View TMP91FW27FG_8305147.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

toshiba original cmos 16-bit microcontroller tlcs-900/l1 series tmp91fw27ug TMP91FW27FG semiconductor company
preface thank you very much for making us e of toshiba microcomputer lsi. before using this lsi, refer to secti on ?points of note and restrictions?. especially, take care below cautions. ** caution ** how to release the halt mode usually, interrupts can release all hal ts stats. however, the interrupts = ( nmi , int0, intrtc), which can release the halt mode may not be able to do so if they are input during the per iod cpu is shifting to the halt mode (for about 5 clocks of f fph ) with idle1 or stop mode (idle2 is not applicable to this case). (in this case, an interupt request is kept on hold internally.) if another interupt is generated after it has shifted to halt mode completely, halt status can be released wit hout difficultly. the priori ty of this interrupt is compare with that of the interrupt kept on hold internally, and the interrupt with higher priority is handled first fo llowed by the other interrupt.
tmp91fw27 2007-11-02 91fw27-1 cmos 16-bit microcontrollers tmp91fw27ug / TMP91FW27FG 1. outline and features tmp91fw27 is a high-speed 16-bit microcontroller designed for the control of various mid-to large-scale equipment. tmp91fw27ug and TMP91FW27FG come in a 64- pin flat package. listed below are the features. (1) high-speed 16-bit cpu (900/l1 cpu) ? instruction mnemonics are upward-compatible with tlcs-90/900 ? 16 mbytes of linear address space ? general-purpose registers and register banks ? 16-bit multiplication and division instructions; bit transfer and arithmetic instructions ? micro dma: 4 channels (593 ns /2 bytes at 27 mhz) (2) minimum instruction exec ution time: 148 ns (at 27 mhz) (3) built-in ram: 12 kbytes built-in rom: 128-kbyte flash memory 4-kbyte mask rom (used for booting) restrictions on product use 20070701-en ? the information contained herein is subject to change without notice. ? toshiba is continually working to improve the quality and reliability of its products. nevertheless, semiconductor devices in general can malfunction or fail due to their inherent electrical sensitivity an d vulnerability to physical stress. it is the responsibility of t he buyer, when utilizing toshiba products, to comply with the standards of safety in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such toshiba products could cause loss of human life, bodily injury or damage to property. in developing your designs, please ensure that toshiba products are used within specified operating ranges as set forth in the most recent toshib a products specifications. also, please keep in mind the precautions and conditions set forth in the ?handling guide for semiconduct or devices,? or ?toshiba semiconductor reliability handbook? etc. ? the toshiba products listed in this document are intend ed for usage in general electronics applications (computer, personal equipment, office equipment, measuring equipmen t, industrial robotics, domestic appliances, etc.).these toshiba products are neither intended nor warranted for us age in equipment that requires extraordinarily high quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury (?unintended usage?). unintended usage include atomic energy control instruments, airplane or spaceship instruments, transportation instrument s, traffic signal instruments, combus tion control instruments, medical instruments, all types of safety devices, etc.. uninte nded usage of toshiba products listed in his document shall be made at the customer?s own risk. ? the products described in this document shall not be used or embedded to any downstream products of which manufacture, use and/or sale are prohibited under any applicable laws and regulations. ? the information contained herein is presented only as a gui de for the applications of our products. no responsibility is assumed by toshiba for any infringements of patents or other rights of the third partie s which may result from its use. no license is granted by implicat ion or otherwise under any patents or other rights of toshiba or the third parties. ? please contact your sales representative for product- by-product details in this document regarding rohs compatibility. please use these products in this document in compliance with all applicable laws and regulations that regulate the inclusion or use of cont rolled substances. toshiba assumes no liability for damage or losses occurring as a result of noncompliance with applicable laws and regulations. this product uses the super flash? technology u nder the license of silicon storage technology,inc. super flash? is a registered tradem ark of silicon storage technology,inc.
tmp91fw27 2007-11-02 91fw27-2 (4) external memory expansion ? expandable up to 16 mbytes (shared program/data area) ? can simultaneously support 8-/16-bit width ex ternal data bus (dynamic data bus sizing) (5) 8-bit timers: 6 channels (6) 16-bit timers: 1 channel (7) general-purpose serial interface: 2 channels ? uart/synchronous mode: 2 channels ? irda ver.1.0 (115.2 kbps) mode selectable: 1 channel (8) serial bus interface: 1 channel ? i 2 c bus mode/clock synchr onous mode selectable (9) 10-bit ad converter (sample hold circuit is inside): 4 channels (10) watchdog timer (11) special timer for clock (12) chip select/wait controller: 4 blocks (13) interrupts: 34 interrupts ? 9 cpu interrupts: software interrupt instruction and illegal instruction ? 21 internal interrupts: 7 prio rity levels are selectable ? 4 external interrupts: 7 prio rity levels are selectable (among 3 interrupts are selectable edge mode) (14) input/output ports: 53 pins (15) stand-by function three halt modes: idle2 (programmable), idle1 and stop (16) clock controller ? clock gear function: select a high-frequency clock fc to fc/16 ? special timer for clock (fs = 32.768 khz) (17) operating voltage ? vcc = 2.7 v to 3.6 v (fc max = 27 mhz, flash memory read operation) ? vcc = 2.2 v to 3.6 v (fc max = 16 mhz, flash memory read operation) ? vcc = 2.7 v to 3.6 v (fc max = 27 mhz, flash memory erase/program operations) (18) package ? lqfp64-p-1010-0.50d (tmp91fw27ug) ? qfp64-p-1414-0.80a (TMP91FW27FG)
tmp91fw27 2007-11-02 91fw27-3 figure 1.1 tmp91fw27 block diagram ( ): initial function after resert [ ]: during resert 10-bit 4-channel ad converter sio/uart/irda (channel 0) sio/uart (channel 1) adtrg (p53) an0~an3 (p50~p53) avcc, avss txd0 (p90) rxd0 (p91) sclk0/ cts0 (p92) txd1 (p93) rxd1 (p94) sclk1/ cts1 (p95) 8-bit timer (tmra0) 8-bit timer (tmra1) ta0in (p70) wa bc de hl ix i y iz sp xwa xbc xde xhl xix xiy xiz xsp 32 bits f sr pc 12-kb ram 128-kb flash eeprom port 0 port 3 interrupt controller high speed oscillator clock gear dvcc dvss x1 x2 a d0~ad7 ( p00~p07 ) rd (p30) [ boot ] wr (p31) hwr (p32) cpu (tlcs-900/l1) low speed oscillator xt1 (p96) xt2 (p97) reset a m0 a m1 a le serial bus interface (sbi) sck (p60) so/sda (p61) si/scl (p62) ta1out (p71) 8-bit timer (tmra2) 8-bit timer (tmra3) ta3out (p72) 8-bit timer (tmra4) 8-bit timer (tmra5) ta4in (p73) ta5out (p74) watchdog timer (wdt) special timer for clock 4-kb boot rom port 1 a d8/a8~ad15/a15 ( p10~p17 ) port 2 cs0 ~ cs2 ( p40~p42 ) port 6 cs/wait controller (4-block) 16-bit timer (tmrb0) tb0in0/int5 (p80) tb0in1/int6 (p81) tb0out0 (p82) tb0out1 (p83) nmi int0 (p63) a 0/a16~a5/a21 (p20~p25)
tmp91fw27 2007-11-02 91fw27-4 2. pin assignment and pin functions the assignment of input/output pins for the tmp91fw27, their names and functions are as follows: 2.1 pin assignment diagram figure 2.1.1 shows the pin assignment of the tmp91fw27ug and TMP91FW27FG. figure 2.1.1 pin assignment diagram (64-pin lqfp, qfp) p61/so/sda 57 p62/si/scl 58 p63/int0 59 p50/an0 60 p51/an1 61 p52/an2 62 p53/an3/ adtrg 63 avcc 64 top view lqfp64, qfp64 56 p60/sck 55 p42/ cs2 54 p41/ cs1 53 p40/ cs0 52 p32/ hwr 51 p31/ wr 50 p30/ rd / boot 49 p25/a5/a21 avss 1 p70/ta0in 2 p71/ta1out 3 p72/ta3out 4 p73/ta4in 5 p74/ta5out 6 p80/tb0in0/int5 7 p81/tb0in1/int6 8 p82/tb0out0 9 p83/tb0out1 10 p90/txd0 11 p91/rxd0 12 p92/sclk0/ cts0 13 p93/txd1 14 p94/rxd1 15 p95/sclk1/ cts1 16 am0 17 dvcc 18 x2 19 dvss 20 x1 21 am1 22 reset 23 p96/xt1 24 32 p04/ad4 31 p03/ad3 30 p02/ad2 29 p01/ad1 28 p00/ad0 27 ale 26 nmi 25 p97/xt2 48 p24/a4/a20 47 p23/a3/a19 46 p22/a2/a18 45 p21/a1/a17 44 p20/a0/a16 43 p17/ad15/a15 42 p16/ad14/a14 41 p15/ad13/a13 40 p14/ad12/a12 39 p13/ad11/a11 38 p12/ad10/a10 37 p11/ad9/a9 36 p10/ad8/a8 35 p07/ad7 34 p06/ad6 33 p05/ad5
tmp91fw27 2007-11-02 91fw27-5 2.2 pin names and functions the names of the input/output pins and their functions are described below. table 2.2.1 and table 2.2.2 show pin names and functions. t able 2.2.1 pin names and functions (1/2) pin names number of pins i/o functions p00 to p07 ad0 to ad7 8 i/o i/o port 0: i/o port that allows i/o to be selected at the bit level address data (lower): 0 to 7 of address/data bus p10 to p17 ad8 to ad15 a8 to a15 8 i/o i/o output port1: i/o port that allows i/o to be selected at the bit level address data (upper): 8 to 15 of address/data bus address: 8 to 15 of address bus p20 to p25 a0 to a5 a16 to a21 6 i/o output output port 2: i/o port that allows i/o to be selected at the bit level address: 0 to 5 of address bus address: 16 to 21 of address bus p30 rd boot 1 output output input port 30: output port read: strobe signal for reading external memory when read internal area also, output rd by setting to p3 = 0 and p3fc = 1. this pin sets single boot mode (only during reset). for the details, please refer to section 3.2.3, ?operation modes?. p31 wr 1 output output port 31: output port write: strobe signal for writing data to pins ad0 to ad7 p32 hwr 1 i/o output port 32: i/o port (with pull-up resistor) high write: strobe signal for writing data to pins ad8 to ad15 p40 cs0 1 i/o output port 40: i/o port (with pull-up resistor) chip select 0: outputs ?0? when address is within specified address area. p41 cs1 1 i/o output port41: i/o port (with pull-up resistor) chip select 1: outputs ?0? when address is within specified address area. p42 cs2 1 i/o output port 42: i/o port (with pull-up resistor) chip select 2: outputs ?0? when address is within specified address area. p50 to p53 an0 to an3 adtrg 4 input input input port 5: input port analog input: analog input pins of the ad converter ad trigger: pin used to request ad start (shared with p53). p60 sck 1 i/o i/o port 60: i/o port serial bus interface clock i/o at sio mode p61 so sda 1 i/o output i/o port 61: i/o port serial bus interface send data at sio mode serial bus interface send/receive data at i 2 c mode open-drain output mode by programmable p62 si scl 1 i/o input i/o port 62: i/o port serial bus interface receive data at sio mode serial bus interface clock i/o at i 2 c mode open-drain output mode by programmable p63 int0 1 i/o input port 63: i/o port (schmitt input) interrupt request pin 0: interrupt reques t pin with level/ rising/falling edge p70 ta0in 1 i/o input port 70: i/o port 8-bit timer 0 input: input pin of 8-bit timer tmra0 p71 ta1out 1 i/o output port 71: i/o port 8-bit timer 1 output: output pin of 8-bit timer tmra0 or tmra1 p72 ta3out 1 i/o output port 72: i/o port 8-bit timer 3 output: output pin of 8-bit timer tmra2 or tmra3
tmp91fw27 2007-11-02 91fw27-6 table 2.2.2 pin names and functions (2/2) pin names number of pins i/o functions p73 ta4in 1 i/o input port 73: i/o port 8-bit timer 4 input: input pin of 8-bit timer tmra4 p74 ta5out 1 i/o output port 74: i/o port 8-bit timer 5 output: output pin of 8-bit timer tmra4 or tmra5 p80 tb0in0 int5 1 i/o input input port 80: i/o port 16-bit timer 0 input 0: input of count/capture trigger in 16-bit timer tmrb0 interrupt request pin 5: interrupt reques t pin with selectable rising/falling edge p81 tb0in1 int6 1 i/o input input port 81: i/o port 16-bit timer 0 input 1: input of count/capture trigger in 16-bit timer tmrb0 interrupt request pin 6: interrupt request pin of rising edge p82 tb0out0 1 i/o output port 82: i/o port 16-bit timer 0 output 0: outpit pin of 16-bit timer tmrb0 p83 tb0out1 1 i/o output port 83: i/o port 16-bit timer 0 output 1: output pin of 16-bit timer tmrb0 p90 txd0 1 i/o output port 90: i/o port serial 0 send data: open-drain output pin by programmable p91 rxd0 1 i/o input port 91: i/o port serial 0 receive data p92 sclk0 cts0 1 i/o i/o input port 92: i/o port serial 0 clock i/o serial 0 data send enable (clear to send) p93 txd1 1 i/o output port 93: i/o port serial 1 send data: open-drain output pin by programmable p94 rxd1 1 i/o input port 94: i/o port serial 1 receive data p95 sclk1 cts1 1 i/o i/o input port 95: i/o port serial 1 clock i/o serial 1 data send enable (clear to send) p96 xt1 1 i/o input port 96: i/o port. open-drain output pin. low frequency oscillator connection pin p97 xt2 1 i/o output port 97: i/o port. open-drain output pin. low frequency oscillator connection pin ale 1 output address latch enable (it can be set as prohibition of an output for noize reduction.) nmi 1 input non-maskable interrupt request pin: interrupt request pin with programmable falling edge level or with both edge levels programmable (schmitt input). am0 and am1 2 input operation mode: fixed to am1 = ?1? and am0 = ?1?. reset 1 input reset: initialize lsi. (schmitt input, with pull-up resistor) avcc 1 pin used to both power supply pin for ad converter and standard power supply for ad converter (h). avss 1 pin used to both gnd pin for ad converter (0 v) and standard power supply pin for ad converter (l). x1/x2 2 i/o high frequency o scillator connection pin. dvcc dvss 1 1 power supply pins (all dvcc pins should be connected with the power supply pin). gnd pins (all pins shuold be connected with gnd(0v).)
tmp91fw27 2007-11-02 91fw27-7 3. functional description this section shows the hardware configuration of the tmp91fw27 and explains how it operates. this device is a version of the created by replacing the predecessor's internal mask rom with a 128-kbyte internal flash memory and expandin g its internal ram size to 12 kbytes. the configuration and the functionality of this device are the same as those of the tmp91cp27. for the functions of this device that are not descri bed here, refer to the tmp91cp27 data sheet. 3.1 memory map figure 3.1.1 shows a memory map of the tmp9 1fw27 in single-chip mode and its memory areas that can be accessed in each addressing mode of the cpu. figure 3.1.1 memory map (single-chip mode) internal i/o (4 kbytes) 000000h 16-mbytes area (r) ( ? r) (r + ) (r + r8/16) (r + d8/16) (nnn) direct area (n) 64-kbytes area (nn) ( = internal area) internal ram (12 kbytes) 128 kbytes internal rom vector table (256 bytes) 000100h 001000h 010000h fe0000h ffff00h ffffffh external memory 004000h
tmp91fw27 91fw27-8 2007-11-02 3.2 flash memory the tmp91fw27 incorporates flash memory that can be electrically erased and programmed using a single 3v power supply. the flash memory is programmed and erased using jedec-standard commands. after a program or erase command is input, the corres ponding operation is automatically performed internally. erase operations can be performed by th e entire chip (chip erase) or on a sector basis (sector erase). the configuration and operations of the flash memory are described below. 3.2.1 features ? power supply voltage for program/erase operations vcc = 2.7 v to 3.6 v ( ? 10 c to 40 c) ? configuration 64 k 16 bits (128 kbytes) ? functions single-word programming chip erase sector erase data polling/toggle bit ? sector size 4 kbytes 32 ? mode control jedec-standard commands ? programming method on-board programming parallel programmer ? security write protection read protection 3.2.2 block diagram figure 3.2.1 block diagram of flash memory unit internal address bus rom controller mode control mode setting pins control data flash memory column decoder/sense amp data latch address latch erase sector decoder control circuit (including automatic sequence control circuit) command register internal data bus internal control bus flash memory cells 128 kb row decoder a ddress
tmp91fw27 91fw27-9 2007-11-02 3.2.3 operation modes 3.2.3.1 overview the following three types of operation modes are available to control program/erase operations on the flash memory. table 3.2.1 description of operation modes operation mode name description single chip mode after reset release, the device starts up from the internal flash memory. single chip mode is further divided into two modes: ?normal mode? is a mode in which user application programs are executed, and ?user boot mode? is used to program the flash memory on-board. the means of switching between these two modes can be set by the user as desired. for example, it can be set so that port 00 = ?1? selects normal mode and port 00 = ?0? selects user boot mode. the user must include a routine to handle mode switching in a user application program. normal mode in this mode, the device star ts up from a user application program. user boot mode in this mode, the flash memo ry can be programmed by a user-specified method. single boot mode after reset release, the device starts up from the internal boot rom (m ask rom). the boot rom includes an algorithm which allows a program for programming/er asing the flash memory on-board via a serial port to be transferred to the device?s internal ram. the transferred program is then executed in the internal ram so that the flash memory can be programmed/erased by receiving data from an external host and issuing program/erase commands. programmer mode this mode enables the internal flash memory to be programmed/erased using a general-purpose programmer. for programmers that can be used, please contact your local toshiba sales representative. of the modes listed in 0 table 3.2.1, the internal flash me mory can be programmed in user boot mode, single boot mode and programmer mode. the mode in which the flash memory can be programmed/erased while mounted on the user board is defined as the on-board progra mming mode. of the modes listed above, single boot mode and user boot mode are classified as on-board programming modes. single boot mode supports toshiba?s proprietary programming/erase method using serial i/o. user boot mode (within single chip mode) allows the flash memory to be programmed/erased by a user-specified method. programmer mode is provided with a read protect function which prohibits reading of rom data. by enabling the read protect function upon completion of programming, the user can protect rom data from being read by third parties.
tmp91fw27 91fw27-10 2007-11-02 the operation mode ? single chip mode, single boot mode or programmer mode ? is determined during reset by externally setti ng the input levels on the am0, am1 and boot (p30) pins. except in programmer mode which is entered with reset held at ?0?, the cpu will start operating in the selected mode after the reset state is released. once the operation mode has been set, make sure that the input levels on the mode setting pins are not changed during operation. 1h1h table 3.2.2 shows how to set each operation mode, and 2h2h figure 3.2.2 shows a mode transition diagram. table 3.2.2 operation mode pin settings input pins operation mode reset boot (p30) am1 am0 (1) single chip mode (normal or user boot mode) 1 1 1 (2) single boot mode 0 1 1 (3) programmer mode 0 D 1 0 although p30 is an output port, it becomes an input port with pull-up resistor only during a reset. after a reset, p30 operates as follows depending on the operation mode. ? single chip mode: output port (without pull-up resistor) ? single boot mode: pull-up (input gate is invalid, and output gate is in high impedance.) figure 3.2.2 mode transition diagram 3.2.3.2 reset operation to reset the device, hold the reset input at ?0? for at least 10 system clocks while the power supply voltage is within the rated operating voltage range and the internal high-frequency oscillator is oscillating stably. programmer mode on-board programming mode reset = 0 reset = 0 (2) (3) (1) switching method to be set by user single chip mode reset state (1) or (2) reset = 0 normal mode user boot mode single boot mode numbers in ( ) correspond to the operation mode pin settings shown in table 3.2.2
tmp91fw27 91fw27-11 2007-11-02 3.2.3.3 memory map for each operation mode in this product, the memory map varies with operation mode. the memory map and sector address ranges for each operation mode are shown below. single chip mode single boot mode programmer mode figure 3.2.3 tmp91fw27 memory map for each operation mode 000000h 020000h ffffffh internal flash rom 128kb reserved 000000h 001000h 004000h fe0000h ffff00h ffffffh internal i/o internal ram 12kb external memory internal flash rom 128kb (interrupt vector 256b) fff000h 000000h 001000h 010000h 030000h ffff00h ffffffh 004000h ( s ) i flash rom internal i/o internal ram 12kb external memory external memory internal boot rom 4kb internal flash rom 128kb (interrupt vector 256b)
tmp91fw27 91fw27-12 2007-11-02 table 3.2.3 sector address ranges for each operation mode single chip mode single boot mode sector-0 fe0000h to fe0fffh 10000h to 10fffh sector-1 fe1000h to fe1fffh 11000h to 11fffh sector-2 fe2000h to fe2fffh 12000h to 12fffh sector-3 fe3000h to fe3fffh 13000h to 13fffh sector-4 fe4000h to fe4fffh 14000h to 14fffh sector-5 fe5000h to fe5fffh 15000h to 15fffh sector-6 fe6000h to fe6fffh 16000h to 16fffh sector-7 fe7000h to fe7fffh 17000h to 17fffh sector-8 fe8000h to fe8fffh 18000h to 18fffh sector-9 fe9000h to fe9fffh 19000h to 19fffh sector-10 fea000h to feafffh 1a000h to 1afffh sector-11 feb000h to febfffh 1b000h to 1bfffh sector-12 fec000h to fecfffh 1c000h to 1cfffh sector-13 fed000h to fedfffh 1d000h to 1dfffh sector-14 fee000h to feefffh 1e000h to 1efffh sector-15 fef000h to feffffh 1f000h to 1ffffh sector-16 ff0000h to ff0fffh 20000h to 20fffh sector-17 ff1000h to ff1fffh 21000h to 21fffh sector-18 ff2000h to ff2fffh 22000h to 22fffh sector-19 ff3000h to ff3fffh 23000h to 23fffh sector-20 ff4000h to ff4fffh 24000h to 24fffh sector-21 ff5000h to ff5fffh 25000h to 25fffh sector-22 ff6000h to ff6fffh 26000h to 26fffh sector-23 ff7000h to ff7fffh 27000h to 27fffh sector-24 ff8000h to ff8fffh 28000h to 28fffh sector-25 ff9000h to ff9fffh 29000h to 29fffh sector-26 ffa000h to ffafffh 2a000h to 2afffh sector-27 ffb000h to ffbfffh 2b000h to 2bfffh sector-28 ffc000h to ffcfffh 2c000h to 2cfffh sector-29 ffd000h to ffdfffh 2d000h to 2dfffh sector-30 ffe000h to ffefffh 2e000h to 2efffh sector-31 fff000h to ffffffh 2f000h to 2ffffh
tmp91fw27 91fw27-13 2007-11-02 3.2.4 single boot mode in single boot mode, the internal boot rom (mask rom) is activated to transfer a program/erase routine (user-created boot program) from an external source into the internal ram. this program/erase routine is th en used to program/erase the flash memory. in this mode, the internal boot rom is mapped into an area containing the interrupt vector table, in which the boot rom program is executed. the flash memory is mapped into an address space different from the one into which the boot rom is mapped (see 3h3h figure 3.2.3). the device?s sio (sio1) and the controller are connected to transfer the program/erase routine from the controller to the device?s internal ram. this program/erase routine is then executed to program/erase the flash memory. the program/erase routine is executed by sending commands and write data from the controller. the communications protocol between the device and the controller is described later in this manual. before the program/erase routine can be transferred to the ram, user password verification is performed to ensure the security of user rom data. if the password is not verified correctly, the ram transfer operation cannot be performed. in single boot mode, disable interrupts and use the interrupt request flags to check for an interrupt request. note: in single boot mode, the boot-rom programs are executed in normal mode. do not change to another operation mode in the program/erase routine.
tmp91fw27 91fw27-14 2007-11-02 3.2.4.1 using the program/erase algor ithm in the internal boot rom (step-1) environment setup since the program/erase routine and write data are transferred via sio (sio1), connect the device?s sio (sio1) and the controller on the board. the user must prepare the program/erase routine (a) on the controller. (step-2) starting up the internal boot rom release the reset with the relevant input pins set for entering single boot mode. when the internal boot rom starts up, the program/erase routine (a) is transferred from the controller to the internal ram via sio according to the communications procedure for single boot mode. before this can be carried out, the password entered by the user is verified against the password written in the user application program. (if the flash memory has been erased, 12 byte s of ?0xff? are used as the password.) (tmp91fw27) flash memory ram old user application program (or erased state) (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (tmp91fw27) (controller) (i/o) 0 1 reset condition for entering single boot mode new user application program (a) program/erase routine flash memory ram old user application program (or erased state) boot rom sio1
tmp91fw27 91fw27-15 2007-11-02 (step-3) copying the program/erase routine to the ram after password verification is completed, the boot rom copies the program/erase routine (a) from the controller to the ram using serial communications. the program/erase routine must be stored within the ram address range of 001000h to 003dffh. (step-4) executing the program/erase routine in the ram control jumps to the program/erase routine (a) in the ram. if necessary, the old user application program is erased (sector erase or chip erase). note: the boot rom is provided with an erase command, wh ich enables the entire chip to be erased from the controller without using the progra m/erase routine. if it is necessary to erase data on a sector basis, incorporate the necessary code in the program/erase routine. (tmp91fw27) flash memory ram old user application program (or erased state) (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (a) program/erase routine (tmp91fw27) flash memory ram (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (a) program/erase routine erased
tmp91fw27 91fw27-16 2007-11-02 (step-5) copying the new user application program the program/erase routine (a) loads the new user application program from the controller into the erased area of the flash memory. in the example below, the new user application program is transferred under the same communications conditions as those used for transferring the program/erase routine. however, after the program/erase routine has been transferred, this routine can be used to change the transfer settings (data bus and transfer source). configure the board hardware and program/erase routine as desired. (step-6) executing the new user application program after the programming operation has been completed, turn off the power to the board and remove the cable connecting the device and the controller. then, turn on the power again and start up the device in single chip mode to execute the new user application program. (tmp91fw27) (controller) 0 1 reset condition for entering single chip mode (normal mode) flash memory ram new user application program boot rom sio1 (tmp91fw27) flash memory ram new user application program (controller) (i/o) new user application program (a) program/erase routine boot rom sio1 (a) program/erase routine
tmp91fw27 91fw27-17 2007-11-02 3.2.4.2 connection exampl es for single boot mode in single boot mode the flash memory is programmed by serial transfer. therefore, on-board programming is performed by conn ecting the device?s sio (sio1) and the controller (programming tool) and sending commands from the controller to the device. 4h4h figure 3.2.4 shows an example of connection between the target board and a programming controller. 5h5h figure 3.2.5 shows an example of connection between the target board and an rs232c board. figure 3.2.4 example of conne ction with an external controller in single boot mode target board on-board programming controller dvcc vcc rs232c rom mode control program controller vcc vcc reg. power supply boot mcu mode control target board operation boot mode switching circuit ram tmp91fw27 a m0 a m1 pc vss dvss p92 p92 txd1 (p93) rxd1 (p94) rxd txd p95 p95 reset reset boot (p30)
tmp91fw27 91fw27-18 2007-11-02 figure 3.2.5 example of connection with an rs232c board in single boot mode target board dvcc vcc rs232c vcc vcc power supply rs232c board reset boot reset boot mode switching circuit boot (p30) tmp91fw27 a m0 a m1 pc vss dvss txd1 (p93) rxd1 (p94) rxd txd vss
tmp91fw27 91fw27-19 2007-11-02 3.2.4.3 mode setting to perform on-board programming, the device must be started up in single boot mode by setting the input pins as shown below. ? am0,am1 = 1 ? boot = 0 ? reset = 0 1 set the am0, am1, and boot pins as shown above with the reset pin held at ?0?. then, setting the reset pin to ?1? will start up the device in single boot mode. 3.2.4.4 memory maps 6h6h figure 3.2.6 shows a comparison of the memory map for normal mode (in single chip mode) and the memory map for single bo ot mode. in single boot mode, the flash memory is mapped to addresses 10000h to 2ffffh (physical addres ses) and the boot rom (mask rom) is mapped to addresses fff000h to ffffffh. figure 3.2.6 comparison of memory maps single chip mode single boot mode 000000h 001000h 004000h fe0000h ffff00h ffffffh fff000h 000000h 001000h 010000h 030000h ffff00h ffffffh 004000h (
m&? ) ]+? flash rom internal i/o internal ram 12kb external memory internal flash rom 128kb internal i/o internal ram 12kb external memory external memory internal boot rom 4kb internal flash rom 128kb (interrupt vector 256b) (interrupt vector 256b)
tmp91fw27 91fw27-20 2007-11-02 3.2.4.5 interface specifications the sio communications format in single boot mode is shown below. the device supports the uart (asynchronous communications) serial operation mode. to perform on-board programming, the same communications form at must also be set on the programming controller?s side. uart (asynchronous ) communications ? communications channel : sio channel 1 (for the pins to be used, see 7h7h table 3.2.4.) ? serial transfer mode : uart (asynchronous communications) mode ? data length : 8 bits ? parity bit : none ? stop bit : 1 bit ? baud rate : see 8h8h table 3.2.5 and 9h9h table 3.2.6. table 3.2.4 pin connections pins uart dvcc { power supply pins dvss { mode setting pins am1,am0, boot { reset pin reset { txd1 { communications pins rxd1 { note: unused pins are in the initial state after reset release. table 3.2.5 baud rate table sio transfer rate (bps) uart 115200 57600 38400 19200 9600
tmp91fw27 91fw27-21 2007-11-02 table 3.2.6 correspondence between operating frequency and baud rate in single boot mode (%) ? ? ? ? 0 ? ? ? ? ? ? ? ? 115200 (bps) ? ? ? ? 115200 ? ? ? ? ? ? ? ? (%) ? ? ? ? 0 ? 0 ? 0 ? ? 0 ? 57600 (bps) ? ? ? ? 57600 ? 57600 ? 57600 ? ? 57600 ? (%) ? + 1.73 ? 0 0 ? ? + 1.73 0 0 + 1.73 ? ? 0.13 38400 (bps) ? 39063 ? 38400 38400 ? ? 39063 38400 38400 39063 ? 38352 (%) ? + 1.73 0 0 0 + 0.16 0 + 1.73 0 0 + 1.73 ? ? 0.13 19200 (bps) ? 19531 19200 19200 19200 19231 19200 19531 19200 19200 19531 ? 19176 error (%) + 0.16 + 1.73 0 0 0 + 0.16 0 + 1.73 0 0 + 1.73 0 ? 0.13 9600 baud rate ( b p s ) 9615 9766 9600 9600 9600 9615 9600 9766 9600 9600 9766 9600 9588 supported range ( mhz ) 7.83 8.14 9.64 10.02 10.84 11.28 12.05 12.53 14.46 15.04 15.66 16.29 18.07 18.80 19.27 20.05 21.68 22.56 24.09 25.06 25.29 26.32 26.50 27.57 reference baud rate (bps) reference frequency ( mhz ) 8 10 11.0592 12.2880 14.7456 16 18.4320 20 22.1184 24.5760 25 25.8048 27 reference frequency: the frequency of the high-speed oscill ation circuit that can be us ed in single boot mode. to program the flash memory using single boot mode, one of the reference frequencies must be selected as a high-speed clock. supported range: the range of clock frequencies that are detected as each reference frequency. it may not be possible to perfor m single boot operations at clock frequencies outside of the supported range. note: to automatically detect the reference frequency (microc ontroller clock frequency), the transfer baud rate error of the fl ash memory programming controller and the oscillation frequency error must be within 2% in total.
tmp91fw27 91fw27-22 2007-11-02 3.2.4.6 data transfer formats 10h10h table 3.2.7 to 11h11h table 3.2.13 show the operation command data and the data transfer format for each operation mode. table 3.2.7 operation command data operation command data operation mode 10h ram transfer 20h flash memory sum 30h product information read 40h flash memory chip erase 60h flash memory protect set
tmp91fw27 91fw27-23 2007-11-02 table 3.2.8 transfer format of single boot program [ram transfer] transfer byte number transfer data from controller to device baud rate transfer data from device to controller 1st byte baud rate setting uart 86h ? 2nd byte ? desired baud rate (note 1) ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (10h) ? 4th byte ? ack response to operation command (note 2) normal 10h error x1h protection applied (note 4) x6h communications error x8h 5th byte to 16th byte password data (12 bytes) (02fef4h to 02feffh) ? 17th byte checksum value for 5th to 16th bytes ? 18th byte ? ack response to checksum value (note 2) normal 10h error 11h communications error 18h 19th byte ram storage start address 31 to 24 (note 3) ? 20th byte ram storage start address 23 to 16 (note 3) ? 21st byte ram storage start address 15 to 8 (note 3) ? 22nd byte ram storage start address 7 to 0 (note 3) ? 23rd byte ram storage byte count 15 to 8 (note 3) ? 24th byte ram storage byte count 7 to 0 (note 3) ? 25th byte checksum value for 19th to 24th bytes (note 3) ? 26th byte ? ack response to checksum value (note 2) normal 10h error 11h communications error 18h 27th byte to m?th byte ram storage data ? (m + 1)th byte checksum value for 27th to m?th bytes ? boot rom (m + 2)th byte ? ack response to checksum value (note 2) normal 10h error 11h communications error 18h ram (m + 3)th byte ? jump to ram storage start address note 1: for the desired baud rate setting, see table 3.2.6. note 2: after sending an error response, the device waits for operation command data (3rd byte). note 3: the data to be transferred in the 19th to 25th bytes should be programmed within the ram address range of 001000h to 003dffh (11.5kbytes). note 4: when read protection or write protection is applied, the device aborts the received operation command and waits for the next operation command data (3rd byte).
tmp91fw27 91fw27-24 2007-11-02 table 3.2.9 transfer format of single boot program [flash memory sum] transfer byte number transfer data from controller to device baud rate transfer data from device to controller 1st byte baud rate setting uart 86h ? 2nd byte ? desired baud rate (note1) ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (20h) ? 4th byte ? a ck response to operation command (note 2) normal 20h erro r x1h communications erro r x8h 5th byte ? sum (upper) 6th byte ? sum (lower) 7th byte ? checksum value for 5th and 6th bytes boot rom 8th byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.2.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw27 91fw27-25 2007-11-02 table 3.2.10 transfer format of single boot program [product information read] (1/2) transfer byte number transfer data from controller to device baud rate transfer data from device to controller 1st byte baud rate setting uart 86h desired baud rate (note 1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (30h) ? 4th byte ? ack response to operation command (note 2) normal 30h error x1h communications error x8h 5th byte ? flash memory data (address 02fef0h) 6th byte ? flash memory data (address 02fef1h) 7th byte ? flash memory data (address 02fef2h) 8th byte ? flash memory data (address 02fef3h) 9th byte to 20th byte ? part number (ascii code, 12 bytes) ?tmp91fw27_ _ _ ? (from 9th byte) 21st byte to 24th byte ? password comparison start address (4 bytes) f4h, feh, 02h, 00h (from 21st byte) 25th byte to 28th byte ? ram start address (4 bytes) 00h, 10h, 00h, 00h (from 25th byte) 29th byte to 32nd byte ? ram (user area) end address (4 bytes) ffh, 3dh, 00h, 00h (from 29th byte) 33rd byte to 36th byte ? ram end address (4 bytes) ffh, 3fh, 00h, 00h (from 33rd byte) 37th byte to 40th byte ? dummy data (4 bytes) 00h,00h,00h,00h (from 37th byte) 41st byte to 44th byte ? dummy data (4 bytes) 00h, 00h, 00h, 00h (from 41st byte) 45th byte to 46th byte ? fuse information (2 bytes from 45th byte) read protection/write protection 1) applied/applied : 00h, 00h 2) not applied/applied : 01h, 00h 3) applied/not applied : 02h, 00h 4) not applied/not applied : 03h, 00h 47th byte to 50th byte ? flash memory start address (4 bytes) 00h, 00h, 01h, 00h (from 47th byte) 51st byte to 54th byte ? flash memory end address (4 bytes) ffh, ffh, 02h, 00h (from 51st byte) 55th byte to 56th byte ? number of sectors in flash memory (2 bytes) 20h, 00h (from 55th byte) boot rom 57th byte to 60th byte ? start address of flash memory sectors of the same size (4 bytes) 00h, 00h, 01h, 00h (from 57th byte)
tmp91fw27 91fw27-26 2007-11-02 table 3.2.11 transfer format of single boot program [product information read] (2/2) transfer byte number transfer data from controller to device baud rate transfer data from device to controller 61st byte to 64th byte ? size (in half words) of flash memory sectors of the same size (4 bytes) 00h, 08h, 00h, 00h (from 61st byte) 65th byte ? number of flash memory sectors of the same size (1 byte) 20h 66th byte ? checksum value for 5th to 65th bytes boot rom 67th byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.2.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw27 91fw27-27 2007-11-02 table 3.2.12 transfer format of single boot program [flash memory chip erase] transfer byte number transfer data from controller to device baud rate transfer data from device to controller 1st byte baud rate setting uart 86h desired baud rate (note 1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (40h) ? 4th byte ? ack response to operation command (note2) normal 40h error x1h communications error x8h 5th byte erase enable command data (54h) ? 6th byte ? ack response to operation command (note 2) normal 54h error x1h communications error x8h 7th byte ? ack response to erase command normal 4fh error 4ch 8th byte ? ack response normal 5dh error 60h boot rom 9th byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.2.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw27 91fw27-28 2007-11-02 table 3.2.13 transfer format of single boot program [flash memory protect set] transfer byte number transfer data from controller to device baud rate transfer data from device to controller 1st byte baud rate setting uart 86h desired baud rate (note 1) ? 2nd byte ? ack response to baud rate setting normal (baud rate ok) ? uart 86h (if the desired baud rate cannot be set, operation is terminated.) 3rd byte operation command data (60h) ? 4th byte ? ack response to operation command (note2) normal 60h error x1h communications error x8h 5th byte to 16th byte password data (12 bytes) (02fef4h to 02feffh) ? 17th byte checksum value for 5th to 16th bytes ? 18th byte ? ack response to checksum value (note 2) normal 60h error 61h communications error 68h 19th byte ? ack response to protect set command normal 6fh error 6ch 20th byte ? ack response normal 31h error 34h boot rom 21st byte (wait for the next operation command data) ? note 1: for the desired baud rate setting, see table 3.2.6. note 2: after sending an error response, the device waits for operation command data (3rd byte).
tmp91fw27 91fw27-29 2007-11-02 3.2.4.7 boot program when the device starts up in single boot mode, the boot program is activated. the following explains the commands that are used in the boot program to communicate with the controller when the de vice starts up in single boot mode. use this information for creating a controller for using single bo ot mode or for building a user boot environment. 1. ram transfer command in ram transfer, data is transferred from the controller and stored in the device?s internal ram. when the transfer completes normally, the boot program will start running the transferred user program. up to 11.5 kbytes of data can be transferred as a user program. (this limit is implemented in the boot program to protect the stack pointer area.) the user program starts executing from the ram storage start address. this ram transfer function enables a user-created program/erase routine to be executed, allowing the user to implement their own on-board programming method. to perform on-board programming with a user program, the flash memory command sequences (see section 12h12h 3.2.6) must be used. after the ram transfer command has been completed, the entire internal ram area can be used. if read protection or write protection is applied on the device or a password error occurs, this command wi ll not be executed. 2. flash memory sum command this command calculates the sum of 128 kbytes of data in the flash memory and returns the result. there is no operation command available to the boot program for reading data from the entire area of the flash memory. instead, this flash memory sum command can be used. reading the sum value enables revision management of the application program. 3. product information read command this command returns the information about the device including its part number and memory details stored in the flash memory at addresses 02fef0h to 02fef3h. this command can also be us ed for revision management of the application program. 4. flash memory chip erase command this command erases all the sectors in the flash memory. if read protection or write protection is applied on the device, all the sectors in the flash memory are erased and the read protection or write protection is cleared. since this command is also used to restore the operation of the boot program when the password is forgotten, it does not include password verification. 5. flash memory protect set command this command sets both read protection and write protection on the device. however, if a password er ror occurs, this command will not be executed. when read protection is set, the flash memory cannot be read in programmer mode. when write protection is set, the flash memory cannot be written in programmer mode.
tmp91fw27 91fw27-30 2007-11-02 3.2.4.8 ram transfer command (see 13h13h table 3.2.8) 1. from the controller to the device the data in the 1st byte is used to determine the baud rate. the 1st byte is transferred with receive operation disabled (sc1mod0 = 0). (the baud rate is determined using an internal timer.) ? to communicate in uart mode send the value 86h from the controller to the target board using uart settings at the desired baud rate. if the serial operation mode is determined as uart, the device checks to see whether or not the desired baud rate can be set. if the device determines that the desired baud rate cannot be set, operation is terminated and no communications can be established. 2. from the device to the controller the data in the 2nd byte is the ack response returned by the device for the serial operation mode setting data sent in the 1st byte. if the data in the 1st byte is found to signify uart and the desired baud rate can be set, the device returns 86h. ? baud rate determination the device determines whether or not the desired baud rate can be set. if it is found that the baud rate can be set, the boot program rewrites the br1cr and br1add values and returns 86h. if it is found that the desired baud rate cannot be set, operation is terminated and no data is returned. the controller sets a time-out time (5 seco nds) after it has finished sending the 1st byte. if the controller does not receive the response (86h) normally within the time-out time, it should be considered that the device is unable to communicate. receive operation is en abled (sc1mod0 = 1) before 86h is written to the transmission buffer. 3. from the controller to the device the data in the 3rd byte is operation command data. in this case, the ram transfer command data (10h) is sent from the controller to the device. 4. from the device to the controller the data in the 4th byte is the ack response to the operation command data in the 3rd byte. first, the device checks to see if the received data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined (they are the upper four bits of the immediately preceding operation command data). next, if the data received in the 3rd byte corresponds to one of the operation commands given in 14h14h table 3.2.7, the device echoes back the received data (ack response for normal receptio n). in the case of the ram transfer command, if read or write protection is not applied, 10h is echoed back and then execution branches to the ram transfer processing routine. if protection is applied, the device returns the corresponding ack response data (b it 2/1) x6h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) after branching to the ram transfer processing routine, the device checks the data in the password area. for details, see 15h15h 3.2.4.15 ? 16h password?.
tmp91fw27 91fw27-31 2007-11-02 if the data in the 3rd byte does not correspond to any operation command, the device returns the ack response data fo r operation command error (bit0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (the y are the upper four bits of the immediately preceding operation command data.) 5. from the controller to the device the 5th to 16th bytes contain password data (12 bytes). the data in the 5th to 16th bytes is verified against the data at addresses 02fef4h to 02feffh in the flash memory, respectively. 6. from the controller to the device the 17th byte contains checksum data. the checksum data sent by the controller is the two?s complement of th e lower 8-bit value obtained by summing the data in the 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 17h17h 3.2.4.17 ? 18h18h how to calculate checksum.? 7. from the device to the controller the data in the 18th byte is the ack response data to the 5th to 17th bytes (ack response to the checksum value). the device first checks to see whether the data received in the 5th to 17th bytes contai ns any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) 18h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?1?. next, the device checks the checksum data in the 17th byte. this check is made to see if the lower 8-bit value obtained by summing the data in the 5th to 17th bytes by unsigned 8-bit addition (ign oring any overflow) is 00h. if the value is not 00h, the device returns the ack re sponse data for ch ecksum error (bit 0) 11h and waits for the next operation command data (3rd byte). finally, the device examines the result of password verification. if all the data in the 5th to 16th bytes is not verified correctly, the device returns the ack response data for password error (bit 0) 11h and waits for the next operation command data (3rd byte). if no error is found in all the above checks, the device returns the ack response data for normal reception 10 h. 8. from the controller to the device the data in the 19th to 22nd bytes indicates the ram start address for storing block transfer data. the 19th byte corresponds to address bits 31 to 24, the 20th byte to address bits 23 to 16, the 21st byte to address bits 15 to 8, and the 22nd byte to address bits 7 to 0. 9. from the controller to the device the data in the 23rd and 24th bytes indicates the number of bytes to be transferred. the 23rd byte corresponds to bits 15 to 8 of the transfer byte count and the 24th byte corresponds to bits 7 to 0.
tmp91fw27 91fw27-32 2007-11-02 10. from the controller to the device the data in the 25th byte is checksum data. the checksum data sent by the controller is the two?s complement of th e lower 8-bit value obtained by summing the data in the 19th to 24th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 19h19h 3.2.4.17 ? 20h20h how to calculate checksum .? note: the data in the 19th to 25th bytes should be placed within addresses 001000h to 003dffh (11.5 kbytes) in the internal ram. 11. from the device to the controller the data in the 26th byte is the ack response data to the data in the 19th to 25th bytes (ack response to the checksum value). the device first checks to see whether the data received in the 19th to 25th bytes contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) 18h and waits for the next operation command (3rd byte). the upper four bits of the ack response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?1?. next, the device checks the checksum data in the 25th byte. this check is made to see if the lower 8-bit value obtained by summing the data in the 19th to 25th bytes by unsigned 8-bit addition (ign oring any overflow) is 00h. if the value is not 00h, the device returns the ack re sponse data for ch ecksum error (bit 0) 11h and waits for the next operation command data (3rd byte). 12. from the controller to the device the data in the 27th to m?th bytes is the data to be stored in the ram. this data is written to the ram starting at the address specified in the 19th to 22nd bytes. the number of bytes to be written is specified in the 23rd and 24th bytes. 13. from the controller to the device the data in the (m+1)th byte is check sum data. the checksum data sent by the controller is the two?s complement of the lower 8-bit value obtained by summing the data in the 27th to m?th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 21h21h 3.2.4.17 ? 22h22h how to calculate checksum.?
tmp91fw27 91fw27-33 2007-11-02 14. from the device to the controller the data in the (m + 2) th byte is the ack response data to the 27th to (m+1)th bytes (ack response to the checksum value). the device first checks to see whether the data in the 27th to (m+1)th byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) 18h and waits for the next operation command (3rd byte). the upper four bits of the ack response are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?1?. next, the device checks the checksum data in the (m+1)th byte. this check is made to see if the lower 8-bit value obtained by summing the data in the 27th to (m+1)th bytes by unsigned 8-bit addition (ignoring any overflow) is 00h. if the value is not 00h, the device returns the ack response data for checksum error (bit 0) 11h and waits for the next operation command data (3rd byte). if no error is found in all the above checks, the device returns the ack response data for normal reception 10h. 15. from the device to the controller if the ack response data in the (m + 2)th byte is 10h (normal reception), the boot program then jumps to the ram start addre ss specified in the 19th to 22nd bytes.
tmp91fw27 91fw27-34 2007-11-02 3.2.4.9 flash memory sum command (see 23h23h table 3.2.9) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the flash memory sum command data (20h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack response data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and wait s for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediatel y preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command values given in 24h24h table 3.2.7, the device echoes back the received data (ack response for normal receptio n). in this case, 20h is echoed back and execution then branches to the flash memory sum processing routine. if the data in the 3rd byte does not correspond to any operation command, the device returns the ack response data for operatio n command error (bit 0) x1 h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the device to the controller the data in the 5th and 6th bytes is the upper and lower data of the sum value, respectively. for details on sum, see 25h25h 3.2.4.16 ? 26h how to calculate sum .? 5. from the device to the controller the data in the 7th byte is checksum data. this is the two?s complement of the lower 8-bit value obtained by summing the data in the 5th and 6th bytes by unsigned 8-bit addition (ignoring any overflow). 6. from the controller to the device the data in the 8th byte is the next operation command data.
tmp91fw27 91fw27-35 2007-11-02 3.2.4.10 product informat ion read command (see 27h27h table 3.2.10 and 28h28h table 3.2.11) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the product information read command data (30h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack response data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and wait s for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediatel y preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command values given in 29h29h table 3.2.7, the device echoes back the received data (ack response for normal receptio n). in this case, 30h is returned and execution then branches to the product information read processing routine. if the data in the 3rd byte does not correspond to any operation command, the device returns the ack response data for operatio n command error (bit 0) x1 h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the device to the controller the data in the 5th to 8th bytes is the data stored at addresses 02fef0h to 02fef3h in the flash memory. by writing the id information of software at these addresses, the version of the software can be managed. (for example, 0002h can indicate that the software is now in version 2.) 5. from the device to the controller the data in the 9th to 20th bytes denotes the part number of the device. ?tmp91fw27_ _ _? is sent in ascii code starting from the 9th byte. note: an underscore (?_?) indicates a space. 6. from the device to the controller the data in the 21st to 24th bytes is the password comparison start address. f4h, feh, 02h and 00h are sent starting from the 21st byte. 7. from the device to the controller the data in the 25th to 28th bytes is the ram start address. 00h, 10h, 00h and 00h are sent starting from the 25th byte. 8. from the device to the controller the data in the 29th to 32nd bytes is the ram (user area) end address. ffh, 3dh, 00h and 00h are sent starting from the 29th byte.
tmp91fw27 91fw27-36 2007-11-02 9. from the device to the controller the data in the 33rd to 36th bytes is the ram end address. ffh, 3fh, 00h and 00h are sent starting from the 33rd byte. 10. from the device to the controller the data in the 37th to 44 th bytes is dummy data. 11. from the device to the controller the data in the 45th and 46th bytes contains the protection status and sector division information of the flash memory. bit 0 indicates the read protection status. ?0: read protection is applied. ?1: read protection is not applied. bit 1 indicates the write protection status. ?0: write protection is applied. ?1: write protection is not applied. bit 2 indicates whether or not the flash memory is divided into sectors. ?0: the flash memory is divided into sectors. ?1: the flash memory is not divided into sectors. bits 3 to 15 are sent as ?0?. 12. from the device to the controller the data in the 47th to 50th bytes is the flash memory start address. 00h, 00h, 01h and 00h are sent starting from the 47th byte. 13. from the device to the controller the data in the 51st to 54th bytes is the flash memory end address. ffh, ffh, 02h and 00h are sent starting from the 51st byte. 14. from the device to the controller the data in the 55th and 56th bytes indicates the number of sectors in the flash memory. 20h and 00h are sent starting from the 55th byte. 15. from the device to the controller the data in the 57th to 65th bytes contains sector information of the flash memory. sector information is comprised of the start address (starting from the flash memory start address), sector size and number of consecutive sectors of the same size. note that the se ctor size is represented in word units. the data in the 57th to 65th bytes indicates 4 kbytes of sectors (sector 0 to sector 31). for the data to be transferred, see 30h30h table 3.2.10 and 31h31h table 3.2.11. 16. from the device to the controller the data in the 66th byte is checksum data. this is the two?s complement of the lower 8-bit value obtained by summing the data in the 5th to 65th bytes by unsigned 8-bit addition (ignoring any overflow). 17. from the controller to the device the data in the 67th byte is the next operation command data.
tmp91fw27 91fw27-37 2007-11-02 3.2.4.11 flash memory chip erase command (see 32h32h table 3.2.12) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the flash memory chip erase command data (40h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack response data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and wait s for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediatel y preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command values given in 33h33h table 3.2.7, the device echoes back the received data (ack response for normal re ception). in this case, 40h is echoed back. if the data in the 3rd byte does not correspond to any op eration command, the device returns the ack response data for operation command e rror (bit 0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the controller to the device the data in the 5th byte is eras e enable command data (54h). 5. from the device to the controller the data in the 6th byte is the ack response data to the erase enable command data in the 5th byte. the device first checks to see if the data in the 5th byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and wait s for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined (they are the upper four bits of the immediatel y preceding operation command data.) then, if the data in the 5th byte corres ponds to the erase enable command data, the device echoes back the received data (ack response for normal reception). in this case, 54h is echoed back and execution jumps to the flash memory chip erase processing routine. if the data in the 5th byte does not correspond to the erase enable command data, the device return s the ack response data for operation command error (bit 0 ) x1h and waits for the next operation command (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.)
tmp91fw27 91fw27-38 2007-11-02 6. from the device to the controller the data in the 7th byte indicates whether or not the erase operation has completed successfully. if the erase operation has completed successfully, the device returns the end code (4fh). if an erase error has occurred, the device returns the error code (4ch). 7. from the device to the controller the data in the 8th byte is ack response data. if the erase operation has completed successfully, the de vice returns the ack response for erase completion (5dh). if an erase error has occurred, the device returns the ack response for erase error (60h). 8. from the controller to the device the data in the 9th byte is the next operation command data.
tmp91fw27 91fw27-39 2007-11-02 3.2.4.12 flash memory protect set command (see 34h34h table 3.2.13) 1. the data in the 1st and 2nd bytes is the same as in the case of the ram transfer command. 2. from the controller to the device the data in the 3rd byte is operation command data. the flash memory protect set command data (60h) is sent here. 3. from the device to the controller the data in the 4th byte is the ack response data to the operation command data in the 3rd byte. the device first checks to see if the data in the 3rd byte contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) x8h and wait s for the next operation command data. the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) then, if the data in the 3rd byte corresponds to one of the operation command data values given in 35h35h table 3.2.7, the device echoes back the received data (ack response for normal receptio n). in this case, 60h is echoed back and execution branches to the flash memory protect set processing routine. after branching to this routine, the data in the password area is checked. for details, see 36h36h 3.2.4.15 ? 37h password.? if the data in the 3rd byte does not correspond to any operation command, the device returns the ack resp onse data for operation co mmand error (bit 0) x1h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are undefined. (they are the upper four bits of the immediately preceding operation command data.) 4. from the controller to the device the data in the 5th to 16th bytes is password data (12 bytes). the data in the 5th byte is verified against the data at ad dress 02fef4h in the flash memory and the data in the 6th byte against the data at address 02fef5h. in this manner, the received data is verified consecutively against the data at the specified address in the flash memory. the data in the 16th byte is verified against the data at address 02feffh in the flash memory. 5. from the controller to the device the data in the 17th byte is checksum data. the checksum data sent by the controller is the two?s complement of th e lower 8-bit value obtained by summing the data in 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). for details on checksum, see 38h38h 3.2.4.17 ? 39h39h how to calculate checksum.?
tmp91fw27 91fw27-40 2007-11-02 6. from the device to the controller the data in the 18th byte is the ack response data to the data in the 5th to 17th bytes (ack response to the checksum value). the device first checks to see whether the data in the 5th to 17th bytes contains any error. if a receive error is found, the device returns the ack response data for communications error (bit 3) 68h and waits for the next operation command data (3rd byte). the upper four bits of the ack response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is ?6?. then, the device checks the checksum data in the 17th byte. this check is made to see if the lower 8 bits of the value obtained by summing the data in the 5th to 17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00h. if the value is not 00h, the device returns the ack response data for checksum error (bit 0) 61h and waits for the next operation command data (3rd byte). finally, the device examines the result of password verification. if all the data in the 5th to 16th bytes is not verified correctly, the device returns the ack response data for password error (bit 0) 61h an d waits for the next operation command data (3rd byte). if no error is found in the above checks, the device returns the ack response data for normal reception 60h. 7. from the device to the controller the data in the 19th byte indicates whether or not the protect set operation has completed successfully. if the operation has completed succes sfully, the device returns the end code (6fh). if an error has occurred, the device returns the error code (6ch). 8. from the device to the controller the data in the 20th byte is ack response data. if the protect set operation has completed successfully, the device return s the ack response data for normal completion (31h). if an error has occurre d, the device returns the ack response data for error (34h). 9. from the device to the controller the data in the 21st byte is the next operation command data.
tmp91fw27 91fw27-41 2007-11-02 3.2.4.13 ack response data the boot program notifies the controller of its processing status by sending various response data. 40h40h table 3.2.14 to 41h41h table 3.2.19 show the ack response data returned for each type of received data. the upper four bits of ack response data are a direct reflection of the upper four bits of the immediately preceding operation command data. bit 3 indicates a receive error and bit 0 indicates an operation command error, checksum error or password error. table 3.2.14 ack response data to serial operation mode setting data transfer data meaning 86h the device can communicate in uart mode. (note) table 3.2.15 ack response data to operation command data transfer data meaning x8h (note) a receive error occurred in the operation command data. x6h (note) terminated receive operation due to protection setting. x1h (note) undefined operation command data was received normally. 10h received the ram transfer command. 20h received the flash memory sum command. 30h received the product information read command. 40h received the flash memory chip erase command. 60h received the flash memory protect set command. table 3.2.16 ack response data to checksum data for ram transfer command transfer data meaning 18h a receive error occurred. 11h a checksum error or password error occurred. 10h received the correct checksum value. table 3.2.17 ack response data to flash memory chip erase operation transfer data meaning 54h received the erase enable command. 4fh completed erase operation. 4ch an erase error occurred. 5dh (note) reconfirmation of erase operation 60h (note) reconfirmation of erase error note: if the desired baud rate cannot be set, the device returns no data and terminates operation. note: the upper four bits are a direct reflection of the upper four bits of the immediately preceding operation command data. note: these codes are returned for reconfirmation of communications.
tmp91fw27 91fw27-42 2007-11-02 table 3.2.18 ack response data to checksum data for flash memory protect set command transfer data meaning 68h a receive error occurred. 61h a checksum or password error occurred. 60h received the correct checksum value. table 3.2.19 ack response data to flash memory protect set operation transfer data meaning 6fh completed the protect (read/write) set operation. 6ch a protect (read/write) set error occurred. 31h (note) reconfirmation of protect (read/write) set operation 34h (note) reconfirmation of protect (read/write) set error note: these codes are returned for reconfirmation of communications.
tmp91fw27 91fw27-43 2007-11-02 3.2.4.14 determining serial operation mode to communicate in uart mode, the controller should transmit the data value 86h as the first byte at the desired baud rate. 42h42h figure 3.2.7 shows the waveform of this operation. figure 3.2.7 data for determining serial operation mode the boot program receives the first byte (86h) after reset release not as serial communications data. instead, the boot program uses the first byte to determine the baud rate. the baud rate is determined by the output periods of tab, tac and tad as shown in 43h43h figure 3.2.7 using the procedure shown in 44h44h figure 3.2.8. the cpu monitors the level of the receive pin. upon detecting a level change, the cpu captures the timer value to determine the baud rate. uart (86h) tab point a point b point c point d bit 7 bit 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 start stop tad tac
tmp91fw27 91fw27-44 2007-11-02 figure 3.2.8 flowchart for serial operation mode receive operation initialize 16-bit timer b0 ( t1 = 8/fc, clear counter) start the prescaler start counting up of 16-bit timer b0 point a stop operation (endless loop) receive pin changed from high to low? yes yes yes start receive pin changed from low to high? capture timer value (tab) by software receive pin changed from high to low? capture timer value (tac) by software yes receive pin changed from low to high? capture timer value (tad) by software stop 16-bit timer b0 tac tad? back up tad value end yes point b point c point d
tmp91fw27 91fw27-45 2007-11-02 3.2.4.15 password when the ram transfer command (10h) or the flash memory protect set command (60h) is received as operation command data, password verification is performed. first, the device echoes back the operation command data (10h to 60h) and checks the data (12 bytes) in the password area (addresses 02fef4h to 02feffh). then, the device verifies the password data received in the 5th to 16th bytes against the data in the password area as shown in 45h45h table 3.2.20. unless all the 12 bytes are verified correc tly, a password e rror will occur. a password error will also occur if all the 12 bytes of password data contain the same value. only exception is when all the 12 bytes are ?ffh? and verified correctly and the reset vector area (addresses 02ff00h to 02ff02h) is all ?ffh?. in this case, a blank device will be assumed and no password error will occur. if a password error has occurred, the devi ce returns the ack response data for password error in the 18th byte. table 3.2.20 password verification table receive data data to be verified against 5th byte data at address 02fef4h 6th byte data at address 02fef5h 7th byte data at address 02fef6h 8th byte data at address 02fef7h 9th byte data at address 02fef8h 10th byte data at address 02fef9h 11th byte data at address 02fefah 12th byte data at address 02fefbh 13th byte data at address 02fefch 14th byte data at address 02fefdh 15th byte data at address02fefeh 16th byte data at address 02feffh example of data that cannot be specified as a password for blank products (note) ? the password of a blank product must be all ?ffh? (ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh, ffh). note: a blank product is a product in which all the byte s in the password area (addresses 02fef4h to 02feffh) and the reset vector area (addresses 02ff00h to 02ff02h) are ?ffh?. for programmed products ? the same 12 consecutive bytes cannot be specified as a password. the table below shows password error examples. programmed product 1 2 3 4 5 6 7 8 9 10 11 12 note error example 1 ffh ffh ffh ffh ffh ffh ffh ffh ffh ffh ffh ffh all ?ff? error example 2 00h 00h 00h 00h 00h 00h 00h 00h 00h 00h 00h 00h all ?00? error example 3 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah 5ah all ?5a?
tmp91fw27 91fw27-46 2007-11-02 3.2.4.16 how to calculate sum sum is calculated by summing the values of all data read from the flash memory by unsigned 8-bit addition and is returned as a word (16-bit) value. the resulting sum value is sent to the controller in order of upper 8 bits and lower 8 bits. all the 128 kbytes of data in the flash memory are included in the calculation of sum. when the flash memory sum command is executed, sum is calculated in this way. example: 3.2.4.17 how to calculate checksum checksum is calculated by taking the two?s complement of the lower 8-bit value obtained by summing the values of received data by unsigned 8-bit addition (ignoring any overflow). when the flash memory sum command or the product information read command is executed, checksum is calculated in this way. the controller should also use this checksum calculation method for sending checksum values. example: calculating checksum for the flash memory sum command when the upper 8-bit data of sum is e5h and the lower 8-bit data is f6h, checksum is calculated as shown below. first, the upper 8 bits and lower 8 bits of the sum value are added by unsigned operation. e5h + f6h = 1dbh then, the two?s complement of the lower 8 bi ts of this result is obtained as shown below. the resulting checksum value (25h) is sent to the controller. 0 ? dbh = 25h a1h b2h c3h d4h when sum is calculated from the four data entries shown to the left, the result is as follows: a1h + b2h + c3h + d4h = 02eah sum upper 8 bits: 02h sum lower 8 bits: eah thus, the sum value is sent to the controller in order o f 02h and eah.
tmp91fw27 91fw27-47 2007-11-02 3.2.5 user boot mode (in single chip mode) user boot mode, which is a sub mode of sing le chip mode, enables a user-created flash memory program/erase routine to be used. to do so, the operation mode of single chip mode must be changed from normal mode for executing a user application program to user boot mode for programming/erasing the flash memory. for example, the reset processing routine of a user application program may include a routine for selecting normal mode or user boot mode upon entering single chip mode. any mode-selecting condition may be set using the device?s i/o to suit the user system. to program/erase the flash memory in user boot mode, a program/erase routine must be incorporated in the user application program in advance. since the processor cannot read data from the internal flash memory while it is being programmed or erased, the program/erase routine must be executed from the outside of the flash memory. while the flash memory is being programmed/erased in user boot mode, interrupts must be disabled. the pages that follow explain the procedure for programming the flash memory using two example cases. in one case the program/erase routine is stored in the internal flash memory (1-a); in the other the program/erase routine is transferred from an external source (1-b).
tmp91fw27 91fw27-48 2007-11-02 3.2.5.1 (1-a) program/erase procedure example 1 when the program/erase routine is stored in the internal flash memory (step-1) environment setup first, the condition (e.g. pin status) for ente ring user boot mode must be set and the i/o bus for transferring data must be de termined. then, the device?s peripheral circuitry must be designed and a correspon ding program must be written. before mounting the device on the board, it is necessary to write the following four routines into one of the sectors in the flash memory. (a) mode select routine : selects normal mode or user boot mode. (b) program/erase routine : loads program/erase data from an external source and programs/erases the flash memory. (c) copy routine 1 : copies routines (a) to (d) into the internal ram or external memory. (d) copy routine 2 : copies routines (a) to (d) from the internal ram or external memory into the flash memory. note: the above (d) is a routine for reconstructing the program/erase routine on the flash memory. if the entire flash memory is always programmed and the program/erase routine is included in the new user application program, this copy routine is not needed. (step-2) entering user boot mode (using the reset processing) after reset release, the reset processing program determines whether or not the device should enter user boot mode. if the condition for entering user boot mode is true, user boot mode is entered to program/erase the flash memory. (tmp91fw27) flash memory ram [reset processing program] ( a ) mode select routine old user application program (controller) new user application program (i/o) (b) program/erase routine ( c ) cop y routine 1 ( d ) cop y routine 2 (tmp91fw27) flash memory ram [reset processing program] old user application program (controller) new user application program (i/o) ( a ) mode select routine ( b ) pro g ram/erase routine ( c ) co py routine 1 0 1 reset condition for entering user boot mode (user-specified) ( d ) co py routine 2
tmp91fw27 91fw27-49 2007-11-02 (step-3) copying the program/erase routine after the device has entered user boot mode, the copy routine 1 (c) copies the routines (a) to (d) into the internal ram or external memory (the routines are copied into the internal ram here.) (step-4) erasing the flash memory by the program/erase routine control jumps to the program/erase routine in the ram and the old user program area is erased (sector erase or chip eras e). (in this case, the flash memory erase command is issued from the ram.) note: if data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, only the program/erase routine (b) need be copied into the ram. new user application program (tmp91fw27) flash memory ram [reset processing program] (a) mode select routine old user application program (controller) (i/o) (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (a) mode select routine (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (tmp91fw27) flash memory ram (controller) new user application program (i/o) (a) mode select routine (b)program/erase routine (c) copy routine 1 (d) copy routine 2 erased
tmp91fw27 91fw27-50 2007-11-02 (step-5) restoring the user boot program in the flash memory the copy routine 2 (d) in the ram copies the routines (a) to (d) into the flash memory. note: if data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, step 5 is not needed. (step-6) writing the new user application program to the flash memory the program/erase routine in the ram is ex ecuted to load the new user application program from the controller into the erased area of the flash memory. new user application program (tmp91fw27) flash memory ram [reset processing program] (a) mode select routine (controller) (i/o) (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (a) mode select routine (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (tmp91fw27) flash memory ram [reset processing program] (a) mode select routine (controller) new user application program (i/o) (b) program/erase routine (c) copy routine 1 (d) copy routine 2 (a) mode select routine (b) program/erase routine (c) copy routine 1 (d) copy routine 2 new user application program
tmp91fw27 91fw27-51 2007-11-02 (step-7) executing the new user application program the reset input pin is driven low (?0?) to reset the device. the mode setting condition is set for normal mode. after reset release, th e device will start executing the new user application program. (tmp91fw27) flash memory ram [reset processing program (a) mode select routine new user application program (controller) (i/o) (b) program/erase routine (c) copy routine 1 0 1 reset condition for entering normal mode (d) copy routine 2
tmp91fw27 91fw27-52 2007-11-02 3.2.5.2 (1-b) program/erase procedure example 2 in this example, only the boot program (minimum requirement) is stored in the flash memory and other necessary routin es are supplied from the controller. (step-1) environment setup first, the condition (e.g. pin status) for ente ring user boot mode must be set and the i/o bus for transferring data must be de termined. then, the device?s peripheral circuitry must be designed and a correspon ding program must be written. before mounting the device on the board, it is necessary to write the following two routines into one on the sectors in the flash memory. (a) mode select routine : selects normal mode or user boot mode. (b) transfer routine : loads the program/erase routine from an external source. the following routines are prepared on the controller. (c) program/erase routine : programs/erases the flash memory. (d) copy routine 1 : copies routines (a) and (b) into the internal ram or external memory. (e) copy routine 2 : copies routines (a) and (b) from the internal ram or external memory into the flash memory. (step-2) entering user boot mode (using the reset processing) the following explanation assumes that these routines are incorporated in the reset processing program. after reset release, the reset processing program first determines whether or not the device should enter user boot mode. if the condition for entering user boot mode is true, user boot mode is entered to program/erase the flash memory. (tmp91fw27) (controller) (i/o) flash memory ram [reset processing routine] (a) mode select routine old user application program (b) transfer routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (tmp91fw27) (controller) (i/o) 0 1 reset condition for entering user boot mode (user-specified) flash memory ram [reset processing routine] (a)mode select routine old user application program (b)transfer routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2
tmp91fw27 91fw27-53 2007-11-02 (step-3) copying the program/erase routine to the internal ram after the device has entered user boot mode, the transfer routine (b) transfers the routines (c) to (e) from the controller to the internal ram (or external memory). (the routines are copied into the internal ram here.) (step-4) executing the copy routine 1 in the internal ram control jumps to the internal ram and the copy routine 1 (d) copies the routines (a) and (b) into the internal ram. (tmp91fw27) (controller) (i/o) flash memory ram [reset processing routine] (a) mode select routine old user application program (b) transfer routine (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (tmp91fw27) (controller) (i/o) flash memory ram [reset processing routine] (a) mode select routine old user application program (b) transfer routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (a)mode select routine ( b ) transfer routine (c) program/erase routine
tmp91fw27 91fw27-54 2007-11-02 (step-5) erasing the flash memory by the program/erase routine the program/erase routine (c) eras es the old user program area. (step-6) restoring the user boot program in the flash memory the copy routine (e) copies the routines (a) and (b) from the internal ram into the flash memory. (tmp91fw27) (controller) (i/o) flash memory ram (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (a)mode select routine (b)transfer routine erased (tmp91fw27) (controller) (i/o) flash memory ram [reset processing program] (a) mode select routine (b) transfer routine (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (e) copy routine 2 (d) copy routine 1 (a)mode select routine (b) transfer routine
tmp91fw27 91fw27-55 2007-11-02 (step-7) writing the new user application program to the flash memory the program/erase routine (c) in the ram is executed to load the new user application program from the controller into the erased area of the flash memory. (step-8) executing the new user application program the reset input pin is driven low (?0?) to reset the device. the mode setting condition is set for normal mode. after reset release, th e device will start executing the new user application program. (controller) (i/o) (tmp91fw27) flash memory ram [reset processing program] (a) mode select routine new user application program (b) transfer routine (c) program/erase routine new user application program (c) program/erase routine (d) copy routine 1 (e) copy routine 2 (a)mode select routine ( b ) transfer routine (d) copy routine 1 (e) copy routine 2 (tmp91fw27) (controller) (i/o) 0 1 reset condition for entering normal mode flash memory ram [reset processing program] (a)mode select routine new user application program (b) transfer routine
tmp91fw27 91fw27-56 2007-11-02 3.2.6 flash memory command sequences the operation of the flash memory is comprised of six commands, as shown in 46h46h table 3.2.21. addresses specified in each command sequence must be in an area where the flash memory is mapped. for details, see 47h47h table 3.2.3. table 3.2.21 command sequences 1st bus write cycle 2nd bus write cycle 3rd bus write cycle 4th bus write cycle 5th bus write cycle 6th bus write cycle command sequence addr. data addr. data addr. data addr. data addr. data addr. data 1 single word program aaah aah 554h 55h aaah a0h pa (note 1) pd (note 1) 2 sector erase (4-kb erase) aaah aah 554h 55h aaah 80h aaah aah 554h 55h sa (note 2) 30h 3 chip erase (all erase) aaah aah 554h 55h aaah 80h aaah aah 554h 55h aaah 10h 4 product id entry aaah aah 554h 55h aaah 90h product id exit xxh f0h 5 product id exit aaah aah 554h 55h aaah f0h read protect set aaah aah 554h 55h aaah a5h 77eh f0h (note3) 6 write protect set aaah aah 554h 55h aaah a5h 77eh 0fh (note3) note 1: pa = program word address, pd = program word data set the address and data to be programmed. even -numbered addresses should be specified here. note 2: sa = sector erase address, each sector erase range is selected by address a23 to a12. note 3: when apply read protect and write protect, be sure to program the data of 00h. table 3.2.22 hardware sequence flags status d7 d6 single word program d7 toggle sector erase/chip erase 0 toggle during auto operation read protect set/write protect set cannot be used toggle note: d15 to d8 and d5 to d0 are ?don?t care?.
tmp91fw27 91fw27-57 2007-11-02 3.2.6.1 single word program the single word program command sequence programs the flash memory on a word basis. the address and data to be programmed are specified in the 4th bus write cycle. it takes a maximum of 60 s to program a single word. another command sequence cannot be executed until the write operation has completed. this can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. while a write operation is in progress, bit 6 of data is toggled each time it is read. note: to rewrite data to flash memory addresses at which data (including ffffh) is already written, make sure to erase the existing data by ?sector eras e? or ?chip erase? before rewriting data. 3.2.6.2 sector erase (4-kbyte erase) the sector erase command sequence erases 4 kbytes of data in the flash memory at a time. the flash memory address range to be erased is specified in the 6th bus write cycle. for the address range of each sector, see 48h48h table 3.2.3. this command sequence cannot be used in programmer mode. it takes a maximum of 75 ms to erase 4 kbytes. another command sequence cannot be executed until the erase operation has completed. this can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. while a erase operation is in progress, bit 6 of data is toggled each time it is read. 3.2.6.3 chip erase (all erase) the chip erase command sequence erases the entire area of the flash memory. it takes a maximum of 300 ms to erase the entire flash memory. another command sequence cannot be executed until the erase operation has completed. this can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. while an erase operation is in progress, bit 6 of data is toggled each time it is read. erase operations clear data to ffh. 3.2.6.4 product id entry when the product id entry command is executed, product id mode is entered. in this mode, the vendor id, flash macro id, fl ash size id, and read/write protect status can be read from the flash memory. in prod uct id mode, the data in the flash memory cannot be read. 3.2.6.5 product id exit this command sequence is used to exit product id mode.
tmp91fw27 91fw27-58 2007-11-02 3.2.6.6 read protect set the read protect set command sequence applies read protection on the flash memory. when read protection is applied, the flash memory cannot be read in programmer mode and the ram transfer command cannot be executed in single boot mode. to cancel read protection, it is necessary to execute the chip erase command sequence. to check whether or not read protection is applied, read xxx77eh in product id mode. it takes a maximum of 60 s to set read protection on the flash memory. another command sequence cannot be executed until the read protection setting has completed. this can be checked by readin g the same address in the flash memory repeatedly until the same data can be read consecutively. while a read protect operation is in progress, bit 6 of data is toggled each time it is read. 3.2.6.7 write protect set the write protect set command sequence applies write protection on the flash memory. when write protection is applied, the flash memory cannot be written to in programmer mode and the ram transfer command cannot be executed in single boot mode. to cancel write protection, it is necessary to execute the chip erase command sequence. to check whether or not write protection is applied, read xxx77eh in product id mode. it takes a maximum of 60 s to set write protection. another command sequence cannot be executed until the write protection setting has completed. this can be checked by readin g the same address in the flash memory repeatedly until the same data can be read consecutively. while a write protect operation is in progress, bit 6 of data is toggled each time it is read. 3.2.6.8 hardware sequence flags the following hardware sequence flags are available to check the auto operation execution status of the flash memory. 1) data polling (d7) when data is written to the flash memo ry, d7 outputs the complement of its programmed data until the write operation has completed. after the write operation has completed, d7 outputs the proper cell data. by reading d7, therefore, the operation status can be checked. while the sector erase or chip erase command sequence is being executed, d7 outputs ?0?. after the command sequence is completed, d7 outputs ?1? (cell data). then, the data written to all the bits can be read after waiting for 1 s. when read/write protection is applied, the data polling function cannot be used. instead, use the toggle bit (d6) to check the operation status.
tmp91fw27 91fw27-59 2007-11-02 2) toggle bit (d6) when the flash memory program, sector erase, chip erase, write protect set, or read protect set command sequence is executed, bit 6 (d6) of the data read by read operations outputs ?0? and ?1? alte rnately each time it is read until the processing of the executed command sequence has completed. the toggle bit (d6) thus provides a software means of checking whether or not the processing of each command sequence has completed. normally, the same address in the flash memory is read repeatedly until the same data is read successively. the initial read of the toggle bit always returns ?1?. note: the flash memory incorporated in the tmp91fw 27 does not have an exceed-time-limit bit (d5). it is therefore necessary to set the data polling time limit and toggle bit polling time limit so that polling can be stopped if the time limit is exceeded. 3.2.6.9 data read data is read from the flash memory in byte units or word units. it is not necessary to execute a command sequence to read data from the flash memory.
tmp91fw27 91fw27-60 2007-11-02 3.2.6.10 programming the flash memory by the internal cpu the internal cpu programs the flash memory by using the command sequences and hardware sequence flags described above. however, since the flash memory cannot be read during auto operation mode, the program/erase routine must be executed outside of the flash memory. the cpu can program the flash memory either by using single boot mode or by using a user-created protocol in single chip mode (user boot). 1) single boot: the microcontroller is started up in single boot mode to program the flash memory by the internal boot rom program. in this mode, the internal boot rom is mapped to an area including the interrupt vector table, in which the boot rom program is executed. the flash memory is mapped to an address area different from the boot rom area. the boot rom program loads data into the flash memory by serial transfer. in single boot mode , interrupts must be disabled including non-maskable interrupts ( nmi , etc.). for details, see 49h 3.2.4? 50h single boot mode? 2) user boot: in this method, the flash memory is programmed by executing a user-created routine in single chip mode (normal operation mode). in this mode, the user-created program/erase routine must also be executed outside of the flash memory. it is also necessary to disable interrupts including non-maskable interrupts. the user should prepare a flash memory program/erase routine (including routines for loading write data and writing the loaded data into the flash memory). in the main program, normal operation is switched to flash memory programming operation to execute the flash memory program/erase routine outside of the flash memory area. for example, the flash memory program/erase routine may be transferred from the flash memory to the internal ram and executed there or it may be prepared and executed in external memory. for details, see 51h 3.2.5? 52h flash memory?.
tmp91fw27 91fw27-61 2007-11-02 flowcharts: flash memory a ccess by the internal cpu single word program program command sequence ( see the flowchart below ) start toggle bit (d6) last address? no yes program end address = address + 2 (even-numbered address/ word units) program command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/a0h even-numbered program address (a0 = 0) / program data (word units) read data matched program data? read data matched program data? abnormal end yes yes no no timeout (60 s) word read addr. = program address word read addr. = program address program command sequence (see the flowchart below) toggle bit (d6)
tmp91fw27 91fw27-62 2007-11-02 chip erase/sector erase note: in chip erase, whether or not the ent ire flash memory is blank is checked. in sector erase, whether or not the se lected sector is blank is checked. chip erase command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/80h xxxaaah/aah xxx554h/55h xxxaaah/10h sector erase command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/80h xxxaaah/aah xxx554h/55h sector address/30h erase command sequence (see the flowchart below) start toggle bit (d6) erase end read data = blank? abnormal end yes no timeout (chip: 300 ms, sector: 75 ms) erase command sequence (see the flowchart below) toggle bit (d6)
tmp91fw27 91fw27-63 2007-11-02 read/write protect set protect set command sequence (address/data) xxxaaah/aah xxx554h/55h xxxaaah/a5h set read protect xxx77eh/f0h set write protect xxx77eh/0fh set both read protect and write protect xxx77eh/00h protect set command sequence (see the flowchart below) start toggle bit (d6) protect set end abnormal end yes timeout (60 s) product id entry read data matched p ro g ram data? product id exit byte read (d7 to d0) addr. = xxx77eh no toggle bit (d6) protect set command sequence (see the flowchart below) product id entry product id exit
tmp91fw27 91fw27-64 2007-11-02 data polling (d7) toggle bit (d6) note: hardware sequence flags are read from the flash memory in byte units or word units. va: in single word program, va denotes the address to be programmed. in sector erase, va denotes any address in the selected sector. in chip erase, va denotes any address in the flash memory. in read protect set, va denotes t he protect set address (xx77eh). in write protect set, va denotes the protect set address (xx77eh). byte read (d7 to d0) addr. = va start d7 = data? yes no (va: valid address) operation end byte read (d7 to d0) addr. = va d6 = toggle? start no operation end yes byte read (d7 to d0) addr. = va
tmp91fw27 91fw27-65 2007-11-02 product id entry read values in product id mode address read value vendor id xxxx00h 98h flash macro id xxxx02h 42h flash size id xxxx04h 1fh read/write protect status xxx77eh data programmed when protection is set. when protection is not set, ffh. product id exit xxx554h/55h start xxxaaah/aah xxxaaah/90h wait for 300 nsec or longer (id access and exit time = max. 300 nsec) [product id mode start] start xxxaaah/aah xxx554h/55h xxxaaah/f0h wait for 300fnsec or longer (id access and exit time = max.300 nsec) xxxxxxh/f0h wait for 300 nsec or longer (id access and exit time = max. 300 nsec) start product id read (see the table below) product id mode end product id mode end
tmp91fw27 91fw27-66 2007-11-02 (example: program to be loaded and executed in ram) erase the flash memory (chip erase) and then write 0706h to address fe0000h. ;#### flash memory chip erase processing #### ld xix, 0xfe0000 ; set start address chiperase: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0x80 ; 3rd bus write cycle ld (0xfe0aaa), 0xaa ; 4th bus write cycle ld (0xfe0554), 0x55 ; 5th bus write cycle ld (0xfe0aaa), 0x10 ; 6th bus write cycle cal togglechk ; check toggle bit chiperase_loop: ld wa, (xix+) ; read data from flash memory cp wa, 0xffff ; blank data? j ne, chiperase_err ; if not blan k data, jump to error processing cp xix, 0xffffff ; end address (0xffffff)? j ult, chiperase_loop ; check entire memory area and then end loop processing ;#### flash memory program processing #### ld xix, 0xfe0000 ; set program address ld wa, 0x0706 ; set program data program: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0xa0 ; 3rd bus write cycle ld (xix), wa ; 4th bus write cycle cal togglechk ; check toggle bit ld bc, (xix) ; read data from flash memory cp wa, bc. j ne, program_err ; if programmed data cannot be read, error is determined ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined program_end: j program_end ; program operation end ;#### toggle bit (d6) check processing #### togglechk: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) ld h, l ; save first toggle bit data togglechk1: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) cp l, h ; toggle bit = toggled? j z, togglechk2 ; if not toggled, end processing ld h, l ; save current toggle bit state j togglechk1 ; recheck toggle bit togglechk2: ret ;#### error processing #### chiperase_err: j chiperase_err ; chip erase error program_err: j program_err ; program error
tmp91fw27 91fw27-67 2007-11-02 (example: program to be loaded and executed in ram) erase data at addresses ff0000h to ff0fffh (sector erase) and then write 0706h to address ff0000h. ;#### flash memory sector erase processing #### ld xix, 0xff0000 ; set start address sectorerase: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0x80 ; 3rd bus write cycle ld (0xfe0aaa), 0xaa ; 4th bus write cycle ld (0xfe0554), 0x55 ; 5th bus write cycle ld (xix), 0x30 ; 6th bus write cycle cal togglechk ; check toggle bit sectorerase_loop: ld wa, (xix+) ; read data from flash memory cp wa, 0xffff ; blank data? j ne, sectorerase_err ; if not blan k data, jump to error processing cp xix, 0xff0fff ; end address (0xff0fff)? j ult, sectorerase_loop ; check erased sector area and then end loop processing ;#### flash memory program processing #### ld xix, 0xff0000 ; set program address ld wa, 0x0706 ; set program data program: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0xa0 ; 3rd bus write cycle ld (xix), wa ; 4th bus write cycle cal togglechk ; check toggle bit ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined ld bc, (xix) ; read data from flash memory cp wa, bc j ne, program_err ; if programmed data cannot be read, error is determined program_end: j program_end ; program operation end ;#### toggle bit (d6) check processing #### togglechk: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) ld h, l ; save first toggle bit data togglechk1: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) cp l, h ; toggle bit = toggled? j z, togglechk2 ; if not toggled, end processing ld h, l ; save current toggle bit state j togglechk1 ; recheck toggle bit togglechk2: ret ;#### error processing #### sectorerase_err: j sectorerase_err ; sector erase error program_err: j program_err ; program error
tmp91fw27 91fw27-68 2007-11-02 (example: program to be loaded and executed in ram) set read protection and write protection on the flash memory. ;#### flash memory protect set processing #### ld xix, 0xfe077e ; set protect address protect: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0xa5 ; 3rd bus write cycle ld (xix), 0x00 ; 4th bus write cycle cal togglechk ; check toggle bit cal pid_entry ; ld a, (xix) ; read protected address cal pid_exit ; cp a, 0x00 ;(0xfe077e)=0x00? j ne, protect_err ; protected? protect_end: j protect_end ; protect set operation completed protect_err: j protect_err ; protect set error ;#### product id entry processing #### pid_entry: ld (0xfe0aaa), 0xaa ; 1st bus write cycle ld (0xfe0554), 0x55 ; 2nd bus write cycle ld (0xfe0aaa), 0x90 ; 3rd bus write cycle ; --- wait for 300 nsec or longer (execute nop instruction [148nsec/@f fph =27mhz] three times) --- nop nop nop ; wait for 444 nsec ret ;#### product id exit processing #### pid_exit: ld (0xfe0000), 0xf0 ; 1st bus write cycle ; --- wait for 300 nsec or longer (execute nop instruction [148nsec/@f fph =27mhz] three times) --- nop nop nop ; wait for 444 nsec ret ;#### toggle bit (d6) check processing #### togglechk: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) ld h, l ; save first toggle bit data togglechk1: ld l, (xix) and l, 0y01000000 ; check toggle bit (d6) cp l, h ; toggle bit = toggled? j z, togglechk2 ; if not toggled, end processing ld h, l ; save current toggle bit state j togglechk1 ; recheck toggle bit togglechk2: ret (example: program to be loaded and executed in ram) read data from address fe0000h. ;#### flash memory read processing #### read: ld wa, (0xfe0000) ; read data from flash memory
tmp91fw27 2007-11-02 91fw27-69 4. electrical characteristics 4.1 absolute maximum ratings parameter symbol rating unit power supply voltage vcc ? 0.5 to 4.0 input voltage vin ? 0.5 to vcc + 0.5 v output current (1 pin) iol 2 output current (1 pin) ioh ? 2 output current (total) iol 80 output current (total) ioh ? 80 ma power dissipation (ta = 85c) pd 600 mw soldering temperature (10 s) tsolder 260 storage temperature tstg ? 65 to 150 operation temperature topr ? 40 to 85 c number of times program erase n ew 100 cycle note: the absolute maximum ratings are rated values that must not be exceeded during operation, even for an instant. any one of the ratings must not be exceeded. if any absolute maximum rating is exceeded, a device may break down or its performance may be degraded, causing it to catch fire or explode resulting in injury to the user. thus, when designing products that include this device, ensure that no absolute maximum rating value will ever be exceeded. solderability of lead free products te s t parameter test condition note use of sn ? 37pb solder bath solder bath temperature = 230 c, dipping time = 5 seconds the number of times = one, use of r-type flux solderability use of sn ? 3.0ag ? 0.5cu solder bath solder bath temperature = 245 c, dipping time = 5 seconds the number of times = one, use of r-type flux (use of lead free) pass: solderability rate until forming 95%
tmp91fw27 2007-11-02 91fw27-70 4.2 dc characteristics (1/2) parameter symbol condition min typ.(note) max unit fc = 4 to 27 mhz 2.7 power supply voltage avcc = dvcc avss = dvss = 0 v vcc fc = 2 to 16 mhz fs = 30 to 34 khz 2.2 3.6 v power supply voltage avcc = dvcc avss = dvss = 0 v for erase/program operations of flash memory vcc fc = 4 to 27 mhz ta = ? 10 40c 2.7 3.6 v vcc 2.7 v 0.6 p00 to p17 (ad0 to ad15) vil vcc < 2.7 v 0.2 vcc vcc 2.7 v 0.3 vcc p20 to p97 (except p63) vil1 vcc < 2.7 v 0.2 vcc vcc 2.7 v 0.25 vcc reset , nmi p63 (int0) vil2 vcc < 2.7 v 0.15 vcc vcc 2.7 v 0.3 am0 and am1 vil3 vcc < 2.7 v 0.3 vcc 2.7 v 0.2 vcc input low voltage x1 vil4 vcc < 2.7 v ? 0.3 0.1 vcc v vcc 2.7 v 2.0 p00 to p17 (ad0 to ad15) vih vcc < 2.7 v 0.7 vcc vcc 2.7 v 0.7 vcc p20 to p97 (except p63) vih1 vcc < 2.7 v 0.8 vcc vcc 2.7 v 0.75 vcc reset , nmi , p63 (int0) vih2 vcc < 2.7 v 0.85 vcc vcc 2.7 v vcc ? 0.3 am0 and am1 vih3 vcc < 2.7 v vcc ? 0.3 vcc 2.7 v 0.8 vcc input high voltage x1 vih4 vcc < 2.7 v 0.9 vcc vcc + 0.3 v iol = 1.6ma vcc 2.7 v 0.45 output low voltage vol iol = 0.4ma vcc < 2.7 v 0.15 vcc ioh = ? 400 a vcc 2.7 v vcc ? 0.3 output high voltage voh ioh = ? 200 a vcc < 2.7 v 0.8 vcc v note: typical values are for when ta = 25c and v cc = 3.0 v uncles otherwise noted.
tmp91fw27 2007-11-02 91fw27-71 dc characteristics (2/2) parameter symbol condition min typ. (note1) max unit input leakage current ili 0.0 v in vcc 0.02 5 output leakage current ilo 0.2 v in vcc ? 0.2 0.05 10 a power down voltage (@stop, ram back up) vstop v il2 = 0.2 vcc, v ih2 = 0.8 vcc 2.2 3.6 v vcc = 2.7 v to 3.6 v 100 400 reset pull-up resistor rrst vcc = 2.2 v 200 1000 k pin capacitance cio fc = 1 mhz 10 pf vcc 2.7 v 0.4 1.0 schmitt width reset , nmi , int0 vth vcc < 2.7 v 0.3 0.8 v vcc = 2.7 v to 3.6 v 100 400 programmable pull-up resistor rkh vcc = 2.2 v 200 1000 k normal (note 2) 13 20 idle2 7 9 idle1 vcc = 2.7 v to 3.6 v fc = 27 mhz 3.4 4.5 ma normal (note 2) 5.5 8 idle2 3.0 4.8 idle1 vcc = 2.2 v (typ. = 2.2v) fc = 16 mhz 1.5 2.9 ma slow (note 2) 20 55 idle2 20 44 idle1 vcc = 2.2 v to 3.6 v fs = 32.768 khz 10 40 a stop icc vcc = 2.2 v to 3.6 v 1 25 a peak current by intermitt operation iccp-p vcc = 2.2v to 3.6v 20 ma note 1: typical values are for when ta = 25c and v cc = 3.0 v unless otherwise noted. note 2: icc measurement conditions (normal, slow): all functions are operational; output pins are open and input pins are fixed. when the program is operating by the flash memory, or when data reed from the flash memory, the flash memory operate intermittently. theref ore, it outputs a peak current like a following diagram, momentarily. in this case, the power supply curren t; icc (normal/slow mode) is the sum of average value of a peak current and a mcu current value. when designing the power supply, set to a circuit wh ich a peak current can be supplyed. in slow mode, a defference of peak current and average current is large. n n+2 n+4 iccp-p [ma] program counter (pc) flash current which flows momentarily. max. current typ. current mcu current the average of peak current + mcu current flash memory intermittent operation
tmp91fw27 2007-11-02 91fw27-72 4.3 ac characteristics (1) vcc = 2.7 v to 3.6 v variable f fph = 27 mhz no. parameter symbol min max min max unit 1 f fph period ( = x) t fph 37.0 31250 37.0 ns 2 a0 to a15 valid ale falling t al 0.5x ? 6 12 ns 3 ale falling a0 to a15 hold t la 0.5x ? 16 2 ns 4 ale high pulse width t ll x ? 20 17 ns 5 ale falling rd / wr falling t lc 0.5x ? 14 4 ns 6 rd rising ale rising t clr 0.5x ? 10 8 ns 7 wr rising ale rising t clw x ? 10 27 ns 8 a0 to a15 vlalid rd / wr falling t acl x ? 23 14 ns 9 a0 to a21 valid rd / wr falling t ach 1.5x ? 26 29 ns 10 rd rising a0 to a21 hold t car 0.5x ? 13 5 ns 11 wr rising a0 to a21 hold t caw x ? 13 24 ns 12 a0 to a15 valid d0 to d15 input t adl 3.0x ? 38 73 ns 13 a0 to a21 valid d0 to d15 input t adh 3.5x ? 41 88 ns 14 rd falling d0 to d15 input t rd 2.0x ? 30 44 ns 15 rd low puse width t rr 2.0x ? 15 59 ns 16 rd rising d0 to d15 hold t hr 0 0 ns 17 rd rising a0 to a15 output t rae x ? 15 22 ns 18 wr low pulse width t ww 1.5x ? 15 40 ns 19 d0 to d15 valid wr rising t dw 1.5x ? 35 20 ns 20 wr rising d0 to d15 hold t wd x ? 25 12 ns 21 a0 to a21 valid port input t aph 3.5x ? 89 40 ns 22 a0 to a21 valid port hold t aph2 3.5x 129 ns 23 a0 to a21 valid port valid t ap 3.5x + 80 209 ns ac measurement conditions ? output level: high 0.7 vcc/low 0.3 v cc , c l = 50 pf ? input level: high 0.9 vcc/low 0.1 v cc note: symbol [x] in the above ta ble means the period of clock f fph . it?s half period the system clock f sys for cpu core. the period of clock f fph depends on the clock gear setting or the selection of high/low oscillator frequency.
tmp91fw27 2007-11-02 91fw27-73 (2) vcc = 2.2 v to 3.6 v variable f fph = 16 mhz no. parameter symbol min max min max unit 1 f fph period ( = x) t fph 62.5 31250 62.5 ns 2 a0 to a15 valid ale falling t al 0.5x ? 18 13 ns 3 ale falling a0 to a15 hold t la 0.5x ? 25 6 ns 4 ale high pulse width t ll x ? 30 32 ns 5 ale falling rd / wr falling t lc 0.5x ? 25 6 ns 6 rd rising ale rising t clr 0.5x ? 15 16 ns 7 wr rising ale rising t clw x ? 15 47 ns 8 a0 to a15 vlalid rd / wr falling t acl x ? 30 32 ns 9 a0 to a21 valid rd / wr falling t ach 1.5x ? 30 63 ns 10 rd rising a0 to a21 hold t car 0.5x ? 21 10 ns 11 wr rising a0 to a21 hold t caw x ? 25 37 ns 12 a0 to a15 valid d0 to d15 input t adl 3.0x ? 50 137 ns 13 a0 to a21 valid d0 to d15 input t adh 3.5x ? 56 162 ns 14 rd falling d0 to d15 input t rd 2.0x ? 50 75 ns 15 rd low puse width t rr 2.0x ? 28 97 ns 16 rd rising d0 to d15 hold t hr 0 0 ns 17 rd rising a0 to a15 output t rae x ? 25 37 ns 18 wr low pulse width t ww 1.5x ? 29 64 ns 19 d0 to d15 valid wr rising t dw 1.5x ? 60 33 ns 20 wr rising d0 to d15 hold t wd x ? 40 22 ns 21 a0 to a21 valid port input t aph 3.5x ? 100 68 ns 22 a0 to a21 valid port hold t aph2 3.5x 218 ns 23 a0 to a21 valid port valid t ap 3.5x + 150 368 ns ac measurement conditions ? output level: high 0.7 vcc/low 0.3 v cc , c l = 50 pf ? input level: high 0.9 vcc/low 0.1 v cc note: symbol [x] in the above ta ble means the period of clock f fph . it?s half period the system clock f sys for cpu core. the period of clock f fph depends on the clock gear setting or the selection of high/low oscillator frequency.
tmp91fw27 2007-11-02 91fw27-74 (3) read cycle note: since the cpu accesses the internal area to read data from a port, the control signals of external pins such as rd and cs are not enabled. therefore, the above waveform diagram should be regarded as depicting internal operation. please also note that the timing and ac characteristics of port input/output shown above are typical representation. for details, contact your local toshiba sales representative. t hr t acl f fph a0 to a21 port input (note) rd ad0 to ad15 ale t fph t aph a0 to a15 t adh t ll t al t la t ac t lc t rr t car t rae t clr d0 to d15 t aph2 t adl cs0 to cs2 t rd
tmp91fw27 2007-11-02 91fw27-75 (4) write cycle note: since the cpu accesses the internal area to write data to a port, the control signals of external pins such as wr and cs are not enabled. therefore, the above waveform diagram should be regarded as depicting internal operation. please also note that the timing and ac characteristics of port input/output shown above are typica l representation. for details, contact your local toshiba sales representative. a0 to a15 d0 to d15 t wd t ap t ww t dw f fph a0 to a21 port output (note) ad0 to ad15 ale wr , hwr cs0 to cs2 t caw t clw
tmp91fw27 2007-11-02 91fw27-76 4.4 ad conversion characteristics avcc = vcc, avss = vss parameter symbol condition min typ. max unit analog input voltage vain avss avcc v error (not including quantization errors) ? vcc = 2.2 v to 3.6 v 1.0 4.0 lsb note 1: 1 lsb = (avcc ? avss)/1024 [v] note 2: minimum operation frequency: the operaion of ad converte r is guranteed only using fc (high frequency oscillator). fs (low frequency oscillator) is not guranteed. bu t when frequency of clock selected by clock gear is more than and eqaull 4 mhz in using fc, it is guranteed (ffph 4 mhz). note 3: the value for icc (current of vcc pin) in cludes the current which flows through the avcc pin.
tmp91fw27 2007-11-02 91fw27-77 4.5 serial channel timing (i/o interface mode) (1) sclk input mode variable 10 mhz 27 mhz parameter symbol min max min max min max unit sclk period t scy 16x 1.6 0.59 s t scy /2 ? 4x ? 110 (v cc = 2.7 v to 3.6 v) 290 38 output data sclk rising/falling t oss t scy /2 ? 4x ? 180 (v cc = 2.2 v) 220 ? ns sclk rising/falling output data hold t ohs t scy /2 + 2x + 0 1000 370 ns sclk rising /falling input data hold t hsr 3x + 10 310 121 ns sclk rising/falling valid data input t srd t scy ? 0 1600 592 ns valid data input sclk rising/falling t rds 0 0 0 ns (2) sclk ouptut mode variable 10 mhz 27 mhz parameter symbol min max min max min max unit sclk period t scy 16x 8192x 1.6 819 0.59 303 s output data sclk rising/falling t oss t scy /2 ? 40 760 256 ns sclk rising/falling output data hold t ohs t scy /2 ? 40 760 256 ns sclk rising/falling input data hold t hsr 0 0 0 ns sclk rising/falling valid data input t srd t scy ? 1x ? 180 1320 375 ns valid data input sclk rising/falling t rds 1x + 180 280 217 ns note 1: sclk rising/falling: the rising edge is used in sclk rising mode. the falling edge is used in sclk falling mode. note 2: 27 mhz and 10 mhz values are calculated from t scy = 16x case. note 3: symbol [x] in the above table means the period of clock f fph . it?s half period the system clock f sys for cpu core. the period of clock f fph depends on the clock gear setting or the selection of high/low oscillator frequency. t rds t srd t hsr t scy output data txd sclk (input falling mode) scl k output mode/ input rising mode 0 t oss t ohs 1 3 0 1 3 2 2 valid input data rxd valid valid valid
tmp91fw27 2007-11-02 91fw27-78 4.6 event counter (ta0in, ta4in, tb0in0 and tb0in1) variable 10 mhz 27 mhz parameter symbol min max min max min max unit clock period t vck 8x + 100 900 396 ns clock low level pulse width t vckl 4x + 40 440 188 ns clock high level pulse width t vckh 4x + 40 440 188 ns 4.7 interrupt and capture (1) nmi and int0 interrupts variable 10 mhz 27 mhz parameter symbol min max min max min max unit nmi and int0 low level pulse width t intal 4x + 40 440 188 ns nmi and int0 high level pulse width t intah 4x + 40 440 188 ns (2) int5 and int6 interrupts, capture int5 and int6 input pulse width depend on the system clock selection and clock selection for prescaler. below table show pulse width of each operation clock. t intbl (int5 and int6 low level pulse width) t intbh (int5 and int6 high level pulse width ) valiable f fph = 27mhz valiable f fph = 27mhz system clock selection syscr1 clock selection for prescaler syscr0 min min min min unit 00 (f fph ) 8x + 100 396 8x + 100 396 ns 0 (fc) 10 (fc/16) 128xc + 0.1 4.8 128xc + 0.1 4.8 1 (fs) 00 (f fph ) 8x + 0.1 244.3 8x + 0.1 244.3 s note 1: ?xc? shows period of clock fc in high frequency oscillator. note 2: symbol [x] in the above table means the period of clock f fph . it?s half period the system clock f sys for cpu core. the period of clock f fph depends on the clock gear setting or the selection of high/low oscillator frequency. 4.8 flash characteristics (1) rewriting parameter condition min typ max unit guarantee on flash-memory rewriting vcc = 2.7v to 3.6v, fc = 4 to 27 mhz ta = ? 10 to 40 oc ? ? 100 times
tmp91fw27 2007-11-02 91fw27-79 5. port section equivalent circuit diagrams ? reading the circuit diagrams basically, the gate symbols written are the same as those used for the standard cmos logic ic [74hcxx] series. the dedicated signal is described below. stop : this signal becomes active 1 when th e halt mode setting re gister is set to the stop mode (syscr2 = ?01?) and the cpu executes the halt instruction. when the drive enable bit syscr2 is se t to ?1?, however stop remains at ?0?. ? the input protection resistance ranges from several tens of ohms to several hundreds of ohms. p0 (ad0~ad7), p1 (ad8~ad15, a8~a15), p2 (a16~a21, a0~a5), p60, p70~p74, p80~p83, p91~p92, p94~p95 p30 ( rd ), p31 ( wr ) vcc output data p-ch i/o input data output enable stop input enable n-ch output vcc output data stop p-ch n-ch
tmp91fw27 2007-11-02 91fw27-80 p32, p40~p42 p5 (an0~an3) p63 (int0) i/o input enable vcc output data output enable stop input data vcc programmable pull-up resistor analog input channel select input input data analog input input enable vcc schmitt i/o output data output enable stop input data p-ch n-ch
tmp91fw27 2007-11-02 91fw27-81 p61 (so/sda), p62 (si/scl), p90 (txd0), p93 (txd1) p96 (xt1), p97 (xt2) nmi input nmi schmitt i/o input enable vcc output data stop input enable open-drain output enable p-ch n-ch output enable p96 (xt1) p97 (xt2) input enable clock ouput data stop input enable input enable low-frequenc y oscillation enable input enable ouput data output enable output enable oscillato r n-ch n-ch
tmp91fw27 2007-11-02 91fw27-82 am0~am1 ale reset x1, x2 input output enable internal ale p-ch n-ch vcc output input wdtout reset reset enable schmitt p-ch vcc n-ch x2 high-frequen c y oscillation oscillato r p-ch clock x1 stop
tmp91fw27 2007-11-02 91fw27-83 vrefh, vrefl a vcc vrefon a vss p-ch string resistance
tmp91fw27 2007-11-02 91fw27-84 6. package dimensions lqfp64-p-1010-0.50d unit: mm 1.25 typ 0.5 m 0.08 0.22 0.05 49 64 32 48 33 11 6 17 10.0 0.2 12.0 0.2 10.0 0.2 12.0 0.2 1.4 0.05 0.1 0.05 1.6 max 0.08 0.145 0.055 0.6 0.15 0.25 ( 0~10 )
tmp91fw27 2007-11-02 91fw27-85 qfp64-p-1414-0.80a unit: mm

▲Up To Search▲

Price & Availability of TMP91FW27FG

	To Download TMP91FW27FG Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .