TMP91FW27UG(C,JZ)

TOSHIBA Original CMOS 16-Bit Microcontroller TLCS-900/L1 Series TMP91FW27UG TMP91FW27FG Semiconductor Company Preface Thank you very much for making use of Toshiba microcomputer LSI. Before using this LSI, refer to section “Points of Note and Restrictions”. Especially, take care below cautions. **CAUTION** How to release the HALT mode Usually, interrupts can release all halts stats. However, the interrupts = ( NMI , INT0, INTRTC), which can release the HALT mode may not be able to do so if they are input during the period CPU is shifting to the HALT mode (for about 5 clocks of fFPH) with IDLE1 or STOP mode (IDLE2 is not applicable to this case). (In this case, an interupt request is kept on hold internally.) If another interupt is generated after it has shifted to HALT mode completely, halt status can be released without difficultly. The priority of this interrupt is compare with that of the interrupt kept on hold internally, and the interrupt with higher priority is handled first followed by the other interrupt. TMP91FW27 CMOS 16-Bit Microcontrollers TMP91FW27UG / TMP91FW27FG 1. Outline and Features TMP91FW27 is a high-speed 16-bit microcontroller designed for the control of various mid-to large-scale equipment. TMP91FW27UG and TMP91FW27FG come in a 64-pin flat package. Listed below are the features. (1) High-speed 16-bit CPU (900/L1 CPU) • Instruction mnemonics are upward-compatible with TLCS-90/900 • 16 Mbytes of linear address space • General-purpose registers and register banks • 16-bit multiplication and division instructions; bit transfer and arithmetic instructions • Micro DMA: 4 channels (593 ns /2 bytes at 27 MHz) (2) Minimum instruction execution time: 148 ns (at 27 MHz) (3) Built-in RAM: 12 Kbytes Built-in ROM: 128-Kbyte Flash memory 4-Kbyte mask ROM (used for booting) RESTRICTIONS ON PRODUCT USE 20070701-EN • The information contained herein is subject to change without notice. • TOSHIBA is continually working to improve the quality and reliability of its products. Nevertheless, semiconductor devices in general can malfunction or fail due to their inherent electrical sensitivity and vulnerability to physical stress. It is the responsibility of the buyer, when utilizing TOSHIBA products, to comply with the standards of safety in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such TOSHIBA products could cause loss of human life, bodily injury or damage to property. In developing your designs, please ensure that TOSHIBA products are used within specified operating ranges as set forth in the most recent TOSHIBA products specifications. Also, please keep in mind the precautions and conditions set forth in the “Handling Guide for Semiconductor Devices,” or “TOSHIBA Semiconductor Reliability Handbook” etc. • The TOSHIBA products listed in this document are intended for usage in general electronics applications (computer, personal equipment, office equipment, measuring equipment, industrial robotics, domestic appliances, etc.).These TOSHIBA products are neither intended nor warranted for usage in equipment that requires extraordinarily high quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury (“Unintended Usage”). Unintended Usage include atomic energy control instruments, airplane or spaceship instruments, transportation instruments, traffic signal instruments, combustion control instruments, medical instruments, all types of safety devices, etc.. Unintended Usage of TOSHIBA products listed in his document shall be made at the customer’s own risk. • The products described in this document shall not be used or embedded to any downstream products of which manufacture, use and/or sale are prohibited under any applicable laws and regulations. • The information contained herein is presented only as a guide for the applications of our products. No responsibility is assumed by TOSHIBA for any infringements of patents or other rights of the third parties which may result from its use. No license is granted by implication or otherwise under any patents or other rights of TOSHIBA or the third parties. • Please contact your sales representative for product-by-product details in this document regarding RoHS compatibility. Please use these products in this document in compliance with all applicable laws and regulations that regulate the inclusion or use of controlled substances. Toshiba assumes no liability for damage or losses occurring as a result of noncompliance with applicable laws and regulations. This product uses the Super Flash® technology under the license of Silicon Storage Technology,Inc. Super Flash® is a registered trademark of Silicon Storage Technology,Inc. 91FW27-1 2007-11-02 TMP91FW27 (4) External memory expansion • Expandable up to 16 Mbytes (shared program/data area) • Can simultaneously support 8-/16-bit width external data bus (Dynamic data bus sizing) (5) 8-bit timers: 6 channels (6) 16-bit timers: 1 channel (7) General-purpose serial interface: 2 channels • UART/Synchronous mode: 2 channels • IrDA Ver.1.0 (115.2 kbps) mode selectable: 1 channel (8) Serial bus interface: 1 channel • I2C bus mode/clock synchronous mode selectable (9) 10-bit AD converter (sample hold circuit is inside): 4 channels (10) Watchdog timer (11) Special timer for CLOCK (12) Chip select/Wait controller: 4 blocks (13) Interrupts: 34 interrupts • 9 CPU interrupts: • 21 internal interrupts: 7 priority levels are selectable • 4 external interrupts: 7 priority levels are selectable (among 3 interrupts are selectable edge mode) Software interrupt instruction and illegal instruction (14) Input/output ports: 53 pins (15) Stand-by function Three Halt modes: IDLE2 (programmable), IDLE1 and STOP (16) Clock controller • Clock gear function: Select a High-frequency clock fc to fc/16 • Special timer for CLOCK (fs = 32.768 kHz) (17) Operating voltage • Vcc = 2.7 V to 3.6 V (fc max = 27 MHz, flash memory read operation) • Vcc = 2.2 V to 3.6 V (fc max = 16 MHz, flash memory read operation) • Vcc = 2.7 V to 3.6 V (fc max = 27 MHz, flash memory erase/program operations) (18)Package • LQFP64-P-1010-0.50D (TMP91FW27UG) • QFP64-P-1414-0.80A (TMP91FW27FG) 91FW27-2 2007-11-02 TMP91FW27 DVCC DVSS CPU (TLCS-900/L1) ADTRG (P53) AN0~AN3 (P50~P53) AVCC, AVSS TXD0 (P90) RXD0 (P91) SCLK0/ CTS0 (P92) 10-bit 4-channel AD converter SIO/UART/IrDA (Channel 0) XWA XBC XDE XHL XIX XIY XIZ XSP W A B C D E H L IX IY IZ SP SCK (P60) SO/SDA (P61) SI/SCL (P62) SIO/UART (Channel 1) Serial bus interface (SBI) X1 X2 Clock gear Low speed oscillator 32 bits SR TXD1 (P93) RXD1 (P94) SCLK1/ CTS1 (P95) High speed oscillator XT1 (P96) XT2 (P97) RESET AM0 AM1 ALE F PC Watchdog timer (WDT) Port 0 AD0~AD7 (P00~P07) Port 1 AD8/A8~AD15/A15 (P10~P17) Port 2 A0/A16~A5/A21 (P20~P25) RD (P30) [ BOOT ] TA0IN (P70) 8-bit timer (TMRA0) TA1OUT (P71) 8-bit timer (TMRA1) Special timer for CLOCK Port 3 HWR (P32) 12-KB RAM 8-bit timer (TMRA2) TA3OUT (P72) 8-bit timer (TMRA3) TA4IN (P73) 8-bit timer (TMRA4) TA5OUT (P74) 8-bit timer (TMRA5) WR (P31) Port 6 CS/WAIT controller (4-block) 128-KB Flash EEPROM Interrupt controller 16-bit timer (TMRB0) 4-KB Boot ROM CS0 ~ CS2 (P40~P42) NMI INT0 (P63) TB0IN0/INT5 (P80) TB0IN1/INT6 (P81) TB0OUT0 (P82) TB0OUT1 (P83) ( ): Initial function after resert [ ]: During resert Figure 1.1 TMP91FW27 Block Diagram 91FW27-3 2007-11-02 TMP91FW27 2. Pin Assignment and Pin Functions The assignment of input/output pins for the TMP91FW27, their names and functions are as follows: 2.1 Pin Assignment Diagram Figure 2.1.1 shows the pin assignment of the TMP91FW27UG and TMP91FW27FG. P61/SO/SDA 57 P62/SI/SCL 58 56 P60/SCK 55 P42/ CS2 P63/INT0 59 54 P41/ CS1 P50/AN0 60 53 P40/ CS0 P51/AN1 61 52 P32/ HWR P52/AN2 62 51 P31/ WR P53/AN3/ ADTRG 63 50 P30/ RD / BOOT AVCC 64 49 P25/A5/A21 AVSS 1 48 P24/A4/A20 P70/TA0IN 2 47 P23/A3/A19 P71/TA1OUT 3 46 P22/A2/A18 P72/TA3OUT 4 45 P21/A1/A17 P73/TA4IN 5 44 P20/A0/A16 P74/TA5OUT 6 43 P17/AD15/A15 P80/TB0IN0/INT5 7 P81/TB0IN1/INT6 8 42 P16/AD14/A14 Top View LQFP64, QFP64 41 P15/AD13/A13 P82/TB0OUT0 9 P83/TB0OUT1 10 40 P14/AD12/A12 39 P13/AD11/A11 P90/TXD0 11 38 P12/AD10/A10 P91/RXD0 12 37 P11/AD9/A9 P92/SCLK0/ CTS0 13 36 P10/AD8/A8 P93/TXD1 14 35 P07/AD7 P94/RXD1 15 34 P06/AD6 P95/SCLK1/ CTS1 16 33 P05/AD5 AM0 17 32 P04/AD4 DVCC 18 31 P03/AD3 X2 19 30 P02/AD2 DVSS 20 29 P01/AD1 X1 21 28 P00/AD0 AM1 22 27 ALE RESET 23 26 NMI P96/XT1 24 25 P97/XT2 Figure 2.1.1 Pin Assignment Diagram (64-pin LQFP, QFP) 91FW27-4 2007-11-02 TMP91FW27 2.2 Pin Names and Functions The names of the input/output pins and their functions are described below. Table 2.2.1 and Table 2.2.2 show Pin names and functions. Table 2.2.1 Pin Names and Functions (1/2) Pin Names P00 to P07 Number of Pins I/O 8 I/O AD0 to AD7 P10 to P17 8 AD8 to AD15 A8 to A15 P20 to P25 Port 0: I/O port that allows I/O to be selected at the bit level I/O Address data (lower): 0 to 7 of address/data bus I/O Port1: I/O port that allows I/O to be selected at the bit level I/O Address data (upper): 8 to 15 of address/data bus Output 6 Functions I/O Address: 8 to 15 of address bus Port 2: I/O port that allows I/O to be selected at the bit level A0 to A5 Output Address: 0 to 5 of address bus A16 to A21 Output Address: 16 to 21 of address bus Output Port 30: Output Port Output Read: Strobe signal for reading external memory When read internal area also, output RD by setting to P3 = 0 and P30 1 RD P3FC = 1. Input BOOT This pin sets single boot mode (only during reset). For the details, please refer to section 3.2.3, “Operation modes”. P31 1 WR P32 1 1 1 CS1 P42 Write: Strobe signal for writing data to pins AD0 to AD7 I/O I/O Output CS0 P41 Port 31: Output port Output Output HWR P40 Output I/O Output 1 I/O Output CS2 High Write: Strobe signal for writing data to pins AD8 to AD15 Port 40: I/O port (with pull-up resistor) Chip select 0: Outputs “0” when address is within specified address area. Port41: I/O port (with pull-up resistor) Chip select 1: Outputs “0” when address is within specified address area. Port 42: I/O port (with pull-up resistor) Chip select 2: Outputs “0” when address is within specified address area. Input Port 5: Input port AN0 to AN3 Input Analog input: Analog input pins of the AD converter ADTRG Input AD trigger: Pin used to request AD start (shared with P53). P50 to P53 P60 4 Port 32: I/O port (with pull-up resistor) 1 SCK P61 1 SO I/O Serial bus interface clock I/O at SIO mode I/O Port 61: I/O port Output SDA Port 60: I/O port I/O I/O Serial bus interface send data at SIO mode 2 Serial bus interface send/receive data at I C mode Open-drain output mode by programmable P62 1 SI I/O Input SCL Port 62: I/O port Serial bus interface receive data at SIO mode 2 I/O Serial bus interface clock I/O at I C mode I/O Port 63: I/O port (Schmitt input) Open-drain output mode by programmable P63 1 INT0 P70 Input 1 TA0IN P71 1 TA1OUT P72 TA3OUT I/O Input I/O Output 1 I/O Output Interrupt request pin 0: Interrupt request pin with level/ rising/falling edge Port 70: I/O port 8-bit timer 0 input: Input pin of 8-bit timer TMRA0 Port 71: I/O port 8-bit timer 1 output: Output pin of 8-bit timer TMRA0 or TMRA1 Port 72: I/O port 8-bit timer 3 output: Output pin of 8-bit timer TMRA2 or TMRA3 91FW27-5 2007-11-02 TMP91FW27 Table 2.2.2 Pin Names and Functions (2/2) Pin Names P73 Number of Pins 1 TA4IN P74 I/O Input 1 TA5OUT P80 I/O I/O Output 1 I/O Functions Port 73: I/O port 8-bit timer 4 Input: Input pin of 8-bit timer TMRA4 Port 74: I/O port 8-bit timer 5 output: Output pin of 8-bit timer TMRA4 or TMRA5 Port 80: I/O port TB0IN0 Input 16-bit timer 0 Input 0: Input of count/capture trigger in 16-bit timer TMRB0 INT5 Input Interrupt request pin 5: Interrupt request pin with selectable rising/falling edge P81 1 I/O Port 81: I/O port TB0IN1 Input 16-bit timer 0 Input 1: Input of count/capture trigger in 16-bit timer TMRB0 INT6 Input Interrupt request pin 6: Interrupt request pin of rising edge P82 1 TB0OUT0 P83 Output 1 TB0OUT1 P90 1 1 1 TXD1 RXD1 P95 Port 83: I/O port 16-bit timer 0 output 1: Output pin of 16-bit timer TMRB0 Port 90: I/O port Serial 0 send data: Open-drain output pin by programmable Port 91: I/O port Serial 0 receive data Port 92: I/O port Serial 0 clock I/O I/O I/O Input Serial 0 data send enable (Clear to send) Port 93: I/O port Serial 1 send data: Open-drain output pin by programmable Port 94: I/O port Serial 1 receive data I/O Port 95: I/O port SCLK1 I/O Serial 1 clock I/O CTS1 Input P96 1 16-bit timer 0 output 0: Outpit pin of 16-bit timer TMRB0 I/O Output 1 Port 82: I/O port I/O Input CTS0 P94 I/O Input 1 SCLK0 P93 I/O Output RXD0 P92 I/O Output TXD0 P91 I/O 1 XT1 P97 1 XT2 ALE 1 Serial 1 data send enable (Clear to send) I/O Port 96: I/O port. Open-drain output pin. Input Low frequency oscillator connection pin I/O Port 97: I/O port. Open-drain output pin. Output Low frequency oscillator connection pin Output Address latch enable (It can be set as prohibition of an output for noize reduction.) NMI 1 Input Non-Maskable interrupt request pin: Interrupt request pin with programmable falling edge level or with both edge levels programmable (Schmitt input). AM0 and AM1 2 Input Operation mode: Fixed to AM1 = “1” and AM0 = “1”. RESET 1 AVCC 1 Input Pin used to both power supply pin for AD converter and standard power supply Reset: Initialize LSI. (Schmitt input, with pull-up resistor) AVSS 1 Pin used to both GND pin for AD converter (0 V) and standard power supply X1/X2 2 DVCC 1 for AD converter (H). pin for AD converter (L). I/O High frequency oscillator connection pin. Power supply pins (All DVCC pins should be connected with the power Supply pin). DVSS 1 GND pins (All pins shuold be connected with GND(0V).) 91FW27-6 2007-11-02 TMP91FW27 3. Functional Description This section shows the hardware configuration of the TMP91FW27 and explains how it operates. This device is a version of the created by replacing the predecessor's internal mask ROM with a 128-Kbyte internal flash memory and expanding its internal RAM size to 12 Kbytes. The configuration and the functionality of this device are the same as those of the TMP91CP27. For the functions of this device that are not described here, refer to the TMP91CP27 data sheet. 3.1 Memory Map Figure 3.1.1 shows a memory map of the TMP91FW27 in single-chip mode and its memory areas that can be accessed in each addressing mode of the CPU. 000000H Internal I/O Direct area (n) (4 Kbytes) 000100H 001000H 64-Kbytes area Internal RAM (12 Kbytes) (nn) 004000H 010000H External 16-Mbytes area memory (R) (−R) (R+) (R + R8/16) (R + d8/16) (nnn) FE0000H 128 Kbytes internal ROM FFFF00H FFFFFFH Vector table (256 bytes) ( = Internal area) Figure 3.1.1 Memory Map (Single-Chip Mode) 91FW27-7 2007-11-02 TMP91FW27 3.2 Flash Memory The TMP91FW27 incorporates flash memory that can be electrically erased and programmed using a single 3V power supply. The flash memory is programmed and erased using JEDEC-standard commands. After a program or erase command is input, the corresponding operation is automatically performed internally. Erase operations can be performed by the entire chip (chip erase) or on a sector basis (sector erase). The configuration and operations of the flash memory are described below. 3.2.1 Features • Power supply voltage for program/erase operations • Sector size Vcc = 2.7 V to 3.6 V (−10 °C to 40 °C) • Configuration 64 K × 16 bits (128 Kbytes) • Functions Single-word programming Chip erase Sector erase Data polling/Toggle bit 3.2.2 4 Kbytes × 32 • Mode control JEDEC-standard commands • Programming method On-board programming Parallel programmer • Security Write protection Read protection Block Diagram Internal address bus Internal data bus Internal control bus Mode setting pins Mode control ROM controller Control Address Data Flash memory Command register Address latch Data latch Column decoder/Sense amp Row decoder Control circuit (including automatic sequence control circuit) Flash memory cells 128 KB Erase sector decoder Figure 3.2.1 Block Diagram of Flash Memory Unit 91FW27-8 2007-11-02 TMP91FW27 3.2.3 Operation Modes 3.2.3.1 Overview The following three types of operation modes are available to control program/erase operations on the flash memory. Table 3.2.1 Description of Operation Modes Operation Mode Name Description Single Chip mode After reset release, the device starts up from the internal flash memory. Single Chip mode is further divided into two modes: “Normal mode” is a mode in which user application programs are executed, and “User Boot mode” is used to program the flash memory on-board. The means of switching between these two modes can be set by the user as desired. For example, it can be set so that Port 00 = “1” selects Normal mode and Port 00 = “0” selects User Boot mode. The user must include a routine to handle mode switching in a user application program. Normal mode User Boot mode Single Boot mode In this mode, the device starts up from a user application program. In this mode, the flash memory can be programmed by a user-specified method. After reset release, the device starts up from the internal boot ROM (mask ROM). The boot ROM includes an algorithm which allows a program for programming/erasing the flash memory on-board via a serial port to be transferred to the device’s internal RAM. The transferred program is then executed in the internal RAM so that the flash memory can be programmed/erased by receiving data from an external host and issuing program/erase commands. This mode enables the internal flash memory to be programmed/erased using a general-purpose programmer. For programmers that can be used, please contact your local Toshiba sales representative. Programmer mode Of the modes listed in Table 3.2.1, the internal flash memory can be programmed in User Boot mode, Single Boot mode and Programmer mode. 0 The mode in which the flash memory can be programmed/erased while mounted on the user board is defined as the on-board programming mode. Of the modes listed above, Single Boot mode and User Boot mode are classified as on-board programming modes. Single Boot mode supports Toshiba’s proprietary programming/erase method using serial I/O. User Boot mode (within Single Chip mode) allows the flash memory to be programmed/erased by a user-specified method. Programmer mode is provided with a read protect function which prohibits reading of ROM data. By enabling the read protect function upon completion of programming, the user can protect ROM data from being read by third parties. 91FW27-9 2007-11-02 TMP91FW27 The operation mode ⎯ Single Chip mode, Single Boot mode or Programmer mode ⎯ is determined during reset by externally setting the input levels on the AM0, AM1 and BOOT (P30) pins. Except in Programmer mode which is entered with RESET held at “0”, the CPU will start operating in the selected mode after the reset state is released. Once the operation mode has been set, make sure that the input levels on the mode setting pins are not changed during operation. Table 3.2.2 shows how to set each operation mode, and Figure 3.2.2 shows a mode transition diagram. 1H 2H Table 3.2.2 Operation Mode Pin Settings Input Pins Operation Mode (1) (2) (3) RESET BOOT (P30) AM1 AM0 0 1 0 ― 1 1 1 1 1 0 Single Chip mode (Normal or User Boot mode) Single Boot mode Programmer mode Although P30 is an output port, it becomes an input port with pull-up resistor only during a reset. After a reset, P30 operates as follows depending on the operation mode. • Single chip mode: Output port (Without pull-up resistor) • Single boot mode: Pull-up (Input gate is invalid, and output gate is in high impedance.) (3) Programmer mode Reset state (1) or (2) ＋ RESET = 0 (1) (2) RESET = 0 RESET = 0 Single Chip mode Single Boot mode User Boot mode Normal mode Switching method to be set by user On-board programming mode Numbers in ( ) correspond to the operation mode pin settings shown in Table 3.2.2 Figure 3.2.2 Mode Transition Diagram 3.2.3.2 Reset Operation To reset the device, hold the RESET input at “0” for at least 10 system clocks while the power supply voltage is within the rated operating voltage range and the internal high-frequency oscillator is oscillating stably. 91FW27-10 2007-11-02 TMP91FW27 3.2.3.3 Memory Map for Each Operation Mode In this product, the memory map varies with operation mode. The memory map and sector address ranges for each operation mode are shown below. Single Chip mode 000000H 001000H Internal I/O Internal RAM 12KB Single Boot mode 000000H 001000H Internal I/O Programmer mode 000000H Internal RAM 12KB Internal Flash ROM 128KB 004000H 004000H External memory 010000H 020000H (予約) External memory Internal内蔵 Flash ROM 128KB Flash ROM Reserved 030000H External memory FE0000H Internal Flash ROM 128KB FFFF00H FFFFFFH (Interrupt vector 256B) FFF000H Internal Boot ROM 4KB FFFF00H FFFFFFH (Interrupt vector 256B) FFFFFFH Figure 3.2.3 TMP91FW27 Memory Map for Each Operation Mode 91FW27-11 2007-11-02 TMP91FW27 Table 3.2.3 Sector Address Ranges for Each Operation Mode Sector-0 Sector-1 Sector-2 Sector-3 Sector-4 Sector-5 Sector-6 Sector-7 Sector-8 Sector-9 Sector-10 Sector-11 Sector-12 Sector-13 Sector-14 Sector-15 Sector-16 Sector-17 Sector-18 Sector-19 Sector-20 Sector-21 Sector-22 Sector-23 Sector-24 Sector-25 Sector-26 Sector-27 Sector-28 Sector-29 Sector-30 Sector-31 Single Chip Mode Single Boot Mode FE0000H to FE0FFFH FE1000H to FE1FFFH FE2000H to FE2FFFH FE3000H to FE3FFFH FE4000H to FE4FFFH FE5000H to FE5FFFH FE6000H to FE6FFFH FE7000H to FE7FFFH FE8000H to FE8FFFH FE9000H to FE9FFFH FEA000H to FEAFFFH FEB000H to FEBFFFH FEC000H to FECFFFH FED000H to FEDFFFH FEE000H to FEEFFFH FEF000H to FEFFFFH FF0000H to FF0FFFH FF1000H to FF1FFFH FF2000H to FF2FFFH FF3000H to FF3FFFH FF4000H to FF4FFFH FF5000H to FF5FFFH FF6000H to FF6FFFH FF7000H to FF7FFFH FF8000H to FF8FFFH FF9000H to FF9FFFH FFA000H to FFAFFFH FFB000H to FFBFFFH FFC000H to FFCFFFH FFD000H to FFDFFFH FFE000H to FFEFFFH FFF000H to FFFFFFH 10000H to 10FFFH 11000H to 11FFFH 12000H to 12FFFH 13000H to 13FFFH 14000H to 14FFFH 15000H to 15FFFH 16000H to 16FFFH 17000H to 17FFFH 18000H to 18FFFH 19000H to 19FFFH 1A000H to 1AFFFH 1B000H to 1BFFFH 1C000H to 1CFFFH 1D000H to 1DFFFH 1E000H to 1EFFFH 1F000H to 1FFFFH 20000H to 20FFFH 21000H to 21FFFH 22000H to 22FFFH 23000H to 23FFFH 24000H to 24FFFH 25000H to 25FFFH 26000H to 26FFFH 27000H to 27FFFH 28000H to 28FFFH 29000H to 29FFFH 2A000H to 2AFFFH 2B000H to 2BFFFH 2C000H to 2CFFFH 2D000H to 2DFFFH 2E000H to 2EFFFH 2F000H to 2FFFFH 91FW27-12 2007-11-02 TMP91FW27 3.2.4 Single Boot Mode In Single Boot mode, the internal boot ROM (mask ROM) is activated to transfer a program/erase routine (user-created boot program) from an external source into the internal RAM. This program/erase routine is then used to program/erase the flash memory. In this mode, the internal boot ROM is mapped into an area containing the interrupt vector table, in which the boot ROM program is executed. The flash memory is mapped into an address space different from the one into which the boot ROM is mapped (see Figure 3.2.3). 3H The device’s SIO (SIO1) and the controller are connected to transfer the program/erase routine from the controller to the device’s internal RAM. This program/erase routine is then executed to program/erase the flash memory. The program/erase routine is executed by sending commands and write data from the controller. The communications protocol between the device and the controller is described later in this manual. Before the program/erase routine can be transferred to the RAM, user password verification is performed to ensure the security of user ROM data. If the password is not verified correctly, the RAM transfer operation cannot be performed. In Single Boot mode, disable interrupts and use the interrupt request flags to check for an interrupt request. Note: In Single Boot mode, the boot-ROM programs are executed in Normal mode. Do not change to another operation mode in the program/erase routine. 91FW27-13 2007-11-02 TMP91FW27 3.2.4.1 Using the program/erase algorithm in the internal boot ROM (Step-1) Environment setup Since the program/erase routine and write data are transferred via SIO (SIO1), connect the device’s SIO (SIO1) and the controller on the board. The user must prepare the program/erase routine (a) on the controller. New user application program (I/O) (a) Program/erase routine (TMP91FW27) Boot ROM (Controller) SIO1 Flash memory Old user application program (or erased state) RAM (Step-2) Starting up the internal boot ROM Release the reset with the relevant input pins set for entering Single Boot mode. When the internal boot ROM starts up, the program/erase routine (a) is transferred from the controller to the internal RAM via SIO according to the communications procedure for Single Boot mode. Before this can be carried out, the password entered by the user is verified against the password written in the user application program. (If the flash memory has been erased, 12 bytes of “0xFF” are used as the password.) New user application program (a) Program/erase routine (I/O) (TMP91FW27) Boot ROM 0 → 1 RESET (Controller) SIO1 Flash memory Condition for entering Single Boot mode Old user application program (or erased state) RAM 91FW27-14 2007-11-02 TMP91FW27 (Step-3) Copying the program/erase routine to the RAM After password verification is completed, the boot ROM copies the program/erase routine (a) from the controller to the RAM using serial communications. The program/erase routine must be stored within the RAM address range of 001000H to 003DFFH. New user application program (I/O) (a) Program/erase routine (TMP91FW27) Boot ROM (Controller) SIO1 Flash memory Old user application program (or erased state) (a) Program/erase routine RAM (Step-4) Executing the program/erase routine in the RAM Control jumps to the program/erase routine (a) in the RAM. If necessary, the old user application program is erased (sector erase or chip erase). Note: The boot ROM is provided with an erase command, which enables the entire chip to be erased from the controller without using the program/erase routine. If it is necessary to erase data on a sector basis, incorporate the necessary code in the program/erase routine. New user application program (I/O) (a) Program/erase routine (TMP91FW27) Boot ROM (Controller) SIO1 Flash memory (a) Program/erase routine Erased RAM 91FW27-15 2007-11-02 TMP91FW27 (Step-5) Copying the new user application program The program/erase routine (a) loads the new user application program from the controller into the erased area of the flash memory. In the example below, the new user application program is transferred under the same communications conditions as those used for transferring the program/erase routine. However, after the program/erase routine has been transferred, this routine can be used to change the transfer settings (data bus and transfer source). Configure the board hardware and program/erase routine as desired. New user application program (I/O) (a) Program/erase routine (TMP91FW27) Boot ROM (Controller) SIO1 Flash memory New user application program (a) Program/erase routine RAM (Step-6) Executing the new user application program After the programming operation has been completed, turn off the power to the board and remove the cable connecting the device and the controller. Then, turn on the power again and start up the device in Single Chip mode to execute the new user application program. (TMP91FW27) Boot ROM 0 → 1 RESET (Controller) SIO1 Flash memory Condition for entering Single Chip mode (Normal mode) New user application program RAM 91FW27-16 2007-11-02 TMP91FW27 3.2.4.2 Connection Examples for Single Boot Mode In Single Boot mode the flash memory is programmed by serial transfer. Therefore, on-board programming is performed by connecting the device’s SIO (SIO1) and the controller (programming tool) and sending commands from the controller to the device. Figure 3.2.4 shows an example of connection between the target board and a programming controller. Figure 3.2.5 shows an example of connection between the target board and an RS232C board. 4H 5H On-Board Programming Controller Target Board VCC Reg. Power supply VCC VCC TMP91FW27 DVCC AM0 AM1 Mode control MCU Program controller Mode control Target board operation ROM RESET RESET BOOT Boot mode switching circuit BOOT (P30) RAM P95 P92 RXD RS232C P95 P92 RXD1 (P94) TXD TXD1 (P93) VSS DVSS PC Figure 3.2.4 Example of Connection with an External Controller in Single Boot Mode 91FW27-17 2007-11-02 TMP91FW27 Target Board RS232C Board VCC VCC Power supply VCC TMP91FW27 DVCC AM0 AM1 RESET RESET BOOT RXD RS232C Boot mode switching circuit BOOT (P30) RXD1 (P94) TXD TXD1 (P93) VSS VSS DVSS PC Figure 3.2.5 Example of Connection with an RS232C Board in Single Boot Mode 91FW27-18 2007-11-02 TMP91FW27 3.2.4.3 Mode Setting To perform on-board programming, the device must be started up in Single Boot mode by setting the input pins as shown below. ・AM0,AM1 =1 ・ BOOT =0 ・ RESET =0→1 Set the AM0, AM1, and BOOT pins as shown above with the RESET pin held at “0”. Then, setting the RESET pin to “1” will start up the device in Single Boot mode. 3.2.4.4 Memory Maps Figure 3.2.6 shows a comparison of the memory map for Normal mode (in Single Chip mode) and the memory map for Single Boot mode. In Single Boot mode, the flash memory is mapped to addresses 10000H to 2FFFFH (physical addresses) and the boot ROM (mask ROM) is mapped to addresses FFF000H to FFFFFFH. 6H Single Chip mode 000000H 001000H Single Boot mode 000000H Internal I/O Internal RAM 12KB 001000H Internal I/O Internal RAM 12KB 004000H 004000H External Memory 010000H External Memory (予約) Internal内蔵 Flash ROM 128KB Flash ROM 030000H External Memory FE0000H FFFF00H FFFFFFH Internal Flash ROM 128KB FFF000H (Interrupt vector 256B) FFFF00H FFFFFFH Internal Boot ROM 4KB (Interrupt vector 256B) Figure 3.2.6 Comparison of Memory Maps 91FW27-19 2007-11-02 TMP91FW27 3.2.4.5 Interface Specifications The SIO communications format in Single Boot mode is shown below. The device supports the UART (asynchronous communications) serial operation mode. To perform on-board programming, the same communications format must also be set on the programming controller’s side. ● UART (asynchronous ) communications ・Communications channel : SIO channel 1 (For the pins to be used, see Table 3.2.4.) ・Serial transfer mode : UART (asynchronous communications) mode ・Data length : 8 bits ・Parity bit : None ・Stop bit : 1 bit ・Baud rate : See Table 3.2.5 and Table 3.2.6. 7H 8H 9H Table 3.2.4 Pin Connections Pins Power supply pins Mode setting pins UART { { DVCC DVSS AM1,AM0, { BOOT Reset pin RESET { TXD1 RXD1 { { Communications pins Note: Unused pins are in the initial state after reset release. Table 3.2.5 Baud Rate Table SIO Transfer Rate (bps) UART 115200 57600 38400 91FW27-20 19200 9600 2007-11-02 91FW27-21 19176 −0.13 38352 ⎯ 39063 38400 38400 39063 0 ⎯ 57600 ⎯ ⎯ ⎯ ⎯ ⎯ 0 ⎯ ⎯ 57600 0 ⎯ 57600 ⎯ 0 115200 ⎯ ⎯ ⎯ frequencies outside of the supported range. The range of clock frequencies that are detected as each reference frequency. It may not be possible to perform Single Boot operations at clock ⎯ ⎯ ⎯ ⎯ ⎯ ⎯ ⎯ ⎯ ⎯ ⎯ 0 ⎯ ⎯ ⎯ ⎯ (%) ⎯ ⎯ ⎯ 115200 ⎯ ⎯ ⎯ 57600 ⎯ ⎯ ⎯ ⎯ ⎯ ⎯ To program the flash memory using Single Boot mode, one of the reference frequencies must be selected as a high-speed clock. −0.13 ⎯ +1.73 0 0 +1.73 ⎯ ⎯ ⎯ ⎯ 0 0 38400 38400 ⎯ ⎯ ⎯ (bps) ⎯ (%) ⎯ (bps) 57600 oscillation frequency error must be within ±2% in total. Note: To automatically detect the reference frequency (microcontroller clock frequency), the transfer baud rate error of the flash memory programming controller and the Supported Range: ⎯ ⎯ 0 −0.13 +1.73 0 0 19531 +1.73 19200 19200 +1.73 0 +0.16 0 0 0 +1.73 ⎯ (%) 39063 38400 The frequency of the high-speed oscillation circuit that can be used in Single Boot mode. 9588 26.50∼27.57 27 Reference frequency: 9600 25.29∼26.32 25.8048 25 9766 0 24.09∼25.06 9600 24.5760 0 19531 +1.73 9600 19200 0 21.68∼22.56 19231 +0.16 22.1184 9615 15.66∼16.29 16 19200 19200 19200 0 9766 9600 14.46∼15.04 14.7456 0 19.27∼20.05 9600 12.05∼12.53 12.2880 0 20 9600 10.84∼11.28 11.0592 +1.73 19531 +1.73 9600 9766 9.64∼10.02 10 ⎯ ⎯ ⎯ +0.16 18.07∼18.80 9615 7.83∼8.14 8 (bps) (%) (bps) 19200 Error (%) 18.4320 Baud Rate (bps) Supported Range (MHz) 9600 Reference Frequency (MHz) Reference Baud Rate (bps) TMP91FW27 Table 3.2.6 Correspondence between Operating Frequency and Baud Rate in Single Boot Mode 2007-11-02 TMP91FW27 3.2.4.6 Data Transfer Formats Table 3.2.7 to Table 3.2.13 show the operation command data and the data transfer format for each operation mode. 10H 1H Table 3.2.7 Operation Command Data Operation Command Data 10H 20H 30H 40H 60H Operation Mode RAM Transfer Flash Memory SUM Product Information Read Flash Memory Chip Erase Flash Memory Protect Set 91FW27-22 2007-11-02 TMP91FW27 Table 3.2.8 Transfer Format of Single Boot Program [RAM Transfer] Transfer Byte Number Boot ROM 1st byte Transfer Data from Controller to Device Baud rate setting UART Operation command data Note 4: Transfer Data from Device to Controller ⎯ ACK response to baud rate setting Normal (baud rate OK) ･UART 86H (If the desired baud rate cannot be set, operation is terminated.) (10H) ⎯ ACK response to operation command (Note 2) Normal 10H Error x1H Protection applied (Note 4) x6H Communications error x8H ⎯ 5th byte to 16th byte Password data (12 bytes) 17th byte CHECKSUM value for 5th to 16th bytes (02FEF4H to 02FEFFH) ⎯ 18th byte ⎯ ACK response to CHECKSUM value (Note 2) Normal 10H Error 11H Communications error 18H 19th byte RAM storage start address 31 to 24 (Note 3) ⎯ 20th byte RAM storage start address 23 to 16 (Note 3) ⎯ 21st byte RAM storage start address 15 to 8 (Note 3) ⎯ 22nd byte RAM storage start address 7 to 0 (Note 3) ⎯ 23rd byte RAM storage byte count 15 to 8 (Note 3) ⎯ 24th byte RAM storage byte count 7 to 0 (Note 3) ⎯ 25th byte CHECKSUM value for 19th to 24th bytes (Note 3) ⎯ ⎯ 26th byte Note 1: Note 2: Note 3: Desired baud rate (Note 1) ⎯ 4th byte RAM 86H ⎯ 2nd byte 3rd byte Baud Rate ACK response to CHECKSUM value (Note 2) Normal 10H Error 11H Communications error 18H ⎯ 27th byte to m’th byte RAM storage data (m+1)th byte CHECKSUM value for 27th to m’th bytes (m+2)th byte ⎯ (m+3)th byte ⎯ ⎯ ACK response to CHECKSUM value (Note 2) Normal 10H Error 11H Communications error 18H Jump to RAM storage start address For the desired baud rate setting, see Table 3.2.6. After sending an error response, the device waits for operation command data (3rd byte). The data to be transferred in the 19th to 25th bytes should be programmed within the RAM address range of 001000H to 003DFFH (11.5Kbytes). When read protection or write protection is applied, the device aborts the received operation command and waits for the next operation command data (3rd byte). 91FW27-23 2007-11-02 TMP91FW27 Table 3.2.9 Transfer Format of Single Boot Program [Flash Memory SUM] Transfer Byte Number Boot ROM 1st byte Transfer Data from Controller to Device Baud Rate Transfer Data from Device to Controller ⎯ Desired Baud rate setting UART 86H baud rate (Note1) 2nd byte ⎯ ACK response to baud rate setting Normal (baud rate OK) ･UART 86H (If the desired baud rate cannot be set, operation is terminated.) 3rd byte Note 1: Note 2: Operation command data ⎯ (20H) 4th byte ⎯ 5th byte ⎯ SUM (upper) 6th byte ⎯ SUM (lower) 7th byte ⎯ CHECKSUM value for 5th and 6th bytes 8th byte (Wait for the next operation command data) ACK response to operation command (Note 2) Normal 20H Error x1H x8H Communications error ⎯ For the desired baud rate setting, see Table 3.2.6. After sending an error response, the device waits for operation command data (3rd byte). 91FW27-24 2007-11-02 TMP91FW27 Table 3.2.10 Transfer Format of Single Boot Program [Product Information Read] (1/2) Transfer Byte Number Boot ROM 1st byte Transfer Data from Controller to Device Baud Rate Baud rate setting Desired UART 86H Transfer Data from Device to Controller ⎯ baud rate (Note 1) 2nd byte 3rd byte ⎯ Operation command data ACK response to baud rate setting Normal (baud rate OK) ･UART 86H (If the desired baud rate cannot be set, operation is terminated.) (30H) ⎯ 4th byte ⎯ ACK response to operation command (Note 2) Normal 30H Error x1H Communications error x8H 5th byte ⎯ Flash memory data (address 02FEF0H) 6th byte ⎯ Flash memory data (address 02FEF1H) 7th byte ⎯ Flash memory data (address 02FEF2H) 8th byte ⎯ Flash memory data (address 02FEF3H) 9th byte to 20th byte ⎯ Part number (ASCII code, 12 bytes) ‘TMP91FW27_ _ _ ’ (from 9th byte) 21st byte to 24th byte ⎯ Password comparison start address (4 bytes) F4H, FEH, 02H, 00H (from 21st byte) 25th byte to 28th byte ⎯ RAM start address (4 bytes) 00H, 10H, 00H, 00H (from 25th byte) 29th byte to 32nd byte ⎯ RAM (user area) end address (4 bytes) FFH, 3DH, 00H, 00H (from 29th byte) 33rd byte to 36th byte ⎯ RAM end address (4 bytes) FFH, 3FH, 00H, 00H (from 33rd byte) 37th byte to 40th byte ⎯ Dummy data (4 bytes) 00H,00H,00H,00H (from 37th byte) 41st byte to 44th byte ⎯ Dummy data (4 bytes) 00H, 00H, 00H, 00H (from 41st byte) 45th byte to 46th byte ⎯ FUSE information (2 bytes from 45th byte) Read protection/Write protection 1) Applied/Applied : 00H, 00H 2) Not applied/Applied : 01H, 00H 3) Applied/Not applied : 02H, 00H 4) Not applied/Not applied : 03H, 00H 47th byte to 50th byte ⎯ Flash memory start address (4 bytes) 00H, 00H, 01H, 00H (from 47th byte) 51st byte to 54th byte ⎯ Flash memory end address (4 bytes) FFH, FFH, 02H, 00H (from 51st byte) 55th byte to 56th byte ⎯ Number of sectors in flash memory (2 bytes) 20H, 00H (from 55th byte) 57th byte to 60th byte ⎯ Start address of flash memory sectors of the same size (4 bytes) 00H, 00H, 01H, 00H (from 57th byte) 91FW27-25 2007-11-02 TMP91FW27 Table 3.2.11 Transfer Format of Single Boot Program [Product Information Read] (2/2) Transfer Byte Number Boot ROM 61st byte Transfer Data from Controller to Device ⎯ Transfer Data from Device to Controller Size (in half words) of flash memory sectors of the same size (4 bytes) to 00H, 08H, 00H, 00H (from 61st byte) 64th byte 65th byte Baud Rate ⎯ Number of flash memory sectors of the same size (1 byte) 20H Note 1: Note 2: 66th byte ⎯ 67th byte (Wait for the next operation command data) CHECKSUM value for 5th to 65th bytes ⎯ For the desired baud rate setting, see Table 3.2.6. After sending an error response, the device waits for operation command data (3rd byte). 91FW27-26 2007-11-02 TMP91FW27 Table 3.2.12 Transfer Format of Single Boot Program [Flash Memory Chip Erase] Transfer Byte Number Boot ROM 1st byte Transfer Data from Controller to Device Baud rate setting Baud Rate Transfer Data from Device to Controller ⎯ Desired UART 86H baud rate (Note 1) 2nd byte 3rd byte 4th byte 5th byte ⎯ Operation command data ACK response to baud rate setting Normal (baud rate OK) ･UART 86H (If the desired baud rate cannot be set, operation is terminated.) Erase Enable command data ⎯ (40H) ⎯ ACK response to operation command (Note2) Normal 40H Error x1H Communications error x8H ⎯ (54H) 6th byte ⎯ ACK response to operation command (Note 2) Normal 54H Error x1H Communications error x8H 7th byte ⎯ ACK response to Erase command Normal Error 4FH 4CH ACK response Normal Error 5DH 60H 8th byte 9th byte ⎯ (Wait for the next operation command data) ⎯ Note 1: For the desired baud rate setting, see Table 3.2.6. Note 2: After sending an error response, the device waits for operation command data (3rd byte). 91FW27-27 2007-11-02 TMP91FW27 Table 3.2.13 Transfer Format of Single Boot Program [Flash Memory Protect Set] Transfer Byte Number Boot ROM 1st byte Transfer Data from Controller to Device Baud rate setting Baud Rate Transfer Data from Device to Controller ⎯ Desired UART 86H baud rate (Note 1) 2nd byte ⎯ ACK response to baud rate setting Normal (baud rate OK) ･UART 86H (If the desired baud rate cannot be set, operation is terminated.) 3rd byte 4th byte ⎯ (60H) ⎯ ACK response to operation command (Note2) Normal 60H Error x1H Communications error x8H ⎯ 5th byte to 16th byte Password data (12 bytes) 17th byte CHECKSUM value for 5th to 16th bytes (02FEF4H to 02FEFFH) ⎯ 18th byte ⎯ ACK response to checksum value (Note 2) Normal 60H Error 61H Communications error 68H 19th byte ⎯ ACK response to Protect Set command Normal 6FH Error 6CH 20th byte ⎯ ACK response Normal Error 21st byte Note 1: Note 2: Operation command data (Wait for the next operation command data) 31H 34H ⎯ For the desired baud rate setting, see Table 3.2.6. After sending an error response, the device waits for operation command data (3rd byte). 91FW27-28 2007-11-02 TMP91FW27 3.2.4.7 Boot Program When the device starts up in Single Boot mode, the boot program is activated. The following explains the commands that are used in the boot program to communicate with the controller when the device starts up in Single Boot mode. Use this information for creating a controller for using Single Boot mode or for building a user boot environment. 1. RAM Transfer command In RAM transfer, data is transferred from the controller and stored in the device’s internal RAM. When the transfer completes normally, the boot program will start running the transferred user program. Up to 11.5 Kbytes of data can be transferred as a user program. (This limit is implemented in the boot program to protect the stack pointer area.) The user program starts executing from the RAM storage start address. This RAM transfer function enables a user-created program/erase routine to be executed, allowing the user to implement their own on-board programming method. To perform on-board programming with a user program, the flash memory command sequences (see section 3.2.6) must be used. After the RAM Transfer command has been completed, the entire internal RAM area can be used. If read protection or write protection is applied on the device or a password error occurs, this command will not be executed. 12H 2. Flash Memory SUM command This command calculates the SUM of 128 Kbytes of data in the flash memory and returns the result. There is no operation command available to the boot program for reading data from the entire area of the flash memory. Instead, this Flash Memory SUM command can be used. Reading the SUM value enables revision management of the application program. 3. Product Information Read command This command returns the information about the device including its part number and memory details stored in the flash memory at addresses 02FEF0H to 02FEF3H. This command can also be used for revision management of the application program. 4. Flash Memory Chip Erase command This command erases all the sectors in the flash memory. If read protection or write protection is applied on the device, all the sectors in the flash memory are erased and the read protection or write protection is cleared. Since this command is also used to restore the operation of the boot program when the password is forgotten, it does not include password verification. 5. Flash Memory Protect Set command This command sets both read protection and write protection on the device. However, if a password error occurs, this command will not be executed. When read protection is set, the flash memory cannot be read in Programmer mode. When write protection is set, the flash memory cannot be written in Programmer mode. 91FW27-29 2007-11-02 TMP91FW27 3.2.4.8 RAM Transfer Command (See Table 3.2.8) 13H 1. From the controller to the device The data in the 1st byte is used to determine the baud rate. The 1st byte is transferred with receive operation disabled (SC1MOD0 = 0). (The baud rate is determined using an internal timer.) • To communicate in UART mode Send the value 86H from the controller to the target board using UART settings at the desired baud rate. If the serial operation mode is determined as UART, the device checks to see whether or not the desired baud rate can be set. If the device determines that the desired baud rate cannot be set, operation is terminated and no communications can be established. 2. From the device to the controller The data in the 2nd byte is the ACK response returned by the device for the serial operation mode setting data sent in the 1st byte. If the data in the 1st byte is found to signify UART and the desired baud rate can be set, the device returns 86H. • Baud rate determination The device determines whether or not the desired baud rate can be set. If it is found that the baud rate can be set, the boot program rewrites the BR1CR and BR1ADD values and returns 86H. If it is found that the desired baud rate cannot be set, operation is terminated and no data is returned. The controller sets a time-out time (5 seconds) after it has finished sending the 1st byte. If the controller does not receive the response (86H) normally within the time-out time, it should be considered that the device is unable to communicate. Receive operation is enabled (SC1MOD0 = 1) before 86H is written to the transmission buffer. 3. From the controller to the device The data in the 3rd byte is operation command data. In this case, the RAM Transfer command data (10H) is sent from the controller to the device. 4. From the device to the controller The data in the 4th byte is the ACK response to the operation command data in the 3rd byte. First, the device checks to see if the received data in the 3rd byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) x8H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined (They are the upper four bits of the immediately preceding operation command data). Next, if the data received in the 3rd byte corresponds to one of the operation commands given in Table 3.2.7, the device echoes back the received data (ACK response for normal reception). In the case of the RAM Transfer command, if read or write protection is not applied, 10H is echoed back and then execution branches to the RAM transfer processing routine. If protection is applied, the device returns the corresponding ACK response data (bit 2/1) x6H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) After branching to the RAM transfer processing routine, the device checks the data in the password area. For details, see 3.2.4.15 “Password”. 14H 15H 91FW27-30 16H 2007-11-02 TMP91FW27 If the data in the 3rd byte does not correspond to any operation command, the device returns the ACK response data for operation command error (bit0) x1H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) 5. From the controller to the device The 5th to 16th bytes contain password data (12 bytes). The data in the 5th to 16th bytes is verified against the data at addresses 02FEF4H to 02FEFFH in the flash memory, respectively. 6. From the controller to the device The 17th byte contains CHECKSUM data. The CHECKSUM data sent by the controller is the two’s complement of the lower 8-bit value obtained by summing the data in the 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). For details on CHECKSUM, see 3.2.4.17 “How to Calculate CHECKSUM.” 17H 7. 18H From the device to the controller The data in the 18th byte is the ACK response data to the 5th to 17th bytes (ACK response to the CHECKSUM value). The device first checks to see whether the data received in the 5th to 17th bytes contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) 18H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is “1”. Next, the device checks the CHECKSUM data in the 17th byte. This check is made to see if the lower 8-bit value obtained by summing the data in the 5th to 17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H, the device returns the ACK response data for CHECKSUM error (bit 0) 11H and waits for the next operation command data (3rd byte). Finally, the device examines the result of password verification. If all the data in the 5th to 16th bytes is not verified correctly, the device returns the ACK response data for password error (bit 0) 11H and waits for the next operation command data (3rd byte). If no error is found in all the above checks, the device returns the ACK response data for normal reception 10 H. 8. From the controller to the device The data in the 19th to 22nd bytes indicates the RAM start address for storing block transfer data. The 19th byte corresponds to address bits 31 to 24, the 20th byte to address bits 23 to 16, the 21st byte to address bits 15 to 8, and the 22nd byte to address bits 7 to 0. 9. From the controller to the device The data in the 23rd and 24th bytes indicates the number of bytes to be transferred. The 23rd byte corresponds to bits 15 to 8 of the transfer byte count and the 24th byte corresponds to bits 7 to 0. 91FW27-31 2007-11-02 TMP91FW27 10. From the controller to the device The data in the 25th byte is CHECKSUM data. The CHECKSUM data sent by the controller is the two’s complement of the lower 8-bit value obtained by summing the data in the 19th to 24th bytes by unsigned 8-bit addition (ignoring any overflow). For details on CHECKSUM, see 3.2.4.17 “How to Calculate CHECKSUM .” 19H 20H Note: The data in the 19th to 25th bytes should be placed within addresses 001000H to 003DFFH (11.5 Kbytes) in the internal RAM. 11. From the device to the controller The data in the 26th byte is the ACK response data to the data in the 19th to 25th bytes (ACK response to the CHECKSUM value). The device first checks to see whether the data received in the 19th to 25th bytes contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) 18H and waits for the next operation command (3rd byte). The upper four bits of the ACK response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is “1”. Next, the device checks the CHECKSUM data in the 25th byte. This check is made to see if the lower 8-bit value obtained by summing the data in the 19th to 25th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H, the device returns the ACK response data for CHECKSUM error (bit 0) 11H and waits for the next operation command data (3rd byte). 12. From the controller to the device The data in the 27th to m’th bytes is the data to be stored in the RAM. This data is written to the RAM starting at the address specified in the 19th to 22nd bytes. The number of bytes to be written is specified in the 23rd and 24th bytes. 13. From the controller to the device The data in the (m+1)th byte is CHECKSUM data. The CHECKSUM data sent by the controller is the two’s complement of the lower 8-bit value obtained by summing the data in the 27th to m’th bytes by unsigned 8-bit addition (ignoring any overflow). For details on CHECKSUM, see 3.2.4.17 ”How to Calculate CHECKSUM.” 21H 91FW27-32 2H 2007-11-02 TMP91FW27 14. From the device to the controller The data in the (m + 2) th byte is the ACK response data to the 27th to (m+1)th bytes (ACK response to the CHECKSUM value). The device first checks to see whether the data in the 27th to (m+1)th byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) 18H and waits for the next operation command (3rd byte). The upper four bits of the ACK response are the upper four bits of the immediately preceding operation command data, so the value of these bits is “1”. Next, the device checks the CHECKSUM data in the (m+1)th byte. This check is made to see if the lower 8-bit value obtained by summing the data in the 27th to (m+1)th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H, the device returns the ACK response data for CHECKSUM error (bit 0) 11H and waits for the next operation command data (3rd byte). If no error is found in all the above checks, the device returns the ACK response data for normal reception 10H. 15. From the device to the controller If the ACK response data in the (m + 2)th byte is 10H (normal reception), the boot program then jumps to the RAM start address specified in the 19th to 22nd bytes. 91FW27-33 2007-11-02 TMP91FW27 3.2.4.9 Flash Memory SUM command (See Table 3.2.9) 23H 1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer command. 2. From the controller to the device The data in the 3rd byte is operation command data. The Flash Memory SUM command data (20H) is sent here. 3. From the device to the controller The data in the 4th byte is the ACK response data to the operation command data in the 3rd byte. The device first checks to see if the data in the 3rd byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) x8H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) Then, if the data in the 3rd byte corresponds to one of the operation command values given in Table 3.2.7, the device echoes back the received data (ACK response for normal reception). In this case, 20H is echoed back and execution then branches to the flash memory SUM processing routine. If the data in the 3rd byte does not correspond to any operation command, the device returns the ACK response data for operation command error (bit 0) x1H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) 24H 4. From the device to the controller The data in the 5th and 6th bytes is the upper and lower data of the SUM value, respectively. For details on SUM, see 3.2.4.16 “How to Calculate SUM .” 25H 5. 26H From the device to the controller The data in the 7th byte is CHECKSUM data. This is the two’s complement of the lower 8-bit value obtained by summing the data in the 5th and 6th bytes by unsigned 8-bit addition (ignoring any overflow). 6. From the controller to the device The data in the 8th byte is the next operation command data. 91FW27-34 2007-11-02 TMP91FW27 3.2.4.10 Product Information Read command (See Table 3.2.10 and Table 3.2.11) 27H 28H 1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer command. 2. From the controller to the device The data in the 3rd byte is operation command data. The Product Information Read command data (30H) is sent here. 3. From the device to the controller The data in the 4th byte is the ACK response data to the operation command data in the 3rd byte. The device first checks to see if the data in the 3rd byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) x8H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) Then, if the data in the 3rd byte corresponds to one of the operation command values given in Table 3.2.7, the device echoes back the received data (ACK response for normal reception). In this case, 30H is returned and execution then branches to the product information read processing routine. If the data in the 3rd byte does not correspond to any operation command, the device returns the ACK response data for operation command error (bit 0) x1H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) 29H 4. From the device to the controller The data in the 5th to 8th bytes is the data stored at addresses 02FEF0H to 02FEF3H in the flash memory. By writing the ID information of software at these addresses, the version of the software can be managed. (For example, 0002H can indicate that the software is now in version 2.) 5. From the device to the controller The data in the 9th to 20th bytes denotes the part number of the device. ‘TMP91FW27_ _ _’ is sent in ASCII code starting from the 9th byte. Note: An underscore (‘_’) indicates a space. 6. From the device to the controller The data in the 21st to 24th bytes is the password comparison start address. F4H, FEH, 02H and 00H are sent starting from the 21st byte. 7. From the device to the controller The data in the 25th to 28th bytes is the RAM start address. 00H, 10H, 00H and 00H are sent starting from the 25th byte. 8. From the device to the controller The data in the 29th to 32nd bytes is the RAM (user area) end address. FFH, 3DH, 00H and 00H are sent starting from the 29th byte. 91FW27-35 2007-11-02 TMP91FW27 9. From the device to the controller The data in the 33rd to 36th bytes is the RAM end address. FFH, 3FH, 00H and 00H are sent starting from the 33rd byte. 10. From the device to the controller The data in the 37th to 44th bytes is dummy data. 11. From the device to the controller The data in the 45th and 46th bytes contains the protection status and sector division information of the flash memory. ● Bit 0 indicates the read protection status. •0: Read protection is applied. •1: Read protection is not applied. ● Bit 1 indicates the write protection status. •0: Write protection is applied. •1: Write protection is not applied. ● Bit 2 indicates whether or not the flash memory is divided into sectors. •0: The flash memory is divided into sectors. •1: The flash memory is not divided into sectors. ● Bits 3 to 15 are sent as “0”. 12. From the device to the controller The data in the 47th to 50th bytes is the flash memory start address. 00H, 00H, 01H and 00H are sent starting from the 47th byte. 13. From the device to the controller The data in the 51st to 54th bytes is the flash memory end address. FFH, FFH, 02H and 00H are sent starting from the 51st byte. 14. From the device to the controller The data in the 55th and 56th bytes indicates the number of sectors in the flash memory. 20H and 00H are sent starting from the 55th byte. 15. From the device to the controller The data in the 57th to 65th bytes contains sector information of the flash memory. Sector information is comprised of the start address (starting from the flash memory start address), sector size and number of consecutive sectors of the same size. Note that the sector size is represented in word units. The data in the 57th to 65th bytes indicates 4 Kbytes of sectors (sector 0 to sector 31). For the data to be transferred, see Table 3.2.10 and Table 3.2.11. 30H 31H 16. From the device to the controller The data in the 66th byte is CHECKSUM data. This is the two’s complement of the lower 8-bit value obtained by summing the data in the 5th to 65th bytes by unsigned 8-bit addition (ignoring any overflow). 17. From the controller to the device The data in the 67th byte is the next operation command data. 91FW27-36 2007-11-02 TMP91FW27 3.2.4.11 Flash Memory Chip Erase Command (See Table 3.2.12) 32H 1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer command. 2. From the controller to the device The data in the 3rd byte is operation command data. The Flash Memory Chip Erase command data (40H) is sent here. 3. From the device to the controller The data in the 4th byte is the ACK response data to the operation command data in the 3rd byte. The device first checks to see if the data in the 3rd byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) x8H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) Then, if the data in the 3rd byte corresponds to one of the operation command values given in Table 3.2.7, the device echoes back the received data (ACK response for normal reception). In this case, 40H is echoed back. If the data in the 3rd byte does not correspond to any operation command, the device returns the ACK response data for operation command error (bit 0) x1H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) 3H 4. From the controller to the device The data in the 5th byte is Erase Enable command data (54H). 5. From the device to the controller The data in the 6th byte is the ACK response data to the Erase Enable command data in the 5th byte. The device first checks to see if the data in the 5th byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) x8H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined (They are the upper four bits of the immediately preceding operation command data.) Then, if the data in the 5th byte corresponds to the Erase Enable command data, the device echoes back the received data (ACK response for normal reception). In this case, 54H is echoed back and execution jumps to the flash memory chip erase processing routine. If the data in the 5th byte does not correspond to the Erase Enable command data, the device returns the ACK response data for operation command error (bit 0 ) x1H and waits for the next operation command (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) 91FW27-37 2007-11-02 TMP91FW27 6. From the device to the controller The data in the 7th byte indicates whether or not the erase operation has completed successfully. If the erase operation has completed successfully, the device returns the end code (4FH). If an erase error has occurred, the device returns the error code (4CH). 7. From the device to the controller The data in the 8th byte is ACK response data. If the erase operation has completed successfully, the device returns the ACK response for erase completion (5DH). If an erase error has occurred, the device returns the ACK response for erase error (60H). 8. From the controller to the device The data in the 9th byte is the next operation command data. 91FW27-38 2007-11-02 TMP91FW27 3.2.4.12 Flash Memory Protect Set command (See Table 3.2.13) 34H 1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer command. 2. From the controller to the device The data in the 3rd byte is operation command data. The Flash Memory Protect Set command data (60H) is sent here. 3. From the device to the controller The data in the 4th byte is the ACK response data to the operation command data in the 3rd byte. The device first checks to see if the data in the 3rd byte contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) x8H and waits for the next operation command data. The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) Then, if the data in the 3rd byte corresponds to one of the operation command data values given in Table 3.2.7, the device echoes back the received data (ACK response for normal reception). In this case, 60H is echoed back and execution branches to the flash memory protect set processing routine. After branching to this routine, the data in the password area is checked. For details, see 3.2.4.15 ”Password.” If the data in the 3rd byte does not correspond to any operation command, the device returns the ACK response data for operation command error (bit 0) x1H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are undefined. (They are the upper four bits of the immediately preceding operation command data.) 35H 36H 4. 37H From the controller to the device The data in the 5th to 16th bytes is password data (12 bytes). The data in the 5th byte is verified against the data at address 02FEF4H in the flash memory and the data in the 6th byte against the data at address 02FEF5H. In this manner, the received data is verified consecutively against the data at the specified address in the flash memory. The data in the 16th byte is verified against the data at address 02FEFFH in the flash memory. 5. From the controller to the device The data in the 17th byte is CHECKSUM data. The CHECKSUM data sent by the controller is the two’s complement of the lower 8-bit value obtained by summing the data in 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). For details on CHECKSUM, see 3.2.4.17 ”How to Calculate CHECKSUM.” 38H 91FW27-39 39H 2007-11-02 TMP91FW27 6. From the device to the controller The data in the 18th byte is the ACK response data to the data in the 5th to 17th bytes (ACK response to the CHECKSUM value). The device first checks to see whether the data in the 5th to 17th bytes contains any error. If a receive error is found, the device returns the ACK response data for communications error (bit 3) 68H and waits for the next operation command data (3rd byte). The upper four bits of the ACK response data are the upper four bits of the immediately preceding operation command data, so the value of these bits is “6”. Then, the device checks the CHECKSUM data in the 17th byte. This check is made to see if the lower 8 bits of the value obtained by summing the data in the 5th to 17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H, the device returns the ACK response data for CHECKSUM error (bit 0) 61H and waits for the next operation command data (3rd byte). Finally, the device examines the result of password verification. If all the data in the 5th to 16th bytes is not verified correctly, the device returns the ACK response data for password error (bit 0) 61H and waits for the next operation command data (3rd byte). If no error is found in the above checks, the device returns the ACK response data for normal reception 60H. 7. From the device to the controller The data in the 19th byte indicates whether or not the protect set operation has completed successfully. If the operation has completed successfully, the device returns the end code (6FH). If an error has occurred, the device returns the error code (6CH). 8. From the device to the controller The data in the 20th byte is ACK response data. If the protect set operation has completed successfully, the device returns the ACK response data for normal completion (31H). If an error has occurred, the device returns the ACK response data for error (34H). 9. From the device to the controller The data in the 21st byte is the next operation command data. 91FW27-40 2007-11-02 TMP91FW27 3.2.4.13 ACK Response Data The boot program notifies the controller of its processing status by sending various response data. Table 3.2.14 to Table 3.2.19 show the ACK response data returned for each type of received data. The upper four bits of ACK response data are a direct reflection of the upper four bits of the immediately preceding operation command data. Bit 3 indicates a receive error and bit 0 indicates an operation command error, CHECKSUM error or password error. 40H 41H Table 3.2.14 ACK Response Data to Serial Operation Mode Setting Data Transfer Data 86H Meaning The device can communicate in UART mode. (Note) Note: If the desired baud rate cannot be set, the device returns no data and terminates operation. Table 3.2.15 ACK Response Data to Operation Command Data Transfer Data x8H (Note) x6H (Note) x1H (Note) 10H 20H 30H 40H 60H Meaning A receive error occurred in the operation command data. Terminated receive operation due to protection setting. Undefined operation command data was received normally. Received the RAM Transfer command. Received the Flash Memory SUM command. Received the Product Information Read command. Received the Flash Memory Chip Erase command. Received the Flash Memory Protect Set command. Note: The upper four bits are a direct reflection of the upper four bits of the immediately preceding operation command data. Table 3.2.16 ACK Response data to CHECKSUM Data for RAM Transfer Command Transfer Data 18H 11H 10H Meaning A receive error occurred. A CHECKSUM error or password error occurred. Received the correct CHECKSUM value. Table 3.2.17 ACK Response Data to Flash Memory Chip Erase Operation Transfer Data 54H 4FH 4CH 5DH (Note) 60H (Note) Meaning Received the Erase Enable command. Completed erase operation. An erase error occurred. Reconfirmation of erase operation Reconfirmation of erase error Note: These codes are returned for reconfirmation of communications. 91FW27-41 2007-11-02 TMP91FW27 Table 3.2.18 ACK Response Data to CHECKSUM Data for Flash Memory Protect Set Command Transfer Data 68H 61H 60H Meaning A receive error occurred. A CHECKSUM or password error occurred. Received the correct CHECKSUM value. Table 3.2.19 ACK Response Data to Flash Memory Protect Set Operation Transfer Data 6FH 6CH 31H (Note) 34H (Note) Meaning Completed the protect (read/write) set operation. A protect (read/write) set error occurred. Reconfirmation of protect (read/write) set operation Reconfirmation of protect (read/write) set error Note: These codes are returned for reconfirmation of communications. 91FW27-42 2007-11-02 TMP91FW27 3.2.4.14 Determining Serial Operation Mode To communicate in UART mode, the controller should transmit the data value 86H as the first byte at the desired baud rate. Figure 3.2.7 shows the waveform of this operation. 42H Start bit 0 Point A bit 1 bit 2 Point B bit 3 bit 4 bit 5 Point C bit 6 bit 7 Stop Point D UART (86H) tAB tAC tAD Figure 3.2.7 Data for Determining Serial Operation Mode The boot program receives the first byte (86H) after reset release not as serial communications data. Instead, the boot program uses the first byte to determine the baud rate. The baud rate is determined by the output periods of tAB, tAC and tAD as shown in Figure 3.2.7 using the procedure shown in Figure 3.2.8. 43H 4H The CPU monitors the level of the receive pin. Upon detecting a level change, the CPU captures the timer value to determine the baud rate. 91FW27-43 2007-11-02 TMP91FW27 Start Initialize 16-bit timer B0 (φT1 = 8/fc, clear counter) Start the prescaler Point A Receive pin changed from High to Low? YES Start counting up of 16-bit timer B0 Point B Receive pin changed from Low to High? YES Capture timer value (tAB) by software Point C Receive pin changed from High to Low? YES Capture timer value (tAC) by software Point D Receive pin changed from Low to High? YES Capture timer value (tAD) by software Stop 16-bit timer B0 tAC ≥ tAD? YES Back up tAD value Stop operation (Endless loop) End Figure 3.2.8 Flowchart for Serial Operation Mode Receive Operation 91FW27-44 2007-11-02 TMP91FW27 3.2.4.15 Password When the RAM Transfer command (10H) or the Flash Memory Protect Set command (60H) is received as operation command data, password verification is performed. First, the device echoes back the operation command data (10H to 60H) and checks the data (12 bytes) in the password area (addresses 02FEF4H to 02FEFFH). Then, the device verifies the password data received in the 5th to 16th bytes against the data in the password area as shown in Table 3.2.20. 45H Unless all the 12 bytes are verified correctly, a password error will occur. A password error will also occur if all the 12 bytes of password data contain the same value. Only exception is when all the 12 bytes are “FFH” and verified correctly and the reset vector area (addresses 02FF00H to 02FF02H) is all “FFH”. In this case, a blank device will be assumed and no password error will occur. If a password error has occurred, the device returns the ACK response data for password error in the 18th byte. Table 3.2.20 Password Verification Table Receive data 5th byte 6th byte 7th byte 8th byte 9th byte 10th byte 11th byte 12th byte 13th byte 14th byte 15th byte 16th byte Data to be verified against Data at address 02FEF4H Data at address 02FEF5H Data at address 02FEF6H Data at address 02FEF7H Data at address 02FEF8H Data at address 02FEF9H Data at address 02FEFAH Data at address 02FEFBH Data at address 02FEFCH Data at address 02FEFDH Data at address02FEFEH Data at address 02FEFFH Example of data that cannot be specified as a password For blank products (Note) ・The password of a blank product must be all “FFH” (FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH). Note: A blank product is a product in which all the bytes in the password area (addresses 02FEF4H to 02FEFFH) and the reset vector area (addresses 02FF00H to 02FF02H) are “FFH”. For programmed products ・The same 12 consecutive bytes cannot be specified as a password. The table below shows password error examples. Programmed product Error example 1 Error example 2 Error example 3 1 2 3 4 5 6 7 8 9 10 11 12 Note FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH FFH 00H 5AH All ”FF” All ”00” All ”5A” 91FW27-45 2007-11-02 TMP91FW27 3.2.4.16 How to Calculate SUM SUM is calculated by summing the values of all data read from the flash memory by unsigned 8-bit addition and is returned as a word (16-bit) value. The resulting SUM value is sent to the controller in order of upper 8 bits and lower 8 bits. All the 128 Kbytes of data in the flash memory are included in the calculation of SUM. When the Flash Memory SUM command is executed, SUM is calculated in this way. Example: A1H When SUM is calculated from the four data entries shown to the left, the result is as follows: A1H + B2H + C3H + D4H = 02EAH SUM upper 8 bits: 02H SUM lower 8 bits: EAH B2H C3H D4H 3.2.4.17 Thus, the SUM value is sent to the controller in order of 02H and EAH. How to Calculate CHECKSUM CHECKSUM is calculated by taking the two’s complement of the lower 8-bit value obtained by summing the values of received data by unsigned 8-bit addition (ignoring any overflow). When the Flash Memory SUM command or the Product Information Read command is executed, CHECKSUM is calculated in this way. The controller should also use this CHECKSUM calculation method for sending CHECKSUM values. Example: Calculating CHECKSUM for the Flash Memory SUM command When the upper 8-bit data of SUM is E5H and the lower 8-bit data is F6H, CHECKSUM is calculated as shown below. First, the upper 8 bits and lower 8 bits of the SUM value are added by unsigned operation. E5H + F6H = 1DBH Then, the two’s complement of the lower 8 bits of this result is obtained as shown below. The resulting CHECKSUM value (25H) is sent to the controller. 0 − DBH = 25H 91FW27-46 2007-11-02 TMP91FW27 3.2.5 User Boot Mode (in Single Chip Mode) User Boot mode, which is a sub mode of Single Chip mode, enables a user-created flash memory program/erase routine to be used. To do so, the operation mode of Single Chip mode must be changed from Normal mode for executing a user application program to User Boot mode for programming/erasing the flash memory. For example, the reset processing routine of a user application program may include a routine for selecting Normal mode or User Boot mode upon entering Single Chip mode. Any mode-selecting condition may be set using the device’s I/O to suit the user system. To program/erase the flash memory in User Boot mode, a program/erase routine must be incorporated in the user application program in advance. Since the processor cannot read data from the internal flash memory while it is being programmed or erased, the program/erase routine must be executed from the outside of the flash memory. While the flash memory is being programmed/erased in User Boot mode, interrupts must be disabled. The pages that follow explain the procedure for programming the flash memory using two example cases. In one case the program/erase routine is stored in the internal flash memory (1-A); in the other the program/erase routine is transferred from an external source (1-B). 91FW27-47 2007-11-02 TMP91FW27 3.2.5.1 (1-A) Program/Erase Procedure Example 1 When the program/erase routine is stored in the internal flash memory (Step-1) Environment setup First, the condition (e.g. pin status) for entering User Boot mode must be set and the I/O bus for transferring data must be determined. Then, the device’s peripheral circuitry must be designed and a corresponding program must be written. Before mounting the device on the board, it is necessary to write the following four routines into one of the sectors in the flash memory. (a) Mode select routine : Selects Normal mode or User Boot mode. (b) Program/erase routine : Loads program/erase data from an external source and programs/erases the flash memory. (c) Copy routine 1 (d) Copy routine 2 : Copies routines (a) to (d) into the internal RAM or external memory. : Copies routines (a) to (d) from the internal RAM or external memory into the flash memory. Note: The above (d) is a routine for reconstructing the program/erase routine on the flash memory. If the entire flash memory is always programmed and the program/erase routine is included in the new user application program, this copy routine is not needed. New user application program (TMP91FW27) (I/O) Flash memory (Controller) Old user application program [Reset processing program] (a) Mode select routine (b) Program/erase routine RAM (c) Copy routine 1 (d) Copy routine 2 (Step-2) Entering User Boot mode (using the reset processing) After reset release, the reset processing program determines whether or not the device should enter User Boot mode. If the condition for entering User Boot mode is true, User Boot mode is entered to program/erase the flash memory. New user application program (TMP91FW27) (I/O) 0 → 1 RESET Flash memory (Controller) Old user application program [Reset processing program] (a) Mode select routine (b) Program/erase routine RAM Condition for entering User Boot mode (user-specified) (c) Copy routine 1 (d) Copy routine 2 91FW27-48 2007-11-02 TMP91FW27 (Step-3) Copying the program/erase routine After the device has entered User Boot mode, the copy routine 1 (c) copies the routines (a) to (d) into the internal RAM or external memory (The routines are copied into the internal RAM here.) New user application program (I/O) (TMP91FW27) Flash memory (Controller) Old user application program (a) Mode select routine [Reset processing program] (b) Program/erase routine (c) Copy routine 1 (a) Mode select routine (d) Copy routine 2 (b) Program/erase routine RAM (c) Copy routine 1 (d) Copy routine 2 (Step-4) Erasing the flash memory by the program/erase routine Control jumps to the program/erase routine in the RAM and the old user program area is erased (sector erase or chip erase). (In this case, the flash memory erase command is issued from the RAM.) Note: If data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, only the program/erase routine (b) need be copied into the RAM. New user application program (TMP91FW27) (I/O) Flash memory (Controller) (a) Mode select routine (b)Program/erase routine (c) Copy routine 1 Erased (d) Copy routine 2 RAM 91FW27-49 2007-11-02 TMP91FW27 (Step-5) Restoring the user boot program in the flash memory The copy routine 2 (d) in the RAM copies the routines (a) to (d) into the flash memory. Note: If data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, step 5 is not needed. New user application program (I/O) (TMP91FW27) (Controller) Flash memory (a) Mode select routine [Reset processing program] (a) Mode select routine (b) Program/erase routine (c) Copy routine 1 (d) Copy routine 2 (b) Program/erase routine RAM (c) Copy routine 1 (d) Copy routine 2 (Step-6) Writing the new user application program to the flash memory The program/erase routine in the RAM is executed to load the new user application program from the controller into the erased area of the flash memory. New user application program (TMP91FW27) (I/O) (Controller) Flash memory New user application program (a) Mode select routine [Reset processing program] (a) Mode select routine (b) Program/erase routine (c) Copy routine 1 (d) Copy routine 2 (b) Program/erase routine RAM (c) Copy routine 1 (d) Copy routine 2 91FW27-50 2007-11-02 TMP91FW27 (Step-7) Executing the new user application program The RESET input pin is driven Low (“0”) to reset the device. The mode setting condition is set for Normal mode. After reset release, the device will start executing the new user application program. (TMP91FW27) (I/O) 0 → 1 RESET Flash memory (Controller) New user application program Condition for entering Normal mode [Reset processing program (a) Mode select routine (b) Program/erase routine RAM (c) Copy routine 1 (d) Copy routine 2 91FW27-51 2007-11-02 TMP91FW27 3.2.5.2 (1-B) Program/Erase Procedure Example 2 In this example, only the boot program (minimum requirement) is stored in the flash memory and other necessary routines are supplied from the controller. (Step-1) Environment setup First, the condition (e.g. pin status) for entering User Boot mode must be set and the I/O bus for transferring data must be determined. Then, the device’s peripheral circuitry must be designed and a corresponding program must be written. Before mounting the device on the board, it is necessary to write the following two routines into one on the sectors in the flash memory. (a) Mode select routine : Selects Normal mode or User Boot mode. (b) Transfer routine : Loads the program/erase routine from an external source. The following routines are prepared on the controller. (c) Program/erase routine : Programs/erases the flash memory. (d) Copy routine 1 : Copies routines (a) and (b) into the internal RAM or external memory. (e) Copy routine 2 : Copies routines (a) and (b) from the internal RAM or external memory into the flash memory. New user application program (I/O) (c) Program/erase routine (TMP91FW27) (d) Copy routine 1 Flash memory (e) Copy routine 2 Old user application program (Controller) [Reset processing routine] (a) Mode select routine RAM (b) Transfer routine (Step-2) Entering User Boot mode (using the reset processing) The following explanation assumes that these routines are incorporated in the reset processing program. After reset release, the reset processing program first determines whether or not the device should enter User Boot mode. If the condition for entering User Boot mode is true, User Boot mode is entered to program/erase the flash memory. New user application program (I/O) (TMP91FW27) 0 → 1 RESET Flash memory Old user application program (d) Copy routine 1 (e) Copy routine 2 (Controller) [Reset processing routine] (a)Mode Select routine (c) Program/erase routine RAM Condition for entering User Boot mode (user-specified) (b)Transfer routine 91FW27-52 2007-11-02 TMP91FW27 (Step-3) Copying the program/erase routine to the internal RAM After the device has entered User Boot mode, the transfer routine (b) transfers the routines (c) to (e) from the controller to the internal RAM (or external memory). (The routines are copied into the internal RAM here.) New user application program (c) Program/erase routine (d) Copy routine 1 (TMP91FW27) (e) Copy routine 2 (I/O) (Controller) Flash memory Old user application program (c) Program/erase routine [Reset processing routine] (a) Mode select routine (d) Copy routine 1 (e) Copy routine 2 (b) Transfer routine RAM (Step-4) Executing the copy routine 1 in the internal RAM Control jumps to the internal RAM and the copy routine 1 (d) copies the routines (a) and (b) into the internal RAM. New user application program (c) Program/erase routine (TMP91FW27) (d) Copy routine 1 (I/O) (e) Copy routine 2 (Controller) Flash memory Old user application program (a)Mode select routine (b) Transfer routine (c) Program/erase routine [Reset processing routine] (a) Mode select routine (b) Transfer routine (d) Copy routine 1 (e) Copy routine 2 RAM 91FW27-53 2007-11-02 TMP91FW27 (Step-5) Erasing the flash memory by the program/erase routine The program/erase routine (c) erases the old user program area. New user application program (TMP91FW27) (c) Program/erase routine (I/O) (d) Copy routine 1 (e) Copy routine 2 (Controller) Flash memory (a)Mode select routine (b)Transfer routine (c) Program/erase routine Erased (d) Copy routine 1 (e) Copy routine 2 RAM (Step-6) Restoring the user boot program in the flash memory The copy routine (e) copies the routines (a) and (b) from the internal RAM into the flash memory. New user application program (c) Program/erase routine (d) Copy routine 1 (TMP91FW27) (I/O) (e) Copy routine 2 (Controller) Flash memory (a)Mode select routine (b) Transfer routine (c) Program/erase routine [Reset processing program] (a) Mode select routine (b) Transfer routine (d) Copy routine 1 (e) Copy routine 2 RAM 91FW27-54 2007-11-02 TMP91FW27 (Step-7) Writing the new user application program to the flash memory The program/erase routine (c) in the RAM is executed to load the new user application program from the controller into the erased area of the flash memory. New user application program (c) Program/erase routine (d) Copy routine 1 (I/O) (e) Copy routine 2 (TMP91FW27) Flash memory New user application program (Controller) (a)Mode select routine (b)Transfer routine (c) Program/erase routine [Reset processing program] (a) Mode select routine (d) Copy routine 1 (e) Copy routine 2 (b) Transfer routine RAM (Step-8) Executing the new user application program The RESET input pin is driven Low (“0”) to reset the device. The mode setting condition is set for Normal mode. After reset release, the device will start executing the new user application program. (TMP91FW27) (I/O) 0 → 1 RESET Flash memory (Controller) New user application program Condition for entering Normal mode [Reset processing program] (a)Mode select routine RAM (b) Transfer routine 91FW27-55 2007-11-02 TMP91FW27 3.2.6 Flash Memory Command Sequences The operation of the flash memory is comprised of six commands, as shown in Table 3.2.21. Addresses specified in each command sequence must be in an area where the flash memory is mapped. For details, see Table 3.2.3. 46H 47H Table 3.2.21 Command Sequences 1st Bus Write Cycle Command 2nd Bus Write Cycle 3rd Bus Write Cycle 4th Bus Write Cycle 5th Bus Write Cycle 6th Bus Write Cycle Addr. Addr. Data Addr. Data Sequence Addr. Data Addr. Data Addr. Data Data PA PD (Note 1) (Note 1) 1 Single Word Program AAAH AAH 554H 55H AAAH A0H 2 Sector Erase (4-KB Erase) AAAH AAH 554H 55H AAAH 80H AAAH AAH 554H 55H SA (Note 2) 30H 3 Chip Erase (All Erase) AAAH AAH 554H 55H AAAH 80H AAAH AAH 554H 55H AAAH 10H 4 Product ID Entry AAAH AAH 554H 55H AAAH 90H Product ID Exit xxH F0H Product ID Exit AAAH AAH 554H 55H AAAH F0H Read Protect Set AAAH AAH 554H 55H AAAH A5H 77EH F0H (Note3) Write Protect Set AAAH AAH 554H 55H AAAH A5H 77EH 0FH (Note3) 5 6 Note 1: PA = Program Word address, PD = Program Word data Set the address and data to be programmed. Even-numbered addresses should be specified here. Note 2: SA = Sector Erase address, Each sector erase range is selected by address A23 to A12. Note 3: When apply read protect and write protect, be sure to program the data of 00H. Table 3.2.22 Hardware Sequence Flags Status During auto operation D7 D6 Single Word Program D7 Toggle Sector Erase/Chip Erase 0 Toggle Read Protect Set/Write Protect Set Cannot be used Toggle Note: D15 to D8 and D5 to D0 are “don’t care”. 91FW27-56 2007-11-02 TMP91FW27 3.2.6.1 Single Word Program The Single Word Program command sequence programs the flash memory on a word basis. The address and data to be programmed are specified in the 4th bus write cycle. It takes a maximum of 60 μs to program a single word. Another command sequence cannot be executed until the write operation has completed. This can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. While a write operation is in progress, bit 6 of data is toggled each time it is read. Note: To rewrite data to Flash memory addresses at which data (including FFFFH) is already written, make sure to erase the existing data by “sector erase” or “chip erase” before rewriting data. 3.2.6.2 Sector Erase (4-Kbyte Erase) The Sector Erase command sequence erases 4 Kbytes of data in the flash memory at a time. The flash memory address range to be erased is specified in the 6th bus write cycle. For the address range of each sector, see Table 3.2.3. This command sequence cannot be used in Programmer mode. 48H It takes a maximum of 75 ms to erase 4 Kbytes. Another command sequence cannot be executed until the erase operation has completed. This can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. While a erase operation is in progress, bit 6 of data is toggled each time it is read. 3.2.6.3 Chip Erase (All Erase) The Chip Erase command sequence erases the entire area of the flash memory. It takes a maximum of 300 ms to erase the entire flash memory. Another command sequence cannot be executed until the erase operation has completed. This can be checked by reading the same address in the flash memory repeatedly until the same data is read consecutively. While an erase operation is in progress, bit 6 of data is toggled each time it is read. Erase operations clear data to FFH. 3.2.6.4 Product ID Entry When the Product ID Entry command is executed, Product ID mode is entered. In this mode, the vendor ID, flash macro ID, flash size ID, and read/write protect status can be read from the flash memory. In Product ID mode, the data in the flash memory cannot be read. 3.2.6.5 Product ID Exit This command sequence is used to exit Product ID mode. 91FW27-57 2007-11-02 TMP91FW27 3.2.6.6 Read Protect Set The Read Protect Set command sequence applies read protection on the flash memory. When read protection is applied, the flash memory cannot be read in Programmer mode and the RAM Transfer command cannot be executed in Single Boot mode. To cancel read protection, it is necessary to execute the Chip Erase command sequence. To check whether or not read protection is applied, read xxx77EH in Product ID mode. It takes a maximum of 60 μs to set read protection on the flash memory. Another command sequence cannot be executed until the read protection setting has completed. This can be checked by reading the same address in the flash memory repeatedly until the same data can be read consecutively. While a read protect operation is in progress, bit 6 of data is toggled each time it is read. 3.2.6.7 Write Protect Set The Write Protect Set command sequence applies write protection on the flash memory. When write protection is applied, the flash memory cannot be written to in Programmer mode and the RAM Transfer command cannot be executed in Single Boot mode. To cancel write protection, it is necessary to execute the Chip Erase command sequence. To check whether or not write protection is applied, read xxx77EH in Product ID mode. It takes a maximum of 60 μs to set write protection. Another command sequence cannot be executed until the write protection setting has completed. This can be checked by reading the same address in the flash memory repeatedly until the same data can be read consecutively. While a write protect operation is in progress, bit 6 of data is toggled each time it is read. 3.2.6.8 Hardware Sequence Flags The following hardware sequence flags are available to check the auto operation execution status of the flash memory. 1) Data polling (D7) When data is written to the flash memory, D7 outputs the complement of its programmed data until the write operation has completed. After the write operation has completed, D7 outputs the proper cell data. By reading D7, therefore, the operation status can be checked. While the Sector Erase or Chip Erase command sequence is being executed, D7 outputs “0”. After the command sequence is completed, D7 outputs “1” (cell data). Then, the data written to all the bits can be read after waiting for 1 μs. When read/write protection is applied, the data polling function cannot be used. Instead, use the toggle bit (D6) to check the operation status. 91FW27-58 2007-11-02 TMP91FW27 2) Toggle bit (D6) When the Flash Memory Program, Sector Erase, Chip Erase, Write Protect Set, or Read Protect Set command sequence is executed, bit 6 (D6) of the data read by read operations outputs “0” and “1” alternately each time it is read until the processing of the executed command sequence has completed. The toggle bit (D6) thus provides a software means of checking whether or not the processing of each command sequence has completed. Normally, the same address in the flash memory is read repeatedly until the same data is read successively. The initial read of the toggle bit always returns “1”. Note: The flash memory incorporated in the TMP91FW27 does not have an exceed-time-limit bit (D5). It is therefore necessary to set the data polling time limit and toggle bit polling time limit so that polling can be stopped if the time limit is exceeded. 3.2.6.9 Data Read Data is read from the flash memory in byte units or word units. It is not necessary to execute a command sequence to read data from the flash memory. 91FW27-59 2007-11-02 TMP91FW27 3.2.6.10 Programming the Flash Memory by the Internal CPU The internal CPU programs the flash memory by using the command sequences and hardware sequence flags described above. However, since the flash memory cannot be read during auto operation mode, the program/erase routine must be executed outside of the flash memory. The CPU can program the flash memory either by using Single Boot mode or by using a user-created protocol in Single Chip mode (User Boot). 1) Single Boot: The microcontroller is started up in Single Boot mode to program the flash memory by the internal boot ROM program. In this mode, the internal boot ROM is mapped to an area including the interrupt vector table, in which the boot ROM program is executed. The flash memory is mapped to an address area different from the boot ROM area. The boot ROM program loads data into the flash memory by serial transfer. In Single Boot mode, interrupts must be disabled including non-maskable interrupts ( NMI , etc.). For details, see 3.2.4“Single Boot Mode” 49H 50H 2) User Boot: In this method, the flash memory is programmed by executing a user-created routine in Single Chip mode (normal operation mode). In this mode, the user-created program/erase routine must also be executed outside of the flash memory. It is also necessary to disable interrupts including non-maskable interrupts. The user should prepare a flash memory program/erase routine (including routines for loading write data and writing the loaded data into the flash memory). In the main program, normal operation is switched to flash memory programming operation to execute the flash memory program/erase routine outside of the flash memory area. For example, the flash memory program/erase routine may be transferred from the flash memory to the internal RAM and executed there or it may be prepared and executed in external memory. For details, see 3.2.5“Flash Memory”. 51H 52H 91FW27-60 2007-11-02 TMP91FW27 Flowcharts: Flash memory access by the internal CPU Single Word Program Start Program Program command command sequence sequence (See (See the the flowchart flowchart below) below) Toggle bit (D6) Timeout (60 μs) Word read Addr. = Program address Read data matched program data? No Yes Word read Addr. = Program address Read data matched program data? No Yes Address = Address + 2 (Even-numbered address/ word units) No Last address? Yes Program end Abnormal end Program Command Sequence (Address/Data) xxxAAAH/AAH xxx554H/55H xxxAAAH/A0H Even-numbered program address (A0 = 0) / program data (word units) 91FW27-61 2007-11-02 TMP91FW27 Chip Erase/Sector Erase Start Erase command sequence (See the flowchart below) Timeout (Chip: 300 ms, Sector: 75 ms) Toggle bit (D6) Read data = blank? No Yes Erase end Abnormal end Note: In Chip Erase, whether or not the entire flash memory is blank is checked. In Sector Erase, whether or not the selected sector is blank is checked. Chip Erase Command Sequence (Address/Data) Sector Erase Command Sequence (Address/Data) xxxAAAH/AAH xxxAAAH/AAH xxx554H/55H xxx554H/55H xxxAAAH/80H xxxAAAH/80H xxxAAAH/AAH xxxAAAH/AAH xxx554H/55H xxx554H/55H xxxAAAH/10H Sector address/30H 91FW27-62 2007-11-02 TMP91FW27 Read/Write Protect Set Start Protect Set command sequence (See the flowchart below) Timeout (60 μs) Toggle bit (D6) Product ID Entry Byte read (D7 to D0) Addr. = xxx77EH Product ID Exit Read data matched program data? No Yes Protect Set end Abnormal end Protect Set Command Sequence (Address/Data) xxxAAAH/AAH xxx554H/55H xxxAAAH/A5H Set read protect xxx77EH/F0H Set write protect xxx77EH/0FH Set both read protect and write protect xxx77EH/00H 91FW27-63 2007-11-02 TMP91FW27 Data Polling (D7) Start Byte read (D7 to D0) Addr. = VA (VA: Valid Address) No D7 = Data? Yes Operation end Toggle Bit (D6) Start Byte read (D7 to D0) Addr. = VA Byte read (D7 to D0) Addr. = VA Yes D6 = Toggle? No Operation end Note: Hardware sequence flags are read from the flash memory in byte units or word units. VA: In Single Word Program, VA denotes the address to be programmed. In Sector Erase, VA denotes any address in the selected sector. In Chip Erase, VA denotes any address in the flash memory. In Read Protect Set, VA denotes the protect set address (xx77EH). In Write Protect Set, VA denotes the protect set address (xx77EH). 91FW27-64 2007-11-02 TMP91FW27 Product ID Entry Start xxxAAAH/AAH xxx554H/55H xxxAAAH/90H Wait for 300 nsec or longer (ID access and exit time = max. 300 nsec) [Product ID mode start] Product ID read (See the table below) Read Values in Product ID Mode Vendor ID Flash macro ID Flash size ID Read/Write Protect status Address xxxx00H xxxx02H xxxx04H xxx77EH Read Value 98H 42H 1FH Data programmed when protection is set. When protection is not set, FFH. Product ID Exit Start Start xxxAAAH/AAH xxxxxxH/F0H xxx554H/55H Wait for 300 nsec or longer (ID access and exit time = max. 300 nsec) xxxAAAH/F0H Product ID mode end Wait for 300fnsec or longer (ID access and exit time = max.300 nsec) Product ID mode end 91FW27-65 2007-11-02 TMP91FW27 (Example: Program to be loaded and executed in RAM) Erase the flash memory (chip erase) and then write 0706H to address FE0000H. ;#### Flash memory chip erase processing #### ld XIX, 0xFE0000 CHIPERASE: ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (0xFE0AAA), 0x80 ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (0xFE0AAA), 0x10 cal TOGGLECHK CHIPERASE_LOOP: ld WA, (XIX+) cp WA, 0xFFFF j ne, CHIPERASE_ERR cp XIX, 0xFFFFFF j ULT, CHIPERASE_LOOP ;#### Flash memory program processing #### ld XIX, 0xFE0000 ld WA, 0x0706 PROGRAM: ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (0xFE0AAA), 0xA0 ld (XIX), WA cal TOGGLECHK ld cp j ld cp j BC, (XIX) WA, BC. ne, PROGRAM_ERR BC, (XIX) WA, BC ne, PROGRAM_ERR PROGRAM_END: j PROGRAM_END ;#### Toggle bit (D6) check processing #### TOGGLECHK: ld L, (XIX) and L, 0y01000000 ld H, L TOGGLECHK1: ld L, (XIX) and L, 0y01000000 cp L, H j z, TOGGLECHK2 ld H, L j TOGGLECHK1 TOGGLECHK2: ret ; set start address ; 1st bus write cycle ; 2nd bus write cycle ; 3rd bus write cycle ; 4th bus write cycle ; 5th bus write cycle ; 6th bus write cycle ; check toggle bit ; read data from flash memory ; blank data? ; if not blank data, jump to error processing ; end address (0xFFFFFF)? ; check entire memory area and then end loop processing ; set program address ; set program data ; 1st bus write cycle ; 2nd bus write cycle ; 3rd bus write cycle ; 4th bus write cycle ; check toggle bit ; read data from flash memory ; if programmed data cannot be read, error is determined ; read data from flash memory ; if programmed data cannot be read, error is determined ; program operation end ; check toggle bit (D6) ; save first toggle bit data ; check toggle bit (D6) ; toggle bit = toggled? ; if not toggled, end processing ; save current toggle bit state ; recheck toggle bit ;#### Error processing #### CHIPERASE_ERR: j CHIPERASE_ERR ; chip erase error PROGRAM_ERR: j PROGRAM_ERR ; program error 91FW27-66 2007-11-02 TMP91FW27 (Example: Program to be loaded and executed in RAM) Erase data at addresses FF0000H to FF0FFFH (sector erase) and then write 0706H to address FF0000H. ;#### Flash memory sector erase processing #### ld XIX, 0xFF0000 SECTORERASE: ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (0xFE0AAA), 0x80 ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (XIX), 0x30 cal TOGGLECHK SECTORERASE_LOOP: ld WA, (XIX+) cp WA, 0xFFFF j ne, SECTORERASE_ERR cp XIX, 0xFF0FFF j ULT, SECTORERASE_LOOP ;#### Flash memory program processing #### ld XIX, 0xFF0000 ld WA, 0x0706 PROGRAM: ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (0xFE0AAA), 0xA0 ld (XIX), WA ; set start address ; 1st bus write cycle ; 2nd bus write cycle ; 3rd bus write cycle ; 4th bus write cycle ; 5th bus write cycle ; 6th bus write cycle ; check toggle bit ; read data from flash memory ; blank data? ; if not blank data, jump to error processing ; end address (0xFF0FFF)? ; check erased sector area and then end loop processing ; set program address ; set program data ; 1st bus write cycle ; 2nd bus write cycle ; 3rd bus write cycle ; 4th bus write cycle cal TOGGLECHK ; check toggle bit ld cp j ld cp j BC, (XIX) WA, BC ne, PROGRAM_ERR BC, (XIX) WA, BC ne, PROGRAM_ERR ; read data from flash memory PROGRAM_END: j PROGRAM_END ;#### Toggle bit (D6) check processing #### TOGGLECHK: ld L, (XIX) and L, 0y01000000 ld H, L TOGGLECHK1: ld L, (XIX) and L, 0y01000000 cp L, H j z, TOGGLECHK2 ld H, L j TOGGLECHK1 TOGGLECHK2: ret ; if programmed data cannot be read, error is determined ; read data from flash memory ; if programmed data cannot be read, error is determined ; program operation end ; check toggle bit (D6) ; save first toggle bit data ; check toggle bit (D6) ; toggle bit = toggled? ; If not toggled, end processing ; save current toggle bit state ; Recheck toggle bit ;#### Error processing #### SECTORERASE_ERR: j SECTORERASE_ERR ; sector erase error PROGRAM_ERR: j PROGRAM_ERR ; program error 91FW27-67 2007-11-02 TMP91FW27 (Example: Program to be loaded and executed in RAM) Set read protection and write protection on the flash memory. ;#### Flash Memory Protect Set processing #### ld XIX, 0xFE077E PROTECT: ld (0xFE0AAA), 0xAA ld (0xFE0554), 0x55 ld (0xFE0AAA), 0xA5 ld (XIX), 0x00 cal cal ld cal cp j TOGGLECHK PID_ENTRY A, (XIX) PID_EXIT A, 0x00 ne, PROTECT_ERR ; set protect address ; 1st bus write cycle ; 2nd bus write cycle ; 3rd bus write cycle ; 4th bus write cycle ; check toggle bit ; ; read protected address ; ;(0xFE077E)=0x00? ; protected? PROTECT_END: j PROTECT_END ; protect set operation completed PROTECT_ERR: j PROTECT_ERR ; protect set error ;#### Product ID Entry processing #### PID_ENTRY: ld (0xFE0AAA), 0xAA ; 1st bus write cycle ld (0xFE0554), 0x55 ; 2nd bus write cycle ld (0xFE0AAA), 0x90 ; 3rd bus write cycle ; --- wait for 300 nsec or longer (execute NOP instruction [148nsec/@fFPH=27MHz] three times) --nop nop nop ; wait for 444 nsec ret ;#### Product ID Exit processing #### PID_EXIT: ld (0xFE0000), 0xF0 ; 1st bus write cycle ; --- wait for 300 nsec or longer (execute NOP instruction [148nsec/@fFPH=27MHz] three times) --nop nop nop ; wait for 444 nsec ret ;#### Toggle bit (D6) check processing #### TOGGLECHK: ld L, (XIX) and L, 0y01000000 ld H, L TOGGLECHK1: ld L, (XIX) and L, 0y01000000 cp L, H j z, TOGGLECHK2 ld H, L j TOGGLECHK1 TOGGLECHK2: ret ; check toggle bit (D6) ; save first toggle bit data ; check toggle bit (D6) ; toggle bit = toggled? ; if not toggled, end processing ; save current toggle bit state ; recheck toggle bit (Example: Program to be loaded and executed in RAM) Read data from address FE0000H. ;#### Flash memory read processing #### READ: ld WA, (0xFE0000) ; read data from flash memory 91FW27-68 2007-11-02 TMP91FW27 4. 4.1 Electrical Characteristics Absolute Maximum Ratings Parameter Symbol Rating Power supply voltage Vcc −0.5 to 4.0 Input voltage VIN −0.5 to Vcc + 0.5 Output current (1 pin) IOL 2 Output current (1 pin) IOH −2 Output current (Total) ΣIOL 80 Output current (Total) ΣIOH −80 Power dissipation (Ta = 85°C) PD 600 Soldering temperature (10 s) TSOLDER 260 Storage temperature TSTG −65 to 150 Operation temperature TOPR −40 to 85 Number of Times Program Erase NEW Unit V mA mW °C 100 Cycle Note: The absolute maximum ratings are rated values that must not be exceeded during operation, even for an instant. Any one of the ratings must not be exceeded. If any absolute maximum rating is exceeded, a device may break down or its performance may be degraded, causing it to catch fire or explode resulting in injury to the user. Thus, when designing products that include this device, ensure that no absolute maximum rating value will ever be exceeded. Solderability of lead free products Test parameter Solderability Test condition Note Use of Sn−37Pb solder Bath Pass: Solder bath temperature =230°C, Dipping time = 5 seconds solderability rate until forming ≥ 95% The number of times = one, Use of R-type flux Use of Sn−3.0Ag−0.5Cu solder bath Solder bath temperature = 245°C, Dipping time = 5 seconds The number of times = one, Use of R-type flux (use of lead free) 91FW27-69 2007-11-02 TMP91FW27 4.2 DC Characteristics (1/2) Parameter Power supply voltage AVCC = DVCC AVSS = DVSS = 0 V Power supply voltage AVCC = DVCC AVSS = DVSS = 0 V Symbol VCC VCC for erase/program Condition fc = 4 to 27 MHz fc = 2 to 16 MHz Min fs = 30 to 34 kHz fc = 4 to 27 MHz Typ.(Note) Unit 3.6 V 3.6 V 2.7 2.2 2.7 Ta = −10∼40°C Max operations of flash memory P00 to P17 Input low voltage (AD0 to AD15) P20 to P97 (Except P63) RESET , NMI P63 (INT0) VIL1 VIL2 AM0 and AM1 VIL3 X1 VIL4 P00 to P17 (AD0 to AD15) Input high voltage VIL P20 to P97 (Except P63) RESET , NMI , P63 (INT0) VIH VIH1 VIH2 AM0 and AM1 VIH3 X1 VIH4 Output low voltage VOL Output high voltage VOH Vcc ≥ 2.7 V 0.6 Vcc < 2.7 V Vcc ≥ 2.7 V 0.2 Vcc 0.3 Vcc Vcc < 2.7 V 0.2 Vcc Vcc ≥ 2.7 V 0.25 Vcc −0.3 Vcc < 2.7 V 0.15 Vcc Vcc ≥ 2.7 V 0.3 Vcc < 2.7 V 0.3 Vcc ≥ 2.7 V 0.2 Vcc Vcc < 2.7 V 0.1 Vcc Vcc ≥ 2.7 V 2.0 Vcc < 2.7 V 0.7 Vcc Vcc ≥ 2.7 V 0.7 Vcc Vcc < 2.7 V 0.8 Vcc Vcc ≥ 2.7 V 0.75 Vcc Vcc < 2.7 V 0.85 Vcc Vcc ≥ 2.7 V Vcc − 0.3 Vcc < 2.7 V Vcc − 0.3 Vcc ≥ 2.7 V 0.8 Vcc Vcc < 2.7 V 0.9 Vcc IOL = 1.6mA V Vcc + 0.3 Vcc ≥ 2.7 V 0.45 0.15 Vcc IOL = 0.4mA Vcc < 2.7 V IOH = −400 μA Vcc ≥ 2.7 V Vcc − 0.3 IOH = −200 μA Vcc < 2.7 V 0.8 Vcc V V Note: Typical values are for when Ta = 25°C and VCC = 3.0 V uncles otherwise noted. 91FW27-70 2007-11-02 TMP91FW27 DC Characteristics (2/2) Parameter Symbol Condition Min Typ. (Note1) Max Input leakage current ILI 0.0 ≤ VIN ≤ Vcc 0.02 ±5 Output leakage current ILO 0.2 ≤ VIN ≤ Vcc − 0.2 0.05 ±10 Power down voltage RRST RESET pull-up resistor Pin capacitance VTH RESET , NMI , INT0 Programmable pull-up resistor V IH2 = 0.8 Vcc 2.2 3.6 Vcc = 2.7 V to 3.6 V 100 400 Vcc = 2.2 V 200 1000 fc = 1 MHz CIO Schmitt width NORMAL V IL2 = 0.2 Vcc, VSTOP (@STOP, RAM back up) RKH (Note 2) IDLE2 10 1.0 Vcc < 2.7 V 0.3 0.8 Vcc = 2.7 V to 3.6 V 100 400 Vcc = 2.2 V 200 1000 IDLE1 NORMAL (Note 2) IDLE1 SLOW (Note 2) Iccp-p 9 3.4 4.5 1.5 2.9 20 55 20 44 10 40 Vcc = 2.2 V to 3.6 V 1 25 Vcc = 2.2V to 3.6V 20 fs = 32.768 kHz Peak current by intermitt operation 7 8 IDLE1 STOP 20 4.8 Vcc = 2.2 V to 3.6 V IDLE2 13 3.0 fc = 16 MHz Icc V 5.5 Vcc = 2.2 V (Typ. = 2.2V) IDLE2 kΩ PF 0.4 fc = 27 MHz μA V Vcc ≥ 2.7 V Vcc = 2.7 V to 3.6 V Unit kΩ mA mA μA μA mA Note 1: Typical values are for when Ta = 25°C and VCC = 3.0 V unless otherwise noted. Note 2: Icc measurement conditions (NORMAL, SLOW): All functions are operational; output pins are open and input pins are fixed. When the program is operating by the flash memory, or when data reed from the flash memory, the flash memory operate intermittently. Therefore, it outputs a peak current like a following diagram, momentarily. In this case, the power supply current; Icc (NORMAL/SLOW mode) is the sum of average value of a peak current and a MCU current value. When designing the power supply, set to a circuit which a peak current can be supplyed. In SLOW mode, a defference of peak current and average current is large. Program counter (PC) n n+2 n+4 Flash current which flows momentarily. Max. current Iccp-p [mA] Typ. current The average of Peak current + MCU current MCU current Flash memory intermittent operation 91FW27-71 2007-11-02 TMP91FW27 4.3 AC Characteristics (1) Vcc = 2.7 V to 3.6 V No. Parameter Variable Symbol fFPH = 27 MHz Min Max Min 31250 37.0 Unit Max 1 fFPH period ( = x) tFPH 37.0 2 A0 to A15 valid → ALE falling tAL 0.5x − 6 12 ns 3 ALE falling → A0 to A15 hold tLA 0.5x − 16 2 ns 4 ALE high pulse width tLL x − 20 17 ns 5 ALE falling → RD / WR falling tLC 0.5x − 14 4 ns 6 RD rising → ALE rising tCLR 0.5x − 10 8 ns 7 WR rising → ALE rising tCLW x − 10 27 ns 8 A0 to A15 vlalid → RD / WR falling tACL x − 23 14 ns 9 A0 to A21 valid → RD / WR falling tACH 1.5x − 26 29 ns 10 RD rising → A0 to A21 hold tCAR 0.5x − 13 5 ns 11 WR rising → A0 to A21 hold tCAW x − 13 12 A0 to A15 valid → D0 to D15 input tADL 3.0x − 38 73 ns 13 A0 to A21 valid → D0 to D15 input tADH 3.5x − 41 88 ns 14 RD falling → D0 to D15 input tRD 2.0x − 30 44 ns 15 RD low puse width tRR 2.0x − 15 59 ns 16 RD rising → D0 to D15 hold tHR 0 0 ns 17 RD rising → A0 to A15 output tRAE x − 15 22 ns 18 WR low pulse width tWW 1.5x − 15 40 ns 19 D0 to D15 valid → WR rising tDW 1.5x − 35 20 ns 20 WR rising → D0 to D15 hold tWD x − 25 12 ns 21 A0 to A21 valid → Port input tAPH 22 A0 to A21 valid → Port hold tAPH2 23 A0 to A21 valid → Port valid tAP Ns 24 3.5x − 89 3.5x ns 40 ns 209 ns 129 3.5x + 80 ns AC measurement conditions ・Output level: High 0.7 × Vcc/Low 0.3 × VCC, CL = 50 pF ・Input level: High 0.9 × Vcc/Low 0.1 × VCC Note: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock fSYS for CPU core. The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator frequency. 91FW27-72 2007-11-02 TMP91FW27 (2) Vcc = 2.2 V to 3.6 V No. Parameter Variable Symbol fFPH = 16 MHz Unit Min Max Min 62.5 31250 62.5 ns 13 ns 1 fFPH period ( = x) tFPH 2 A0 to A15 valid → ALE falling tAL 0.5x − 18 Max 3 ALE falling → A0 to A15 hold tLA 0.5x − 25 6 ns 4 ALE high pulse width tLL x − 30 32 ns 5 ALE falling → RD / WR falling tLC 0.5x − 25 6 ns 6 RD rising → ALE rising tCLR 0.5x − 15 16 ns 7 WR rising → ALE rising tCLW x − 15 47 ns 8 A0 to A15 vlalid → RD / WR falling tACL x − 30 32 ns 9 ns A0 to A21 valid → RD / WR falling tACH 1.5x − 30 63 10 RD rising → A0 to A21 hold tCAR 0.5x − 21 10 ns 11 WR rising → A0 to A21 hold tCAW x − 25 37 ns 12 A0 to A15 valid → D0 to D15 input tADL 3.0x − 50 137 ns 13 A0 to A21 valid → D0 to D15 input tADH 3.5x − 56 162 ns 14 RD falling → D0 to D15 input tRD 75 ns 15 RD low puse width tRR 2.0x − 28 97 ns 16 RD rising → D0 to D15 hold tHR 0 0 ns 17 RD rising → A0 to A15 output tRAE x − 25 37 ns 18 WR low pulse width tWW 1.5x − 29 64 ns 19 D0 to D15 valid → WR rising tDW 1.5x − 60 33 ns 20 WR rising → D0 to D15 hold tWD x − 40 22 ns 21 A0 to A21 valid → Port input tAPH 22 A0 to A21 valid → Port hold tAPH2 23 A0 to A21 valid → Port valid tAP 2.0x − 50 3.5x − 100 3.5x 68 ns 368 ns 218 3.5x + 150 ns AC measurement conditions ・Output level: High 0.7 × Vcc/Low 0.3 × VCC, CL = 50 pF ・Input level: High 0.9 × Vcc/Low 0.1 × VCC Note: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock fSYS for CPU core. The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator frequency. 91FW27-73 2007-11-02 TMP91FW27 (3) Read cycle tFPH fFPH A0 to A21 CS0 to CS2 tAPH tAPH2 Port input (Note) tADH RD tCAR tRR tAC tRAE tACL tRD tADL tLC A0 to A15 AD0 to AD15 tAL ALE tHR D0 to D15 tLA tCLR tLL Note: Since the CPU accesses the internal area to read data from a port, the control signals of external pins such as RD and CS are not enabled. Therefore, the above waveform diagram should be regarded as depicting internal operation. Please also note that the timing and AC characteristics of port input/output shown above are typical representation. For details, contact your local Toshiba sales representative. 91FW27-74 2007-11-02 TMP91FW27 (4) Write cycle fFPH A0 to A21 CS0 to CS2 tAP Port output (Note) tCAW tWW WR , HWR tDW AD0 to AD15 A0 to A15 tWD D0 to D15 tCLW ALE Note: Since the CPU accesses the internal area to write data to a port, the control signals of external pins such as WR and CS are not enabled. Therefore, the above waveform diagram should be regarded as depicting internal operation. Please also note that the timing and AC characteristics of port input/output shown above are typical representation. For details, contact your local Toshiba sales representative. 91FW27-75 2007-11-02 TMP91FW27 4.4 AD Conversion Characteristics AVCC = VCC, AVSS = VSS Parameter Analog input voltage Error (Not including quantization errors) Symbol Condition VAIN − Min Typ. AVSS VCC = 2.2 V to 3.6 V ±1.0 Max Unit AVCC V ±4.0 LSB Note 1: 1 LSB = (AVCC − AVSS)/1024 [V] Note 2: Minimum operation frequency: The operaion of AD converter is guranteed only using fc (High frequency oscillator). fs (Low frequency oscillator) is not guranteed. But When frequency of clock selected by clock gear is more than and eqaull 4 MHz in using fc, it is guranteed (fFPH ≥ 4 MHz). Note 3: The value for Icc (Current of VCC pin) includes the current which flows through the AVCC pin. 91FW27-76 2007-11-02 TMP91FW27 4.5 Serial Channel Timing (I/O interface mode) (1) SCLK input mode Parameter Symbol SCLK period tSCY Variable Min 10 MHz Max 16X → Output data hold SCLK rising /falling → Input data hold SCLK rising/falling 290 38 (VCC = 2.2 V) 220 − tOHS tSCY/2 + 2X + 0 1000 370 ns tHSR 3X + 10 310 121 ns → Valid data input tSRD → SCLK rising/falling tRDS Valid data input μs 0.59 tOSS SCLK rising/falling Unit Min Max Min Max 1.6 tSCY/2 − 4X − 110 Output data → SCLK rising/falling 27 MHz (VCC = 2.7 V to 3.6 V) ns tSCY/2 − 4X − 180 tSCY − 0 0 1600 592 0 0 10 MHz 27 MHz ns ns (2) SCLK ouptut mode Parameter SCLK period Output data → SCLK rising/falling SCLK rising/falling → Output data hold SCLK rising/falling → Input data hold SCLK rising/falling → Valid data input Valid data input → SCLK rising/falling Symbol Variable Unit Min Max tSCY 16X 8192X tOSS tSCY/2 − 40 760 256 ns tOHS tSCY/2 − 40 760 256 ns tHSR 0 0 0 ns 1.6 tSCY − 1X − 180 tSRD tRDS Min Max Min Max 1X + 180 819 0.59 1320 280 μs 303 375 ns 217 ns Note 1: SCLK rising/falling: The rising edge is used in SCLK rising mode. The falling edge is used in SCLK falling mode. Note 2: 27 MHz and 10 MHz values are calculated from tSCY = 16X case. Note 3: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock fSYS for CPU core. The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator frequency. tSCY SCLK Output mode/ input rising mode SCLK (Input falling mode) tOHS tOSS Output data TXD 0 Input data RXD 0 1 tSRD Valid 91FW27-77 tRDS 1 Valid 2 3 2 3 Valid Valid tHSR 2007-11-02 TMP91FW27 4.6 Event Counter (TA0IN, TA4IN, TB0IN0 and TB0IN1) Parameter Clock period 4.7 Variable Symbol Min tVCK 10 MHz Max 27 MHz Max Unit Min Max Min 8X + 100 900 396 ns Clock low level pulse width tVCKL 4X + 40 440 188 ns Clock high level pulse width tVCKH 4X + 40 440 188 ns Interrupt and Capture (1) NMI and INT0 Interrupts Parameter Variable Symbol Min 10 MHz Max 27 MHz Min Max Min Unit Max NMI and INT0 low level pulse width tINTAL 4X + 40 440 188 ns NMI and INT0 high level pulse width tINTAH 4X + 40 440 188 ns (2) INT5 and INT6 interrupts, capture INT5 and INT6 input pulse width depend on the system clock selection and clock selection for prescaler. Below table show pulse width of each operation clock. System Clock Selection SYSCR1 Clock Selection for Prescaler SYSCR0 0 (fc) 1 (fs) tINTBL tINTBH (INT5 and INT6 low level pulse width) (INT5 and INT6 high level pulse width ) Valiable fFPH = 27MHz Valiable fFPH = 27MHz Min Min Min Min Unit 00 (fFPH) 8X + 100 396 8X + 100 396 ns 10 (fc/16) 128Xc + 0.1 4.8 128Xc + 0.1 4.8 00 (fFPH) 8X + 0.1 244.3 8X + 0.1 244.3 μs Note 1: “Xc” shows period of clock fc in high frequency oscillator. Note 2: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock fSYS for CPU core. The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator frequency. 4.8 Flash Characteristics (1) Rewriting Parameter Guarantee on Flash-memory rewriting Condition Min Typ Max Unit − − 100 Times Vcc = 2.7V to 3.6V, fc = 4 to 27 MHz Ta = −10 to 40 ºC 91FW27-78 2007-11-02 TMP91FW27 5. Port Section Equivalent Circuit Diagrams • Reading the circuit diagrams Basically, the gate symbols written are the same as those used for the standard CMOS logic IC [74HCXX] series. The dedicated signal is described below. STOP : This signal becomes active 1 when the HALT mode setting register is set to the STOP mode (SYSCR2 = “01”) and the CPU executes the HALT instruction. When the drive enable bit SYSCR2 is set to “1”, however STOP remains at “0”. • The input protection resistance ranges from several tens of ohms to several hundreds of ohms. ■ P0 (AD0~AD7), P1 (AD8~AD15, A8~A15), P2 (A16~A21, A0~A5), P60, P70~P74, P80~P83, P91~P92, P94~P95 VCC Output data P-ch Output enable STOP N-ch I/O Input data Input enable ■ P30 ( RD ), P31 ( WR ) Vcc Output data P-ch Output STOP N-ch 91FW27-79 2007-11-02 TMP91FW27 ■ P32, P40~P42 Vcc Output data Vcc Programmable pull-up resistor Output enable STOP I/O Input data Input enable ■ P5 (AN0~AN3) Analog input channel select Analog input Input Input data Input enable ■ P63 (INT0) Vcc Output data P-ch Output enable STOP N-ch I/O Input data Schmitt 91FW27-80 2007-11-02 TMP91FW27 ■ P61 (SO/SDA), P62 (SI/SCL), P90 (TXD0), P93 (TXD1) Vcc Output data P-ch Open-drain Output enable N-ch Output enable STOP I/O Input enable Input enable ■ P96 (XT1), P97 (XT2) Input enable Clock Oscillator Input enable P97 (XT2) Ouput data Output enable N-ch Input enable Input enable P96 (XT1) Ouput data Output enable N-ch STOP Low-frequency oscillation enable ■ NMI NMI Input Schmitt 91FW27-81 2007-11-02 TMP91FW27 ■ AM0~AM1 Input ■ ALE Vcc Internal ALE P-ch Output N-ch Output enable ■ RESET Vcc P-ch Input Reset Schmitt WDTOUT Reset enable ■ X1, X2 Oscillator X2 High-frequen cy oscillation STOP P-ch N-ch X1 Clock 91FW27-82 2007-11-02 TMP91FW27 ■ VREFH, VREFL VREFON P-ch AVCC String resistance AVSS 91FW27-83 2007-11-02 TMP91FW27 Package Dimensions LQFP64-P-1010-0.50D Unit: mm 1.25 typ 10.0 0.2 48 33 49 32 64 17 0.6 0.15 91FW27-84 1.6max 0.25 (0~10 ) 0.145 0.055 0.08 1.4 0.05 16 0.1 0.05 1 12.0 0.2 10.0 0.2 0.5 0.08 M 12.0 0.2 0.22 0.05 6. 2007-11-02 TMP91FW27 QFP64-P-1414-0.80A Unit: mm 91FW27-85 2007-11-02