View TMP91FW40FG_7312398.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

toshiba original cmos 16-bit microcontroller tlcs-900/l1 series TMP91FW40FG semiconductor company
preface thank you very much for making us e of toshiba microcomputer lsis. before use this lsi, refer the section, ?points of note and restrictions?. especially, take care below cautions.
tmp91fw40 2008-10-22 91fw40-1 low voltage/low power consumption cmos 16-bit microcontroller TMP91FW40FG 1. outline and features the tmp91fw40 is a high-speed, high-performance 16-bit microcontroller capable of low-voltage, low-power-consumption operation. this microcontroller comes in a 100-pin flat package and has the following features: (1) toshiba proprietary 16-bit cpu (900/l1 cpu) ? instruction mnemonics are upwardly compatible with the tlcs-90 and tlcs-900. ? 16-mbyte linear address space ? architecture based on general-purp ose registers and register banks ? 16-bit multiply/divide instructions and bit transfer/arithmetic instructions ? micro dma: 4 channels (593 ns/2 bytes at 27 mhz) (2) minimum instruction execution time: 148 ns (at 27 mhz) restrictions on product use 20070701-en general ? the information contained herein is subject to change without notice. ? toshiba is continually working to improve the quality and reliability of its products. nevertheless, semiconductor devices in general can malfunction or fail due to their inherent electrical sensitivity a nd vulnerability to physical stress. it is the responsibility of t he buyer, when utilizing toshiba products, to comply with the standards of safety in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such toshiba products could cause loss of human life, bodily injury or damage to property. in developing your designs, please ensure that toshiba products are used within specified operating ranges as set forth in the most recent toshib a products specifications. also, please keep in mind the precautions and conditions set forth in the ?handling guide for semiconduct or devices,? or ?toshiba semiconductor reliability handbook? etc. ? the toshiba products listed in this document are intend ed for usage in general electronics applications (computer, personal equipment, office equipment, measuring equipmen t, industrial robotics, domestic appliances, etc.).these toshiba products are neither intended nor warranted for us age in equipment that requires extraordinarily high quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury (?unintended usage?). unintended usage include atomic energy control instruments, airplane or spaceship instruments, transportation instrument s, traffic signal instruments, combus tion control instruments, medical instruments, all types of safety devices, etc.. uninte nded usage of toshiba products listed in his document shall be made at the customer?s own risk. ? the products described in this document shall not be used or embedded to any downstream products of which manufacture, use and/or sale are prohibited under any applicable laws and regulations. ? the information contained herein is presented only as a gui de for the applications of our products. no responsibility is assumed by toshiba for any infringements of patents or other rights of the third partie s which may result from its use. no license is granted by implicat ion or otherwise under any patents or other rights of toshiba or the third parties. ? please contact your sales representative for product- by-product details in this document regarding rohs compatibility. please use these products in this document in compliance with all applicable laws and regulations that regulate the inclusion or use of cont rolled substances. toshiba assumes no liability for damage or losses occurring as a result of noncompliance with applicable laws and regulations. this product uses the super flash? technology u nder the license of silicon storage technology,inc. super flash? is a registered tradem ark of silicon storage technology,inc.
tmp91fw40 2008-10-22 91fw40-2 (3) internal ram: 4 kbytes (4) internal rom: 128 kbytes flash memory 4 kbytes mask rom (used for booting) (5) 8-bit timer: 4 channels (6) 16-bit timer: 3 channels (7) divider output (8) general-purpose serial interface: 4 channels x both uart and synchronous transfer modes are supported. (9) 10-bit ad converter (with sample-and-hold): 4 channels (10) watchdog timer (11) key-on wakeup: 4 channels (12) real-time clock (rtc) x based on the tc8521a specifications (13) melody/alarm generator (mld) (14) program patch logic: 6 banks (15) lcd driver/controller (voltage reducer type, reference voltage = vcc) x lcd direct drive possible (8 to 40 segments x 4 commons) x 1/4 duty, 1/3 duty, 1/2 duty or static drive selectable (16) interrupts: 43 sources x 9 cpu interrupts: triggered by a software interrupt instruction or undefined instruction x 27 internal interrupts: 7 priority levels x 7 external interrupts: 7 priority levels (two interrupts support selection of triggering edge.) (17) input/output ports: 61 pins (18) standby function three halt modes (programmable idle2, idle1, stop) (19) clock control function x low-frequency clock (fs 32.768 khz) (20) operating voltage range x vcc 2.7 to 3.6 v (fc max 27 mhz at flash memory read) x vcc 2.2 to 3.6 v (fc max 16 mhz at flash memory read) x vcc 2.7 to 3 .6 v (fc max 27 mhz at flash memory erase and program) (21) package: lqfp100-p-1414-0.50f
tmp91fw40 2008-10-22 91fw40-3 figure 1.1 tmp91fw40 block diagram x1 x2 power supply pins high-frequency oscillator connecting pins input/output ports (segment outputs) dvdd dvss address/data bus system controller standby controller high- frequency low- frequency clock generator tlcs-900/l1 cpu ram 4 kb rom 128 kb interrupt controller ad converter power supply analog reference power supply input/output ports avcc,avss vrefh,vrefl p50(an0/kwi0) p51(an1/kwi1) p52(an2/kwi2) p53(an3/ adtrg /kwi3) seg7 to seg0 p6 10-bit ad converter p5 p8 asynchronous/ synchronous serial interface sio0 address/data bus common outputs com3 to com0 lcd driver (automatic display) p0 p07 (seg31) to p00 (seg24) pb pb7 (seg39) to pb0 ( seg32 ) lcd power supply circuit lcd driver power supply c0 c1 v1 v2 v3 reset pin reset test pins am1, am0 emu1, emu0 tc5 8-bit timer/counter tc6 tc7 tc8 tc1 16-bit timer/counter watchdog timer p80(tc5out) p81(tc6out) p82(tc7out) p83(tc8out) p60(int0) p61(int1) p62( alarm / boot ) xt1 xt2 low-frequency oscillator connecting pins p2 p27 (seg15) to p20 ( seg8 ) p1 p17 (seg23) to p10 (seg16) tc2 tc3 p7 p70(ecnt1) p71(ecnt2) p72(ecnt3/ dvo / mldalm ) p73(ecin1) p74(ecin2) p75(ecin3) sio1 sio2 sio3 p9 p90(txd0) p91(rxd0) p92(sclk0/ 0cts ) p93(txd1) p94(rxd1) p95(sclk1/ 1cts ) rtc pa pa0(txd2) pa1(rxd2) pa2(sclk2/ 2cts ) pa3(txd3) pa4(rxd3) pa5(sclk3/ 3cts ) input ports nmi mld
tmp91fw40 2008-10-22 91fw40-4 2. pin assignments and pin functions 2.1 pin assignments figure 2.1.1 shows the pin assignments of the tmp91fw40. p82 /tc7out TMP91FW40FG lqfp100 to p vi e w 1 5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 95 100 p83/t c8out dvcc boot /p62/ al arm p9 0/txd 0 p9 1/rxd0 p92 /scl k0/ ct s0 p93 /txd1 p94 /rxd1 p95 /scl k1/ cts1 dvss pa0/txd2 pa1/rxd2 pa2/sc lk2/ cts2 pa3/txd3 pa4/rxd3 pa5/sc lk3/ cts3 nmi p60/int0 p61/int1 p70 /ecn t1 p72/ec nt3/ dvo / mldalm dvcc seg6 seg7 dvcc dvss p20 /seg8 p21 /seg9 p22 /seg1 0 p23 /seg11 p24 /seg1 2 p25 /seg1 3 p26 /seg1 4 p27 /seg1 5 p11/seg17 p12 /seg1 8 p13 /seg1 9 p14 /seg2 0 p 15/seg21 p16 /seg2 2 p17 /seg2 3 p00 /seg2 4 p01 /seg2 5 p02 /seg2 6 p03 /seg2 7 p04 /seg2 8 p05 /seg2 9 p0 6/seg3 0 p07/seg31 dvc c dvss pb0/seg32 pb1/seg33 pb2/seg34 pb3/seg35 pb4/ seg36 pb5/seg3 7 pb6/seg38 pb7/seg39 p75/ecin 3 p74 /ecni 2 p73/ecin1 emu 1 emu 0 xt2 xt1 am1 x1 dvss x2 vrefl v3 a vss p52/an2/kwi2 p51 /an1 /kwi1 p50/an 0/kwi0 p80/tc 5ou t v2 v1 c0 com0 com1 com2 com3 seg0 seg1 seg2 seg3 seg4 p8 1/tc6out am 0 seg5 a vcc p71 /ecn t2 reset p10 /seg1 6 c1 p53 /an3 /adtrg/kwi3 vrefh figure 2.1.1 tmp91fw40 pin assign ments (100-pin lqfp, top view)
tmp91fw40 2008-10-22 91fw40-5 2.2 pin names and functions table 2.2.1 to table 2.2.2 list the names and functions of the input and output pins of the tmp91fw40. t able 2.2.1 pin names and functions (1/2) pin name number of pins i/o function p50 to p53 an0 to an3 adtrg kwi0 to kwi3 4 input input input input port 5: input port analog input: input to the ad converter ad trigger: external start request pin for the ad converter (multiplexed with p53) key-on wakeup input (multiplexed with p50 to p53) p60 int0 1 input input port 60: input port interrupt request pin 0: programmable as high-level, low-level, rising-edge or falling-edge sensitive p61 int1 1 i/o input port 61: input/output port interrupt request pin 1: programmable as high-level, low-level, rising-edge or falling-edge sensitive p62 alarm boot 1 i/o output input port 62: input/output port rtc alarm output pin boot mode control pin for flash memory (specifically designed for 91fw40; to be pulled up during the reset period) when released reset, single boot mode is started at low level. p70 ecnt1 1 i/o input port 70: input/output port 16-bit timer 1 input: count control input for 16-bit timer tc1 p71 ecnt2 1 i/o input port 71: input/output port 16-bit timer 2 input: count control input for 16-bit timer tc2 p72 ecnt3 dvo mldalm 1 i/o input output output port 72: input/output port 16-bit timer 3 input: count cont rol input for 16-bit timer tc3 divider output pint melody/alarm output pin p73 ecin1 1 i/o input port 73: input/output port 16-bit timer 1 input: count input for 16-bit timer tc1 p74 ecin2 1 i/o input port 74: input/output port 16-bit timer 2 input: count input for 16-bit timer tc2 p75 ecin3 1 i/o input port 75: input/output port 16-bit timer 3 input: count input for 16-bit timer tc3 p80 tc5out 1 i/o output port 80: input/output port (large-current port) 8-bit timer 5 output: output pin for 8-bit timer tc5 open-drain output mode by programmable p81 tc6out 1 i/o output port 81: input/output port (large-current port) 8-bit timer 6 output: output pin for 8-bit timer tc6 open-drain output mode by programmable p82 tc7out 1 i/o output port 82: input/output port (large-current port) 8-bit timer 7 output: output pin for 8-bit timer tc7 open-drain output mode by programmable p83 tc8out 1 i/o output port 83: input/output port (large-current port) 8-bit timer 8 output: output pin for 8-bit timer tc8 open-drain output mode by programmable p90 txd0 1 i/o output port 90: input/output port serial 0 transmit data open-drain output mode by programmable p91 rxd0 1 i/o input port 91: input/output port serial 0 receive data p92 sclk0 0cts 1 i/o i/o input port 92: input/output port serial 0 clock input/output serial 0 data transmit enable (clear to send)
tmp91fw40 2008-10-22 91fw40-6 table 2.2.2 pin names and functions (2/2) pin name number of pins i/o function p93 txd1 1 i/o output port 93: input/output port serial 1 transmit data open-drain output mode by programmable p94 rxd1 1 i/o input port 94: input/output port serial 1 receive data p95 sclk1 1cts 1 i/o i/o input port 95: input/output port serial 1 clock input/output serial 1 data transmit enable (clear to send) pa0 txd2 1 i/o output port a0: input/output port serial 2 transmit data open-drain output mode by programmable pa1 rxd2 1 i/o input port a1: input/output port serial 2 receive data pa2 sclk2 2 cts 1 i/o i/o input port a2: input/output port serial 2 clock input/output serial 2 data transmit enable (clear to send) pa3 txd3 1 i/o output port 3: input/output port serial 3 transmit data open-drain output mode by programmable pa4 rxd3 1 i/o input port a4: input/output port serial 3 receive data pa5 sclk3 3cts 1 i/o i/o input port a5: input/output port serial 3 clock input/output serial 3 data transmit enable (clear to send) seg0 to seg7 8 output segment output p20 to p27 seg8 to seg15 8 i/o output port 2: input/output port segment output p10 to p17 seg16 to seg23 8 i/o output port 1: input/output port segment output p00 to p07 seg24 to seg31 8 i/o output port 0: input/output port segment output pb0 to pb7 seg32 to seg39 8 i/o output port b: input/output port segment output c0,c1 2 lcd drive power supply v1 to v3 3 lcd drive power supply com0 to com3 4 common output nmi 1 input nonmaskable interrupt request pin: causes an nmi interrupt on the falling edge; programmable to be rising-edge s ensitive (schmitt input). am0, am1 2 input operation mode both am0 and am1 should be held at logic 1. emu0 1 output this pin should be left open. emu1 1 output this pin should be left open. reset 1 input reset: initializes the tmp91fw40. (schmitt input, with pull-up resistor) vrefh 1 input input pin for high reference voltage for the ad converter vrefl 1 input input pin for low reference voltage for the ad converter avcc 1 power supply pin for the ad converter avss 1 ground pin for the ad converter (0 v) x1/x2 2 i/o connection pins fo r a high-frequency oscillator xt1/xt2 2 i/o connection pins for a low-frequency oscillator dvcc dvss 4 4 power supply pins (the dvcc pins should be connected to power supply.) ground pins (the dvss pins shoul d be connected to ground (0 v).)
tmp91fw40 2008-10-22 91fw40-7 3. operation this section describes the functions an d basic operation of the tmp91fw40. for the functions of this device that are not de scribed here, refer to the tmp91cw40 data sheet. 3.1 cpu the tmp91fw40 contains a high-performance 16-bit cpu (900/l1 pcu). for a detailed description of the cpu, refer to ?tlcs- 900/l1 cpu? in the preceding chapter. functions unique to the tmp91fw40 not covered in ?tlcs-900/l1 cpu? are described below. 3.1.1 reset operation to reset the tmp91fw40, ensure that the power supply voltage is within the operating voltage range, and that the internal high-frequency oscillator has stabilized. then, set the reset input to low level for at least 10 system clocks (1s at 27 mhz). after turning on the power to the tmp91fw40, hold the reset input at low level for at least 10 system clocks with the power supply voltage within the operating voltage range and the internal high-frequency oscillator oscillating stably. reset operation initializes the system clock f sys to fc/2. the cpu performs the following operations as a result of a reset: ? sets the program counter (pc) according to the reset vector stored at addresses ffff00h to ffff02h. pc < 7:0 > value at address ffff00h pc < 15:8 > value at address ffff01h pc < 23:16 > value at address ffff02h ? sets the stack pointer (xsp) to 100h. ? sets the bits of the status register (sr) to 111 (setting the interrupt level mask register to level 7). ? sets the bit of the status register (sr) to 1 (selecting maximum mode). ? clears the bits of the status regi ster (sr) to 000 (selecting register bank 0). after the reset state is released, the cpu starts executing instructions according to the pc. cpu internal registers other than the above are not changed. the internal i/o peripherals, ports and other pins are initialized as follows upon a reset: ? all internal i/o registers are initialized. ? all port pins, including those multiplexed with internal i/o functions, are configured either as general-purpose inputs or general-purpose outputs. note: reset operation does not affect the contents of the internal ram or the cpu registers other than pc, sr and xsp. 0 figure 3.1.1 shows reset timings of the tmp91fw40.
tmp91fw40 2008-10-22 91fw40-8 f fph sampling indicates high-impedance state. sampling (input mode) rese t p62 p70 to p75 p80 to p83 p90 to p95, pa0 to pa5 pb0 to pb7(seg32 to seg39) p00 to p07(seg24 to seg31) p10 to p17(seg16 to seg23) p20 to p27(seg8 to seg15) seg0 to seg7 (input mode) com0 to com3 (output mode) (input mode) p62 tmp91fw40 only, (pull-up) figure 3.1.1 tmp91fw40 reset timings
tmp91fw40 2008-10-22 91fw40-9 3.1.2 outline of operation modes there are single-chip and single-boot modes. which mode is selected depends on the device?s pin state after a reset. single-chip mode: the device normally operations in this mode. after a reset, the device starts executing the internal memory program. single-boot mode: this mode is used to rewrite t he internal flash memory by serial transfer (uart). after a reset, internal boot program starts up, executing an on-board rewrite program. table 3.1.1 operation mode setup table mode setup input pin operation mode reset boot (p62) am0 am1 single-chip mode h single-boot mode l h h
tmp91fw40 2008-10-22 91fw40-10 3.2 memory map 1 figure 3.2.1 shows a memory map of the tmp9 1fw40 in single-chip mode and its memory areas that can be accessed in each addressing mode of the cpu. figure 3.2.1 memory map 000000h 001000h 16-mbyte area (r) ( ? r) (r + ) (r + r 8/16) (r + d8/16) (nnn) direct area ( n ) 64-kbyte area (n n) 128 kbytes internal rom internal i/o (4 kbytes) internal ram (4 kbytes) 002000h 010000h fe0000h ( = internal area) ffff00h ffffffh vector table ( 256 b y tes ) external memory (access prohibited) 000100h
tmp91fw40 2008-10-22 91fw40-11 3.3 flash memory the tmp91fw40 incorporates flash memory that can be electrically erased and programmed using a single 3v power supply. the flash memory is programmed and erased using jedec-standard commands. after a program or erase command is input, the corres ponding operation is automatically performed internally. erase operations can be performed by th e entire chip (chip erase) or on a sector basis (sector erase). the configuration and operations of the flash memory are described below. 3.3.1 features ? power supply voltage for program/erase operations vcc = 2.7 v to 3.6 v (-10 c to 40 c) ? configuration 64 k 16 bits (128 kbytes) ? functions single-word programming chip erase sector erase data polling/toggle bit ? sector size 4 kbytes 32 ? mode control jedec-standard commands ? programming method on-board programming parallel programmer ? security write protection read protection 3.3.2 block diagram figure 3.3.1 block diagram of flash memory unit internal address bus rom controller mode control mode setting pins control data flash memory column decoder/sense amp data latch address latch erase sector decoder control circuit (including automatic sequence control circuit) command register internal data bus internal control bus flash memory cells 128 kb row decoder a ddress
tmp91fw40 2008-10-22 91fw40-12 3.3.3 operation modes 3.3.3.1 overview the following three types of operation modes are available to control program/erase operations on the flash memory. table 3.3.1 description of operation modes operation mode name description single chip mode after reset release, the device starts up from the internal flash memory. single chip mode is further divided into two modes: ?normal mode? is a mode in which user application programs are executed, and ?user boot mode? is used to program the flash memory on-board. the means of switching between these two modes can be set by the user as desired. for example, it can be set so that port 00 = ?1? selects normal mode and port 00 = ?0? selects user boot mode. the user must include a routine to handle mode switching in a user application program. normal mode in this mode, the device star ts up from a user application program. user boot mode in this mode, the flash memo ry can be programmed by a user-specified method. single boot mode after reset release, the device starts up from the internal boot rom (mask rom). the boot rom includes an algorithm which allows a program for programming/erasing the flash memory on-board via a serial port to be transferred to the device?s internal ram. the transferred program is then executed in the internal ram so that the flash memory ca n be programmed/erased by receiving data from an external host and issuing program/erase commands. programmer mode this mode enables the internal flash memory to be programmed/erased using a general-purpose programmer. for programmers that can be used, please contact your local toshiba sales representative. of the modes listed in table 3.3.1, the internal flash memory can be programmed in user bo ot mode, single boot mode and programmer mode. the mode in which the flash memory can be programmed/erased while mounted on the user board is defined as the on-board programming mode. of the modes listed above, single boot mode and user boot mode are classified as on-board programming modes. single boot mode supports toshiba?s proprietar y programming/erase method using serial i/o. user boot mode (within single chip mode) allows the flash memory to be programmed/erased by a user-specified method. programmer mode is provided with a read protect function which prohibits reading of rom data. by enabling the read protect function upon completion of programming, the user can protect rom data from being read by third parties.
tmp91fw40 2008-10-22 91fw40-13 the operation mode ? single chip mode, single boot mode or programmer mode ? is determined during reset by externally setting the input levels on the am0, am1 and boot (p62) pins. except in programmer mode which is entered with reset held at ?0?, the cpu will start operating in the selected mode after the reset state is released. once the operation mode has been set, make sure that the input levels on the mode setting pins are not changed during operation. table 3.3.2 shows how to set each operation mode, and figure 3.3.2 shows a mod e transition diagram. table 3.3.2 operation mode pin settings input pins operation mode reset boot (p62) am1 am0 (1) single chip mode (normal or user boot mode) 1 1 1 (2) single boot mode 0 1 1 (3) programmer mode 0 D 1 0 figure 3.3.2 mode transition diagram 3.3.3.2 reset operation to reset the device, hold the reset input at ?0? for at least 10 system clocks while the power supply voltage is within the rate d operating voltage range and the internal high-frequency oscillator is oscillating stably. programmer mode on-board programming mode reset = 0 reset = 0 (2) (3) (1) switching method to be set by user single chip mode reset state (1) or (2) reset = 0 normal mode user boot mode single boot mode numbers in ( ) correspond to the operation mode pin settings shown in table 3.3.2.
tmp91fw40 2008-10-22 91fw40-14 3.3.3.3 memory map for each operation mode in this product, the memory map varies with operation mode. the memory map and sector address ranges for each operation mode are shown below. single chip mode single boot mode programmer mode figure 3.3.3 tmp91fw40 memory map for each operation mode 000000h 020000h ffffffh internal flash rom 128kb reserved 000000h 001000h 002000h fe0000h ffff00h ffffffh internal i/o internal ram 4kb external memory (access prohibited) internal flash rom 128kb (interrupt vector 256b) fff000h 000000h 001000h 010000h 030000h ffff00h ffffffh 002000h ( s ) i flash rom internal i/o internal ram 4kb external memory (access prohibited) external memory (access prohibited) internal boot rom 4kb internal flash rom 128kb (interrupt vector 256b)
tmp91fw40 2008-10-22 91fw40-15 table 3.3.3 sector address ranges for each operation mode single chip mode single boot mode sector-0 fe0000h to fe0fffh 10000h to 10fffh sector-1 fe1000h to fe1fffh 11000h to 11fffh sector-2 fe2000h to fe2fffh 12000h to 12fffh sector-3 fe3000h to fe3fffh 13000h to 13fffh sector-4 fe4000h to fe4fffh 14000h to 14fffh sector-5 fe5000h to fe5fffh 15000h to 15fffh sector-6 fe6000h to fe6fffh 16000h to 16fffh sector-7 fe7000h to fe7fffh 17000h to 17fffh sector-8 fe8000h to fe8fffh 18000h to 18fffh sector-9 fe9000h to fe9fffh 19000h to 19fffh sector-10 fea000h to feafffh 1a000h to 1afffh sector-11 feb000h to febfffh 1b000h to 1bfffh sector-12 fec000h to fecfffh 1c000h to 1cfffh sector-13 fed000h to fedfffh 1d000h to 1dfffh sector-14 fee000h to feefffh 1e000h to 1efffh sector-15 fef000h to feffffh 1f000h to 1ffffh sector-16 ff0000h to ff0fffh 20000h to 20fffh sector-17 ff1000h to ff1fffh 21000h to 21fffh sector-18 ff2000h to ff2fffh 22000h to 22fffh sector-19 ff3000h to ff3fffh 23000h to 23fffh sector-20 ff4000h to ff4fffh 24000h to 24fffh sector-21 ff5000h to ff5fffh 25000h to 25fffh sector-22 ff6000h to ff6fffh 26000h to 26fffh sector-23 ff7000h to ff7fffh 27000h to 27fffh sector-24 ff8000h to ff8fffh 28000h to 28fffh sector-25 ff9000h to ff9fffh 29000h to 29fffh sector-26 ffa000h to ffafffh 2a000h to 2afffh sector-27 ffb000h to ffbfffh 2b000h to 2bfffh sector-28 ffc000h to ffcfffh 2c000h to 2cfffh sector-29 ffd000h to ffdfffh 2d000h to 2dfffh sector-30 ffe000h to ffefffh 2e000h to 2efffh sector-31 fff000h to ffffffh 2f000h to 2ffffh
tmp91fw40 2008-10-22 91fw40-16 3.3.4 single boot mode in single boot mode, the internal boot rom (mask rom) is activated to transfer a program/erase routine (user-created boot program) from an external source into the internal ram. this program/erase routine is th en used to program/erase the flash memory. in this mode, the internal boot rom is mapped into an area containing the interrupt vector table, in which the boot rom program is executed. the flash memory is mapped into an address space different from the one into which the boot rom is mapped (see figure 3.3.3). t he de vice?s sio (sio1) and the controller are connected to transfer the program/erase routine from the controller to the device?s internal ram. this program/erase routine is then executed to program/erase the flash memory. the program/erase routine is executed by sending commands and write data from the controller. the communications protocol between the device and the controller is described later in this manual. before the program/erase routine can be transferred to the ram, user password verification is performed to ensure the security of user rom data. if the password is not verified correctly, the ram transfer operation cannot be performed. in single boot mode, disable interrupts and use the interrupt request flags to check for an interrupt request. note: in single boot mode, the boot-rom programs are executed in normal mode. do not change to another operation mode in the program/erase routine.
tmp91fw40 2008-10-22 91fw40-17 3.3.4.1 using the program/erase algorithm in the internal boot rom (step-1) environment setup since the program/erase routine and write data are transferred via sio (sio1), connect the device?s sio (sio1) and the controller on the board. the user must prepare the program/erase routine (a) on the controller. (step-2) starting up the internal boot rom release the reset with the relevant input pins set for entering single boot mode. when the internal boot rom starts up, the program/erase routine (a) is transferred from the controller to the internal ram via sio according to the communications procedure for single boot mode. before this can be carried out, the password entered by the user is verified against the password written in the user application program. (if the flash memory has been erased, 12 byte s of ?0xff? are used as the password.) (tmp91fw40) flash memory ram old user application program (or erased state) (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (tmp91fw40) (controller) (i/o) 0 1 reset condition for entering single boot mode new user application program (a) program/erase routine flash memory ram old user application program (or erased state) boot rom sio1
tmp91fw40 2008-10-22 91fw40-18 (step-3) copying the program/erase routine to the ram after password verification is completed, the boot rom copies the program/erase routine (a) from the controller to the ram using serial communications. the program/erase routine must be stored within the ram address range of 001000h to 001dffh. (step-4) executing the program/erase routine in the ram control jumps to the program/erase routine (a) in the ram. if necessary, the old user application program is erased (sector erase or chip erase). note: the boot rom is provided with an erase command, which enables the entire chip to be erased from the controller without using the program/erase routine. if it is necessary to erase data on a sector basis, incorporate the necessary code in the program/erase routine. (tmp91fw40) flash memory ram old user application program (or erased state) (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (a) program/erase routine (tmp91fw40) flash memory ram (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (a) program/erase routine erased
tmp91fw40 2008-10-22 91fw40-19 (step-5) copying the new user application program the program/erase routine (a) loads the new user application program from the controller into the erased area of the flash memory. in the example below, the new user application program is transferred under the same communications conditions as those used for transferring the program/erase routine. however, after the program/erase routine has been transferred, this routine can be used to change the transfer settings (data bus and transfer source). configure the board hardware and program/erase routine as desired. (step-6) executing the new user application program after the programming operation has been completed, turn off the power to the board and remove the cable connecting the device and the controller. then, turn on the power again and start up the device in single chip mode to execute the new user application program. (tmp91fw40) (controller) 0 1 reset condition for entering single chip mode (normal mode) flash memory ram new user application program boot rom sio1 (tmp91fw40) flash memory ram new user application program (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (a) program/erase routine
tmp91fw40 2008-10-22 91fw40-20 3.3.4.2 connection examples for single boot mode in single boot mode the flash memory is programmed by serial transfer. therefore, on-board programming is performed by conn ecting the device?s sio (sio1) and the controller (programming tool) and sending commands from the controller to the device. figure 3.3.4 shows an example of connection between the target board and a programmin g controller . figure 3.3.5 shows an example of connection between the target bo ard and an rs232c board. figure 3.3.4 example of conne ction with an external controller in single boot mode target board dvcc vcc rs232c rom mode control program controller vcc vcc reg. power supply on-board programming controller reset boot mcu mode control target board operation reset (30pin) boot mode switching circuit boot (5pin) ram tmp91fw40 a m0 (24pin) a m1 (29pin) pc vss dvss p92 (8pin) p92 txd1 (9pin rxd1 (10pin) rxd txd p95 p95 (11pin)
tmp91fw40 2008-10-22 91fw40-21 figure 3.3.5 example of connection with an rs232c board in single boot mode target board dvcc vcc rs232c vcc vcc power supply rs232c board reset boot reset (30pin) boot mode switching circuit boot (5pin) tmp91fw40 a m0 (24pin) a m1 (29pin) pc vss dvss txd1 (9pin rxd1 (10pin) rxd txd vss
tmp91fw40 2008-10-22 91fw40-22 3.3.4.3 mode setting to perform on-board programming, the device must be started up in single boot mode by setting the input pins as shown below. ? am0,am1 = 1 ? boot = 0 ? reset = 0 1 set the am0, am1, and boot pins as shown above with the reset pin held at ?0?. then, setting the reset pin to ?1? will start up the device in single boot mode. 3.3.4.4 memory maps figure 3.3.6 shows a comparison of the memory map for normal mode (in single chip mode) and the memory map for single bo ot mode. in single boot mode, the flash memory is mapped to addresses 10000h to 2ffffh (physical addres ses) and the boot rom (mask rom) is mapped to addresses fff000h to ffffffh. figure 3.3.6 comparison of memory maps single chip mode single boot mode 000000h 001000h 002000h fe0000h ffff00h ffffffh fff000h 000000h 001000h 010000h 030000h ffff00h ffffffh 002000h (
m&? ) ]+? flash rom internal i/o internal ram 4kb external memory (access prohibited) internal flash rom 128kb internal i/o internal ram 4kb external memory (access prohibited) external memory (access prohibited) internal boot rom 4kb internal flash rom 128kb (interrupt vector 256b) (interrupt vector 256b)
tmp91fw40 2008-10-22 91fw40-23 3.3.4.5 interface specifications the sio communications format in single boot mode is shown below. the device supports the uart (asynchronous communications) serial operation mode. to perform on-board programming, the same communications form at must also be set on the programming controller?s side. z uart (asynchronous ) communications ? communications channel: sio channel 1 (for the pins to be used, see table 3.3.4.) ? serial trans f er mode : uart (asynchronous communications) mode ? data length : 8 bits ? parity bit : none ? stop bit : 1 bit ? baud rate : see table 3.3.5 and table 3.3.6. t able 3.3.4 pin conne ctions pins uart dvcc { power supply pins dvss { mode setting pins am1,am0, boot { reset pin reset { txd1 { communications pins rxd1 { note: unused pins are in the initial state after reset release. table 3.3.5 baud rate table sio transfer rate (bps) uart 115200 57600 38400 19200 9600
tmp91fw40 2008-10-22 91fw40-24 table 3.3.6 correspondence between operating frequency and baud rate in single boot mode note ? ? ? ? ? ? note 1 note 2 note 2 note 1 115200 baud rate (bps) ? ? ? ? ? ? d d d d note note 2 ? ? ? note 1 note 1 note 1 note 1 note 1 note 1 57600 baud rate (bps) d ? ? ? d d d d d d note note 1 note 1 note 1 note 1 note 1 note 1 note 1 note 1 note 1 note 1 38400 baud rate (bps) d d d d d d d d d d note note 1 note 1 note 1 ? note 1 ? note 1 note 1 ? ? 19200 baud rate (bps) d d d ? d ? d d ? ? note note 1 note 1 ? ? ? ? ? ? ? ? 9600 baud rate (bps) d d ? ? ? ? ? ? ? ? supported range (mhz) 7.848.16 7.8410.02 7.8420.05 7.8427.54 10.84 14.28 10.84 27.54 14.46 15.04 15.68 18.80 19.60 20.40 21.68 27.54 reference baud rate (bps) reference frequency (mhz) 8.0 8.09.8304 8.019.6608 8.027.0 11.0592 14.0 11.0592 27.0 14.7456 16.018.4320 20.0 22.1184 27.0 reference frequency: the frequency of the high-speed oscill ation circuit that can be us ed in single boot mode. to program the flash memory using single boot mode, one of the reference frequencies must be selected as a high-speed clock. supported range: the range of clock frequencies that are detected as each reference frequency. it may not be possible to perfor m single boot operations at clock frequencies outside of the supported range. note 1: to automatically detect the reference frequency (mic rocontroller clock frequency), the transfer baud rate error of the flash memory programming controller and the oscillation frequency error must be within 3% in total. note 2: to automatically detect the reference frequency (mic rocontroller clock frequency), the transfer baud rate error of the flash memory programming controller and the oscillation frequency error must be within 2% in total.
tmp91fw40 2008-10-22 91fw40-25 3.3.4.6 data transfer formats table 3.3.7 to table 3.3.13 show the operation command data and the data transfer format for each operation mode. table 3.3.7 operation command data operation command data operation mode 10h ram transfer 20h flash memory sum 30h product information read 40h flash memory chip erase 60h flash memory protect set
tmp91fw40 2008-10-22 91fw40-26 table 3.3.8 transfer format of single boot program [ram transfer] transfer byte number transfer data from controller to device baud rate transfer data from device to controller boot rom 1st byte baud rate setting uart 86h desired baud rate (note 1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (10h) ? 4th byte ? ack response to operation command (note 2) normal 10h error x1h protection applied (note 4) x6h communications error x8h 5th byte to 16th byte password data (12 bytes) (02fef4h to 02feffh) ? 17th byte checksum value for 5th to 16th bytes ? 18th byte ? ack response to checksum value (note 2) normal 10h error 11h communications error 18h 19th byte ram storage start address 31 to 24 (note 3) ? 20th byte ram storage start address 23 to 16 (note 3) ? 21st byte ram storage start address 15 to 8 (note 3) ? 22nd byte ram storage start address 7 to 0 (note 3) ? 23rd byte ram storage byte count 15 to 8 (note 3) ? 24th byte ram storage byte count 7 to 0 (note 3) ? 25th byte checksum value for 19th to 24th bytes (note 3) ? 26th byte ? ack response to checksum value (note 2) normal 10h error 11h communications error 18h 27th byte to m?th byte ram storage data ? (m + 1)th byte checksum value for 27th to m?th bytes ? (m + 2)th byte ? ack response to checksum value (note 2) normal 10h error 11h communications error 18h ram (m + 3)th byte ? jump to ram storage start address note 1: for the desired baud rate setting, see table 3.3.6. note 2: after sending an error response, the device waits for operation command data (3rd byte). note 3: the data to be transferred in the 19th to 25th bytes should be programmed within the ram address range of 001000h to 001dffh (3.5 kbytes). note 4: when read protection or write protection is applied, the device aborts the received operation command and waits for the next operation command data (3rd byte).
tmp91fw40 2008-10-22 91fw40-27 table 3.3.9 transfer format of single boot program [flash memory sum] transfer byte number transfer data from controller to device baud rate transfer data from device to controller boot rom 1st byte baud rate setting uart 86h desired baud rate (note1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (20h) ? 4th byte ? ack response to operation command (note 2) normal 20h error x1h communications error x8h 5th byte ? sum (upper) 6th byte ? sum (lower) 7th byte ? checksum value for 5th and 6th bytes 8th byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.3.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw40 2008-10-22 91fw40-28 table 3.3.10 transfer format of single boot program [product information read] (1/2) transfer byte number transfer data from controller to device baud rate transfer data from device to controller boot rom 1st byte baud rate setting uart 86h ? 2nd byte ? desired baud rate (note 1) ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (30h) ? 4th byte ? ack response to operation command (note 2) normal 30h error x1h communications error x8h 5th byte ? flash memory data (address 02fef0h) 6th byte ? flash memory data (address 02fef1h) 7th byte ? flash memory data (address 02fef2h) 8th byte ? flash memory data (address 02fef3h) 9th byte to 20th byte ? part number (ascii code, 12 bytes) ?tmp91fw40_ _ _ ? (from 9th byte) 21st byte to 24th byte ? password comparison start address (4 bytes) f4h, feh, 02h, 00h (from 21st byte) 25th byte to 28th byte ? ram start address (4 bytes) 00h, 10h, 00h, 00h (from 25th byte) 29th byte to 32nd byte ? ram (user area) end address (4 bytes) ffh, 1dh, 00h, 00h (from 29th byte) 33rd byte to 36th byte ? ram end address (4 bytes) ffh, 1fh, 00h, 00h (from 33rd byte) 37th byte to 40th byte ? dummy data (4 bytes) 00h,00h,00h,00h (from 37th byte) 41st byte to 44th byte ? dummy data (4 bytes) 00h, 00h, 00h, 00h (from 41st byte) 45th byte to 46th byte ? fuse information (2 bytes from 45th byte) read protection/write protection 1) applied/applied : 00h, 00h 2) not applied/applied : 01h, 00h 3) applied/not applied : 02h, 00h 4) not applied/not applied : 03h, 00h 47th byte to 50th byte ? flash memory start address (4 bytes) 00h, 00h, 01h, 00h (from 47th byte) 51st byte to 54th byte ? flash memory end address (4 bytes) ffh, ffh, 02h, 00h (from 51st byte) 55th byte to 56th byte ? number of sectors in flash memory (2 bytes) 20h, 00h (from 55th byte) 57th byte to 60th byte ? start address of flash memory sectors of the same size (4 bytes) 00h, 00h, 01h, 00h (from 57th byte)
tmp91fw40 2008-10-22 91fw40-29 table 3.3.11 transfer format of single boot program [product information read] (2/2) transfer byte number transfer data from controller to device baud rate transfer data from device to controller 61st byte to 64th byte ? size (in half words) of flash memory sectors of the same size (4 bytes) 00h, 08h, 00h, 00h (from 61st byte) 65th byte ? number of flash memory sectors of the same size (1byte) 20h 66th byte ? checksum value for 5th to 65th bytes boot rom 67th byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.3.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw40 2008-10-22 91fw40-30 table 3.3.12 transfer format of single boot program [flash memory chip erase] transfer byte number transfer data from controller to device baud rate transfer data from device to controller boot rom 1st byte baud rate setting uart 86h desired baud rate (note 1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (40h) ? 4th byte ? ack response to operation command (note2) normal 40h error x1h communications error x8h 5th byte erase enable command data (54h) ? 6th byte ? ack response to operation command (note 2) normal 54h error x1h communications error x8h 7th byte ? ack response to erase command normal 4fh error 4ch 8th byte ? ack response normal 5dh error 60h 9th byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.3.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw40 2008-10-22 91fw40-31 table 3.3.13 transfer format of single boot program [flash memory protect set] transfer byte number transfer data from controller to device baud rate transfer data from device to controller boot rom 1st byte baud rate setting uart 86h desired baud rate (note 1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (60h) ? 4th byte ? ack response to operation command (note2) normal 60h error x1h communications error x8h 5th byte to 16th byte password data (12 bytes) (02fef4h to 02feffh) ? 17th byte checksum value for 5th to 16th bytes ? 18th byte ? ack response to checksum value (note 2) normal 60h error 61h communications error 68h 19th byte ? ack response to protect set command normal 6fh error 6ch 20th byte ? ack response normal 31h error 34h 21st byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.3.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw40 2008-10-22 91fw40-32 3.3.4.7 boot program when the device starts up in single boot mode, the boot program is activated. the following explains the commands that are used in the boot program to communicate with the controller when the de vice starts up in single boot mode. use this information for creating a controller for using single bo ot mode or for building a user boot environment. 1. ram transfer command in ram transfer, data is transferred from the controller and stored in the device?s internal ram. when the transfer completes normally, the boot program will start running the transferred user program. up to 3.5 kbytes of data can be transferred as a user program. (this limit is implemented in the boot program to protect the stack pointer area.) the user program starts exec uting from the ram storage start address. this ram transfer function enables a user-created program/erase routine to be executed, allowing the user to implement their own on-board programming method. to perform on-board programming with a user program, the flash memory command sequences (see section 3.3.6) must be used. after the ram t r a nsfer command has been completed, the entire internal ram area can be used. if read protection or write protection is ap plied on the device or a password error occurs, this command will not be executed. 2. flash memory sum command this command calculates the sum of 128 kbytes of data in the flash memory and returns the result. there is no operation command available to the boot program for reading data from the entire area of the flash memory. instead, this flash memory sum command can be used. reading the sum value enables revision management of the application program. 3. product information read command this command returns the information about the device including its part number and memory details stored in the flash memory at addresses 02fef0h to 02fef3h. this command can also be used for revision ma nagement of the application program. 4. flash memory chip erase command this command erases all the sectors in the flash memory. if read protection or write protection is applied on the device, all the sectors in the flash memory are erased and the read protection or write protection is cleared. since this command is also used to restore the operation of the boot program when the password is forgotten, it does not include password verification. 5. flash memory protect set command this command sets both read protection and write protection on the device. however, if a password error occurs, this co mmand will not be executed. when read protection is set, the flash memory cannot be read in programmer mode. when write protection is set, the flash memory cannot be written in programmer mode.
tmp91fw40 2008-10-22 91fw40-33 3.3.4.8 ram transfer command (see table 3.3.8) 1. from the controller to the device the data in the 1st byte is used to determin e the baud rate. the 1st byte is transferred with receive operation disabled (sc1mod0 = 0). ? to communicate in uart mode send the value 86h from the controller to the target board using uart settings at the desired baud rate. if the se rial operation mode is determined as uart, the device checks to see whether or not the desired baud rate can be set. if the device determines that the desired baud rate cannot be set, operation is terminated and no communications can be established. 2. from the device to the controller the data in the 2nd byte is the ack response returned by the device for the serial operation mode setting data sent in the 1st by te. if the data in the 1st byte is found to signify uart and the desired baud rate can be set, the device returns 86h. ? baud rate determination the device determines whether or not the desired baud rate can be set. if it is found that the baud rate can be set, the boot program rewrites the br1cr and br1add values and returns 86h. if it is found that the desired baud rate cannot be set, operation is terminated and no data is returned. the controller sets a time-out time (5 seconds) after it has finished sending the 1st byte. if the controller does not receive the response (86h) norm ally within the time-out time, it should be considered that the device is unable to communicate. receive operation is enabled (sc1mod0 = 1) before 86h is written to the transmission buffer. 3. from the controller to the device the data in the 3rd byte is operation command data. in this case, the ram transfer command data (10h) is sent from the controller to the device. 4. from the device to the controller the data in the 4th byte is the ack response to the operation command data in the 3rd byte. first, the device checks to see if the received data in the 3rd byte contains any error. if a receive error is found, the de vice returns the ack response data for communications error (bit 3) x8h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined (they are the upper four bits of the immediately preceding operation command data). next, if the data received in the 3rd byte corresponds to one of the operation commands given in table 3.3.7, the device echoes back the received data (ack response for normal rec e ption). i n the case of the ra m transfer command, if read or write protection is not applied, 10h is echoed back and then execution branches to the ram transfer processing routine. if protection is applied, the device returns the corresponding ack response data (bit 2/1) x6h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) after branching to the ram transfer processing routine, the device checks the data in the password area. for details, see 3.3.4.14 ? password?. if the data in the 3rd byte does not corre sp ond to any op erat ion command, the device returns the ack response data for operatio n command error (bit0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.)
tmp91fw40 2008-10-22 91fw40-34 5. from the controller to the device the 5th to 16th bytes contain password data (12 bytes). the data in the 5th to 16th bytes is verified against the data at a ddresses 02fef4h to 02 feffh in the flash memory, respectively. 6. from the controller to the device the 17th byte contains checksum data. the checksum data sent by the controller is the two?s complement of the lower 8-bit value obtained by summing the data in the 5th to 16th bytes by unsigned 8- bit addition (ignoring any overflow). for details on checksum, see 3.3.4.16 ? how to calculate checksum.? 7. f r om the device to the controller the data in the 18th byte is the ack response data to the 5th to 17th bytes (ack response to the checksum value). the device first checks to see whether the data received in the 5th to 17th bytes contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) 18h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?1?. next, the device checks the checksum data in the 17th byte. this check is made to see if the lower 8-bit value obtained by summing the data in the 5th to 17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00h. if the value is not 00h, the device returns the ack response data for checksum error (bit 0) 11h and waits for the next operation command data (3rd byte). finally, the device examines the result of password verification. if all the data in the 5th to 16th bytes is not verifi ed correctly, the device returns the ack response data for password error (bit 0) 11h and waits for the next operation command data (3rd byte). if no error is found in all the above checks, the device returns the ack response data for normal reception 10 h. 8. from the controller to the device the data in the 19th to 22nd bytes indica tes the ram start address for storing block transfer data. the 19th byte corresponds to address bits 31 to 24, the 20th byte to address bits 23 to 16, the 21st byte to address bits 15 to 8, and the 22nd byte to address bits 7 to 0. 9. from the controller to the device the data in the 23rd and 24th bytes indicate s the number of bytes to be transferred. the 23rd byte corresponds to bits 15 to 8 of the transfer byte count and the 24th byte corresponds to bits 7 to 0. 10. from the controller to the device the data in the 25th byte is checksum data. the checksum data sent by the controller is the two?s complement of the lower 8-bit value obtained by summing the data in the 19th to 24th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 3.3.4.16 ? how to calculate checksum .? note: the data in the 19th to 25th bytes should be placed within addresses 001000h to 001dffh (3.5 kbytes) in the internal ram.
tmp91fw40 2008-10-22 91fw40-35 11. from the device to the controller the data in the 26th byte is the ack response data to the data in the 19th to 25th bytes (ack response to the checksum value). the device first checks to see whether the data received in the 19th to 25th bytes contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) 18h and waits for the next operation command (3rd byte). the upper four bits of the ack response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?1?. next, the device checks the checksum data in the 25th byte. this check is made to see if the lower 8-bit value obtained by summing the data in the 19th to 25th bytes by unsigned 8-bit addition (ignoring any overflow) is 00h. if the value is not 00h, the device returns the ack response data for checksum error (bit 0) 11h and waits for the next operation command data (3rd byte). 12. from the controller to the device the data in the 27th to m?th bytes is the data to be stored in the ram. this data is written to the ram starting at the address specified in the 19th to 22nd bytes. the number of bytes to be written is sp ecified in the 23rd and 24th bytes. 13. from the controller to the device the data in the (m+1) th byte is checksum data. the checksum data sent by the controller is the two?s complement of the lower 8-bit value obtained by summing the data in the 27th to m?th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 3.3.4.16 ? how to calculate checksum.? 14. f r om the device to the controller the data in the (m + 2)th byte is the ack response data to the 27th to (m+1)th bytes (ack response to the checksum value). the device first checks to see whether the data in the 27th to (m+1)th byte contains any error. if a receive error is found, th e device returns the ack response data for communications error (bit 3) 18h and waits fo r the next operation command (3rd byte). the upper four bits of the ack response are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?1?. next, the device checks the checksum data in the (m+1)th byte. this check is made to see if the lower 8-bit value obtained by summing the data in the 27th to (m+1)th bytes by unsigned 8-bit addition (ignoring any overflow) is 00h. if the value is not 00h, the device returns the ack response data for checksum error (bit 0) 11h and waits for the next operation command data (3rd byte). if no error is found in all the above checks, the device returns the ack response data for normal reception 10h. 15. from the device to the controller if the ack response data in the (m + 2)th byte is 10h (normal reception), the boot program then jumps to the ram start address specified in the 19th to 22nd bytes.
tmp91fw40 2008-10-22 91fw40-36 3.3.4.9 flash memory sum command (see table 3.3.9) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the flash memory sum command data (20h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack respon se data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and waits for the next operation comma nd data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command values given in table 3.3.7, the device echoes back the received data (ack response for normal reception). in this case, 20h is echo ed back and execut ion then branc hes to the flash memory sum processing routine. if the data in the 3rd byte does not correspond to any operation command, the device retu rns the ack response data for operation command error (bit 0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response da ta are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the device to the controller the data in the 5th and 6th bytes is the upper and lower data of the sum value, respectively. for details on sum, see 3.3.4.15 ? how to calculate sum .? 5. f r om the device to the controller the data in the 7th byte is checksum data. this is the two?s complement of the lower 8-bit value obtained by summing the data in the 5th and 6th bytes by unsigned 8-bit addition (ignoring any overflow). 6. from the controller to the device the data in the 8th byte is the next operation command data.
tmp91fw40 2008-10-22 91fw40-37 3.3.4.10 product information read command (see table 3.3.10 and table 3.3.11) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the product information read command data (30h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack respon se data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and waits for the next operation comma nd data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command values given in table 3.3.7, the device echoes back the received data (ack response for normal reception). in this ca se, 30h is returned a n d execution then branches to the product information read processing routine. if the data in the 3rd byte does not correspond to any operation command, the de vice returns the ack response data for operation command error (bit 0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the device to the controller the data in the 5th to 8th bytes is the data stored at addresses 02fef0h to 02fef3h in the flash memory. by writing the id information of software at these addresses, the version of the software can be managed. (for example, 0002h can indicate that the software is now in version 2.) 5. from the device to the controller the data in the 9th to 20th bytes denotes the part number of the device. ?tmp91fw40_ _ _? is sent in ascii code starting from the 9th byte. note: an underscore (?_?) indicates a space. 6. from the device to the controller the data in the 21st to 24th bytes is the password comparison start address. f4h, feh, 02h and 00h are sent starting from the 21st byte. 7. from the device to the controller the data in the 25th to 28th bytes is the ram start address. 00h, 10h, 00h and 00h are sent starting from the 25th byte. 8. from the device to the controller the data in the 29th to 32nd bytes is the ram (user area) end address. ffh, 1dh, 00h and 00h are sent starting from the 29th byte.
tmp91fw40 2008-10-22 91fw40-38 9. from the device to the controller the data in the 33rd to 36th bytes is the ram end address. ffh, 1fh, 00h and 00h are sent starting from the 33rd byte. 10. from the device to the controller the data in the 37th to 44 th bytes is dummy data. 11. from the device to the controller the data in the 45th and 46th bytes contains the protection status and sector division information of the flash memory. ? bit 0 indicates the read protection status. ? 0: read protection is applied. ? 1: read protection is not applied. ? bit 1 indicates the write protection status. ? 0: write protection is applied. ? 1: write protection is not applied. ? bit 2 indicates whether or not the flas h memory is divided into sectors. ? 0: the flash memory is divided into sectors. ? 1: the flash memory is not divided into sectors. ? bits 3 to 15 are sent as ?0?. 12. from the device to the controller the data in the 47th to 50th bytes is the flash memory start address. 00h, 00h, 01h and 00h are sent starting from the 47th byte. 13. from the device to the controller the data in the 51st to 54th bytes is the flash memory end address. ffh, ffh, 02h and 00h are sent starting from the 51st byte. 14. from the device to the controller the data in the 55th and 56th bytes indicates the number of sectors in the flash memory. 20h and 00h are sent starting from the 55th byte. 15. from the device to the controller the data in the 57th to 65th bytes contains sector information of the flash memory. sector information is comprised of the start address (starting from the flash memory start address), sector size and number of consecutive sectors of the same size. note that the sector size is represented in word units. the data in the 57th to 65th bytes indicates 4 kbytes of sectors (sector 0 to sector 31). for the data to be transferred, see table 3.3.10 and table 3.3.11. 16. f r om the device to the controller the data in the 66th byte is checksum data. this is the two?s complement of the lower 8-bit value obtained by summing the data in the 5th to 65th bytes by unsigned 8-bit addition (ignoring any overflow). 17. from the controller to the device the data in the 67th byte is the next operation command data.
tmp91fw40 2008-10-22 91fw40-39 3.3.4.11 flash memory chip erase command (see table 3.3.12) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the flash memory chip erase command data (40h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack respon se data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and waits for the next operation comma nd data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command values given in table 3.3.7, the device echoes back the received data (ack response for normal rec e ption). in this case, 40h is echoed back. if the data in the 3rd byte does not correspond to any operation command, the de vice returns the ack response data for operation command error (bit 0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the controller to the device the data in the 5th byte is eras e enable command data (54h). 5. from the device to the controller the data in the 6th byte is the ack response data to the erase enable command data in the 5th byte. the device first checks to see if the data in the 5th byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and waits for the next operation comma nd data (3rd byte). the upper four bits of the ack response data are undefined (they are the upper four bits of the immediately preceding operation command data.) then, if the data in the 5th byte corresponds to the erase enable command data, the device echoes back the received data (ack re sponse for normal reception). in this case, 54h is echoed back and execution jumps to the flash memory chip erase processing routine. if the data in the 5th byte does not correspond to the erase enable command data, the device returns the ack response data for operation command error (bit 0 ) x1h and waits for the next operation command (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.)
tmp91fw40 2008-10-22 91fw40-40 6. from the device to the controller the data in the 7th byte indicates whether or not the erase operation has completed successfully. if the erase operation has co mpleted successfully, the device returns the end code (4fh). if an erase error has occurred, the device returns the error code (4ch). 7. from the device to the controller the data in the 8th byte is ack response data. if the erase operation has completed successfully, the device return s the ack response for erase completion (5dh). if an erase error has occurred, the device returns the ack response for erase error (60h). 8. from the controller to the device the data in the 9th byte is the next operation command data.
tmp91fw40 2008-10-22 91fw40-41 3.3.4.12 flash memory protect set command (see table 3.3.13) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the flash memory protect set command data (60h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack respon se data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and waits for the next operation command data. the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command data values given in table 3.3.7, the device echoes back the received data (ack response for normal reception). in this case, 60h is ech o ed back and execut ion branches t o the flash memory protect set processing routine. after branching to this routine, the data in the password area is checked. for details, see 3.3.4.14 ?password.? if the data in the 3rd byte does not corre spond to any op erat ion command, the device returns the ack response data for operatio n command error (bit 0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the controller to the device the data in the 5th to 16th bytes is password data (12 bytes). the data in the 5th byte is verified against the data at address 02f ef4h in the flash memory and the data in the 6th byte against the data at address 02fef 5h. in this manner, the received data is verified consecutively against the data at the specified address in the flash memory. the data in the 16th byte is verified against the data at address 02feffh in the flash memory. 5. from the controller to the device the data in the 17th byte is checksum data. the checksum data sent by the controller is the two?s complement of the lower 8-bit value obtained by summing the data in 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 3.3.4.16 ? how to calculate checksum.?
tmp91fw40 2008-10-22 91fw40-42 6. from the device to the controller the data in the 18th byte is the ack response data to the data in the 5th to 17th bytes (ack response to the checksum value). the device first checks to see whether the data in the 5th to 17th bytes contains any error. if a receive error is found, the de vice returns the ack response data for communications error (bit 3) 68h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?6?. then, the device checks the checksum data in the 17th byte. this check is made to see if the lower 8 bits of the value obtained by summing the data in the 5th to 17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00h. if the value is not 00h, the device returns the ack response data for checksum error (bit 0) 61h and waits for the next operation command data (3rd byte). finally, the device examines the result of password verification. if all the data in the 5th to 16th bytes is not verifi ed correctly, the device returns the ack response data for password error (bit 0) 61h and waits for the next operation command data (3rd byte). if no error is found in the above checks, th e device returns the ack response data for normal reception 60h. 7. from the device to the controller the data in the 19th byte indicates whether or not the protect set operation has completed successfully. if the operation has completed succe ssfully, the device returns the end code (6fh). if an error has occurred, the device returns the error code (6ch). 8. from the device to the controller the data in the 20th byte is ack response data. if the protect set operation has completed successfully, the device return s the ack response data for normal completion (31h). if an erro r has occurred, the device re turns the ack response data for error (34h). 9. from the device to the controller the data in the 21st byte is the next operation command data.
tmp91fw40 2008-10-22 91fw40-43 3.3.4.13 ack response data the boot program notifies the controller of its processing status by sending various response data. table 3.3.14 to table 3.3.19 show the ack response data returned for each type of received data. the upper four bits of ack response data are a direct reflection of the upper four bits of the immediately preceding operation command data. bit 3 indicates a receive error and bit 0 indicates an operation command error, checksum error or password error. table 3.3.14 ack response data to serial operation mode setting data transfer data meaning 86h the device can communicate in uart mode. (note) table 3.3.15 ack response data to operation command data transfer data meaning x8h (note) a receive error occurred in the operation command data. x6h (note) terminated receive oper ation due to protection setting. x1h (note) undefined operation command data was received normally. 10h received the ram transfer command. 20h received the flash memory sum command. 30h received the product information read command. 40h received the flash memory chip erase command. 60h received the flash memory protect set command. table 3.3.16 ack response data to checksum data for ram transfer command transfer data meaning 18h a receive error occurred. 11h a checksum error or password error occurred. 10h received the correct checksum value. table 3.3.17 ack response data to flash memory chip erase operation transfer data meaning 54h received the erase enable command. 4fh completed erase operation. 4ch an erase error occurred. 5dh (note) reconfirmation of erase operation 60h (note) reconfirmation of erase error note: if the desired baud rate cannot be set, the device returns no data and terminates operation. note: these codes are returned for reconfirmation of communications. note: the upper four bits are a direct reflection of the upper four bits of the immediately preceding operation command data.
tmp91fw40 2008-10-22 91fw40-44 table 3.3.18 ack response data to checksum data for flash memory protect set command transfer data meaning 68h a receive error occurred. 61h a checksum or password error occurred. 60h received the correct checksum value. table 3.3.19 ack response data to flash memory protect set operation transfer data meaning 6fh completed the protect (read/write) set operation. 6ch a protect (read/write) set error occurred. 31h (note) reconfirmation of protect (read/write) set operation 34h (note) reconfirmation of protect (read/write) set error note: these codes are returned for reconfirmation of communications.
tmp91fw40 2008-10-22 91fw40-45 3.3.4.14 password when the ram transfer command (10h) or the flash memory protect set command (60h) is received as operation command data, password verification is performed. first, the device echoes back the operation command data (10h to 60h) and checks the data (12 bytes) in the password area (addresses 02fef4h to 02feffh). then, the device verifies the password data received in the 5th to 16th bytes against the data in the password area as shown in table 3.3.20. unl e ss all th e 12 bytes are verified correc tly, a password e rror will occur. a password error will also occur if all the 12 bytes of password data contain the same value. only exception is when all the 12 bytes are ?ffh? and verified correctly and the reset vector area (addresses 02ff00h to 02ff02h) is all ?ffh?. in this case, a blank device will be assumed and no password error will occur. if a password error has occurred, the devi ce returns the ack response data for password error in the 18th byte. table 3.3.20 password verification table receive data data to be verified against 5th byte data at address 02fef4h 6th byte data at address 02fef5h 7th byte data at address 02fef6h 8th byte data at address 02fef7h 9th byte data at address 02fef8h 10th byte data at address 02fef9h 11th byte data at address 02fefah 12th byte data at address 02fefbh 13th byte data at address 02fefch 14th byte data at address 02fefdh 15th byte data at address02fefeh 16th byte data at address 02feffh example of data that cannot be specified as a password for blank products (note) ? the password of a blank product must be all ?ffh? (ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh). note: a blank product is a product in which all the bytes in the password area (addresses 02fef4h to 02feffh) and the reset vector area (addresses 02ff00h to 02ff02h) are ?ffh?. for programmed products ? the same 12 consecutive bytes cannot be specified as a password. the table below shows password error examples. programmed product 1 2 3 4 5 6 7 8 9 10 11 12 note error example 1 ffh ffh ffh ffh ffh ffh ffh ffh ffh ffh ffh ffh all ?ff? error example 2 00h 00h 00h 00h 00h 00h 00h 00h 00h 00h 00h 00h all ?00? error example 3 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah all ?5a?
tmp91fw40 2008-10-22 91fw40-46 3.3.4.15 how to calculate sum sum is calculated by summing the values of all data read from the flash memory by unsigned 8-bit addition and is returned as a word (16-bit) value. the resulting sum value is sent to the controller in order of upper 8 bits and lower 8 bits. all the 128 kbytes of data in the flash memory are included in the calculation of sum. when the flash memory sum command is executed, sum is calculated in this way. example: 3.3.4.16 how to calculate checksum checksum is calculated by taking the two?s complement of the lower 8-bit value obtained by summing the values of received data by unsigned 8-bit addition (ignoring any overflow). when the flash memory sum command or the product information read command is executed, checksum is calculated in this way. the controller should also use this checksum calculation method for sending checksum values. example: calculating checksum for the flash memory sum command when the upper 8-bit data of sum is e5h and the lower 8-bit data is f6h, checksum is calculated as shown below. first, the upper 8 bits and lower 8 bits of the sum value are added by unsigned operation. e5h + f6h = 1dbh then, the two?s complement of the lower 8 bits of this result is obtained as shown below. the resulting checksum value (25h) is sent to the controller. 0 ? dbh = 25h a1h b2h c3h d4h when sum is calculated from the four data entries shown to the left, the result is as follows: a1h + b2h + c3h + d4h = 02eah sum upper 8 bits: 02h sum lower 8 bits: eah thus, the sum value is sent to the controller in order o f 02h and eah.
tmp91fw40 2008-10-22 91fw40-47 3.3.5 user boot mode (in single chip mode) user boot mode, which is a sub mode of sing le chip mode, enables a user-created flash memory program/erase routine to be used. to do so, the operation mode of single chip mode must be changed from normal mode for executing a user application program to user boot mode for programming/erasing the flash memory. for example, the reset processing routine of a user application program may include a routine for selecting normal mode or user boot mode upon entering single chip mode. any mode-selecting condition may be set using the device?s i/o to suit the user system. to program/erase the flash memory in user boot mode, a program/erase routine must be incorporated in the user application program in advance. since the processor cannot read data from the internal flash memory while it is being programmed or erased, the program/erase routine must be executed from the outside of the flash memory. while the flash memory is being programmed/erased in user boot mode, interrupts must be disabled. the pages that follow explain the procedure for programming the flash memory using two example cases. in one case the program/erase routine is stored in the internal flash memory (1-a); in the other the program/erase routine is transferred from an external source (1-b).
tmp91fw40 2008-10-22 91fw40-48 3.3.5.1 (1-a) program/erase procedure example 1 when the program/erase routine is stored in the internal flash memory (step-1) environment setup first, the condition (e.g. pin status) for ente ring user boot mode must be set and the i/o bus for transferring data must be de termined. then, the device?s peripheral circuitry must be designed and a correspon ding program must be written. before mounting the device on the board, it is necessary to write the following four routines into one of the sectors in the flash memory. (a) mode select routine : selects normal mode or user boot mode. (b) program/erase routine : loads program/erase data from an external source and programs/era ses the flash memory. (c) copy routine 1 : copies routines (a) to (d) into the internal ram or external memory. (d) copy routine 2 : copies routines (a) to (d) from the internal ram or external memory into the flash memory. note: the above (d) is a routine for reconstructing the program/erase routine on the flash memory. if the entire flash memory is always programmed and the program/erase routine is included in the new user application program, this copy routine is not needed. (step-2) entering user boot mode (using the reset processing) after reset release, the reset processing program determines whether or not the device should enter user boot mode. if the condition for entering user boot mode is true, user boot mode is entered to program/erase the flash memory. (tmp91fw40) flash memory ram [reset processing program] ( a ) mode select routine old user application program (controller) new user application program (i/o) (b) program/erase routine (c) copy routine 1 ( d ) cop y routine 2 (tmp91fw40) flash memory ram [reset processing program] old user application program (controller) new user application program (i/o) ( a ) mode select routine ( b ) pro g ram/erase routine ( c ) co py routine 1 0 1 reset condition for entering user boot mode (user-specified) ( d ) co py routine 2
tmp91fw40 2008-10-22 91fw40-49 (step-3) copying the program/erase routine after the device has entered user boot mode, the copy routine 1 (c) copies the routines (a) to (d) into the internal ram or external memory (the routines are copied into the internal ram here.) (step-4) erasing the flash memory by the program/erase routine control jumps to the program/erase routine in the ram and the old user program area is erased (sector erase or chip eras e). (in this case, the flash memory erase command is issued from the ram.) note: if data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, only the program/erase routine (b) need be copied into the ram. new user application program (tmp91fw40) flash memory ram [reset processing program] (a) mode select routine old user application program (controller) (i/o) (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (a) mode select routine (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (tmp91fw40) flash memory ram (controller) new user application program (i/o) (a) mode select routine (b)program/erase routine (c) copy routine 1 (d) copy routine 2 erased
tmp91fw40 2008-10-22 91fw40-50 (step-5) restoring the user boot program in the flash memory the copy routine 2 (d) in the ram copies the routines (a) to (d) into the flash memory. note: if data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, step 5 is not needed. (step-6) writing the new user application program to the flash memory the program/erase routine in the ram is ex ecuted to load the new user application program from the controller into the erased area of the flash memory. new user application program (tmp91fw40) flash memory ram [reset processing program] (a) mode select routine (controller) (i/o) (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (a) mode select routine (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (tmp91fw40) flash memory ram [reset processing program] (a) mode select routine (controller) new user application program (i/o) (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (a) mode select routine (b) program/erase routine (c) copy routine 1 (d) copy routine 2 new user application program
tmp91fw40 2008-10-22 91fw40-51 (step-7) executing the new user application program the reset input pin is driven low (?0?) to reset the device. the mode setting condition is set for normal mode. after reset release, th e device will start executing the new user application program. (tmp91fw40) flash memory ram [reset processing program (a) mode select routine new user application program (controller) (i/o) (b) program/erase routine (c) copy routine 1 0 1 reset condition for entering normal mode (d) copy routine 2
tmp91fw40 2008-10-22 91fw40-52 3.3.5.2 (1-b) program/erase procedure example 2 in this example, only the boot program (minimum requirement) is stored in the flash memory and other necessary routin es are supplied from the controller. (step-1) environment setup first, the condition (e.g. pin status) for ente ring user boot mode must be set and the i/o bus for transferring data must be de termined. then, the device?s peripheral circuitry must be designed and a correspon ding program must be written. before mounting the device on the board, it is necessary to write the following two routines into one on the sectors in the flash memory. (a) mode select routine : selects normal mode or user boot mode. (b) transfer routine : loads the program/erase routine from an external source. the following routines are prepared on the controller. (c) program/erase routine : programs/erases the flash memory. (d) copy routine 1 : copies routines (a) and (b) into the internal ram or external memory. (e) copy routine 2 : copies routines (a) and (b) from the internal ram or external memory into the flash memory. (step-2) entering user boot mode (using the reset processing) the following explanation assumes that these routines are incorporated in the reset processing program. after reset release, the reset processing program first determines whether or not the device should enter user boot mode. if the condition for entering user boot mode is true, user boot mode is entered to program/erase the flash memory. (tmp91fw40) (controller) (i/o) flash memory ram [reset processing routine] (a) mode select routine old user application program (b) transfer routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (tmp91fw40) (controller) (i/o) 0 1 reset condition for entering user boot mode (user-specified) flash memory ram [reset processing routine] (a)mode select routine old user application program (b)transfer routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2
tmp91fw40 2008-10-22 91fw40-53 (step-3) copying the program/erase routine to the internal ram after the device has entered user boot mode, the transfer routine (b) transfers the routines (c) to (e) from the controller to the internal ram (or external memory). (the routines are copied into the internal ram here.) (step-4) executing the copy routine 1 in the internal ram control jumps to the internal ram and the copy routine 1 (d) copies the routines (a) and (b) into the internal ram. (tmp91fw40) (controller) (i/o) flash memory ram [reset processing routine] (a) mode select routine old user application program (b) transfer routine (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (tmp91fw40) (controller) (i/o) flash memory ram [reset processing routine] (a) mode select routine old user application program (b) transfer routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (a)mode select routine ( b ) transfer routine (c) program/erase routine
tmp91fw40 2008-10-22 91fw40-54 (step-5) erasing the flash memory by the program/erase routine the program/erase routine (c) eras es the old user program area. (step-6) restoring the user boot program in the flash memory the copy routine (e) copies the routines (a) and (b) from the internal ram into the flash memory. (tmp91fw40) (controller) (i/o) flash memory ram (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (a)mode select routine (b)transfer routine erased (tmp91fw40) (controller) (i/o) flash memory ram [reset processing program] (a) mode select routine (b) transfer routine (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (a)mode select routine (b) transfer routine
tmp91fw40 2008-10-22 91fw40-55 (step-7) writing the new user application program to the flash memory the program/erase routine (c) in the ram is executed to load the new user application program from the controller into the erased area of the flash memory. (step-8) executing the new user application program the reset input pin is driven low (?0?) to reset the device. the mode setting condition is set for normal mode. after reset release, th e device will start executing the new user application program. (controller) (i/o) (tmp91fw40) flash memory ram [reset processing program] (a) mode select routine new user application program (b) transfer routine (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (a)mode select routine ( b ) transfer routine (d) copy routine 1 (e) copy routine 2 (tmp91fw40) (controller) (i/o) 0 1 reset condition for entering normal mode flash memory ram [reset processing program] (a)mode select routine new user application program (b) transfer routine
tmp91fw40 2008-10-22 91fw40-56 3.3.6 flash memory command sequences the operation of the flash memory is comprised of six commands, as shown in table 3.3.21. addresses specified in each c ommand sequence must be in an area where the flash memory is mapped. for details, see table 3.3.3. table 3.3.21 comm and sequences 1st bus write cycle 2nd bus write cycle 3rd bus write cycle 4th bus write cycle 5th bus write cycle 6th bus write cycle command sequence addr. data addr. data addr. data addr. data addr. data addr. data 1 single word program aaah aah 554h 55h aaah a0h pa (note 1) pd (note 1) 2 sector erase (4-kb erase) aaah aah 554h 55h aaah 80h aaah aah 554h 55h sa (note 2) 30h 3 chip erase (all erase) aaah aah 554h 55h aaah 80h aaah aah 554h 55h aaah 10h 4 product id entry aaah aah 554h 55h aaah 90h product id exit xxh f0h 5 product id exit aaah aah 554h 55h aaah f0h read protect set aaah aah 554h 55h aaah a5h 77eh f0h (note3) 6 write protect set aaah aah 554h 55h aaah a5h 77eh 0fh (note3) note 1: pa = program word address, pd = program word data set the address and data to be programmed. even-numbered addresses should be specified here. note 2: sa = sector erase address, each sector erase range is selected by address a23 to a12. note 3: when apply read protect and write protect, be sure to program the data of 00h. table 3.3.22 hardware sequence flags status d7 d6 single word program 7 d toggle sector erase/chip erase 0 toggle during auto operation read protect set/write protect set cannot be used toggle note: d15 to d8 and d5 to d0 are ?don?t care?.
tmp91fw40 2008-10-22 91fw40-57 3.3.6.1 single word program the single word program command sequence programs the flash memory on a word basis. the address and data to be programmed are specified in the 4th bus write cycle. it takes a maximum of 60 s to program a single word. another command sequence cannot be executed until the write operation has completed. this can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. while a write operation is in progress, bit 6 of data is toggled each time it is read. note: to rewrite data to flash memory addresses at which data (including ffffh) is already written, make sure to erase the existing data by ?sector eras e? or ?chip erase? before rewriting data. 3.3.6.2 sector erase (4-kbyte erase) the sector erase command sequence erases 4 kbytes of data in the flash memory at a time. the flash memory address range to be erased is specified in the 6th bus write cycle. for the address range of each sector, see table 3.3.3. this command sequence cannot be us ed in pr ogrammer mode. it take s a maximum of 75 ms to erase 4 kbytes. another command sequence cannot be executed until the erase operation has completed. this can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. while an erase operation is in progress, bit 6 of data is toggled each time it is read. 3.3.6.3 chip erase (all erase) the chip erase command sequence erases the entire area of the flash memory. it takes a maximum of 300 ms to erase the entire flash memory. another command sequence cannot be executed until the erase operation has completed. this can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. while an erase operation is in progress, bit 6 of data is toggled each time it is read. erase operations clear data to ffh. 3.3.6.4 product id entry when the product id entry command is executed, product id mode is entered. in this mode, the vendor id, flash macro id, fl ash size id, and read/write protect status can be read from the flash memory. in prod uct id mode, the data in the flash memory cannot be read. 3.3.6.5 product id exit this command sequence is used to exit product id mode.
tmp91fw40 2008-10-22 91fw40-58 3.3.6.6 read protect set the read protect set command sequence applies read protection on the flash memory. when read protection is applied, the flash memory cannot be read in programmer mode and the ram transfer command cannot be executed in single boot mode. to cancel read protection, it is necessary to execute the chip erase command sequence. to check whether or not read protection is applied, read xxx77eh in product id mode. it takes a maximum of 60 s to set read protection on the flash memory. another command sequence cannot be executed until the read protection setting has completed. this can be checked by readin g the same address in the flash memory repeatedly until the same data can be read consecutively. while a read protect operation is in progress, bit 6 of data is toggled each time it is read. 3.3.6.7 write protect set the write protect set command sequence applies write protection on the flash memory. when write protection is applied, the flash memory cannot be written to in programmer mode and the ram transfer command cannot be executed in single boot mode. to cancel write protection, it is necessary to execute the chip erase command sequence. to check whether or not write protection is applied, read xxx77eh in product id mode. it takes a maximum of 60 s to set write protection. another command sequence cannot be executed until the write protection setting has completed. this can be checked by readin g the same address in the flash memory repeatedly until the same data can be read consecutively. while a write protect operation is in progress, bit 6 of data is toggled each time it is read. 3.3.6.8 hardware sequence flags the following hardware sequence flags are available to check the auto operation execution status of the flash memory. 1) data polling (d7) when data is written to the flash memory, d7 outputs the complement of its programmed data until the write operation has completed. after the write operation has completed, d7 outputs the proper cell data. by reading d7, therefore, the operation status can be checked. while the sector erase or chip erase command sequence is being executed, d7 outputs ?0?. after the command sequence is completed, d7 outputs ?1? (cell data). then, the data written to all the bits can be read after waiting for 1 s. when read/write protection is applied, the data polling function cannot be used. instead, use the toggle bit (d6) to check the operation status.
tmp91fw40 2008-10-22 91fw40-59 2) toggle bit (d6) when the flash memory program, sector erase, chip erase, write protect set, or read protect set command sequence is executed, bit 6 (d6) of the data read by read operations outputs ?0? and ?1? alternately each time it is read until the processing of the executed command sequence has completed. the toggle bit (d6) thus provides a software means of checking whether or not the processing of each command sequence has completed. normally, the same address in the flash me mory is read repeatedly until the same data is read successively. the initial read of the toggle bit always returns ?1?. note: the flash memory incorporated in the tmp91fw 40 does not have an exceed-time-limit bit (d5). it is therefore necessary to set the data polling time limit and toggle bit polling time limit so that polling can be stopped if the time limit is exceeded. 3.3.6.9 data read data is read from the flash memory in byte units or word units. it is not necessary to execute a command sequence to read data from the flash memory.
tmp91fw40 2008-10-22 91fw40-60 3.3.6.10 programming the flash memory by the internal cpu the internal cpu programs the flash memory by using the command sequences and hardware sequence flags described above. however, since the flash memory cannot be read during auto operation mode, the program/erase routine must be executed outside of the flash memory. the cpu can program the flash memory either by using single boot mode or by using a user-created protocol in single chip mode (user boot). 1) single boot: the microcontroller is started up in single boot mode to program the flash memory by the internal boot rom program. in this mode, the internal boot rom is mapped to an area including the interrupt vector table, in which the boot rom program is executed. the flash memory is mapped to an address area different from the boot rom area. the boot rom program loads data into the flash me mory by serial transfer. in single boot mode, interrupts must be disabled including non-maskable interrupts ( nmi , etc.). for details, see 3.3.4 ? single boot mode? 2) user bo ot: in this method, the flash memory is programmed by executing a user-created routine in single chip mode (normal operation mode). in this mode, the user-created program/erase routine must also be executed outside of the flash memory. it is also necessary to disable interrupts including non-maskable interrupts. the user should prepare a flash memory program/erase routine (including routines for loading write data and writing the loaded data into the flash memory). in the main program, normal operation is switched to flash memory programming operation to execute the flash memory program/erase routine outside of the flash memory area. for example, the flash memory program/erase routine may be transferred from the flash memory to the internal ram and executed there or it may be prepared and executed in external memory. for details, see 3.3.5 ? user boot mode (in single chip mode)?
tmp91fw40 2008-10-22 91fw40-61 flowcharts: flash memory a ccess by the internal cpu single word program program command sequence ( see the flowchart below ) start toggle bit (d6) last address? no yes program end address = address + 2 (even-numbered address/ word units) program command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/a0h even-numbered program address (a0 = 0) / program data (word units) read data matched program data? read data matched program data? abnormal end yes yes no no timeout (60 s) word read addr. = program address word read addr. = program address program command sequence (see the flowchart below) toggle bit (d6)
tmp91fw40 2008-10-22 91fw40-62 chip erase/sector erase note: in chip erase, whether or not the ent ire flash memory is blank is checked. in sector erase, whether or not the se lected sector is blank is checked. chip erase command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/80h xxxaaah/aah xxx554h/55h xxxaaah/10h sector erase command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/80h xxxaaah/aah xxx554h/55h sector address/30h erase command sequence (see the flowchart below) start toggle bit (d6) erase end read data = blank? abnormal end yes no timeout (chip: 300ms, sector: 75ms) erase command sequence (see the flowchart below) toggle bit (d6)
tmp91fw40 2008-10-22 91fw40-63 read/write protect set protect set command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/a5h set read protect xxx77eh/f0h set write protect xxx77eh/0fh set both read protect and write protect xxx77eh/00h protect set command sequence (see the flowchart below) start toggle bit (d6) protect set end abnormal end yes timeout (60 s) product id entry read data matched p ro g ram data? product id exit byte read (d7 to d0) addr. = xxx77eh no toggle bit (d6) protect set command sequence (see the flowchart below) product id entry product id exit
tmp91fw40 2008-10-22 91fw40-64 data polling (d7) toggle bit (d6) note: hardware sequence flags are read from the flash memory in byte units or word units. va: in single word program, va denotes the address to be programmed. in sector erase, va denotes any address in the selected sector. in chip erase, va denotes any address in the flash memory. in read protect set, va denotes the protect set address (xxx77eh). in write protect set, va denotes the protect set address (xxx77eh). byte read (d7 to d0) addr. = va start d7 = data? yes no (va: valid address) operation end byte read (d7 to d0) addr. = va d6 = toggle? start no operation end yes byte read (d7 to d0) addr. = va
tmp91fw40 2008-10-22 91fw40-65 product id entry read values in product id mode address read value vendor id xxxx00h 98h flash macro id xxxx02h 42h flash size id xxxx04h 1fh read/write protect status xxx77eh data programmed when protection is set. when protection is not set, ffh. product id exit xxx554h/55h start xxxaaah/aah xxxaaah/90h wait for 300 nsec or longer (id access and exit time = max. 300 nsec) [product id mode start] start xxxaaah/aah xxx554h/55h xxxaaah/f0h wait for 300 nsec or longer (id access and exit time = max.300 nsec) xxxxxxh/f0h wait for 300 nsec or longer (id access and exit time = max. 300 nsec) start product id read (see the table below) product id mode end product id mode end
tmp91fw40 2008-10-22 91fw40-66 (example: program to be loaded and executed in ram) erase the flash memory (chip erase) and then write 0706h to address fe0000h. ;#### flash memory chip erase processing #### ld xix, 0xfe0000 ; set start address chiperase: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0x80 ; 3rd bus write cycle ld (0xfe0aaa), 0xaa ; 4th bus write cycle ld (0xfe0554), 0x55 ; 5th bus write cycle ld (0xfe0aaa), 0x10 ; 6th bus write cycle cal togglechk ; check toggle bit chiperase_loop: ld wa, (xix+) ; read data from flash memory cp wa, 0xffff ; blank data? j ne, chiperase_err ; if not blan k data, jump to error processing cp xix, 0xffffff ; end address (0xffffff)? j ult, chiperase_loop ; check entire memory area and then end loop processing ;#### flash memory program processing #### ld xix, 0xfe0000 ; set program address ld wa, 0x0706 ; set program data program: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0xa0 ; 3rd bus write cycle ld (xix), wa ; 4th bus write cycle cal togglechk ; check toggle bit ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined program_end: j program_end ; program operation end ;#### toggle bit (d6) check processing #### togglechk: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) ld h, l ; save first toggle bit data togglechk1: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) cp l, h ; toggle bit = toggled? j z, togglechk2 ; if not toggled, end processing ld h, l ; save current toggle bit state j togglechk1 ; recheck toggle bit togglechk2: ret ;#### error processing #### chiperase_err: j chiperase_err ; chip erase error program_err: j program_err ; program error
tmp91fw40 2008-10-22 91fw40-67 (example: program to be loaded and executed in ram) erase data at addresses ff0000h to ff0fffh (sector erase) and then write 0706h to address ff0000h. ;#### flash memory sector erase processing #### ld xix, 0xff0000 ; set start address sectorerase: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0x80 ; 3rd bus write cycle ld (0xfe0aaa), 0xaa ; 4th bus write cycle ld (0xfe0554), 0x55 ; 5th bus write cycle ld (xix), 0x30 ; 6th bus write cycle cal togglechk ; check toggle bit sectorerase_loop: ld wa, (xix+) ; read data from flash memory cp wa, 0xffff ; blank data? j ne, sectorerase_err ; if not blan k data, jump to error processing cp xix, 0xff0fff ; end address (0xff0fff)? j ult, sectorerase_loop ; check erased sector area and then end loop processing ;#### flash memory program processing #### ld xix, 0xff0000 ; set program address ld wa, 0x0706 ; set program data program: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0xa0 ; 3rd bus write cycle ld (xix), wa ; 4th bus write cycle cal togglechk ; check toggle bit ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined program_end: j program_end ; program operation end ;#### toggle bit (d6) check processing #### togglechk: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) ld h, l ; save first toggle bit data togglechk1: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) cp l, h ; toggle bit = toggled? j z, togglechk2 ; if not toggled, end processing ld h, l ; save current toggle bit state j togglechk1 ; recheck toggle bit togglechk2: ret ;#### error processing #### sectorerase_err: j sectorerase_err ; sector erase error program_err: j program_err ; program error
tmp91fw40 2008-10-22 91fw40-68 (example: program to be loaded and executed in ram) set read protection and write protection on the flash memory. ;#### flash memory protect set processing #### ld xix, 0xfe077e ; set protect address protect: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0xa5 ; 3rd bus write cycle ld (xix), 0x00 ; 4th bus write cycle cal togglechk ; check toggle bit cal pid_entry ; ld a, (xix) ; read protected address cal pid_exit ; cp a, 0x00 ;(0xfe077e)=0x00? j ne, protect_err ; protected? protect_end: j protect_end ; protect set operation completed protect_err: j protect_err ; protect set error ;#### product id entry processing #### pid_entry: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0x90 ; 3rd bus write cycle ; --- wait for 300nsec or longer (execute nop instruction [148nsec/@f fph =27mhz] three times) --- nop nop nop ; wait for 444 nsec ret ;#### product id exit processing #### pid_exit: ld (0xfe0000), 0xf0 ; 1st bus write cycle ; --- wait for 300nsec or longer (execute nop instruction [148nsec/@f fph =27mhz] three times) --- nop nop nop ; wait for 444 nsec ret ;#### toggle bit (d6) check processing #### togglechk: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) ld h, l ; save first toggle bit data togglechk1: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) cp l, h ; toggle bit = toggled? j z, togglechk2 ; if not toggled, end processing ld h, l ; save current toggle bit state j togglechk1 ; recheck toggle bit togglechk2: ret (example: program to be loaded and executed in ram) read data from address fe0000h. ;#### flash memory read processing #### read: ld wa, (0xfe0000) ; read data from flash memory
tmp91fw40 2008-10-22 91fw40-69 4. electrical characteristics 4.1 absolute maximum ratings parameter symbol rating unit supply voltage vcc ?0.5 to 4.0 v input voltage vin ?0.5 to vcc + 0.5 v output current (per pin) iol (other than port8) 2 ma iol (port8) 20 ma output current (per pin) ioh ?2 ma output current (total) iol (other than port8) 60 ma iol (port8) 80 ma output current (total) ioh ?80 ma power dissipation (ta = 85c) pd 600 mw soldering temperature (10 s) tsolder 260 c storage temperature tstg ?65 to 150 c operating temperature topr ?40 to 85 c number of times program erase n ew 100 cycle note: absolute maximum ratings are limiting values of operating and environmental conditions that should not be exceeded under the worst possible conditions. the equipment manufactu rer should design so that no absolute maximum rating value is exceeded. exposure to conditions beyond those listed above may cause permanent damage to the device or affect devi ce reliability, which could increase potential risks of personal injury due to ic blowout and/or burning. solderability of lead free products test parameter test condition note use of sn-37pb solder bath solder bath temperature =230 c, dipping time = 5 seconds the number of times = one, use of r-type flux solderability use of sn-3.0ag-0.5cu solder bath solder bath temperature =245 c, dipping time = 5 seconds the number of times = one, use of r-type flux (use of lead free) pass: solderability rate until forming 95%
tmp91fw40 2008-10-22 91fw40-70 4.2 dc electrical characteristics (1/2) parameter symbol condition min typ. (note) max unit fc = 8 to 27 mhz 2.7 power supply voltage avcc = dvcc avss = dvss = 0 v vcc fc = 8 to 16 mhz fs = 30 to 34 khz 2.2 3.6 v power supply voltage avcc = dvcc avss = dvss = 0 v for erase/program operations of flash memory vcc fc = 8 to 27 mhz ta = ?10 40c 2.7 3.6 v vcc 2.7 v 0.3 vcc p0, p1, p2, p5, p62, p7, p8, p9, pa, pb vil1 vcc < 2.7 v 0.2 vcc vcc 2.7 v 0.25 vcc reset , nmi , p60(int0), p61(int1) vil2 vcc < 2.7 v 0.15 vcc vcc 2.7 v 0.3 am0, am1 vil3 vcc < 2.7 v 0.3 vcc 2.7 v 0.2 vcc low-level input voltage x1 vil4 vcc < 2.7 v ?0.3 0.1 vcc v vcc 2.7 v 0.7 vcc p0, p1, p2, p5, p62, p7, p8, p9, pa, pb vih1 vcc < 2.7 v 0.8 vcc vcc 2.7 v 0.75 vcc reset , nmi , p60(int0), p61(int1) vih2 vcc < 2.7 v 0.85 vcc vcc 2.7 v vcc ? 0.3 am0, am1 vih3 vcc < 2.7 v vcc ? 0.3 vcc 2.7 v 0.8 vcc high-level input voltage x1 vih4 vcc < 2.7 v 0.9 vcc vcc + 0.3 v iol = 1.6 ma vcc 2.7 v 0.45 low-level output voltage vol iol = 0.4 ma vcc < 2.7 v 0.15 vcc v high-level output voltage voh ioh = ?400 a vcc 2.7 v vcc ? 0.3 v vol = 1.0 v vcc 2.7 v 15 low-level output current (port 8) iol vol = 1.0 v vcc 2.2 v 10 ma note: ta = 25c, vcc = 3.0 v, unless otherwise noted.
tmp91fw40 2008-10-22 91fw40-71 dc electrical characteristics (2/2) parameter symbol condition min typ. (note 1) max unit input leakage current ili 0.0 v in vcc 0.02 5 output leakage current ilo 0.2 v in vcc ? 0.2 0.05 10 a power down voltage (while ram is being backed up in stop mode) vstop v il2 = 0.2 vcc, v ih2 = 0.8 vcc 2.2 3.6 v vcc = 2.7 v to 3.6 v 100 400 reset pull-up resistor rrst vcc = 2.2 v 200 1000 k pin capacitance cio fc = 1 mhz 10 pf vcc 2.7 v 0.4 schmitt width reset , nmi , int0, int1 vth vcc < 2.7 v 0.3 v normal (note 2) 40 50 idle2 30 38 idle1 vcc = 2.7 v to 3.6 v fc = 27 mhz 25 30 ma normal (note 2) 20 28 idle2 13 18 idle1 vcc = 2.2 v to 3.6 v fc = 16 mhz 9 13 ma slow (note 2) 55 75 idle2 40 60 idle1 vcc = 2.2 v to 3.6 v fs = 32.768 khz 35 45 a stop icc vcc = 2.2 v to 3.6 v 1 25 a peak current by intermitt operation iccp-p vcc = 2.2 v to 3.6 v 20 m a note 1: ta = 25c, vcc = 3.0 v, unless otherwise noted. note 2: test conditions for normal and slow i cc : all blocks operating, output pins open, and input pin levels fixed. when the program is operating by the flash memory, or when data reed from the flash memory, the flash memory operate intermitte ntly. therefore, it outputs a peak current like a following diagram, mome ntarily. in this case, the power supply current; icc (normal /slow mode) is the sum of average value of a peak current and a mcu current value. when designing the power supply, set to a ci rcuit which a peak current can be supplyed. in slow mode, a defference of peak curr ent and average current is large. n n+2 n+4 iccp-p [ma] program counter (pc) flash current which flows momentarily. max. current typ. current mcu current the average of peak current + mcu current flash memory intermittent operation
tmp91fw40 2008-10-22 91fw40-72 4.3 ad conversion electrical characteristics avcc=vcc avss=vss parameter symbol condition min typ. max unit vcc 2.7v vcc 0.2v vcc vcc analog reference voltage vrefh vcc < 2.7 v vcc vcc vcc vcc 2.7v vss vss vss+0.2v analog reference voltage vrefl vcc < 2.7 v vss vss vss analog input voltage vain vrefl vrefh v vcc 2.7v 0.94 1.35 analog current for analog reference voltage = 1 vcc < 2.7 v 0.65 0.90 ma = 0 iref (vrefl=0v) v cc = 2.2v to 3.6v 0.02 5.0 a vcc 2.7v 1.0 4.0 total error (not including quantization error) ? vcc < 2.7 v 1.0 4.0 lsb note 1: 1 lsb = (vrefh ? vrefl)/1024 [v] note 2: minimum operating frequency the operation of the ad converter is guaranteed only when the high-fequency o scillator (fc) is used (not guaranteed with fs). note 3: the supply current flowing through the av cc pin is included in the vcc pin supply current (i cc ).
tmp91fw40 2008-10-22 91fw40-73 4.4 sio timing (i/o interface mode) (1) sclk input mode equation 16 mhz 27 mhz parameter symbol min max min max min max unit sclk period t scy 16x 1.0 0.59 s t scy /2 ? 4x ? 110 (v cc = 2.7 to 3.6 v) 140 38 output data sclk rising /falling edge* t oss t scy /2 ? 4x ? 180 (v cc = 2.2 to 2.7 v ) 70 ? ns sclk rising /falling edge* output data hold t ohs t scy /2 + 2x + 0 625 370 ns sclk rising /falling edge* input data hold t hsr 3x + 10 198 121 ns sclk rising /falling edge* valid data hold t srd t scy ? 0 1000 592 ns valid data input /falling edge * sclk rising /falling edge* t rds 0 0 0 ns (2) sclk output mode equation 16 mhz 27 mhz parameter symbol min max min max min max unit sclk period t scy 16x 8192x 1.0 512 0.59 303 s output data sclk rising /falling edge* t oss t scy /2 ? 40 460 256 ns sclk rising /falling edge* output data hold t ohs t scy /2 ? 40 460 256 ns sclk rising /falling edge* input data hold t hsr 0 0 0 ns sclk rising /falling edge* valid data hold t srd t scy ? 1x ? 180 757 375 ns valid data input /falling edge * sclk rising /falling edge* t rds 1x + 180 243 217 ns note 1: sclk rise or fall: measured relative to the programmed active edge of sclk. note 2: the values shown in the 27 mhz and 16 mhz columns are measured with t scy = 16x. note 3: in the above tables, the letter x represents the f fph cycle period, which is half the system clock (f sys ) cycle period used in the cpu core. the f fph cycle period varies depending whether the high-fr equency or low frequency oscillator is used. t rds t srd t hsr t scy transmit data txd sclk (active-low input mode) sclk output mode/ active-high input mode 0 t oss t ohs 1 3 0 1 3 2 2 valid receive data rxd valid valid valid
tmp91fw40 2008-10-22 91fw40-74 4.5 timer/counter input (eci n) characteristics parameter symbol condition min typ. max unit count on a single edge frequency measurement mode vcc =2.7 to 3.6 v count on both edges ? ? count on a single edge timer/counter input (ecin1 to ecin3 input) t tc1 frequency measurement mode vcc =2.2 to 2.7 v count on both edges ? ? fc/2 (fc/2 = max. 8mhz) mhz 4.6 interrupts (1) nmi , int0 and int1 interrupts equation 16 mhz 27 mhz parameter symbol min max min max min max unit low pulse width for nmi , int0, int1 t intal 4x + 40 290 188 ns high pulse width for nmi , int0, int1 t intah 4x + 40 290 188 ns note 1: xc represents the cy cle period of the high-frequency oscillator clock (fc). note 2: in the above table, the letter x represents the f fph cycle period, which is half the system clock (f sys ) cycle period used in the cpu core. the f fph cycle period varies depending whether the high- frequency or low frequency oscillator is used. 4.7 flash characteristics (1) rewriting parameter condition min typ max unit gurantee on flash-memory rewriting vcc = 2.7v to 3.6v, fc = 8 to 27 mhz ta = -10 to 40oc D D 100 times
tmp91fw40 2008-10-22 91fw40-75 4.8 recommended crystal oscillation circuit TMP91FW40FG is evaluated by be low oscillator vender. when selecting external parts, make use of this information. note: total loads value of oscillator is sum of external loads (c1 and c2) and floating loads of actual assemble board. there is a possibility of miss-operating using c1 and c2 value in below table. when designing board, it should design minimum length pattern around oscillator. and we recommend that oscillator evaluation try on your actual using board. (1) connection example (2) TMP91FW40FG recommended ceramic oscillator the TMP91FW40FG recommend the high-freque ncy oscillator by murata manufacturing co., ltd. please refer to the following url http://www.murata.com/ low-frequency oscillator high-frequency oscillator x1 x2 c1 c2 rd xt1 xt2 c1 c2 rd
tmp91fw40 2008-10-22 91fw40-76 5. port section equivalent circuit diagrams ? reading the circuit diagrams basically, the gate symbols written are the same as those used for the standard cmos logic ic [74hcxx] series. the dedicated signal is described below. stop : this signal becomes active 1 when the halt mode setting register is set to the stop mode (syscr2 = ?01?) and the cpu executes the halt instruction. when the drive enable bit syscr2 is set to ?1?, however stop remains at ?0?. ? the input protection resistance ranges from several tens of ohms to several hundreds of ohms. p0 (seg24~seg31), p1 (seg16~seg23), p2 (seg8~seg15), pb (seg32~seg39) p5 (an0~an3/kwi0~kwi3) p60 (int0) lcd output enable v cc output data p-ch input/output input data output enable stop input enable n-ch seg output analog input channel select input input data analog input input enable input input enable input data
tmp91fw40 2008-10-22 91fw40-77 p61 (int1) p62(alarm), p70~p75(ecnt1~ ecnt3, ecin1~ecin3), p91(rx d0), p92(sclk0/cts0), p94 (rxd1), p95(sclk1/cts1), pa1(rxd2), pa2( sclk2/cts2), pa4(rxd3), pa5(sclk3/cts3) p80~p83(tc5out~tc8out), p90(txd0), p93(txd1), pa0(txd2), pa3(txd3) v cc output data p-ch input/output input data output enable stop input enable n-ch vcc output data input data output enable stop input enable p-ch n-ch input/output open-drain output enable v cc output enable stop input enable n-ch output data p-ch input/output input data
tmp91fw40 2008-10-22 91fw40-78 xt1, xt2 x1, x2 nmi am0~am1 input nmi schmitt trigge r input x2 high-frequency oscillator enable oscillator circuit p-ch n-ch clock x1 xt1 xt2 clock low-frequency oscillation enable
tmp91fw40 2008-10-22 91fw40-79 reset vrefh, vrefl input wdtout reset enable reset schmitt trigge r p-ch vcc vrefh vrefon vrefl p-ch ladder resistors
tmp91fw40 2008-10-22 91fw40-80 6. package lqfp100-p-1414-0.50f unit: mm

▲Up To Search▲

Price & Availability of TMP91FW40FG

	To Download TMP91FW40FG Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .