View AN1528_8153096.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

AN1528/0105 1/18 rev. 3.0 AN1528 application note st92f120/f124/150/f250 testflash introduction the testflash is a st reserved flash area that contains device informat ion, flash parameters and the boot code. this boot code contains the protocol for in-system programming and the routines for e3 tm initialization and management. the testflash is programmed by st at the factory before shipping and cannot be erased or programmed in user mode. the purpose of this document is to give an s ufficiently accurate description of the testflash content to allow the user to access to the different parameters and routines included in the testflash. after an overview of the testflash content, the document describes the different routines that can be called at any time by the user code. the last part of this document provides guidelines on the way to handle an e3 tm failure. 1 glossary and acronyms the terms, abbreviations and acronyms used in this document are listed below and described in alphabetical order. ? confxr: configuration x register ? nvapr: non volatile access protection register ? nvcssx: nv complementary sector status x ? nvespx: nv emulation status pointer x ? nvpwdx: non volatile password x ? nvwpr: non volatile write protection register ? redxr: redundancy x register ? vcssx: volatile complementary sector status x ? vespx: volatile emulation status pointer x 1
2/18 table of contents 18 1 introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 glossary and acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.1 vector table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1.1 device identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1.2 testflash code revision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.2 user otp area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.3 protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3 routines description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.1 power-on routine (230020h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.2 non maskable interrupt routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3.3 code update routine: in-system programming . . . . . . . . . . . . . . . . 8 3.4 e3 tm initialization routine (230026h) . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.5 e3 tm swap error routines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.5.1 find wrong pages (230029h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 3.5.2 find wrong bytes (23002ch) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.5.3 complete aborted swap (23002fh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.6 e3 tm reset to delivery status (230032h) . . . . . . . . . . . . . . . . . . . . . . 14 3.7 user routine for external watchdog refresh . . . . . . . . . . . . . . 15 4 e3 tm failure recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 4.1 erase or write error: fatal error . . . . . . . . . . . . . . . . . . . . . . . . . . 17 4.2 swap error: non fatal error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 4.2.1 generate a reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 4.2.2 call the ?complete aborted swap phase? routine in testflash. . . . . . . . . . . 17
3/18 st92f120/f124/150/f250 testflash 2 overview the structure of the testflash content is shown by the following figure: figure 1. st9 testflash content vector table power-on code update routine (in-system programming) otp area 124 bytes protections 230000h 230020h 231f78h 231f80h 231ffch routine 230023h sci interrupt routines 230026h e3 tm initialization e3 tm management routines 230029h e3 tm swap error: find wrong pages 23002ch e3 tm swap error: find wrong bytes in given page 23002fh e3 tm swap error: complete aborted swap phase e3 tm reset to delivery status 230032h 230035h reserved for testing (248 bytes) 231e80h 230e80h not used (4 kbytes) 2
4/18 st92f120/f124/150/f250 testflash 2.1 vector table the first 16 words of the testflash contain the vector table. the power-on vector is read when exiting from reset. the monitor vector is read in em- bedded emulation mode after an etrap instruction or an external break. the nmi vector is read if a non maskable interrupt occurs. the sci interrupt vectors are used for the in-system programming routine. figure 2. vector table 2.1.1 device identifier this identifier contains the information about th e device, its flash size and its reset vector lo- cation. 2.1.2 testflash code revision the checksum is the sum of all the bytes from 230000h to 230e77h, it can be used to verify if the actual testflash content is the most recent one, or if the testflash content is corrupted. 2.2 user otp area the 124 bytes of testflash from 231f80h to 231ffbh are available to the user application as one time programmable area (not erasable). rev 2.6 rev 2.7 rev 2.7.1 device flash size device id (230008h) tf rev (23000 ah) testflash checksum tf rev (23000 ah) testflash checksum tf rev (23000 ah) testflash checksum st92f124/f150 64k 1024h xx26h 9 33bfh xx27h 8fc55h 0127h 8fbebh st92f124/f150 128k 1080h xx26h 9341bh xx27h 8fcb1h 0127h 8fc47h st92f250 256k 1100h xx26h 9339ch xx27h 8fc32h 0127h 8fbc8h 230000h 230002h vector table power-on vector monitor vector 230004h nmi vector 230006h mask set number 230010h sci error vector 230012h 230014h 230016h sci address match vector sci receiving end vector sci transmitting end vector 230008h device identifier 23000ah testflash code revision
5/18 st92f120/f124/150/f250 testflash 2.3 protections the testflash locations shown by the following figure have a special meaning related to the access and write flash protection features (refer to the datasheets). figure 3. protection map nvapr nvwpr 231ffch 231ffdh protection 231ffeh nvpwd0 nvpwd1 231fffh
6/18 st92f120/f124/150/f250 testflash 3 routines description 3.1 power-on routine (230020h) inputs: none. outputs: r0, r1. variables: r2-r47, r160-r223 (for stack). goal: to perform the initializations of st9 device (boot code). the power-on routine is executed automatically when exiting reset. the power-on routine performs the following operations: initialize the stack pointer in the register f ile (for this reason, this routine modifies the registers of group a, b, c and d). call the ?e3 tm initialization routine? (230026h). initialize the mmu paged registers as shown by the following table. set bit memsel (bit 4) in the r246 (emr2) register page 21 set the register page pointer to page 0. set group 0 as working registers. set program memory. read in 000000h the first word of segment 0h (flash memory), that is interpreted as the power-on vector of the user application. (warni ng: if the device identifier is equal to 0080h, the user reset vector is read in 01e000h instead of in 000000h). table 1. mmu registers initialization register value seg notes dpr0 - r240 00h 0h 1st 16k-page dpr1 - r241 01h 0h 2nd 16k-page dpr2 - r242 02h 0h 3rd 16k-page dpr3 - r243 80h 20h 1st 16k-page isr - r248 00h 0h dmasr - r249 20h 20h mpsr - r250 21h 21h mdpr0 - r251 84h 21h 1st 32k-page mdpr1 - r252 86h 21h 2nd 32k-page
7/18 st92f120/f124/150/f250 testflash check the value of the sout0 pin (sout pin of sc i0 macrocell): if it is low, the ?code update routine? is called. check the power-on vector of the user applicati on: if its value is ffffh halt instruction is executed, otherwise the execution jumps into the location it points to. the user application should check the 2 output variables of the power-on routine: the ?e3 tm initialization routine? writes an output code in the r0 register to show if the initiali- zation has been successful (good code: a4h), or if the e3 tm nv pointers are completely cor- rupted (bad code: 40h) and the user software has to call the ?e3 tm reset routine? (230032h). the ?code update routine? writes an output code in the r1 register to show if no update has been requested or the update has been requested and the sci communications have been performed correctly (good code: 23h), or if the update has been requested, but the sci com- munications has not been performed correctly in the timeout of 10ms (for a fosc frequency of 4mhz) (bad code: 3fh). due to the ?e3 tm initialization routine?, the power-on routine can last a long time. the typical duration of the power-on routine as a function of the external clock period tck is shown in the following table. 3.2 non maskable interrupt routine inputs: none. outputs: none. variables: none. goal: react to a non maskable interrupt when the vector table is remapped in testflash. this routine should never be ca lled, since the vector table is normally mapped in the flash address space. this routine does not perform any operation, simply returns from interrupt. table 2. power-on routine typical duration condition typical power-on routine duration with fosc=4mhz normal operation (no e3 tm operation) 33 ms sout0 pulled low, no code update 42 ms aborted e3 tm write operation (worst case) 165 ms (1) (1) this duration depends also on e3 erasing and programming times
8/18 st92f120/f124/150/f250 testflash 3.3 code update routine: in-system programming inputs: none. outputs: r1. variables: r4-r15, r208-r223 (for stack). goal: in-system programming of the flash memory content. the code update routine is automatically called by the power-on routine if the sout0 pad is checked low. the code update routine performs the following operations: enable the sci0 peripheral in synchronous mode; transmit a synchronisation datum (25h); wait for an address match (23h) with a timeout of 10ms (with an fosc frequency of 4mhz).; if the match is not received before the timeout, the execution returns to the power-on routine with an error code in the output register r1 (25h); if the match is received, the sci0 transmits a new datum (21h) to tell the external device that it is ready to receive the data to be loaded in ram (that represents the code of the in-system programming routine); receive two data bytes representing the numb er of bytes to be loaded (max 4kbyte); receive the specified number of bytes (each one preceded by the transmission of a ready to receive character: 21h) and write them in internal ram starting from address 200010h; the first 4 words should be the interrupt vec tors of the 4 possible sci interrupts, to be used by the in-system programming routine. transmit a last datum (21h) as an end of communication request; receive the end of communication confirmation datum (any byte other than 25h); reset all the unused ram locations to ffh; call the address 200018h in internal ram. after completion of the in-system programming routine, an halt instruction is executed and a hardware reset is needed. the code update routine initializes the sci0 peripheral as shown in the following table: table 3. sci0 registers (page 24) initialization register value notes ivr - r244 10h vector table in 0010h acr - r245 23h address match is 23h idpr - r249 00h sci interrupt priority is 0
9/18 st92f120/f124/150/f250 testflash the code update routine also remaps the interrupts in testflash (isr = 23h), and configures pins 3 (sout0) and 4 (clkout0) of port 5 as alternate function. the code update routine uses 4 interrupt routines: sci receiver error interrupt routine (vector in 0010h), sci address match interrupt routine (vector in 0012h), sci receiver data ready interrupt routine (vector in 0014h), sc i transmitter buffer empty interrupt routine (vector in 0016h). 3.4 e3 tm initialization routine (230026h) inputs: none. outputs: r0. variables: r1-r47, r160-r223 (for stack). goal: to initialize the e3 tm hardware emulation. this routine is automatically called by the power- on routine, but it can be also called by any other routine through a far call: calls 23h, 0026h ;e3 tm init the e3 tm initialization routine performs the following operations: read the nvcss1 registers of sector e0 (229003h) and e1 (22d003h); if the values of the two nvcss1 registers are not coherent, the routine returns with the error code 40h, without completing the e3 tm initialization; if an aborted erase phase is detected, a se ctor erase operation is performed on the bad sector; write the vcss1 register (222003h) with the sector number currently mapping the e3 tm data; read the nvcss0 registers of sector e0 (229001h) and e1 (22d001h); chcr - r250 83h 8 data bits ccr - r251 e8h rec. clock: ext rxclk0 trx clock: int clkout0 brghr - r252 00h brglr - r253 04h baud rate divider is 4 sicr - r254 83h synchronous mode socr - r255 01h table 3. sci0 registers (page 24) initialization register value notes
10/18 st92f120/f124/150/f250 testflash if the values of the two nvcss0 registers are not invalid, the routine returns with the error code 40h, without completing the e3 tm initialization; if an aborted erase phase is detected, a se ctor erase operation is performed on the bad sector; write the vcss0 register (222001h) with the number of the last completed erase phase on complementary sector; read the nvesp0-63 registers of sector e0 (229000h-22907eh) and e1 (22d000h- 22d07e); if the values of a pair of nvespx registers ar e invalid, the routine returns with the error code 40h, without completing the e3 tm initialization; if an aborted swap phase is detected, the swap is completed and a sector erase operation is performed on the old sector; write each of the vesp0-63 registers (22200 0h-2223f0h) with the block number in which the relative page is mapped; each time an e3 tm write operation is performed, a user routine is called to refresh an external watchdog if needed. 3.7 user routine for external watchdog refresh for details. the user application should check the output variable of the e3 tm initialization routine: register r0 shows if the e3 tm initialization has been possible (good code: a4h), or if the e3 tm nv pointers are invalid and the initialization has not been completed (bad code: 40h). in case of an initialization error, the e3 tm nv pointers can be reset to a valid content through a far call to the ?e3 tm reset routine? (230032h): calls 23h, 0032h ;e3 tm reset note that in this case, any data present in the e3 tm is lost.
11/18 st92f120/f124/150/f250 testflash 3.5 e3 tm swap error routines 3.5.1 find wrong pages (230029h) inputs: none. outputs: r16-r23. variables: r192-r223 (for stack). goal: to find the pages in which some new data are different from the old ones after a swap fail. this routine has to be called by the user applic ation if bits feerr of fesr0 (224002h) reg- ister and swer of fesr1 (224003h) register are set after an e3 tm write operation. it can be called through a far call: calls 23h, 0029h ;find wrong pages this routine performs the following operations: initialize a page counter (from 00h to 3fh); read the 16 bytes of the current page in the new block (new data after swap); read the 16 bytes of the current page in the old block (old data before swap); if at least one of the new and old data differs, set the output flag corresponding to the current page; increment the page counter and repeat the 3 preceding steps, untill the last page is reached; the user application should check the 8 output variables, which are explained in the following table: table 4. wrong pages output meaning reg bit 0 meaning 1 meaning r16 0 page 00h ok page 00h wrong r16 x pg 00h+x ok pg 00h+x wrong r16 7 page 07h ok page 07h wrong r17 0 page 08h ok page 08h wrong r17 x pg 08h+x ok pg 08h+x wrong r17 7 page 0fh ok page 0fh wrong r18 x pg 10h+x ok pg 10h+x wrong r19 x pg 18h+x ok pg 18h+x wrong r20 x pg 20h+x ok pg 20h+x wrong r21 x pg 28h+x ok pg 28h+x wrong
12/18 st92f120/f124/150/f250 testflash 3.5.2 find wrong bytes (23002ch) inputs: r2-r3. outputs: r0-r1. variables: r192-r223 (for stack). goal: to find in the specified page the bytes different from the old ones after a swap fail. this routine has to be called by the user applic ation if bits feerr of fesr0 (224002h) reg- ister and swer of fesr1 (224003h) register are set after an e3 tm write operation. after having executed the ?find wrong pages routine?, thi s routine can be called through a far call, providing as input in rr2 the address of the first byte of the page to check: ldw rr2, #01c0h;if page 1ch is wrong calls 23h, 002ch ;find wrong bytes this routine performs the following operations: initialize a byte counter (from 0h to fh); read the current byte in the new block (new data after swap); read the current byte in the old block (old data before swap); if the new and old data differs, set the output flag corresponding to the current byte; increment the byte counter and repeat the 3 preceding steps, untill the last byte is reached; the user application should check the 2 output variables, which are explained in the following table: r22 0 page 30h ok page 30h wrong r22 x pg 30h+x ok pg 30h+x wrong r22 7 page 37h ok page 37h wrong r23 0 page 38h ok page 38h wrong r23 x pg 38h+x ok pg 38h+x wrong r23 7 page 3fh ok page 3fh wrong table 5. wrong bytes output meaning reg bit 0 meaning 1 meaning r1 0 byte 0h ok byte 0h wrong r1 x byte 0h+x ok byte 0h+x wrong r1 7 byte 7h ok byte 7h wrong r0 0 byte 8h ok byte 8h wrong table 4. wrong pages output meaning reg bit 0 meaning 1 meaning
13/18 st92f120/f124/150/f250 testflash 3.5.3 complete aborted swap (23002fh) inputs: none. outputs: r0. variables: r192-r223 (for stack). goal: complete the aborted swap phase after a swap fail. this routine has to be called by the user application if after an e3 tm write operation the bits feerr of fesr0 (224002h) and swer of fe sr1 (224003h) are set. after having executed the ?find wrong pages routine? and the ?find wr ong bytes routine?, and after having stored in ram the e3 tm addresses and data to program again, this routine can be called through a far call: calls 23h, 002fh ;complete swap this routine performs the following operations: perform a sector erase operation on the old sector; during the sector erase operation, a user rout ine is called toy refresh an external watchdog if necessary. 3.7 user routine for external watchdog refresh for details. write the vcss1 register (222003h) with the sector number currently mapping the e3 tm data; write the vcss0 register (222001h) with the number of the last completed erase phase on the complementary sector; the user application should check the output variable of the complete swap routine: register r0 shows if the sector erase operation has been completed correctly (good code: a4h), or if has failed (bad code: 40h). r0 x byte 8h+x ok byte 8h+x wrong r0 7 byte fh ok byte fh wrong table 5. wrong bytes output meaning reg bit 0 meaning 1 meaning
14/18 st92f120/f124/150/f250 testflash 3.6 e3 tm reset to delivery status (230032h) inputs: none. outputs: r0. variables: r192-r223 (for stack). goal: erase sectors e0 and e1 and program the nv pointers so that e0 is the current sector with all the pages mapped in block 0 and e1 is completely erased. this routine has to be called by the user application if the e3 tm nv pointers have lost any co- herence and can be no more correctly interpreted by the ?power-on routine?. this routine can be called through a far call: calls 23h, 0032h ;e3 tm reset this routine performs the following operations: perform a sector erase operation on sector e0; perform a sector erase operation on sector e1; program fdh in the nvcss1 register of sector e0 (229003h); write 00h in the vcss1 register (222003h): e0 is the sector currently mapping the e3 tm data; program 00h in the nvcss0 register of sector e0 (229001h); write 30h in the vcss0 register (222001h): erase phase 3 has been completed on complementary sector e1; program eeh in the nvesp0-63 register s of sector e0 (229000h-22907eh); write 00h in the vesp0-63 registers (222000h- 2223f0h): all pages are mapped in block 0 of sector e0; each time an e3 tm write operation is performed, a user routine is called to eventually refresh an external watchdog. 3.7 user routine for external watchdog refresh for details. the user application should check the output variable of the e3 tm reset routine: register r0 shows if the sector erase operations have been completed correctly (good code: a4h), or if have failed (bad code: 40h).
15/18 st92f120/f124/150/f250 testflash 3.7 user routine for external watchdog refresh inputs: none. outputs: none. variables: none. goal: to refresh the external watchdog during the bootrom code execution. this routine has to be written by the user in flash. the address where the routine starts has to be written in 000006h (1 word), while the segment where the routine is located has to be written in 000009h (1 byte). this routine is called at least once every time that the bootrom execution performs an e3 tm write operation. if the write operations has a long duration, the user routine is called with a rate fixed by location 000008h: with an internal cl ock frequency of 2mhz, location 000008h fixes the number of milliseconds to wait between two calls of the user routine. if location 000006h is virgin (ffffh) , the user routine is not called. the user routine is called only by the e3 tm management routines (e3 tm swap error routines, e3 tm reset routine) in testflash revisions 2.5 and 2.6, but is also called by the e3 tm initializa- tion routine at power on in testflash version 2.5. to avoid modifying the user initialization, wh en the bootrom code calls the user routine, it does not perform the standard initializations: the mmu paged registers are set as shown by the following table. table 6. user routine parameters location size notes 000006h 2 byte user routine address 000008h 1 byte ms rate at 2mhz 000009h 1 byte user routine segment table 7. mmu registers initialization register value seg notes dpr0 - r240 00h 0h 1st 16k-page dpr1 - r241 89h 22h 2nd 16k-page dpr2 - r242 8ah 22h 3rd 16k-page dpr3 - r243 8bh 22h 4th 16k-page isr - r248 xxh xxh not modified dmasr - r249 xxh xxh not modified
16/18 st92f120/f124/150/f250 testflash bit memsel (bit 4) of r246 (emr2) page 21 is not modified. the register page pointer is set to page 21. group 0 is set as the working register group. data memory is set. the user routine must avoid modifying the co ntext of the bootrom routine. the following reg- isters must not be modified when the user routine returns: system stack pointer: rr238. page pointer: r234. register pointers: rr232. bit 0 of flag register: r231. data page pointers dpr0-3. registers of groups 0 and 1. mpsr - r250 xxh xxh not modified mdpr0 - r251 xxh xxh not modified mdpr1 - r252 xxh xxh not modified table 7. mmu registers initialization register value seg notes
17/18 st92f120/f124/150/f250 testflash 4 e3 tm failure recovery 4.1 erase or write error: fatal error st guarantees 100 000 erase cycles endurance for the e3 tm , which correponds to 800 000 write cycles for the most updated page (1 page contains 16 bytes). but after this period, an erase error or a write error may occur. this erro r is due to one or several flash cells that cannot be erased (logic level 1) or programmed (logic level 0) anymore. this is a hardware failure and the only workaround is to not use these bytes, which means that the data must be relocated. as each time a data is updated, the whole pag e is recopied, consequently the whole page should be remapped in order to avoid any erase/write error at the same location. 4.2 swap error: non fatal error a swap error may occur during the e3 tm product life. till now, no sw ap error has been identi- fied in any application using the emulated e3 tm of the st9. anyway, this error is not fatal and there are 2 ways to recover: 4.2.1 generate a reset generating a software reset will automatically execute the testflash, which will complete the e3 tm swap operation. it will restore the e3 tm content as it was before the last writing attempt, which means that the last updated data is lost. 4.2.2 call the ?complete aborted sw ap phase? routine in testflash. the fastest way to complete the swap operation is to call the routine ?complete aborted swap phase? directly in testflash. this is done by the instruction: calls 0x23, 0x002f ;complete swap the ?complete aborted swap phase? routine will restore the e3 tm content as it was before the last write attempt, which means that the last updated data is lost. it is possible for the user to find exactly what was the last page and byte wr itten by calling the routines ?find wrong page? and then ?find wrong byte?.
18/18 st92f120/f124/150/f250 testflash ?the present note which is for guidance only aims at providing customers with information regarding their products in order for them to save time. as a result, stmicroelectronics shall not be held liable for any direct, indirect or consequential damages with respect to any claims arising from the content of such a note and/or the use made by customers of the information contained herein in connection with their products.? information furnished is believed to be accurate and reliable. however, stmicroelectronics assumes no responsibility for the co nsequences of use of such information nor for any infringement of patents or other rights of third parties which may result from its use. no license is granted by implication or otherwise under any patent or patent rights of stmicroelectronics. specifications mentioned in this publicati on are subject to change without notice. this publication supersedes and replaces all information previously supplied. stmicroelectronics prod ucts are not authorized for use as critical components in life support devices or systems without express written approval of stmicroelectro nics. the st logo is a registered trademark of stmicroelectronics. all other names are the property of their respective owners ? 2005 stmicroelectronics - all rights reserved stmicroelectronics group of companies australia ? belgium - brazil - canada - china ? czech republic - finland - france - germany - hong kong - india - israel - ital y - japan - malaysia - malta - morocco - singapore - spain - sweden - switzerland - united kingdom - united states of america www.st.com

▲Up To Search▲

Price & Availability of AN1528

	To Download AN1528 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .