 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| TOSHIBA Original CMOS 16-Bit Microcontroller TLCS-900/L1 Series TMP91FY28 Semiconductor Company Preface Thank you very much for making use of Toshiba microcomputer LSIs. Before use this LSI, refer the section, "Points of Note and Restrictions". Under development TMP91FY28 CMOS 16-Bit Microcontroller TMP91FY28FG 1. Outline The TMP91FY28 is a high-speed and high-performance 16-bit microcontroller suitable for low-voltage, low-power applications. The TMP91FY28FG comes in a 100-pin mini flat package. Features of the TMP91FY28FG include the following: (1) High-speed 16-bit CPU (900/L1 CPU) Instruction set is upwardly assembly-code compatible. 16-Mbyte linear address space Architecture based on general-purpose registers and register banks 16-bit multiply/divide instructions and bit transfer/arithmetic instructions 4-channel Micro DMA (1.6 s/2 bytes at 10 MHz) (2) Minimum instruction execution time: 400 ns (at 10 MHz) (3) 8-Kbyte on-chip RAM 256-Kbyte on-chip flash 2-Kbyte masked ROM that contains software bootstrap (4) External memory expansion 16-Mbyte off-chip address space for code and data External bus interface with dynamic bus sizing for 8-bit and 16-bit data ports (5) 4-channel 8-bit timer (6) 2-channel 16-bit timer (7) 1-channel general-purpose serial interface Both UART and synchronous transfer modes are supported. (8) 2-channel serial bus interface Either I2C mode or clock-synchronous mode can be selected. 030619EBP1 The information contained herein is subject to change without notice. The information contained herein is presented only as a guide for the applications of our products. No responsibility is assumed by TOSHIBA for any infringements of patents or other rights of the third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of TOSHIBA or others. TOSHIBA is continually working to improve the quality and reliability of its products. Nevertheless, semiconductor devices in general can malfunction or fail due to their inherent electrical sensitivity and vulnerability to physical stress. It is the responsibility of the buyer, when utilizing TOSHIBA products, to comply with the standards of safety in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such TOSHIBA products could cause loss of human life, bodily injury or damage to property. In developing your designs, please ensure that TOSHIBA products are used within specified operating ranges as set forth in the most recent TOSHIBA products specifications. Also, please keep in mind the precautions and conditions set forth in the "Handling Guide for Semiconductor Devices," or "TOSHIBA Semiconductor Reliability Handbook" etc.. The TOSHIBA products listed in this document are intended for usage in general electronics applications (computer, personal equipment, office equipment, measuring equipment, industrial robotics, domestic appliances, etc.). These TOSHIBA products are neither intended nor warranted for usage in equipment that requires extraordinarily high quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury ("Unintended Usage"). Unintended Usage include atomic energy control instruments, airplane or spaceship instruments, transportation instruments, traffic signal instruments, combustion control instruments, medical instruments, all types of safety devices, etc.. Unintended Usage of TOSHIBA products listed in this document shall be made at the customer's own risk. The products described in this document are subject to the foreign exchange and foreign trade laws. TOSHIBA products should not be embedded to the downstream products which are prohibited to be produced and sold, under any law and regulations. For a discussion of how the reliability of microcontrollers can be predicted, please refer to Section 1.3 of the chapter entitled Quality and Reliability Assurance/Handling Precautions. Purchase of TOSHIBA I2C components conveys a license under the Philips I2C Patent Rights to use these components in an I2C system, provided that the system conforms to the I2C Standard Specification as defined by Philips. 91FY28-1 2004-02-12 Under development (9) 8-channel 10-bit AD converter (with internal sample/hold) (10) Watchdog timer (11) Key wakeup interrupt with 8-bit inputs (12) WAKE output pin (13) BCD adder/subtractor (14) Program patch logic 6 banks of registers (15) 4-channel chip select/wait controller (16) 48 interrupt sources TMP91FY28 9 CPU interrupts: Triggered by software interrupt instruction or upon the execution of an undefined instruction 21 internal interrupts: 7 priority levels 18 external interrupts: 7 priority levels (16 interrupts supporting selection of triggering edge) (17) 80-pin input/output ports (18) Three HALT modes: Programmable IDLE2, IDLE1 and STOP (19) Clock control Clock gear: Switches the frequency of high-frequency clock within the range from fc to fc/16 (20) Operating voltage range: VCC 1.8 to 2.6 V (fc max 10 MHz) (21) Package: P-LQFP100-1414-0.50F 91FY28-2 2004-02-12 Under development (P60) SCK0 (P61) SO0/SDA0 (P62) SI0/SCL0 Port 6 (P63) INT0 (P64) SCOUT (P65) (P66) (P70) TA0IN (P71) TA1OUT Port 7 High-frequency oscillator CPU (TLCS-900/L1) TMP91FY28 I2C/SIO (Channel 0) X1 X2 EMU0 EMU1 RESET Clock gear 8-bit timer (TMRA0) 8-bit timer (TMRA1) 8-bit timer (TMRA2) 8-bit timer (TMRA3) XWA XBC XDE XHL XIX XIY XIZ XSP WA BC DE HL IX IY IZ SP 32 bits SR F PC C (P72) TA3OUT (P73) (P74) (P75) (P80) TB0IN0/INT5 (P81) TB0IN1/INT6 (P82) TB0OUT0 (P83) TB0OUT1 (P84) TB1IN0/INT7 (P85) TB1IN1/INT8 (P86) TB1OUT0 (P87) TB1OUT1 (P90) SCK1 (P91) SO1/SDA1 (P92) SI1/SCL1 Watchdog timer (WDT) BCD calculator (BCDC) Port 1 AM0 AM1 ALE AD0 (P00) AD1 (P01) AD2 (P02) AD3 (P03) AD4 (P04) AD5 (P05) AD6 (P06) AD7 (P07) AD8/A8 (P10) AD9/A9 (P11) AD10/A10 (P12) AD11/A11 (P13) AD12/A12 (P14) AD13/A13 (P15) AD14/A14 (P16) AD15/A15 (P17) A0/A16 (P20) A1/A17 (P21) A2/A18 (P22) A3/A19 (P23) A4/A20 (P24) A5/A21 (P25) A6/A22 (P26) A7/A23 (P27) RD (P30) WR (P31) 16-bit timer (TMRB0) Port 8 8-Kbyte RAM Program patch logic 256-Kbyte FLASH I2C/SIO (Channel 1) Port 9 2-Kbyte boot ROM SIO/UART Port 3 Port 2 16-bit timer (TMRB1) Port 0 HWR (P32) WAIT (P33) BUSRQ (P34) BUSAK (P35) (P93) TXD (P94) RXD (P95) SCLK/ CTS (P96) (PA0) INT1 (PA1) INT2 (PA2) INT3 (PA3) INT4 (PA4) (PA5) (PA6) (PA7) NMI WAKE Standby controller (KWI) Port 4 Interrupt controller Port A CS/WAIT controller R/ W (P36) BOOT (P37) CS0 (P40) CS1 (P41) CS2 (P42) CS3 (P43) 10-bit 8-channel AD converter Port 5 AN0/KWI0 (P50) AN1/KWI1 (P51) AN2/KWI2 (P52) AN3/ ADTRG /KWI3 (P53) AN4/KWI4 (P54) AN5/KWI5 (P55) AN6/KWI6 (P56) AN7/KWI7 (P57) AVCC AVSS VREFL VREFH DVCC [3] DVSS [3] ( ): Initial pin function after reset Figure 1.1 TMP91FY28 Block Diagram 91FY28-3 2004-02-12 Under development TMP91FY28 2. Signal Description This section contains pin assignments for the TMP91FY28 as well as brief descriptions of the TMP91FY28 input and output signals. 2.1 Pin Assignment The following illustrates the TMP91FY28FG pin assignment. 88 P65 DVCC P66 DVSS P50/AN0/KWI0 P51/AN1/KWI1 P52/AN2/KWI2 P53/AN3/ADTRG/KWI3 89 90 91 92 93 94 95 96 97 98 99 100 87 P64/SCOUT 86 P63/INT0 85 P62/SI0/SCL0 84 P61/SO0/SDA0 83 P60/SCK0 82 P43/CS3 81 P42/CS2 80 P41/CS1 79 P40/CS0 78 P37/BOOT 77 P36/R/W 76 P35/BUSAK 75 P34/BUSRQ 74 P33/WAIT 73 P32/HWR 72 P31/WR 71 P30/RD 70 P27/A7/A23 69 P26/A6/A22 68 P25/A5/A21 67 P24/A4/A20 66 P23/A3/A19 65 P22/A2/A18 P54/AN4/KWI4 P55/AN5/KWI5 P56/AN6/KWI6 P57/AN7/KWI7 VREFH VREFL AVSS AVCC P70/TA0IN P71/TA1OUT P72/TA3OUT P73 P74 P75 1 2 3 4 5 6 7 8 9 P80/TB0IN0/INT5 10 P81/TB0IN1/INT6 11 P82/TB0OUT0 P83/TB0OUT1 12 13 P84/TB1IN0/INT7 14 P85/TB1IN1/INT8 15 P86/TB1OUT0 P87/TB1OUT1 P90/SCK1 P91/SO1/SDA1 P92/ SI1/SCL1 P93/TXD P94/RXD P95/SCLK/CTS AM0 DVCC X2 DVSS X1 AM1 RESET P96 WAKE EMU0 EMU1 PA0/INT1 PA1/INT2 PA2/INT3 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 TMP91FY28FG Top view LQFP100 64 DVCC 63 NMI 62 DVSS 61 P21/A1/A17 60 P20/A0/A16 59 P17/AD15/A15 58 P16/AD14/A14 57 P15/AD13/A13 56 P14/AD12/A12 55 P13/AD11/A11 54 P12/AD10/A10 53 P11/AD9/A9 52 P10/AD8/A8 51 P07/AD7 50 P06/AD6 49 P05/AD5 48 P04/AD4 47 P03/AD3 46 P02/AD2 45 P01/AD1 44 P00/AD0 43 ALE 42 PA7 41 PA6 40 PA5 39 PA4 38 PA3/INT4 Figure 2.1.1 100-Pin LQFP Pin Assignment 91FY28-4 2004-02-12 Under development TMP91FY28 2.2 Pin Usage Information Table 2.2.1 to Table 2.2.4 list the input and output pins of the TMP91FY28, including alternate pin names and functions for multi-function pins. Table 2.2.1 Pin names and functions (1/4) Pin name P00 to P07 AD0 to AD7 P10 to P17 AD8 to AD15 A8 to A15 P20 to P27 A0 to A7 A16 to A23 P30 RD Number of Pins 8 8 I/O Function I/O Port 0: Individually programmable as input or output I/O Address (Lower): Bits 0 to 7 of the address/data bus I/O Port 1: Individually programmable as input or output I/O Address/data (Upper): Bits 8 to 15 of the address/data bus Output Address: Bits 8 to 15 of the address bus I/O Port 2: Individually programmable as input or output Output Address: Bits 0 to 7 of the address bus Output Address: Bits 16 to 23 of the address bus Output Port 30: Output only Output Read strobe: Asserted during a read operation from an external memory device Also asserted during a read from internal memory if P3 8 1 P31 WR 1 1 1 1 1 P32 HWR P33 WAIT P34 BUSRQ P35 BUSAK P36 R/W 1 P37 BOOT 1 1 P40 CS0 Note: An external DMA controller configured with the BUSRQ and BUSAK pins cannot access the on-chip memory and peripheral functions of the TMP91FY28. 91FY28-5 2004-02-12 Under development Table 2.2.2 Pin Names and Functions (2/4) Pin name P41 CS1 TMP91FY28 Number of Pins 1 I/O Function I/O Port 41: Programmable as input or output (with internal pull-up resistor) Output Chip select 1: Asserted low to enable external devices at programmed addresses I/O Port 42: Programmable as input or output (with internal pull-up resistor) Output Chip select 2: Asserted low to enable external devices at programmed addresses I/O Port 43: Programmable as input or output (with internal pull-up resistor) Output Chip select 3: Asserted low to enable external devices at programmed addresses Input Input Input Input Port 5: Input-only Analog input: Input to the on-chip AD converter AD trigger: Starts an AD conversion (Multiplexed with P53) Key wakeup input (Multiplexed with P50 to P57) P42 CS2 1 P43 CS3 1 P50 to P57 AN0 to AN7 ADTRG 8 KWI0 to KWI7 P60 SCK0 P61 SO0 SDA0 P62 SI0 SCL0 P63 INT0 P64 SCOUT P65 P66 P70 TA0IN P71 TA1OUT P72 TA3OUT 1 1 I/O Port 60: Programmable as input or output I/O Clock input/output pin when the serial bus interface 0 is in SIO mode I/O Port 61: Programmable as input or output (with internal pull-up resistor) Output Data transmit pin when the serial bus interface 0 is in SIO mode I/O Data transmit/receive pin when the Serial Bus Interface 0 is in I2C mode; programmable as an open-drain output I/O Port 62: Programmable as input or output (with internal pull-up resistor) Input Data receive pin when the serial bus interface 0 is in SIO mode I/O Clock input/output pin when the serial bus interface 0 is in I2C mode; programmable as an open-drain output I/O Port 63: Programmable as input or output Input Interrupt request 0: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive I/O Port 64: Programmable as input or output Output System clock output: Drives out fFPH clock. I/O Port 65: Programmable as input or output I/O Port 66: Programmable as input or output I/O Port 70: Programmable as input or output (with internal pull-up resistor) Input 8-bit timer 0 input: Input to timer 0 I/O Port 71: Programmable as input or output (with internal pull-up resistor) Output 8-bit timer 1 output: Output from either timer 0 or timer 1 I/O Port 72: Programmable as input or output (with internal pull-up resistor) Output 8-bit timer 3 output: Output from either timer 2 or timer 3 1 1 1 1 1 1 1 1 91FY28-6 2004-02-12 Under development Table 2.2.3 Pin Names and Functions (3/4) Pin name P73 P74 P75 P80 TB0IN0 INT5 P81 TB0IN1 INT6 P82 TB0OUT0 P83 TB0OUT1 P84 TB1IN0 INT7 P85 TB1IN1 INT8 P86 TB1OUT0 P87 TB1OUT1 P90 SCK1 P91 SO1 SDA1 P92 SI1 SCL1 P93 TXD TMP91FY28 Number of Pins 1 1 1 1 I/O Function I/O Port 73: Programmable as input or output (with internal pull-up resistor) I/O Port 74: Programmable as input or output (with internal pull-up resistor) I/O Port 75: Programmable as input or output (with internal pull-up resistor) I/O Port 80: Programmable as input or output (with internal pull-up resistor) Input 16-bit timer 0 input 0: Count/capture trigger input to 16-bit timer 0 Input Interrupt request 5: Programmable to be rising-edge or falling-edge sensitive I/O Port 81: Programmable as input or output (with internal pull-up resistor) Input 16-bit timer 0 input 1: Capture trigger input to 16-bit timer 0 Input Interrupt request 6: Rising-edge sensitive I/O Port 82: Programmable as input or output (with internal pull-up resistor) Output 16-bit timer 0 output 0: Output from 16-bit timer 0 I/O Port 83: Programmable as input or output (with internal pull-up resistor) Output 16-bit timer 0 output 1: Output from 16-bit timer 0 I/O Port 84: Programmable as input or output (with internal pull-up resistor) Input 16-bit timer 1 Input 0: Count/capture trigger input to 16-bit timer 1 Input Interrupt request 7: Programmable to be rising-edge or falling-edge sensitive I/O Port 85: Programmable as input or output (with internal pull-up resistor) Input 16-bit timer 1 input 1: Capture trigger input to 16-bit timer 1 Input Interrupt request 8: Rising-edge sensitive I/O Port 86: Programmable as input or output (with internal pull-up resistor) Output 16-bit timer 1 output 0: Output from 16-bit timer 1 I/O Port 87: Programmable as input or output (with internal pull-up resistor) Output 16-bit timer 1 output 1: Output from 16-bit timer 1 I/O Port 90: Programmable as input or output I/O Clock input/output pin when the serial bus interface 1 is in SIO mode I/O Port 91: Programmable as input or output (with internal pull-up resistor) Output Data transmit pin when the serial bus interface 1 is in SIO mode I/O Data transmit/receive pin when the serial bus interface 1 is in I2C mode; programmable as an open-drain output I/O Port 92: Programmable as input or output (with internal pull-up resistor) Input Data receive pin when the serial bus interface 1 is in SIO mode I/O Clock input/output pin when the serial bus interface 1 is in I2C mode; programmable as an open-drain output I/O Port 93: Programmable as input or output Output Serial transmit data: Programmable as an open-drain output 1 1 1 1 1 1 1 1 1 1 1 91FY28-7 2004-02-12 Under development Table 2.2.4 Pin Names and Functions (4/4) Pin name P94 RXD P95 SCLK CTS TMP91FY28 Number of Pins 1 1 I/O Function I/O Port 94: Programmable as input or output Input Serial receive data I/O Port 95: Programmable as input or output I/O Serial clock input/output Input Serial clear-to-send I/O Port96: Programmable as input or output I/O Ports A0 to A3: Individually programmable as input or output (with internal pull-up resistor) Input Interrupt request 1 to 4: Individually programmable to be rising-edge or falling-edge sensitive I/O Port A4 to A7: Programmable as input or output (with internal pull-up resistor) Output STOP mode monitor output This pin drives low when the CPU is operating; the pin is in high-impedance state during reset or in STOP mode. Output Address latch enable (This pin can be disabled in order to reduce noise.) Input Non maskable interrupt request: Causes an NMI interrupt on the falling edge. Programmable to be rising-edge sensitive. Input Both AM0 and AM1 should be held at logic 1. Output Test pin. This pin should be left open. Output Test pin. This pin should be left open. Input Reset (with internal pull-up resistor): Initializes the whole TMP91FY28. Input Input pin for high reference voltage for the AD converter. Input Input pin for low reference voltage for the AD converter. Power supply pin for the AD converter. Ground pin for the AD converter. I/O Connection pins for an oscillator crystal Power supply pins. The DVCC pins should be connected to power supply. Ground pins. The DVSS pins should be connected to ground. P96 PA0 to PA3 INT1 to INT4 1 4 PA4 to PA7 WAKE 4 1 ALE NMI 1 1 2 1 1 1 1 1 1 1 2 3 3 AM0 to AM1 EMU0 EMU1 RESET VREFH VREFL AVCC AVSS X1/X2 DVCC DVSS Note: All pins that have built-in pull-up resistors (Other than the RESET pin) can be disconnected from the built-in pull-up resistor by software. 91FY28-8 2004-02-12 Under development TMP91FY28 3. Functional Description This chapter describes the flash memory of the TMP91FY28, a flash version of the TMP91CW28. The TMP91FY28 contains a 256-Kbyte flash EEPROM and an 8-Kbyte RAM whereas the TMP91CW28 contains an 8-Kbyte RAM and 128-Kbyte ROM. In other respects, the hardware configuration and the functionality of the TMP91FY28 are identical to those of the TMP91CW28. For descriptions of the configurations other than the flash memory, refer to the TMP91CW28 datasheet. 3.1 Overview of Operating Modes The TMP91FY28 has the following two modes of operation. The logic states on the BOOT , AM0 and AM1 after a reset determine the mode of operation for the TMP91FY28. Single Chip mode: The TMP91FY28 operates in Normal mode. After a reset, the TLCS-900/L1 core processor executes out of the on-chip flash memory. Single Boot mode: After a reset, the TLCS-900/L1 core processor executes out of the on-chip boot ROM. The boot ROM contains a routine to aid users in performing on-board programming of the flash memory via a serial port (UART) of the TMP91FY28. Table 3.1.1 Modes of Operation Operating Mode RESET Single chip mode Single boot mode Input Pins BOOT (P37) H L AM0 H AM1 H 91FY28-9 2004-02-12 Under development TMP91FY28 3.2 Memory Map Figure 3.2.1 shows memory assignment for the TMP91FY28 in single chip mode and the areas of memory the CPU can access in different addressing modes. 000000H On-chip peripherals (4 Kbytes) 000100H 001000H On-chip RAM (8 Kbytes) 003000H External memory 010000H 16-Mbyte area (R) ( R) (R ) (R R8/16) (R d8/16) (nnn) Direct area (n) 64-Kbyte area (nn) FC0000H On-chip flash ROM (256 Kbytes) FFFF00H FFFFFFH Vector table (256 bytes) ( Internal area) Figure 3.2.1 Memory Map for Single Chip Mode 91FY28-10 2004-02-12 Under development TMP91FY28 3.3 Flash Memory The TMP91FY28 contains flash memory that can be programmed or erased electrically using a single 2-V power supply. Standard JEDEC commands are supported to program and erase the flash memory. Upon the entry of a command, the flash memory programs or erases its contents automatically. The flash memory can erase the entire chip at one time or erase the contents of one or more specified blocks. Features Supply voltage in write/erase operation Vcc 1.8 to 2.6 V Structure 256 K 8 bits/128 K 16 bits (256 Kbytes) Functions Auto program Auto chip erase Auto block erase Auto multi-block erase DATA polling/Toggle bit Erase blocks 16 Kbytes 1/8 Kbytes 2/ 32 Kbytes 1/64 Kbytes 3 Command set compatible with the JEDEC EEPROM standard. General-purpose flash memory equivalent to the 29SL800TD * Some 29SL800TD functions, including block protection, are not supported. Block architecture: xx0000H 64 Kbytes 64 Kbytes 64 Kbytes 32 Kbytes 8 Kbytes 8 Kbytes 16 Kbytes xx: Depends on the TMP91FY28 operating mode. xxFFFFH Figure 3.3.1 Block Architecture of Flash Memory 91FY28-11 2004-02-12 Under development Command Definitions Command Cycles Sequence Required 1st Cycle (Write) Address Data XXXXXH F0H x5554H x5554H x5554H x5554H 55H 55H 55H 55H xAAAAH xAAAAH xAAAAH xAAAAH F0H A0H 80H 80H RA PA xAAAAH xAAAAH RD PD AAH AAH x5554H x5554H 55H 55H 2nd Cycle (Write) Address Data Bus Cycles 3rd Cycle 4th Cycle (Write) (Read/ Write) Address Data Address Data 5th Cycle (Write) Address Data TMP91FY28 6th Cycle (Write) Address Data Read/Reset Read/Reset Auto program Auto chip erase Auto block erase 1 3 4 6 6 XAAAAH AAH XAAAAH AAH XAAAAH AAH XAAAAH AAH xAAAAH BA 10H 30H The addresses to be provided by the CPU are shown below. Command Address Address A23 to A16 A15 A14 A13 A12 X 1 0 X 0 1 X 1 0 X 0 1 X X X X X H Flash memory X A A A A H address area X5554H CPU Addresses: A23 to A0 A11 X 1 0 A10 X 0 1 A9 X 1 0 A8 X 0 1 A7 X 1 0 A6 X 0 1 A5 X 1 0 A4 X 0 1 A3 X 1 0 A2 X 0 1 A1 X 1 0 A0 0 0 0 F0H, AAH, 55H, A0H, 80H, 10H, 30H: Command data, written to DQ7 to DQ0 RA: Read address Data is read on a byte-by-byte or word-by-word basis. RD: Read data PA: Program address The address must be even-numbered. PD: Program data Data is written on a word-by-word basis. BA: Block address. A combination of A17, A16, A15, A14, and A13 specifies an individual block. *: Both types of reset commands can reset the device to read mode. Write Status Flags Status Auto program Embedded operation in progress Time-out in embedded operation Auto erase (during the time-out window) Auto erase Auto program Auto erase DQ7 DQ7 DQ6 Toggle Toggle Toggle Toggle Toggle DQ5 0 0 0 1 1 DQ3 0 0 1 1 1 0 0 DQ7 0 Note: DQ8 to DQ15, DQ0 to DQ2 are don't cares. 91FY28-12 2004-02-12 Under development Block Erase Addresses Block BA0 BA1 BA2 BA3 BA4 BA5 BA6 TMP91FY28 Address in Single Mode A17 L L H H H H H Address Range Single Chip Mode FC0000H to FCFFFFH FD0000H to FDFFFFH FE0000H to FEFFFFH A16 L H L H H H H A15 A14 A13 Single Boot Mode 010000H to 01FFFFH 020000H to 02FFFFH 030000H to 03FFFFH 040000H to 047FFFH 048000H to 049FFFH 04A000H to 04BFFFH 04C000H to 04FFFFH Size 64 Kbytes 64 Kbytes 64 Kbytes 32 Kbytes 8 Kbytes 8 Kbytes 16 Kbytes L H H H L L H L H FF0000H to FF7FFFH FF8000H to FF9FFFH FFA000H to FFBFFFH FFC000H to FFFFFFH Basic Operations The flash memory of the TMP91FY28 has the following two modes of operation: Read mode in which array data is read Embedded operation mode in which the flash memory is programmed or erased The flash memory enters embedded operation mode when a valid command sequence is executed in read mode. In embedded operation mode, array data can not be read. (1) Reading array data The flash memory is automatically set to reading array data upon CPU reset after device power-up and after an embedded operation is successfully completed. When an embedded operation is terminated abnormally, the read/reset command must be issued to put the flash memory back in Read mode as described below. (2) Writing commands The operations of the flash memory are selected by commands or command sequences written into the internal command register. This uses the same mechanism as for JEDEC-standard EEPROMs. Commands are made up of data sequences written at specific addresses via the command register. The flash memory uses the command data provided via DQ0 to DQ7. It ignores any data appearing at DQ8 to DQ15. The command sequence being written can be canceled by issuing the read/reset command between sequence cycles. The read/reset command clears the command register and resets the flash memory to read mode. Invalid command sequences also cause the flash memory to clear the command register and returns to read mode. (3) Reset (Read/reset command) The flash memory does not return to read mode if an embedded operation terminated abnormally. In this case, the read/reset command must be issued to put the flash memory back in read mode. The read/reset command may also be written between sequence cycles of the command being written to clear the command register. 91FY28-13 2004-02-12 Under development (4) Auto program command TMP91FY28 The flash memory is programmed on a word-by-word basis. As one word is 16 bits wide, the program address must be a multiple of two. The program address and data is latched in the fourth bus cycle of the auto program command sequence. The latching of the program data initiates the embedded auto program algorithm. The auto program command executes a sequence of internally timed events to program the desired bits of the addressed memory location and verify that the desired bits are sufficiently programmed. The system can determine the status of the programming operation by using write status flags. Any commands written during the programming operation are ignored. A bit must be programmed to change its state from a 1 to a 0. A bit cannot be programmed from a 0 back to a 1. Only an erase operation can change a 0 back to a 1. If any failure occurs during the programming operation, the flash memory remains locked in embedded operation mode. The system can determine this status by using write status flags. To put the flash memory back in read mode, use the read/reset command to reset the flash memory. In case of a programming failure, it is recommended to discontinue the use of the failing flash block. (5) Auto chip erase command The embedded auto chip erase algorithm is initiated at the completion of the sixth bus cycle of a command sequence. The embedded auto chip erase algorithm automatically preprograms the entire memory for an all-0 data pattern prior to the erase; then, it automatically erases and verifies the entire memory for an all-1 data pattern. The system can determine the status of the chip erase operation by using write status flags. Any commands written during the chip erase operation are ignored. If any failure occurs during the erase operation, the flash memory remains locked in embedded operation mode. The system can determine this status by using write status flags. To put the flash memory back in read mode, use the read/reset command to reset the flash memory. In case of an erase failure, it is recommended to replace the chip or discontinue the use of the failing flash block. The failing block can be identified by means of the auto block erase command. 91FY28-14 2004-02-12 Under development (6) Auto block erase and auto multi-block erase commands TMP91FY28 The address of the block to be erased is latched at the completion of the sixth bus cycle of a command sequence. After the time-out has expired, the erase operation will commence. The embedded auto block erase algorithm automatically preprograms the selected block for an all-0 data pattern, and then erases and verifies that block for an all-1 data pattern. During the time-out period, additional block addresses and auto block erase commands may be written. Any command other than auto block erase during the time-out period resets the flash memory to read mode. The block erase time-out period is 50 m. The time-out window is reset at the completion of the sixth bus cycle. The system can determine the status of the erase operation by using write status flags. Any commands written during the block erase operation are ignored. If any failure occurs during the erase operation, the flash memory remains locked in embedded operation mode. The system can determine this status by using write status flags. To put the flash memory back in read mode, use the read/reset command to reset the flash memory. In case of an erase failure, it is recommended to replace the chip or discontinue the use of the failing flash block. If any failure occurred during the multi-block erase operation, the failing block can be identified by running auto block erase on each of the blocks selected for multi-block erasure. 91FY28-15 2004-02-12 Under development (7) Write operation status TMP91FY28 As shown in Table "Write status flags", the flash memory provides several flag bits to determine the status of an embedded operation: DQ7, DQ6, DQ5 and DQ3. These status bits can be read during an embedded operation using the same timing as for read mode. The flash memory automatically returns to read mode when an embedded operation completes. The system can determine the operating status by referencing write status flags during an embedded operation. Once an embedded operation has completed, the system can determine the status by checking whether the data it has read matches the cell data. 1. DQ7 (Data polling) The data polling bit, DQ7, indicates to the host system the status of the embedded operation. Data polling is valid at the completion of the final bus cycle of a command sequence. When the embedded program algorithm is in progress, an attempt to read the flash memory will produce the complement of the data last written to DQ7. Upon completion of the embedded program algorithm, an attempt to read the flash memory will produce the true data last written to DQ7. Therefore, the system can use DQ7 to determine whether the embedded program algorithm is in progress or completed. When the embedded erase algorithm is in progress, an attempt to read the flash memory will produce a 0 at the DQ7 output. Upon completion of the embedded erase algorithm, the flash memory will produce a 1 at the DQ7 output. If there is a failure during an embedded operation, DQ7 continues to drive out the same value. The flash memory disables address latching when an embedded operation is complete. Data polling must be performed with a valid programmed address or an address within any of the non-protected blocks selected for erasure. 2. DQ6 (Toggle bit) The toggle bit, DQ6, also indicates to the host system the status of the embedded operation. Toggle bit is valid at the completion of the final bus cycle of a command sequence. Note that the erase operation will begin after the time-out has expired. When the embedded program algorithm is in progress, successive read cycles to any address cause DQ6 to toggle. If DQ6 is a 1 in the first read cycle, it will be a 0 in the next. Upon completion of the embedded program algorithm, DQ6 stops toggling and an attempt to read the flash memory will produce the data last written to DQ6. If there is a failure during an embedded operation, DQ6 still toggles. 91FY28-16 2004-02-12 Under development 3. DQ5 (Exceeded timing limits) TMP91FY28 DQ5 produces a 0 while the program or erase operation is in progress normally. DQ5 produces a 1 to indicate that the program or erase time has exceeded the specified internal limit. This is a failure condition that indicates the program or erase cycle was not successfully completed. The DQ5 failure condition also appears if the system tries to program a 1 to a location that was previously programmed to a 0. Only an erase operation can change a 0 back to a 1. In this case, the embedded program algorithm halts the operation. Once the operation has exceeded the timing limits, DQ5 will indicate a 1. Note that this is not a device failure condition since the flash memory was used incorrectly. Under both these conditions, the flash memory remains locked in embedded operation mode. The system must issue the read/reset command to return the flash memory to read mode. 4. DQ3 (Block erase timer) The block erase time-out window begins at the completion of the sixth bus cycle of the command sequence. The erase operation will begin after the time-out has expired (80 s). When the time-out is complete and the erase operation has begun, DQ3 switches from 0 to 1. If DQ3 is 0, the flash memory will accept additional auto block erase commands. Each time an auto block erase command is written, the time-out window is reset. To ensure that the command has been accepted, the system should check DQ3 prior to and following each auto block erase command. If DQ3 is 1 on the second status check, the command might not have been accepted. 5. RDY/ BSY (Ready/busy) This signal is not available because it is not connected to the CPU. 91FY28-17 2004-02-12 Under development (8) Re-programming the flash memory from the internal CPU TMP91FY28 The internal CPU can re-program the flash memory using the command sequence and write status flags described above. Because the flash memory cannot be read while it is performing an embedded operation, the programming routine must be executed in a memory area other than those assigned to the flash memory. The internal CPU can re-program the flash memory in one of two modes: using single boot mode or using a user-defined protocol in single chip mode (User boot mode). 1. Single boot mode In single boot mode, the flash memory can be re-programmed by using a program contained in the TMP91FY28 on-chip boot ROM. This boot ROM is a masked ROM. When single boot mode is selected upon reset, the boot ROM is mapped to the address region including the interrupt vector table while the flash memory is mapped to an address region different from it (See Figure 3.4.2 on page 23). The program in the boot ROM fetches new application data by serial transfer and re-programs the flash memory with that data. Interrupts should be disabled in single boot mode, including the NMI and other nonmaskable interrupts. For details, see section 3.4, "Single Boot Mode". 2. User boot mode (Single chip mode) User boot mode allows you to create a programming algorithm of your own. User boot mode is a sub-mode of single chip mode, or normal mode. This mode also requires that the flash programming routine run in address space outside the flash memory area and that all interrupts, including nonmaskable interrupts, be disabled. The user must provide a flash programming routine, including a routine for fetching new application data, with which the flash will be re-programmed. Code the main program so that it can switch from normal operation to flash memory programming mode, in which it expands and executes the flash programming routine outside the flash memory area. A flash programming routine may be stored in the flash memory and expanded into the on-chip RAM for execution or it may be stored and executed in an external memory device. 91FY28-18 2004-02-12 Under development TMP91FY28 Start Auto program command sequence (shown below) Data polling and toggle bits No Address Address 2 (Even-numbered address/ word-by-word) Last address? Yes Auto program done Auto program command sequence (Address/data) xAAAAH/AAH x5554H/55H xAAAAH/A0H Even address (A0 0)/ Program data (Word-by-word) Figure 3.3.2 Auto Security on Operation 91FY28-19 2004-02-12 Under development Start TMP91FY28 Auto erases command sequence (shown below) DATA polling and Toggle bits Auto erase done Auto chip erase command sequence (Address/data) xAAAAH/AAH Auto Block/Multi-block erase command sequence (Address/command) xAAAAH/AAH x5554H/55H x5554H/55H xAAAAH/80H xAAAAH/80H xAAAAH/AAH xAAAAH/AAH x5554H/55H x5554H/55H xAAAAH/10H Block Address/30H Block Address/30H Additional address for Auto Multi-block Erase (Each within 50 s) Block Address/30H Figure 3.3.3 Auto Erase Operations 91FY28-20 2004-02-12 Under development TMP91FY28 Start Read DQ7 to DQ0. Address = VA DQ7 = Data? No No DQ5 = 1? Yes Read DQ7 to DQ0. Address = VA Yes DQ7 = Data? No Failure Yes Pass Figure 3.3.4 Data Polling (DQ7) Algorithm Start Read DQ7 to DQ0. Address = VA DQ6 =Toggle? Yes No DQ5 = 1? Yes Read DQ7 to DQ0. Address = VA No DQ6 = Toggle? Yes Failure No Pass Figure 3.3.5 Toggle Bit Algorithm (DQ6) VA: Auto program: The address at which data is being written Auto chip erase: Any flash memory address Auto block erase: The selected block address 91FY28-21 2004-02-12 Under development TMP91FY28 3.4 Single Boot Mode (1) Overview The TMP91FY28 has single boot mode for serial programming of the flash memory while the TMP91FY28 is installed on the board. When single boot mode is selected, the boot ROM is mapped to an address region. In single boot mode, the flash memory can be re-programmed by using a program contained in the on-chip boot ROM. This boot ROM is a masked ROM. For on-board programming, the SIO of the TMP91FY28 is connected to an external host controller, which issue commands to the target board. The boot program contained in the boot ROM offers RAM transfer command, which stores program code transferred from a host controller to the on-chip RAM. Figure 3.4.1 shows an example of host-to-target connection. Host controller (Note) Low-voltage adapter (Note) Target boad 100V a.c. Register VCC VCC VCC MCU Mode control VCC AM0, AM1 RESET TRES Dedicated cable BOOT THODE BOOT mode selection logic RESET BOOT (P37) Mode control ROM RAM TMP91FY28 RX TTXD TX RXD1 (P94) TRXD TXD1 (P93) GND VSS VSS Note: The AF210 (Advanced on-board flash microcomputer programmer) and the AF264 (Voltage conversion adapter) from Yokogawa Digital Computer Corporation are supported. For a detailed description, consult the manual that accompanies the AF210 and AF264. Contact: Yokogawa Digital Computer Corporation Instrument Business Division Phone: +81-42-333-6224 Figure 3.4.1 Example of a Connection Between a Host Controller and a Target Board 91FY28-22 2004-02-12 Under development (2) Configuring for single boot mode TMP91FY28 For on-board programming, boot the TMP91FY28 in single boot mode, as follows: AM0 AM1 BOOT (P37) RESET H H L Set the AM0, AM1 and BOOT inputs as the logic values shown above. The TMP91FY28 boots in single boot mode on the rising edge of the RESET pin. (3) Memory map Figure 3.4.2 shows a comparison of the memory maps in user boot and single boot modes. In single boot mode, the on-chip flash memory is mapped to physical addresses 10000H through 4FFFFH, and the on-chip boot ROM (Masked ROM) is mapped to physical addresses FFF800H through FFFFFFH. User boot mode 000000H On-chip peripherals (4 Kbytes) 000100H 001000H On-chip RAM (8 Kbytes) 003000H External memory 010000H 010000H 003000H 000000H Single boot mode On-chip peripherals (4 Kbytes) 000100H 001000H On-chip RAM (8 Kbytes) External memory FC0000H On-chip Flash ROM (256 Kbytes) On-chip Flash ROM (256 Kbytes) 04FFFFH FFF800H Internal Boot ROM FFFFFFH FFFFFFH Internal area Figure 3.4.2 Memory Maps for User Boot and Single Boot Modes 91FY28-23 2004-02-12 Under development (4) Interface specification TMP91FY28 The following shows specifications for SIO communication in single boot mode. To enable on-board programming, the host controller must be configured to use these specifications. The baud rate is initially 9600 bps, which can be changed as shown in Table 3.4.1. Cominnucation channel: Serial transfer mode: Data length: Pality bit: STOP bit: Baud rate (reset value) (5) Data transfer format Table 3.4.1 to Table 3.4.7 show baud rate change codes, operation commands, and data transfer formats in different operating modes. Also refer to "Description of the boot program commands," following the tables. Table 3.4.1 Baud Rate Change Codes Code Baud rate (bps) 04H 76800 05H 62500 06H 57600 07H 38400 0AH 31250 18H 19200 28H 9600 SIO channel 1 UART (Asynchronous) mode, full-duplex 8 bits None 1 9600 bps Note: The AF200 series currently supports 9600, 19200, 31250, and 62500 bps only. Table 3.4.2 Single Boot Mode Commands Code 30H 60H 90H Program flash RAM transfer Show flash memory SUM Command 91FY28-24 2004-02-12 Reference Baud Rate (bps) 28H Baud rate (bps) (%) 0 +1.73 2.34 0 0 38400 31250 19200 19531 18750 19200 19531 19200 19231 18750 19200 19531 18385 19200 19200 19531 19091 19176 0.13 0.57 +1.72 0 32000 32552 30000 30134 0 31418 4.24 30085 3.73 +0.54 +2.4 +4.17 4 3.57 +1.72 31250 0 0 30720 1.7 2.34 31250 0 38400 39063 36771 38400 38400 39063 38182 38352 0 +1.73 4.24 0 0 +1.73 0.57 0.13 55156 57600 54857 55804 4.24 0 4.76 3.12 64000 65104 +2.4 +4.17 76800 78125 +0.16 31250 0 56250 2.34 61440 62500 1.7 0 76800 78125 0 32914 38400 +5.3 0 +1.72 32552 39063 +1.73 57600 0 62500 0 +4.17 0 32000 38400 0 +2.4 2.34 31250 37500 2.34 0 +1.72 31250 39063 +1.73 62500 64000 65104 0 +2.4 +4.17 76800 0 0 30720 38400 0 1.7 0 0 57600 0 62500 0 76800 78125 +0.16 0 +1.73 2.34 0 +1.73 0 +0.16 2.34 0 +1.73 4.24 0 0 +1.73 0.57 0.13 19200 0 19200 0 32000 +2.4 18750 2.34 31250 0 19531 +1.72 +1.73 39063 19200 0 0 38400 (%) (%) (%) (%) (%) 9600 9766 9375 9600 9600 9615 9600 9766 9375 9600 9766 9600 9615 9375 9600 9766 9193 9600 9600 9766 9545 9588 (bps) (bps) (bps) (bps) (bps) 18H 0AH 07H 06H 05H (bps) 76800 78125 9600 19200 31250 38400 57600 62500 76800 04H (%) 0 +1.73 Baud Rate Change Code Area (MHz) 4.85 to 5.07 Reference Frequency (MHz) 4.9152 5 5.91 to 6.23 7.26 to 7.48 7.84 to 8.16 6 6.144 7.3728 8 9.8304 10 9.64 to 10.20 0 +1.73 12 12.288 11.76 to 12.75 12.5 14.7456 14.46 to 15.04 0 16 15.68 to 16.32 Under development Table 3.4.3 Operating Frequency and Baud Rate in Single Boot Mode 91FY28-25 18 17.64 to 18.36 19.6608 20 19.27 to 20.40 0 +1.73 21.18 22.1184 20.76 to 22.56 24.5760 25 24.09 to 25.50 0 +1.73 26.88 27 26.35 to 27.54 Reference frequency: Area: High-speed oscillator frequencies supported in single boot mode When re-programming the flash memory in single boot mode, select any of the reference frequencies for the high-speed clock. Approximate range of clock frequencies that are detected as each reference frequency. Single boot operation may be disabled at clock frequencies not included in any of the detectable ranges. TMP91FY28 2004-02-12 Note: To automatically detect a reference frequency (Microcontroller clock frequency), the total error must be within 3%, including the transmission baud rate error (at 9600 bps) for the host controller, the oscillation frequency error, and the matching data timing detection error. Under development TMP91FY28 Table 3.4.4 Format of Data Transfer by the Boot Program (for re-programming the flash memory) Byte Boot ROM 1st byte 2nd byte 3rd byte 4th byte Data Transferred from the Controller to TMP91FY28 Matching data (5AH) Baud Rate 9600 bps 9600 bps 9600 bps 9600 bps Data Transferred from the TMP91FY28 to Controller (Baud rate set automatically) OK: Echo back data (5AH) Error: None Baud rate change code (See Table 3.4.1) OK: Echo back data Error: A1H 3, A2H 3, A3H (*1) OK: Echo back data (30H) Error: A1H 3, A2H 3, A3H (*1) OK: C1H Error: 64H 3 (*1) 3, 62H 3 5th byte 6th byte Command code (30H) New baud rate New baud rate 3, 63H 3 7th byte 8th byte : (n-2)th byte (n-1)th byte nth byte (n+1)th byte New baud rate Data in Intel hexadecimal object New baud rate file format (Binary) (*2) New baud rate New baud rate (Wait for the next command New baud rate code.) OK: OK: SUM (Upper byte) (*3) SUM (Lower byte) (*3) Error: None Error: None *1: "xxH 3" means that the boot program transmits three bytes of xxH and then stops operating. See "Code transmitted by the boot program," described later in this section. See "Notes on Intel hexadecimal object file format (Binary)," described later in this section. See "Calculation of the Show Flash Memory SUM Command," described later in this section. *2: *3: 91FY28-26 2004-02-12 Under development Table 3.4.5 Format of Data Transfer by the Boot Program (for RAM transfer) Byte Boot ROM 1st byte 2nd byte 3rd byte 4th byte TMP91FY28 Data Transferred from the Controller to TMP91FY28 Matching data (5AH) Baud Rate 9600 bps 9600 bps 9600 bps 9600 bps Data Transferred from the TMP91FY28 to Controller (Baud rate set automatically) OK: Echo back data (5AH) Error: None OK: Echo back data Error: A1H 3, A2H 3, A3H (*1) OK: Echo back data (60H) Error: A1H 3, A2H 3, A3H (*1) OK: None Error: A1H 3, A2H OK: None Error: A1H 3, A2H OK: None Error: A1H 3, A2H OK: None Error: A1H 3, A2H OK: None Error: A1H 3, A2H OK: None Error: A1H 3, A2H OK: None Error: A1H 3, A2H Baud rate change code (See Table 3.4.1) 3, 62H 3 5th byte 6th byte Command code (60H) New baud rate New baud rate 3, 63H 3 7th byte 8th byte 9th byte 10th byte 11th byte 12th byte 13th byte 14th byte 15th byte 16th byte 17th byte 18th byte 19th byte : mth byte (m+1)th byte : (n-2)th byte (n-1)th byte nth byte Password count storage address bits 23 to 16 (*2) Password count storage address bits 15 to 08 (*2) Password count storage address bits 07 to 00 (*2) Password comparison start address bits 23 to 16 (*2) Password comparison start address bits 15 to 08 (*2) Password comparison start address bits 07 to 00 (*2) Password sequence (*2) New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate New baud rate 3, A3H 3 (*1) 3, A3H 3 (*1) 3, A3H 3 (*1) 3, A3H 3 (*1) 3, A3H 3 (*1) 3, A3H 3 (*1) 3, A3H 3 (*1) Data in Intel hexadecimal object file format (Binary) (*3) New baud rate New baud rate OK: SUM (Upper byte) (*4) Error: None OK: SUM (Lower byte) (*4) Error: None RAM Branch to the user program start address. *1: "xxH 3" means that the boot program transmits three bytes of xxH and then stops operating. See "Code transmitted by the boot program," described later in this section. Refer to "Notes on passwords," described later in this section. See "Notes on Intel hexadecimal object file format (Binary)," described later in this section. See "Calculation of the Show Flash Memory SUM Command," described later in this section. *2: *3: *4: 91FY28-27 2004-02-12 Under development TMP91FY28 Table 3.4.6 Format of Data Transfer by the Boot Program (for the flash memory SUM) Byte Boot ROM 1st byte 2nd byte 3rd byte 4th byte Data Transferred from the Controller to TMP91FY28 Matching data (5AH) Baud Rate 9600 bps 9600 bps 9600 bps 9600 bps Data Transferred from the TMP91FY28 to Controller (Baud rate set automatically) OK: Echo back data (5AH) Error: None OK: Echo back data Error: A1H 3, A2H 3, A3H (*1) OK: Echo back data (90H) Error: A1H 3, A2H 3, A3H (*1) OK: Error: OK: Error: SUM (Upper byte) (*2) SUM (Lower byte) (*2) Baud rate change code (See Table 3.4.1) 3, 62H 3 5th byte 6th byte Command code (90H) New baud rate New baud rate 3, 63H 3 7th byte 8th byte 9th byte (Wait for the next command code.) New baud rate New baud rate New baud rate *1: "xxH 3" means that the boot program transmits three bytes of xxH and then stops operating. See "Code transmitted by the boot program," described later in this section. See "Calculation of the Show Flash Memory SUM Command," described later in this section. *2: 91FY28-28 2004-02-12 Under development (6) Description of the boot program commands TMP91FY28 When the TMP91FY28 is started in single boot mode, the boot program runs automatically. The boot program offers the following three commands, the details of which are provided on the following subsections. 1. Program flash command The program flash command first erases the entire flash memory chip (256 Kbytes) and then writes data to specified addresses. The host controller must transmit write data as binary data in Intel hexadecimal object file format. Once all records have been written without an error, the boot program calculates the SUM of 256 Kbytes in the flash memory and returns the result. 2. RAM transfer command The RAM transfer command stores Intel hexadecimal object file format data transferred from the host controller to the on-chip RAM. Once the transfer is successfully completed, the boot program calculates and transmits the SUM, and then starts executing the user program. The address received first specifies the address at which the user program should start. The RAM transfer command can be used to download a flash programming routine of your own; this provides the ability to control on-board programming of the flash memory in a unique manner. The programming routine must utilize the flash memory command sequences described earlier in this section (to align with flash memory addresses used in single boot mode). Before initiating a transfer, the RAM transfer command checks a password sequence coming from the controller against that stored in the flash memory. If they do not match, the RAM transfer command aborts. 3. Show flash memory SUM command (See Table 3.4.4) The show flash memory SUM command adds the contents of the 256 Kbytes of the flash memory together. The boot program does not provide a command to read out the contents of the flash memory. Instead, the flash memory SUM command can be used for software revision management. a. Program flash command 1. The 1st byte specifies matching data. Once started in single boot mode, the boot program waits for matching data to be transmitted from the host controller. Upon the reception of matching data, the program automatically adjusts the initial baud rate for the serial channel to 9600 bps. Matching data is 5AH. The 2nd byte, transmitted from the TMP91FY28 to the controller, is an acknowledge response to the 1st byte. After setting the baud rate automatically, the boot program echoes back the 1st byte (5AH). If it fails to set the baud rate, it stops operation. 2. 91FY28-29 2004-02-12 Under development 3. TMP91FY28 The 3rd byte specifies a new baud rate, which is one of the seven supported baud rates listed in Table 3.4.1. If the controller need not change the baud rate, it must transmit the default baud rate (28H: 9600 bps). The new baud rate does not become effective until the boot program echoes back the data. The 4th byte, transmitted from the TMP91FY28 to the controller, is an acknowledge response to the 3rd byte. If the received data corresponds to any of the baud rates supported for the current operating frequency, the boot program echoes back the data before changing the baud rate. Otherwise, it transmits three bytes of error code (62H) and then stops operation. The 5th byte, which the TMP91FY28 receives from the controller, is a command. The code for the program flash command is 30H. The 6th byte, transmitted from the TMP91FY28 to the controller, is an acknowledge response to the 5th byte. If the 5th byte is equal to any of the command codes listed in Table 3.4.2, the boot program echoes it back to the controller. When the program flash command was received, the boot program echoes back a value of 30H and then branches to the flash programming routine. If the 5th byte is not a valid command, the boot program sends back three bytes of error code (63H) and then stops operation. The 7th byte, transmitted from the TMP91FY28 to the controller, indicates whether chip erase operation (256 Kbytes) has completed successfully. If the chip has been erased normally, the flash programming routine transmits the normal erase completion code (C1H). If an error occurs during erasure, the routine transmits three bytes of error code (64H) and then stops operation. The controller can transmit next data once it receives the normal erase completion code (C1H). The 8th to (n 2)th bytes, which the TMP91FY28 receives from the controller, are binary data in Intel hexadecimal object file format. The TMP91FY28 does not echo back these bytes. The flash programming routine ignores received data, without transmitting an error code, until it detects a RECORD MARK for Intel hexadecimal object file format (3AH, ":"). Once it detects a RECORD MARK, it receives a sequence from the RECLEN field to CHKSUM field. The routine sequentially writes each received byte to a specified flash memory address. The first record must be an extended segment address record because bits 23 to 16 of the write address pointer are 00H by default. Once the routine has received a single record, from the RECORD MARK to CHKSUM field, it again waits for a RECORD MARK. If a write error, reception error, or Intel hexadecimal object file format error occurs, the routine stops operation without transmitting an error code. The flash programming routine executes the show flash memory SUM routine when it detects an end of file record. The controller must, therefore, wait for the SUM after transmitting an end of file record. 4. 5. 6. 7. 8. 91FY28-30 2004-02-12 Under development 9. TMP91FY28 The show flash memory SUM routine adds all the bytes of the flash memory together. The (n 1)th and nth bytes, transmitted from the TMP91FY28 to the controller, indicate the upper and lower bytes of the total SUM, respectively. For details, see section, "Calculation of the Show Flash Memory SUM Command." The SUM is calculated only when the end of file record is detected without a write error, reception error, or Intel hexadecimal object file format error. Calculating the SUM for the 256-Kbyte flash memory area requires approximately 400 ms at fc 20 MHz. After calculating the SUM, the program transmits the SUM to the controller. After transmitting the end of file record, the controller can determine whether the re-programming of the flash memory has completed successfully, according to whether it receives the SUM. 10. The (n 1)th byte will be the next command code if re-programming completes successfully. b. RAM transfer command (See Table 3.4.5.) 1. 2. 3. The processing of the 1st to 4th bytes are the same as for the program flash command. The 5th byte, which the TMP91FY28 receives from the controller, is a command. The code for the RAM transfer command is 60H. The 6th byte, transmitted from the TMP91FY28 to the controller, is an acknowledge response to the 5th byte. If the 5th byte is equal to any of the command codes listed in Table 3.4.2, the boot program echoes it back to the controller. When the RAM transfer command was received, the boot program echoes back a value of 60H and then branches to the RAM transfer routine. If the 5th byte is not a valid command, the boot program sends back three bytes of error code (63H) and then stops operation. The 7th byte contains data for bits 23 to 16 of the address storing the number of passwords. The address is specified using three bytes. Note that operation is canceled if the received passwords are less than eight. The 8th byte, from the TMP91FY28 to the controller, is not transmitted if the 7th byte has been received without an error. If a reception error occurs, the RAM transfer routine transmits three bytes of error code and then stops operation. The 9th to 12th bytes correspond to data for bits 15 to 8 and 7 to 0 of the password count storage address and the respective error code bytes, if any. See steps 4 and 5, above. The 13th byte contains data for bits 23 to 16 of the address at which the comparison of passwords will start. The address is specified using three bytes. The 14th byte, from the TMP91FY28 to the controller, is not transmitted if the 13th byte has been received without an error. If a reception error occurs, the RAM transfer routine transmits three bytes of error code and then stops operation. The 15th to 18th bytes correspond to data for bits 15 to 8 and 7 to 0 of the password comparison start address and the respective error code bytes, if any. See steps 7 and 8, above. 4. 5. 6. 7. 8. 9. 10. The 19th to mth bytes contain passwords. The number of passwords (N) is specified with the data stored at the password count storage address. The RAM transfer routine compares N passwords with those stored in the area starting with the password comparison start address. The controller must transmit N bytes of password data. If any of the passwords fails to match in comparison, the routine stops operation without transmitting an error code. 91FY28-31 2004-02-12 Under development TMP91FY28 11. The (m 1)th to (n 2)th bytes, which the TMP91FY28 receives from the controller, are binary data in Intel hexadecimal object file format. The TMP91FY28 does not echo back these bytes. The RAM transfer routine ignores received data, without transmitting an error code, until it detects a RECORD MARK for Intel hexadecimal object file format (3AH, ":"). Once it detects a RECORD MARK, it receives a sequence from the RECLEN field to CHKSUM field. The routine sequentially writes each received byte to a specified RAM address. Bits 23 to 16 of the write address pointer are 00H by default. The first record need not be an extended segment address record. Once the routine has received a single record, from the RECORD MARK to CHKSUM field, it again waits for a RECORD MARK. If a reception error or Intel hexadecimal object file format error occurs, the routine stops operation without transmitting an error code. The RAM transfer routine executes the show flash memory SUM routine when it detects an end of file record. The controller must, therefore, wait for the SUM after transmitting an end of file record. 12. The (n 1)th and nth bytes, transmitted from the TMP91FY28 to the controller, indicate the upper and lower bytes of the SUM, respectively. For details, see section, "Calculation of the Show Flash Memory SUM Command." The SUM is calculated only when the end of file record is detected without a reception error or Intel hexadecimal object file format error. The time required for calculating the SUM is roughly proportional to the number of data bytes written to RAM. Calculating the SUM for a 4-Kbyte RAM area requires approximately 6 ms at fc 20 MHz. After calculating the SUM, the program transmits the SUM to the controller. After transmitting the end of file record, the controller can determine whether transfer to the RAM has completed successfully, according to whether it receives the SUM. 13. After transmitting the SUM, the program makes a branch to the address specified with the first data byte received in Intel hexadecimal object file format. 91FY28-32 2004-02-12 Under development c. Show flash memory SUM command (See Table 3.4.6.) 1. 2. 3. TMP91FY28 The processing of the 1st and 4th bytes are the same as for the program flash command. The 5th byte, which the target board receives from the controller, is a command. The code for the show flash memory SUM command is 90H. If the 6th byte is equal to any of the command codes listed in Table 3.4.2 on page 24, the boot program echoes it back to the controller. When the show flash memory SUM command was received, the boot program echoes back a value of 90H and then branches to the show flash memory SUM routine. If the 6th byte is not a valid command, the boot program sends back 63H to the controller and then stops operation. The show flash memory SUM routine adds all the bytes of the flash memory together. The 7th and 8th bytes, transmitted from the target board to the controller, indicate the upper and lower bytes of this total SUM, respectively. For details, see section, "Calculation of the Show Flash Memory SUM Command". The 9th byte is the next command code. 4. 5. d. Code transmitted by the boot program The boot program represents processing states with specific codes, as listed below. Table 3.4.7 Code Transmitted by the Boot Program Code C1H 62H, 62H, 62H 63H, 63H, 63H 64H, 64H, 64H A1H, A1H, A1H A2H, A2H, A2H A3H, A3H, A3H Description Chip erase operation has completed successfully. A baud rate change error has occurred. A command error has occurred. An erase error has occurred. Received data contains a framing error. Received data contains a parity error. Received data contains an overrun error. (Note) (Note) (Note) Note: If any of these errors occur while data in Intel hexadecimal object file format is being received, the boot program does not transmit a reception error code. 91FY28-33 2004-02-12 Under development e. Calculation of the show flash memory SUM command 1. Calculation method TMP91FY28 The show flash memory SUM command adds all 256 Kbytes of the flash memory together and provides the total SUM as a word quantity. Example: A1H For the interest of simplicity, assume the depth of the flash memory is four locations. Then the SUM of the four bytes is calculated as: B2H C3H D4H A1H B2H C3H D4H 02H EAH 02EAH SUM (High) SUM (Low) When the program flash, RAM transfer, and show flash memory SUM commands are executed, the SUM is calculated as described above. 2. Scope of calculation Table 3.4.8 lists the data to be totaled to obtain the SUM. Table 3.4.8 Scope of SUM Calculation Command Program flash command RAM transfer command Data to be Totaled Data stored in the entire flash memory area (256 Kbytes) Data written to the area from the address received first to that received last Data stored in the entire flash memory area (256 Kbytes) Remarks The data to be totaled is not limited to the data actually written to the flash memory or RAM. If received addresses are not contiguous, leaving some intermediate areas unwritten, those areas are also included in the calculation of the SUM. Show flash memory SUM command 91FY28-34 2004-02-12 Under development f. Notes on Intel hexadecimal object file format (Binary) 1. TMP91FY28 The program flash command requires that the first record be an extended segment address record. This is because the TMP91FY28 flash memory is mapped to an area starting from address 10000H and bits 23 to 16 of the write address pointer are 00H by default. The RAM transfer command does not require that the first record be an extended segment address record. This is because bits 23 to 16 of the write address pointer are 00H by default. After receiving the CHKSUM field of a record, the program waits for a RECORD MARK (3AH, ":") for the next record. If any data other than 3AH is transmitted between records, it is ignored. Note: ":": 3AH (RECORD MARK) xx, yy: Data written to flash memory CS, EC, DC, FF: Checksum data zz: No effect if transmitted by the controller ww: Must not be transmitted by the controller 2. 3. 4. After transmitting the CHKSUM field of an end of file record, the program on the controller must wait for two bytes of data (Upper and lower bytes of the SUM) to be received, without transmitting any data. After receiving the CHKSUM field of an end of file record, the SUM calculation routine on the TMP91FY28 calculates the SUM and transmits the result as two bytes. If a write error (only for the program flash command), reception error, or Intel hexadecimal object file format error occurs, the program stops operation without transmitting an error code. An Intel hexadecimal object file format error occurs in the following cases: The RECTYP field of a record is other than 00H, 01H, and 02H. A checksum error occurs. The RECLEN field of an extended segment address record (RECTYP is other than 02H. 02H) 5. The LOAD OFFSET field of an extended segment address record (RECTYP 02H) is other than 0000H. The second byte of the data contained in an extended segment address record (RECTYP 02H) is other than 00H. The RECLEN field of an end of file record (RECTYP 00H. 01H) is other than 01H) is other The LOAD OFFSET field of an end of file record (RECTYP than 0000H. Example: Table 3.4.9 shows the transfer format when writing data to memory space in the address range of 1FFF8H to 2002FH. 91FY28-35 2004-02-12 Under development Table 3.4.9 Example Transfer Format for the Program Flash Command Direction of Transfer Controller to TMP91FY28 Controller to TMP91FY28 Controller to TMP91FY28 Controller to TMP91FY28 Controller to TMP91FY28 TMP91FY28 to controller TMP91FY28 to controller Controller to TMP91FY28 TMP91FY28 Meaning of Data Intel Hexadecimal Object File Format (8th to (n 2)th bytes in Table 3.4.4) Extended segment address record Data record (Data length: 08H) Extended segment address record Data record (Data length: 30H) End of file record SUM (Upper byte) ((n 1)th byte in Table 3.4.4) SUM (Lower byte) (nth byte in Table 3.4.4) Command ((n 1)th byte in Table 3.4.4) Data : 02 0000 02 1000 EC zz : 08 FFF8 00 xxxxxx CS zz : 02 0000 02 2000 DC zz : 30 0000 00 yyyyyyyy CS zz : 00 0000 01 FF ww SUM (Upper byte) SUM (Lower byte) Next command data 91FY28-36 2004-02-12 Under development TMP91FY28 g. Notes on passwords Passwords can be stored in the address range of 12000H to 4DFFFH. Figure 3.4.3 provides a schematic view of the password area. 1. Password count storage address (PNSA) The address specified with PNSA contains the number of passwords (N). A password error occurs in the following cases: PNSA Address 4DFFFH N 2. address 12000H PNSA 8 Password comparison start address (PCSA) The boot program starts comparing passwords from the address specified with PCSA. The password area to be compared is PCSA to PCSA N. A password error occurs in the following cases: PCSA Address 4DFFFH address 12000H PCSA N 1 The same data is found in three or more consecutive bytes in the password area. If all bytes in the vector block (4FF00H to 4FFFFH) contain FFH, however, the program assumes that the device is a blank device and does not check the passwords. 3. Password sequence The received sequence of passwords is compared with the data stored in the flash memory. A password error occurs in the following case: Received password data does not match the data stored in the corresponding byte in the flash memory. 4. Handling a password error If a password error occurs, the boot program stops operation. Flash memory 10000H 12000H Password count storage address (PNSA) N Password comparison start address (PCSA) Password area used for comparison (N bytes) Supported password area PCSA + N 1 4DFFFH 4FFFFH Figure 3.4.3 Schematic View of the Password Area 91FY28-37 2004-02-12 Under development TMP91FY28 Start Automatic baud rate setting Receive a command Command Show SUM Program Flash RAM Transfer Others SUM calculation Re-programming RAM transfer Send error codes Stop operation Figure 3.4.4 General Flowchart for Single Boot Mode 91FY28-38 2004-02-12 Under development TMP91FY28 SUM calculation Calculate SUM for entire area Output upper byte of SUM Output lower byte of SUM RET Figure 3.4.5 Show Flash Memory SUM Command Re-programming Erase flash memory Can erase? No Yes Send erase OK code Send erase cancel code Stop operation Write hexadecimal data RET Figure 3.4.6 Program Flash Command 91FY28-39 2004-02-12 Under development TMP91FY28 RAM transfer Check for blank No Vector blank? Yes Blank 1 Blank 0 Enter password count storage address Enter PNSA No PNSA within area? Yes No 8 < (PNSA) Yes Enter password comparison start address Enter PCSA No PCSA + n within area? Yes Check passwords Yes Blank 1 No Yes Three consecutive same bytes? No Enter password Password matched? No Yes No n 0 Yes Write hexadecimal data Stop operation Run user program Branch to RAM area Figure 3.4.7 RAM Transfer Command 91FY28-40 2004-02-12 Under development TMP91FY28 Write hexadecimal data Enter data No RECORD MARK? Yes Enter RECLEN Enter LOAD OFFSET Enter RECTYP RECTYP 00 Data Record 02 Extended Segment Address Record Extended Segment Address Record 01 End of File Record Others Data Record End of File Record Stop operation RET Figure 3.4.8 Writing Hexadecimal Data 91FY28-41 2004-02-12 Under development TMP91FY28 Data Record Receive 1st byte Yes RAM transfer? No Odd address? No Yes Yes 1 byte left? No Read next address data Read preceding address data Receive 2nd byte Write a word Write a byte to RAM No No byte left? Yes Enter SUM Sum OK? Yes No RET Stop operation Figure 3.4.9 Data Record 91FY28-42 2004-02-12 Under development TMP91FY28 Extended Segment Address Record End of File Record No RECLEN 02? Yes RECLEN 00? Yes No LOAD OFFSET 0000? Yes No LOAD OFFSET 0000? Yes No Enter paragraph address Enter SUM Set USBA USBA: Paragraph address No SUM OK? Yes Enter data Calculate SUM No Data = 00? Output upper byte of SUM Yes Enter SUM Output lower byte of SUM No SUM OK? Yes Stop operation RET Stop operation RET Figure 3.4.10 Extended Segment Address Record Figure 3.4.11 End of File Record 91FY28-43 2004-02-12 Under development TMP91FY28 Write a word Erase flash memory 1st cycle (1AAAA) AA 1st cycle (1AAAA) AA 2nd cycle (15554) 55 2nd cycle (15554) 55 3rd cycle Command for writing (1AAAA) A0 3rd cycle Set up erase (1AAAA) 80 Write to specified address 4th cycle (1AAAA) AA Polling check 5th cycle (15554) 55 Yes Write error occurred? 6th cycle Erase chip (1AAAA) 10 No Polling check Stop operation RET RET Figure 3.4.12 Writing a Word Figure 3.4.13 Erasing the Flash Memory 91FY28-44 2004-02-12 Under development TMP91FY28 Polling check Read written data Yes Write and read polling bits match? No No Read time-out bit 1? Yes Read written data Write and read polling bits match? Yes Status OK No Status Error RET Figure 3.4.14 Data polling 91FY28-45 2004-02-12 Under development TMP91FY28 4. 4.1 Electrical Characteristics (Preliminary) Maximum Ratings Parameter Supply voltage Input voltage Output current (Per pin) Output current (Per pin) Output current (Total) Output current (Total) Power dissipation (Ta Storage temperature Operating temperature Write/erase cycles 85C) Soldering temperature (10 s) Vcc VIN IOL IOH IOL IOH PD TSOLDER TSTG TOPR NEW Symbol Rating 0.5 to 3.0 0.5 to Vcc 2 2 80 80 600 260 55 to 125 20 to 70 10000 0.5 Unit V mA mW C Cycle Note: The maximum ratings are rated values which must not be exceeded during operation, even for an instant. Any one of the ratings must not be exceeded. If any absolute maximum rating is exceeded, a device may break down or its performance may be degraded, causing it to catch fire or explode resulting in injury to the user. Thus, when designing products which include this device, ensure that no maximum rating value will ever be exceeded. Point of note about solderability of lead free products (attach "G" to package name) Test parameter Solderability Test Condition (1) Use of Sn-63Pb solder bath Solder bath temperature 230C, Dipping time The number of times = One, Use of R-type flux 5 [s] Note Pass: Solderability rate until forming 95% (2) Use of Sn-3.0Ag-0.5Cu solder bath Solder bath temperature 245C, Dipping time 5 [s] The number of times = One, Use of R-type flux (use of lead free) 91FY28-46 2004-02-12 Under development TMP91FY28 4.2 DC Electrical Characteristics (1/2) Parameter Symbol VCC 0V VIL VIL1 VIL2 VIL3 VIL4 VIH VIH1 VIH2 VIH3 VIH4 VOL VOH VCC VCC VCC VCC VCC VCC VCC VCC VCC VCC IOL IOH 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V 0.4 mA VCC 1.8 to 2.6 V 1.8 to 2.6 V 0.8 Vcc 0.7 Vcc 0.8 Vcc 0.85 Vcc Vcc 0.3 Vcc 0.3 V 0.3 0.2 Vcc 0.2 Vcc 0.15 Vcc 0.3 0.1 Vcc V fc Conditions 4 to 10 MHz Min 1.8 Typ. (Note) Max 2.6 Unit V Supply Voltage AVcc DVcc AVss DVss P00 to P17 (AD0 to AD15) Low-level input voltage High-level input voltage P20 to P37 RESET , NMI , P40 to PA7 AM0 to AM1 X1 P00 to P17 (AD0 to AD15) P20 to P37 RESET , NMI , P40 to PA7 AM0 to AM1 X1 0.9 Vcc 0.15 Vcc V Low-level output voltage High-level output voltage 200 A VCC Note: Vcc 2.0 V, Ta 25C, unless otherwise noted. 91FY28-47 2004-02-12 Under development TMP91FY28 4.2 DC Electrical Characteristics (2/2) Parameter Input leakage current Output leakage current Symbol ILI ILO 0.0 0.2 Conditions VIN VIN Vcc Vcc 0.2 Min Typ. (Note 1) 0.02 0.05 Max 5 10 2.6 1000 600 10 Unit A Power-down voltage (while RAM is being backed VSTOP up in STOP mode) RESET pull-up resistor V IL2 0.2 Vcc, V IH2 0.8 Vcc VCC VCC fc 1.8 to 2.2 V 2.2 to 2.6 V 1.8 200 100 V RRST CIO VTH k pF V Pin capacitance Schmitt width RESET , NMI , P40 to P43, KWI0 to KWI7, P60 to PA7 Programmable pull-up resistor NORMAL (Note 2) IDLE2 IDLE1 STOP 1 MHz 1.8 to 2.6 V 1.8 to 2.2 V 2.2 to 2.6 V 1.8 to 2.6 V 2.0 V) 0.3 200 100 10.0 0.8 0.4 5 0.8 VCC VCC VCC VCC RKH 1000 600 35.0 1.8 1.0 15 k Icc fc 10 MHz (Typ.value Vcc VCC 1.8 to 2.6 V mA A Note 1: Vcc 2.0 V, Ta 25C, unless otherwise noted. Note 2: Test conditions for NORMAL Icc: All blocks operating, output pins open, and input pin levels fixed. 91FY28-48 2004-02-12 Under development TMP91FY28 4.3 AC Electrical Characteristics (1) VCC 1.8 to 2.6 V Equation Parameter fFPH cycle period (x) A0 to A15 valid to ALE low A0 to A15 hold after ALE low ALE pulse width high ALE low to RD or WR asserted RD negated to ALE high WR negated to ALE high No. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 Symbol Min tFPH tAL tLA tLL tLC tCLR tCLW tACL tACH tCAR tCAW tADL tADH tRD tRR tHR tRAE tWW tDW tWD tAWH tAWL tCW tAPH tAPH2 tAP 3.5x 3.5x 170 2.0x 0 3.5x 170 (1 + N) WAIT mode (1 + N) WAIT mode fFPH Min 100 22 15 60 22 30 80 25 80 20 70 10 MHz Max Unit ns ns ns ns ns ns ns ns ns ns ns Max 250 100 0.5x 0.5x x 0.5x 0.5x x x 1.5x 0.5x x 28 35 40 28 20 20 75 70 30 30 A0 to A15 valid to RD or WR asserted A0 to A23 valid to RD or WR asserted A0 to A23 hold after RD negated A0 to A23 hold after WR negated A0 to A15 valid to D0 to D15 data in A0 to A23 valid to D0 to D15 data in RD asserted to D0 to D15 data in RD width low 3.0x 3.5x 2.0x 2.0x 0 x 1.5x 1.5x x 30 30 70 50 3.5x 3.0x 30 76 82 60 170 0 70 120 80 50 120 100 200 224 268 140 ns ns ns ns ns ns ns ns ns D0 to D15 hold after RD negated RD negated to next A0 to A15 output WR width low D0 to D15 valid to WR negated D0 to D15 hold after WR negated A0 to A23 valid to WAIT input A0 to A15 valid to WAIT input A0 to A23 valid to port input A0 to A23 valid to port hold A0 to A23 valid to port valid 230 200 180 350 520 ns ns ns ns ns ns WAIT hold after RD or WR asserted AC Measurement Conditions Output levels: High 0.7 V Vcc/Low 0.3 Vcc, CL Input levels: High 0.9 V Vcc/Low 0.1 Vcc 50 pF Note: In the table above, the letter x represents the fFPH period, which varies, depending on the programming of the clock gear function. The cycle period of fFPH is half that of the CPU system clock, fSYS. 91FY28-49 2004-02-12 Under development (2) Read operation timings tFPH fFPH TMP91FY28 A0 to A23 CS0 to CS3 R/W tAWH tAWL tCW WAIT tAPH Port input (Note) tAPH2 tADH RD tCAR tRR tRAE tHR D0 to D15 tACH tACL tLC RD ADL AD0 to AD15 A0 to A15 tAL tLA tCLR ALE tLL Note: Since the CPU accesses the internal area to read data from a port, the control signals of external pins such as RD and CS are not enabled. Therefore, the above waveform diagram should be regarded as depicting internal operation. Please also note that the timing and AC characteristics of port input/output shown above are typical representation. For details, contact your local Toshiba sales representative. 91FY28-50 2004-02-12 Under development (3) Write operation timings TMP91FY28 fFPH A0 to A23 CS0 to CS3 R/W WAIT tAP Port output (Note) tCAW WR , HWR tWW tDW tWD AD0 to AD15 A0 to A15 D0 to D15 tCLW ALE Note: Since the CPU accesses the internal area to write data to a port, the control signals of external pins such as WR and CS are not enabled. Therefore, the above waveform diagram should be regarded as depicting internal operation. Please also note that the timing and AC characteristics of port input/output shown above are typical representation. For details, contact your local Toshiba sales representative. 91FY28-51 2004-02-12 Under development TMP91FY28 4.4 ADC Electrical Characteristics AVcc Parameter Symbol VREFH VREFL VAIN 1 0 IREF (VREFL IREF (VREFH VSS) VCC) VCC VCC VCC 1.8 to 2.6 V 1.8 to 2.6 V 1.8 to 2.6 V Vcc, AVss Max Vcc Vss VREFH Vss Unit V Conditions VCC VCC 1.8 to 2.6 V 1.8 to 2.6 V Min Vcc Vss VREFL Typ. Vcc Vss Analog reference voltage ( ) Analog reference voltage ( ) Analog input voltage Analog supply current ADMOD1.VREFON ADMOD1.VREFON 0.65 0.02 1.0 1.0 5.0 4.0 mA A LSB Total error (Not including quantization error) Note 1: 1 LSB (VREFH VREFL)/1024 (V) Note 2: Minimum operating frequency Guaranteed when the frequency of the clock selected with the clock gear is 4 MHz or higher with fc used. Note 3: The supply current flowing through the AVCC pin is included in the digital supply current parameter (ICC). 4.5 SIO Timing (I/O interface mode) Note: In the tables below, the letter x represents the fFPH period, which varies, depending on the programming of the clock gear function. The cycle period of fFPH is half that of the CPU system clock, fSYS. (1) SCLK input mode Parameter SCLK period TXD data to SCLK rise or fall* Symbol tSCY tOSS tSCY/2 (VCC tSCY/2 3x 0 Equation Min 16x 4x 2V 180 10%) 2x 0 10 tSCY 0 10 MHz (Note) Max Min Max 1.6 220 1000 310 1600 0 Unit s ns ns ns ns ns TXD data hold after SCLK rise or fall* tOHS RXD data valid to SCLK rise or fall* tHSR RXD data valid after SCLK rise or fall* tSRD RXD data hold after SCLK rise or fall* tRDS * SCLK rise or fall: Measured relative to the programmed active edge of SCLK. Note: tSCY 16x 91FY28-52 2004-02-12 Under development (2) SCLK output mode Parameter SCLK period TXD data to SCLK rise or fall* TXD data hold after SCLK rise or fall* RXD data valid to SCLK rise or fall* RXD data valid to SCLK rise or fall* TMP91FY28 Symbol tSCY tOSS tOHS tHSR tSRD Equation Min 16x tSCY/2 tSCY/2 0 tSCY 1X 180 1X 180 40 40 10 MHz Min Max 1.6 760 760 0 1320 280 819 Max 8192X Unit s ns ns ns ns ns RXD data hold after SCLK rise or fall* tRDS * SCLK rise or fall: Measured relative to the programmed active edge of SCLK. tSCY SCLK SCK output mode/ active-high SCL input mode SCLK (Active-low SCK input mode) Transmit data (TXD) Receive data (RXD) tOSS 0 tOHS 1 tSRD 0 tRDS 1 Valid tHSR 2 Valid 3 Valid 2 3 Valid 4.6 Event Counters (TA0IN, TB0IN0, TB0IN1, TB1IN0, TB1IN1) Equation Min 8x 4x 4x 100 40 40 Parameter Clock cycle period Clock low pulse width Clock high pulse width Symbol tVCK tVCKL tVCKH 10 MHz Min Max 900 440 440 Unit ns ns ns Max Note: In the table above, the letter x represents the fFPH period, which varies, depending on the programming of the clock gear function. The cycle period of fFPH is half that of the CPU system clock, fSYS. 91FY28-53 2004-02-12 Under development TMP91FY28 4.7 Interrupts and Timer Capture Note: In the tables below, the letter x represents the fFPH period, which varies, depending on the programming of the clock gear function. The cycle period of fFPH is half that of the CPU system clock, fSYS. (1) NMI and INT0 to INT4 interrupts Parameter Low pulse width for NMI and INT0 to INT4 High pulse width for INT0 to INT4 Symbol tINTAL tINTAH Equation Min 4X 4X 40 40 10 MHz Min 440 440 Unit ns ns Max Max (2) INT5 to INT8 interrupts and capture The input pulse widths for INT5 to INT8 vary with the selected system clock and prescaler clock. The following table shows the pulse widths for different operating clocks: Selected Prescaler Clock 00 (fFPH) 10 (fc/16) tINTBL (INT5 to INT8 low pulse width) Equation Min 8X 128Xc 100 0.1 tINTBL (INT5 to INT8 high pulse width) Equation Min 8X 128Xc 100 0.1 Unit fFPH 10 MHz Min 900 12.9 ns s fFPH 10 MHz Min 900 12.9 Note: Xc indicates the period of the high-speed oscillator clock (fc). 4.8 SCOUT Pin Parameter Clock high pulse width Clock low pulse width Symbol tSCH tSCL Equation Min 0.5T 0.5T 25 25 10 MHz Min 25 25 Max Max Conditions VCC VCC 1.8 to 2.6 V 1.8 to 2.6 V Unit ns ns Note: In the table above, the letter T represents the cycle period of the SCOUT output clock. Measurement condition Outpute Levels: High 0.7 Vcc/Low 0.3 Vcc, CL tSCH tSCL SCOUT 10 pF 91FY28-54 2004-02-12 Under development TMP91FY28 4.9 Bus Request/Bus Acknowledge BUSRQ BUSAK (Note 1) tCBAL tBAA AD0 to AD15 A0 to A23, RD , WR tABA (Note 2) (Note 2) CS0 to CS3 , R / W , HWR ALE Parameter Bus float to BUSAK asserted Bus float after BUSAK negated Symbol tABA tBAA Equation Min 0 0 fFPH Min 0 0 10 MHz Max 300 300 Conditions VCC VCC 1.8 to 2.6 V 1.8 to 2.6 V Unit ns ns Max 300 300 Note 1: If the current bus cycle has not terminated due to wait-state insertion, the TMP91FY28 does not respond to BUSRQ until the wait state ends. Note 2: This broken lines indicate that output buffers are disabled, not that the signals are at indeterminate states. The pin holds the last logic value present at that pin before the bus is relinquished. This is dynamically accomplished through external load capacitances. The equipment manufacturer may maintain the bus at a predefined state by means of off-chip resistors, but he or she should design, considering the time (Determined by the CR constant) it takes for a signal to reach a desired state. The on-chip, integrated programmable pull-up/pull-down resistors remain active, depending on internal signal states. 91FY28-55 2004-02-12 Under development TMP91FY28 4.10 Recommended Oscillator Circuit The TMP91FY28 is evaluated by the following resonator manufacturer. The results of evaluation are shown below. Note: The additional capacitance of the resonator connecting pins are the SUM of load capacitance C1, C2 and the stray capacitance on the target board. Even when recommended constants for C1 and C2 are used, actual load capacitance may vary with the board, possibly resulting in the malfunction of the oscillator. The board should be designed so that the patterns around the oscillator are as short as possible. Toshiba recommends that the resonator be finally evaluated after it is mounted on the target board. (1) Sample crystal circuit X1 X2 Rd C1 C2 Figure 4.10.1 High-Frequency Oscillator Connection Diagram (2) Recommended ceramic resonators for the TMP91FY28, manufactured by Murata Manufacturing Co., Ltd. Ta 20 to 70 C Oscillating Component Frequency [MHz] 4.0 High-speed oscillator 8.0 10.0 Recommended Resonator CSTCR4M00G55-R0 CSTLS4M00G56-B0 CSTCE8M00G52-R0 CSTLS8M00G53-B0 CSTCE10M0G52-R0 CSTLS10M0G53-B0 Recommended Constants VCC [V] Remarks C1 [pF] (39) (47) (10) (15) (10) (15) C2 [pF] (39) (47) (10) (15) (10) (15) Rd [k ] 0 1.8 to 2.6 The C1 and C2 constants are enclosed in parentheses for resonator models having built-in capacitors. The product numbers and specifications of the resonators by Murata Manufacturing Co., Ltd. are subject to change. For up-to-date information, please refer to the following URL: http://www.murata.co.jp/search/index.html 91FY28-56 2004-02-12 Under development TMP91FY28 5. Package Dimensions P-LQFP100-1414-0.50F Unit: mm 91FY28-57 2004-02-12 Under development TMP91FY28 91FY28-58 2004-02-12 |
Price & Availability of TMP91FY28
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |