. if the data received in byte five do not match any of the operating command data in table 3.4 (2), the boot program sends a three-byte operating command error code (63h), then stops operation. 7. the data received in byte seven indicate whether batch erase (256 kb) is successfully completed. when batch erase (256 kb) is successfully completed, the boot program sends the batch erase end code (c1h). if an erase error occurs, the boot program sends a three-byte error code (64h). then stops operation. on receiving the batch erase end code (c1h), the controller must send the next data. 8. the data received in byte eight to byte n-2 are regarded as binary data in expanded intel hex format. no echo back data are sent. the flash memory overwrite processing routine ignores any data received before a start mark (3ah," :" ) in expanded intel hex format. it does not send an error code while ignoring premature data. after receiving the start mark, the routine receives a record from data length to checksum. the routine sequentially writes the received write data into the specified addresses in flash memory. bits 23 to 16 of the default address pointer are 00h. thus, make sure to set the first record to an expanded record. after receiving a record from start mark to checksum, the routine waits for the next start mark. when a write, receive, or expanded intel hex format error occurs, the boot program stops operation without sending an error code. after detecting the end record, the flash memory overwrite processing routine executes the sum routine. make sure that, after sending the end record, the controller enters wait state for receiving the sum. 9. byte n-1 is used to send the upper byte of the sum value. then byte n is used to send the lower byte of the sum value. for how to calculate the sum, see the notes on sum given in section . the sum is calculated when only the end record is detected without a write, receive, or expanded intel hex format error. it takes about 400ms at fc=20 mhz to calculate sum of the 256 kb flash memory area. then the sum is sent. after sending the end record, the controller must judge whether the write to flash memory was correctly performed, depending on whether the sum value was sent. 10. when a write is performed correctly, the data received in byte n+1 are the wait for next operating command data. ram loader command (table 3.4 (4)) 1. the send/receive data in bytes one to four are the same as those for the flash memory overwrite command. 2. the data received in byte five are the ram loader command data (60h). 3. if the data received in byte five match one of the operating command data in table 3.4 (2), byte six is used to send the echo back of the received data (60h). then the ram loader processing routine is called. if the data received in byte five do not match any of the operating command data in table 3.4 (2), the boot program sends a three-byte operating command error code (63h), then stops operation. 4. the data received in byte seven are those in bits 23 to 16 of the address used to store the password. three bytes of the address are needed for storing the password count. the data at this address are used as the password count. note that if the password count is eight or less, execution of the ram loader command is canceled. 5 2
toshiba under development TMP95FY64 95fy64_10e.doc 28 99/01/19 11:43 5. if there is no receive error in the data received in byte seven, the processing routine does not send any data using byte eight. if there is a receive error, the processing routine sends three bytes of the corresponding error code, then stops operation. 6. bytes nine to 12 are used to receive data from bits 15 to 8 and from bits 7 to 0 of the address used to store the password. these bytes are also used to send an error code for receive error, if any. for this operation, see 4 and 5 above. 7. the data received in byte 13 are those of bits 23 to 16 of the password compare start address. three bytes of the password compare start address are required. the password comparison starts from this address. 8. if there is no receive error in the data received in byte 13, the processing routine does not send any data using byte 14. if there is a receive error, the processing routine sends three bytes of the corresponding error code, then stops operation. 9. bytes 15 to 18 are used to receive and send data from bits 15 to 8 and from bits 7 to 0 of the password compare start address. for this operation, see 7 and 8 above. 10. bytes 19 to m are used to receive password data. the password count is data (n) indicated by the address used to store the password count. n passwords are compared from the password compare start address. the controller must send the n-byte password data. if the password does not match, the processing routine stops operation without sending an error code. 11. the data received in bytes m+1 to n-2 are regarded as binary data in expanded intel hex format. no echo back data are sent. the ram loader processing routine ignores any data received before a start mark (3ah ,,":" ) in expanded intel hex format. it does not send an error code while ignoring premature data. after receiving the start mark, the routine receives a record from data length to checksum. the routine sequentially writes the received write data into the specified addresses in ram. bits 23 to 16 of the default address pointer are 00h. thus, the first record is not necessarily an expansion record. after receiving a record from the start mark to checksum, the routine waits for the next start mark. when a receive or expanded intel hex format error occurs, the routine stops operation without sending the error code. after detecting the end record, the ram loader processing routine executes the sum routine. make sure that, after sending the end record, the controller enters wait state for receiving the sum. 12. byte n-1 is used to send the upper byte of the sum value. then byte n is used to send the lower byte of the sum value. for the method of calculating the sum, see the notes on sum given in section . the sum is calculated when only the end record is detected without a receive or expanded intel hex format error. the time required for calculating the sum is almost proportional to the number of data items which have been written into ram. for example, the time required to calculate a 4k ram area at fc=20 mhz is approximately 6 ms. then the sum is sent. after sending the end record, the controller must judge whether the write to ram was correctly performed, depending on whether the sum value was sent. 13. when the sum has been sent, the boot program jumps to the address of the first data stored in the ram area in expanded intel hex format. 5
toshiba under development TMP95FY64 95fy64_10e.doc 29 99/01/19 11:43 flash memory sum command (table 3.4 (5)) 1. the send/receive data in bytes one to four are the same as those for the flash memory overwrite command. 2. the data received in byte five are the flash memory sum command data (90h). 3. if the data received in byte five match one of the operating command data in table 3.4 (2), byte six is used to send the echo back of the received data (90h). then the flash memory sum processing routine is called. if the data received in byte five do not match any of the operating command data in table 3.4 (2), the boot program sends a three-byte operating command error code (63h), then stops operation. 4. byte seven is used to send the upper byte of the sum value. then byte eight is used to send the lower byte of the sum value. for the method of calculating the sum, see the notes on sum given in section . 5. the data received in byte 9 are the wait for next operating command data. boot program send data the boot program sends the processing status in code form to the controller. listed below are the send data ( processing codes): table 3.4(6) boot program send data send data send data description c1h normally end of chip erasing. 62h,62h,62h baud rate change error is occurred. 63h,63h,63h operating command error is occurred. 64h,64h,64h erasing error is occurred. a1h,a1h,a1h framing error in receive data is occurred. *1 a2h,a2h,a2h parity error in receive data is occurred. *1 a3h,a3h,a3h overrun error in receive data is occurred. *1 *1 : if this error is generated while data in expanded intel hex format are being received, the receive error code is not sent. 3 5 4
toshiba under development TMP95FY64 95fy64_10e.doc 30 99/01/19 11:43 sum calculation 1. calculation method the flash memory sum command returns, in words, the result of summing in bytes. that is, data are read in bytes, and calculated, but the result is returned in words. example a1h if the four bytes on the left are the target data, the sum is determined as follows: b2h a1h+b2h+c3h+d4h=02eah c3h d4h the above calculation method is used to obtain the sums returned when the flash memory overwrite command, ram loader command, and flash memory sum command are executed. 2. sum target data table 3.4 (7) shows the sum target data. table 3.4(7) sum target data operating mode calculation target data remarks flash memory overwrite command data written in entire flash memory (256kb) sum target data are not write data received in flash memory or ram. even if the received addresses are not consecutive and there are some areas without any data written, the data which have been written are the target. ram loader command data written starting at address received first, going on to address received last. flash memory sum command data written to entire flash memory (256kb) ? 5 sum(high) =0 2h sum(low) =eah
toshiba under development TMP95FY64 95fy64_10e.doc 31 99/01/19 11:43 notes on expanded intel hex format (binary) 1. for the flash memory overwrite command, the first record must be an expansion record, because the flash memory of the TMP95FY64 is allocated to addresses starting from 10000h, thus bits 23 to 16 of the default address pointer are 00h. 2. for the ram loader command, the first record does not necessarily have to be an expansion record, because bits 23 to 16 of the default address pointer are 00h. 3. after the checksum of a record is received, the program enters wait state for the next record start mark (3ah, ":"). thus, data other than 3ah are ignored. 4. make sure that after sending the checksum of the end record, the controller program does not do anything other than wait for the 2-byte receive data (upper and lower data of the sum). this is because after receiving the checksum of the end record, the boot program calculates the sum and returns the result in two bytes. 5. when a write (for flash memory overwrite command only), receive, or expanded intel hex format error occurs, the boot program stops operation without sending the error code. expanded intel hex format errors occur in the following cases: when type is other than 00h, 01h, or 02h when a checksum error occurs when data length of an expansion record (type=02h) is other than 02h when the address of an expansion record (type=02h) is other than 0000h when byte two data of an expansion record (type=02h) are other than 00h when data length of an end record (type=01h) is other than 00h when the address of an end record (type=01h) is other than 0000h example : when data are written to the area between addresses 1fff8h and 2002fh, the operating command data are as shown below: table 3.4(8) example of transfer format for flash memory overwrite command data data transfer direction data description expanded intel hex format (byte 8 and byte n-2 in table3.4(3)) data controller to TMP95FY64 expansion record : 02 0000 02 1000 ec zz controller to TMP95FY64 data record(data length : 08h) : 08 fff8 00 xxxxxx cs zz controller to TMP95FY64 expansion record : 02 0000 02 2000 dc zz controller to TMP95FY64 data record(data length : 30h) : 30 0000 00 yyyyyyyy cs zz controller to TMP95FY64 end record : 00 0000 01 ff ww TMP95FY64 to controller sum(upper) (byte n-1 in table 3.4(3)) sum(high) TMP95FY64 to controller sum(lower) (byte n in table 3.4(3)) sum(low) controller to TMP95FY64 operating command (byte n+1 in table 3.4(3)) next operating command data notes : ? : ? : 3ah(start mark) xx, yy : data to be written to flash memory cs ,ec,dc,ff : check sum data zz : controller does not have to send. ww : controller must not send. 6
toshiba under development TMP95FY64 95fy64_10e.doc 32 99/01/19 11:43 notes on passwords a password cannot be specified for the entire flash memory area (256 kb). it can only be specified for a limited area, which is bounded by the addresses from 12000h to 4dfffh. figure 3.4 (3) shows a schematic representation of the password area. 1. address to store password count (pnsa) the contents at the address specified by pnsa is the password count (n). in the following case, a password error occurs. pnsa < address 12000h address 4dfffh < pnsa n < 8 2. password compare start address (pcsa) password comparison starts from the address specified by pcsa. the specified password area is from pcsa to pcsa+n. in the following case, a password error occurs. pcsa < address 12000h address 2dfffh < pcsa+n-1 if the same data continues for three bytes or more in the specified password area: if the data in the vector area (4ff00h to 4ffffh) are all ffh, th e area is regarded as unprogrammed, thus checking is not performed. 3. password string the password string is compared with the data in flash memory. a password error occurs when the received data do not match the data in fla sh memory. 4. password error processing when a password error occurs, the program stops operation. specified password area (n passwords) n pcsa + n - 1 password compare start address(pcsa) address used to store password count (pnsa) 4ffff h 4dfff h 12000 h 10000 h flash memory specifiable password area figure 3.4(3) schematic representation of password area 7
toshiba under development TMP95FY64 95fy64_10e.doc 33 99/01/19 11:43 single boot general flow start baud rate automatic setting command sum process overwrite process command receive error code transmit ram loader process the others sum overwrite ram loader stop operation
toshiba under development TMP95FY64 95fy64_10e.doc 34 99/01/19 11:43 (1) sum command sum sum calculation for entire area sum(high) output sum(low) output ret (2) overwrite command flash erasing erase ok? erase ok code output erase ng code transmit stop operation overwrite process no yes writing hex data ret
toshiba under development TMP95FY64 95fy64_10e.doc 35 99/01/19 11:43 (3) ram loader command ram loader vector:blank blank=1 blank=0 pnsa input pnsa area 8 < (pnsa) pcsa input pcsa+n area blank=1 same data for three byte password input password matching n = 0 stop operation blank checking password count store address input password compare address input password checking no no no no no no no yes no yes yes yes yes yes yes yes writing hex data jump to ram area execution of user's program
toshiba under development TMP95FY64 95fy64_10e.doc 36 99/01/19 11:43 (2) - 1 writing hex data data input start mark ? data length input record type address input record type input no yes data record expansion record end record 00 = data record 01 = end record 02 = expansion record stop operation the others ret writing hex data
toshiba under development TMP95FY64 95fy64_10e.doc 37 99/01/19 11:43 (2) - 1 - 1 data record data record 1st byte receive ram loader odd address the rest = 1 2nd byte receive writing one word reading next address data reading previous address data writing one byte to ram the rest = 0 sum input sum ok? ret stop operation yes yes yes yes yes no no no no no
toshiba under development TMP95FY64 95fy64_10e.doc 38 99/01/19 11:43 (2) - 1 - 2 expansion record (2) - 1 - 3 end record expansion record data length = 02 address = 0000 paragragh address input setting usba data input data = 00 sum input sum ok? ret stop operation no no no no yes yes yes yes usba :paragragh address end record data length = 00 address = 0000 sum input sum ok? ret no no no yes yes yes sum calculation sum(high) output sum(low) output stop operation
toshiba under development TMP95FY64 95fy64_10e.doc 39 99/01/19 11:43 (2) - 1 - 1 - 1 writing one word (2) - 2 erasing flash memory writing one word (1aaaa) = aa (15554) = 55 (1aaaa) = a0 writing to selected address polling check 1st cycle 2nd cycle 3rd cycle write command set write error ret stop operation yes no flash erasing (1aaaa) = aa (15554) = 55 (1aaaa) = 80 polling check ret 1st cycle 2nd cycle 3rd cycle erase setup (1aaaa) = aa (15554) = 55 (1aaaa) = 10 4th cycle 5th cycle 6th cycle chip erase
toshiba under development TMP95FY64 95fy64_10e.doc 40 99/01/19 11:43 (2) - 2 - 1 data polling polling check reading write data dq7 = write data dq5 = "1" reading write data dq7 = write data status = ok status = ng ret no no no yes yes yes
toshiba under development TMP95FY64 95fy64_10e.doc 41 99/01/19 11:43 n ew erase/program cycle capability 1,000 cycle 100 150
toshiba under development TMP95FY64 95fy64_10e.doc 42 99/01/19 11:43
toshiba under development TMP95FY64 95fy64_10e.doc 43 99/01/19 11:43
toshiba under development TMP95FY64 95fy64_10e.doc 44 99/01/19 11:43
toshiba under development TMP95FY64 95fy64_10e.doc 45 99/01/19 11:43
toshiba under development TMP95FY64 95fy64_10e.doc 46 99/01/19 11:43
toshiba under development TMP95FY64 95fy64_10e.doc 47 99/01/19 11:43

▲Up To Search▲

Price & Availability of TMP95FY64

	To Download TMP95FY64 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .