TOSHIBA TMP91FW27UG

TOSHIBA Original CMOS 16-Bit Microcontroller
TLCS-900/L1 Series
TMP91FW27UG
TMP91FW27FG
Semiconductor Company
Preface
Thank you very much for making use of Toshiba microcomputer LSI.
Before using this LSI, refer to section “Points of Note and Restrictions”.
Especially, take care below cautions.
**CAUTION**
How to release the HALT mode
Usually, interrupts can release all halts stats. However, the interrupts = ( NMI ,
INT0, INTRTC), which can release the HALT mode may not be able to do so if
they are input during the period CPU is shifting to the HALT mode (for about 5
clocks of fFPH) with IDLE1 or STOP mode (IDLE2 is not applicable to this case).
(In this case, an interupt request is kept on hold internally.)
If another interupt is generated after it has shifted to HALT mode completely,
halt status can be released without difficultly. The priority of this interrupt is
compare with that of the interrupt kept on hold internally, and the interrupt with
higher priority is handled first followed by the other interrupt.
TMP91FW27
CMOS 16-Bit Microcontrollers
TMP91FW27UG / TMP91FW27FG
1.
Outline and Features
TMP91FW27 is a high-speed 16-bit microcontroller designed for the control of various mid-to
large-scale equipment.
TMP91FW27UG and TMP91FW27FG come in a 64-pin flat package. Listed below are the
features.
(1) High-speed 16-bit CPU (900/L1 CPU)
•
Instruction mnemonics are upward-compatible with TLCS-90/900
•
16 Mbytes of linear address space
•
General-purpose registers and register banks
•
16-bit multiplication and division instructions; bit transfer and arithmetic instructions
•
Micro DMA: 4 channels (593 ns /2 bytes at 27 MHz)
(2) Minimum instruction execution time: 148 ns (at 27 MHz)
(3) Built-in RAM: 12 Kbytes
Built-in ROM: 128-Kbyte Flash memory
4-Kbyte mask ROM (used for booting)
RESTRICTIONS ON PRODUCT USE
20070701-EN
• The information contained herein is subject to change without notice.
• TOSHIBA is continually working to improve the quality and reliability of its products. Nevertheless, semiconductor
devices in general can malfunction or fail due to their inherent electrical sensitivity and vulnerability to physical
stress. It is the responsibility of the buyer, when utilizing TOSHIBA products, to comply with the standards of safety
in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such
TOSHIBA products could cause loss of human life, bodily injury or damage to property.
In developing your designs, please ensure that TOSHIBA products are used within specified operating ranges as
set forth in the most recent TOSHIBA products specifications. Also, please keep in mind the precautions and
conditions set forth in the “Handling Guide for Semiconductor Devices,” or “TOSHIBA Semiconductor Reliability
Handbook” etc.
• The TOSHIBA products listed in this document are intended for usage in general electronics applications (computer,
personal equipment, office equipment, measuring equipment, industrial robotics, domestic appliances, etc.).These
TOSHIBA products are neither intended nor warranted for usage in equipment that requires extraordinarily high
quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury
(“Unintended Usage”). Unintended Usage include atomic energy control instruments, airplane or spaceship
instruments, transportation instruments, traffic signal instruments, combustion control instruments, medical
instruments, all types of safety devices, etc.. Unintended Usage of TOSHIBA products listed in his document shall
be made at the customer’s own risk.
• The products described in this document shall not be used or embedded to any downstream products of which
manufacture, use and/or sale are prohibited under any applicable laws and regulations.
• The information contained herein is presented only as a guide for the applications of our products. No responsibility
is assumed by TOSHIBA for any infringements of patents or other rights of the third parties which may result from its
use. No license is granted by implication or otherwise under any patents or other rights of TOSHIBA or the third
parties.
• Please contact your sales representative for product-by-product details in this document regarding RoHS
compatibility. Please use these products in this document in compliance with all applicable laws and regulations that
regulate the inclusion or use of controlled substances. Toshiba assumes no liability for damage or losses occurring
as a result of noncompliance with applicable laws and regulations.
This product uses the Super Flash® technology under the license of Silicon Storage Technology,Inc.
Super Flash® is a registered trademark of Silicon Storage Technology,Inc.
91FW27-1
2007-11-02
TMP91FW27
(4) External memory expansion
•
Expandable up to 16 Mbytes (shared program/data area)
•
Can simultaneously support 8-/16-bit width external data bus (Dynamic data bus sizing)
(5) 8-bit timers: 6 channels
(6) 16-bit timers: 1 channel
(7) General-purpose serial interface: 2 channels
•
UART/Synchronous mode: 2 channels
•
IrDA Ver.1.0 (115.2 kbps) mode selectable: 1 channel
(8) Serial bus interface: 1 channel
•
I2C bus mode/clock synchronous mode selectable
(9) 10-bit AD converter (sample hold circuit is inside): 4 channels
(10) Watchdog timer
(11) Special timer for CLOCK
(12) Chip select/Wait controller: 4 blocks
(13) Interrupts: 34 interrupts
•
9 CPU interrupts:
•
21 internal interrupts: 7 priority levels are selectable
•
4 external interrupts: 7 priority levels are selectable
(among 3 interrupts are selectable edge mode)
Software interrupt instruction and illegal instruction
(14) Input/output ports: 53 pins
(15) Stand-by function
Three Halt modes: IDLE2 (programmable), IDLE1 and STOP
(16) Clock controller
•
Clock gear function: Select a High-frequency clock fc to fc/16
•
Special timer for CLOCK (fs = 32.768 kHz)
(17) Operating voltage
•
Vcc = 2.7 V to 3.6 V (fc max = 27 MHz, flash memory read operation)
•
Vcc = 2.2 V to 3.6 V (fc max = 16 MHz, flash memory read operation)
•
Vcc = 2.7 V to 3.6 V (fc max = 27 MHz, flash memory erase/program operations)
(18)Package
•
LQFP64-P-1010-0.50D (TMP91FW27UG)
•
QFP64-P-1414-0.80A (TMP91FW27FG)
91FW27-2
2007-11-02
TMP91FW27
DVCC
DVSS
CPU (TLCS-900/L1)
ADTRG (P53)
AN0~AN3 (P50~P53)
AVCC, AVSS
TXD0 (P90)
RXD0 (P91)
SCLK0/ CTS0 (P92)
10-bit 4-channel
AD
converter
SIO/UART/IrDA
(Channel 0)
XWA
XBC
XDE
XHL
XIX
XIY
XIZ
XSP
W A
B C
D E
H L
IX
IY
IZ
SP
SCK (P60)
SO/SDA (P61)
SI/SCL (P62)
SIO/UART
(Channel 1)
Serial bus
interface
(SBI)
X1
X2
Clock gear
Low speed
oscillator
32 bits
SR
TXD1 (P93)
RXD1 (P94)
SCLK1/ CTS1 (P95)
High speed
oscillator
XT1 (P96)
XT2 (P97)
RESET
AM0
AM1
ALE
F
PC
Watchdog timer
(WDT)
Port 0
AD0~AD7 (P00~P07)
Port 1
AD8/A8~AD15/A15 (P10~P17)
Port 2
A0/A16~A5/A21 (P20~P25)
RD (P30) [ BOOT ]
TA0IN (P70)
8-bit timer
(TMRA0)
TA1OUT (P71)
8-bit timer
(TMRA1)
Special timer for CLOCK
Port 3
HWR (P32)
12-KB RAM
8-bit timer
(TMRA2)
TA3OUT (P72)
8-bit timer
(TMRA3)
TA4IN (P73)
8-bit timer
(TMRA4)
TA5OUT (P74)
8-bit timer
(TMRA5)
WR (P31)
Port 6
CS/WAIT
controller
(4-block)
128-KB Flash EEPROM
Interrupt
controller
16-bit timer
(TMRB0)
4-KB Boot ROM
CS0 ~ CS2 (P40~P42)
NMI
INT0 (P63)
TB0IN0/INT5 (P80)
TB0IN1/INT6 (P81)
TB0OUT0 (P82)
TB0OUT1 (P83)
( ): Initial function after resert
[ ]: During resert
Figure 1.1 TMP91FW27 Block Diagram
91FW27-3
2007-11-02
TMP91FW27
2.
Pin Assignment and Pin Functions
The assignment of input/output pins for the TMP91FW27, their names and functions are as
follows:
2.1
Pin Assignment Diagram
Figure 2.1.1 shows the pin assignment of the TMP91FW27UG and TMP91FW27FG.
P61/SO/SDA
57
P62/SI/SCL
58
56 P60/SCK
55 P42/ CS2
P63/INT0
59
54 P41/ CS1
P50/AN0
60
53 P40/ CS0
P51/AN1
61
52 P32/ HWR
P52/AN2
62
51 P31/ WR
P53/AN3/ ADTRG 63
50 P30/ RD / BOOT
AVCC
64
49 P25/A5/A21
AVSS
1
48 P24/A4/A20
P70/TA0IN
2
47 P23/A3/A19
P71/TA1OUT
3
46 P22/A2/A18
P72/TA3OUT
4
45 P21/A1/A17
P73/TA4IN
5
44 P20/A0/A16
P74/TA5OUT
6
43 P17/AD15/A15
P80/TB0IN0/INT5 7
P81/TB0IN1/INT6 8
42 P16/AD14/A14
Top View
LQFP64, QFP64
41 P15/AD13/A13
P82/TB0OUT0
9
P83/TB0OUT1
10
40 P14/AD12/A12
39 P13/AD11/A11
P90/TXD0
11
38 P12/AD10/A10
P91/RXD0
12
37 P11/AD9/A9
P92/SCLK0/ CTS0 13
36 P10/AD8/A8
P93/TXD1
14
35 P07/AD7
P94/RXD1
15
34 P06/AD6
P95/SCLK1/ CTS1 16
33 P05/AD5
AM0
17
32 P04/AD4
DVCC
18
31 P03/AD3
X2
19
30 P02/AD2
DVSS
20
29 P01/AD1
X1
21
28 P00/AD0
AM1
22
27 ALE
RESET
23
26 NMI
P96/XT1
24
25 P97/XT2
Figure 2.1.1 Pin Assignment Diagram (64-pin LQFP, QFP)
91FW27-4
2007-11-02
TMP91FW27
2.2
Pin Names and Functions
The names of the input/output pins and their functions are described below. Table 2.2.1 and
Table 2.2.2 show Pin names and functions.
Table 2.2.1 Pin Names and Functions (1/2)
Pin Names
P00 to P07
Number of
Pins
I/O
8
I/O
AD0 to AD7
P10 to P17
8
AD8 to AD15
A8 to A15
P20 to P25
Port 0: I/O port that allows I/O to be selected at the bit level
I/O
Address data (lower): 0 to 7 of address/data bus
I/O
Port1: I/O port that allows I/O to be selected at the bit level
I/O
Address data (upper): 8 to 15 of address/data bus
Output
6
Functions
I/O
Address: 8 to 15 of address bus
Port 2: I/O port that allows I/O to be selected at the bit level
A0 to A5
Output
Address: 0 to 5 of address bus
A16 to A21
Output
Address: 16 to 21 of address bus
Output
Port 30: Output Port
Output
Read: Strobe signal for reading external memory
When read internal area also, output RD by setting to P3<P30> = 0 and
P30
1
RD
P3FC<P30F> = 1.
Input
BOOT
This pin sets single boot mode (only during reset).
For the details, please refer to section 3.2.3, “Operation modes”.
P31
1
WR
P32
1
1
1
CS1
P42
Write: Strobe signal for writing data to pins AD0 to AD7
I/O
I/O
Output
CS0
P41
Port 31: Output port
Output
Output
HWR
P40
Output
I/O
Output
1
I/O
Output
CS2
High Write: Strobe signal for writing data to pins AD8 to AD15
Port 40: I/O port (with pull-up resistor)
Chip select 0: Outputs “0” when address is within specified address area.
Port41: I/O port (with pull-up resistor)
Chip select 1: Outputs “0” when address is within specified address area.
Port 42: I/O port (with pull-up resistor)
Chip select 2: Outputs “0” when address is within specified address area.
Input
Port 5: Input port
AN0 to AN3
Input
Analog input: Analog input pins of the AD converter
ADTRG
Input
AD trigger: Pin used to request AD start (shared with P53).
P50 to P53
P60
4
Port 32: I/O port (with pull-up resistor)
1
SCK
P61
1
SO
I/O
Serial bus interface clock I/O at SIO mode
I/O
Port 61: I/O port
Output
SDA
Port 60: I/O port
I/O
I/O
Serial bus interface send data at SIO mode
2
Serial bus interface send/receive data at I C mode
Open-drain output mode by programmable
P62
1
SI
I/O
Input
SCL
Port 62: I/O port
Serial bus interface receive data at SIO mode
2
I/O
Serial bus interface clock I/O at I C mode
I/O
Port 63: I/O port (Schmitt input)
Open-drain output mode by programmable
P63
1
INT0
P70
Input
1
TA0IN
P71
1
TA1OUT
P72
TA3OUT
I/O
Input
I/O
Output
1
I/O
Output
Interrupt request pin 0: Interrupt request pin with level/ rising/falling edge
Port 70: I/O port
8-bit timer 0 input: Input pin of 8-bit timer TMRA0
Port 71: I/O port
8-bit timer 1 output: Output pin of 8-bit timer TMRA0 or TMRA1
Port 72: I/O port
8-bit timer 3 output: Output pin of 8-bit timer TMRA2 or TMRA3
91FW27-5
2007-11-02
TMP91FW27
Table 2.2.2 Pin Names and Functions (2/2)
Pin Names
P73
Number of
Pins
1
TA4IN
P74
I/O
Input
1
TA5OUT
P80
I/O
I/O
Output
1
I/O
Functions
Port 73: I/O port
8-bit timer 4 Input: Input pin of 8-bit timer TMRA4
Port 74: I/O port
8-bit timer 5 output: Output pin of 8-bit timer TMRA4 or TMRA5
Port 80: I/O port
TB0IN0
Input
16-bit timer 0 Input 0: Input of count/capture trigger in 16-bit timer TMRB0
INT5
Input
Interrupt request pin 5: Interrupt request pin with selectable rising/falling edge
P81
1
I/O
Port 81: I/O port
TB0IN1
Input
16-bit timer 0 Input 1: Input of count/capture trigger in 16-bit timer TMRB0
INT6
Input
Interrupt request pin 6: Interrupt request pin of rising edge
P82
1
TB0OUT0
P83
Output
1
TB0OUT1
P90
1
1
1
TXD1
RXD1
P95
Port 83: I/O port
16-bit timer 0 output 1: Output pin of 16-bit timer TMRB0
Port 90: I/O port
Serial 0 send data: Open-drain output pin by programmable
Port 91: I/O port
Serial 0 receive data
Port 92: I/O port
Serial 0 clock I/O
I/O
I/O
Input
Serial 0 data send enable (Clear to send)
Port 93: I/O port
Serial 1 send data: Open-drain output pin by programmable
Port 94: I/O port
Serial 1 receive data
I/O
Port 95: I/O port
SCLK1
I/O
Serial 1 clock I/O
CTS1
Input
P96
1
16-bit timer 0 output 0: Outpit pin of 16-bit timer TMRB0
I/O
Output
1
Port 82: I/O port
I/O
Input
CTS0
P94
I/O
Input
1
SCLK0
P93
I/O
Output
RXD0
P92
I/O
Output
TXD0
P91
I/O
1
XT1
P97
1
XT2
ALE
1
Serial 1 data send enable (Clear to send)
I/O
Port 96: I/O port. Open-drain output pin.
Input
Low frequency oscillator connection pin
I/O
Port 97: I/O port. Open-drain output pin.
Output
Low frequency oscillator connection pin
Output
Address latch enable (It can be set as prohibition of an output for noize
reduction.)
NMI
1
Input
Non-Maskable interrupt request pin: Interrupt request pin with programmable
falling edge level or with both edge levels programmable (Schmitt input).
AM0 and AM1
2
Input
Operation mode:
Fixed to AM1 = “1” and AM0 = “1”.
RESET
1
AVCC
1
Input
Pin used to both power supply pin for AD converter and standard power supply
Reset: Initialize LSI. (Schmitt input, with pull-up resistor)
AVSS
1
Pin used to both GND pin for AD converter (0 V) and standard power supply
X1/X2
2
DVCC
1
for AD converter (H).
pin for AD converter (L).
I/O
High frequency oscillator connection pin.
Power supply pins (All DVCC pins should be connected with the power
Supply pin).
DVSS
1
GND pins (All pins shuold be connected with GND(0V).)
91FW27-6
2007-11-02
TMP91FW27
3.
Functional Description
This section shows the hardware configuration of the TMP91FW27 and explains how it operates.
This device is a version of the created by replacing the predecessor's internal mask ROM with a
128-Kbyte internal flash memory and expanding its internal RAM size to 12 Kbytes. The
configuration and the functionality of this device are the same as those of the TMP91CP27. For the
functions of this device that are not described here, refer to the TMP91CP27 data sheet.
3.1 Memory Map
Figure 3.1.1 shows a memory map of the TMP91FW27 in single-chip mode and its memory
areas that can be accessed in each addressing mode of the CPU.
000000H
Internal I/O
Direct area
(n)
(4 Kbytes)
000100H
001000H
64-Kbytes area
Internal RAM
(12 Kbytes)
(nn)
004000H
010000H
External
16-Mbytes area
memory
(R)
(−R)
(R+)
(R + R8/16)
(R + d8/16)
(nnn)
FE0000H
128 Kbytes
internal ROM
FFFF00H
FFFFFFH
Vector table (256 bytes)
(
= Internal area)
Figure 3.1.1 Memory Map (Single-Chip Mode)
91FW27-7
2007-11-02
TMP91FW27
3.2
Flash Memory
The TMP91FW27 incorporates flash memory that can be electrically erased and programmed
using a single 3V power supply.
The flash memory is programmed and erased using JEDEC-standard commands. After a
program or erase command is input, the corresponding operation is automatically performed
internally. Erase operations can be performed by the entire chip (chip erase) or on a sector basis
(sector erase).
The configuration and operations of the flash memory are described below.
3.2.1
Features
• Power supply voltage for program/erase operations • Sector size
Vcc = 2.7 V to 3.6 V (−10 °C to 40 °C)
• Configuration
64 K × 16 bits (128 Kbytes)
• Functions
Single-word programming
Chip erase
Sector erase
Data polling/Toggle bit
3.2.2
4 Kbytes × 32
• Mode control
JEDEC-standard commands
• Programming method
On-board programming
Parallel programmer
• Security
Write protection
Read protection
Block Diagram
Internal address bus
Internal data bus
Internal control bus
Mode
setting pins
Mode control
ROM controller
Control
Address
Data
Flash memory
Command
register
Address latch
Data latch
Column decoder/Sense amp
Row decoder
Control
circuit
(including
automatic
sequence
control
circuit)
Flash memory cells
128 KB
Erase sector decoder
Figure 3.2.1 Block Diagram of Flash Memory Unit
91FW27-8
2007-11-02
TMP91FW27
3.2.3
Operation Modes
3.2.3.1 Overview
The following three types of operation modes are available to control program/erase
operations on the flash memory.
Table 3.2.1 Description of Operation Modes
Operation Mode Name
Description
Single Chip mode
After reset release, the device starts up from the internal flash memory.
Single Chip mode is further divided into two modes: “Normal mode” is a mode in which user application
programs are executed, and “User Boot mode” is used to program the flash memory on-board.
The means of switching between these two modes can be set by the user as desired. For example, it can
be set so that Port 00 = “1” selects Normal mode and Port 00 = “0” selects User Boot mode. The user
must include a routine to handle mode switching in a user application program.
Normal mode
User Boot mode
Single Boot mode
In this mode, the device starts up from a user application program.
In this mode, the flash memory can be programmed by a user-specified method.
After reset release, the device starts up from the internal boot ROM (mask ROM). The boot ROM includes
an algorithm which allows a program for programming/erasing the flash memory on-board via a serial port
to be transferred to the device’s internal RAM. The transferred program is then executed in the internal
RAM so that the flash memory can be programmed/erased by receiving data from an external host and
issuing program/erase commands.
This mode enables the internal flash memory to be programmed/erased using a general-purpose
programmer. For programmers that can be used, please contact your local Toshiba sales representative.
Programmer mode
Of the modes listed in Table 3.2.1, the internal flash memory can be programmed in User
Boot mode, Single Boot mode and Programmer mode.
0
The mode in which the flash memory can be programmed/erased while mounted on the
user board is defined as the on-board programming mode. Of the modes listed above, Single
Boot mode and User Boot mode are classified as on-board programming modes. Single Boot
mode supports Toshiba’s proprietary programming/erase method using serial I/O. User
Boot mode (within Single Chip mode) allows the flash memory to be programmed/erased by
a user-specified method.
Programmer mode is provided with a read protect function which prohibits reading of
ROM data. By enabling the read protect function upon completion of programming, the
user can protect ROM data from being read by third parties.
91FW27-9
2007-11-02
TMP91FW27
The operation mode ⎯ Single Chip mode, Single Boot mode or Programmer mode ⎯ is
determined during reset by externally setting the input levels on the AM0, AM1 and BOOT
(P30) pins.
Except in Programmer mode which is entered with RESET held at “0”, the CPU will start
operating in the selected mode after the reset state is released. Once the operation mode
has been set, make sure that the input levels on the mode setting pins are not changed
during operation. Table 3.2.2 shows how to set each operation mode, and Figure 3.2.2
shows a mode transition diagram.
1H
2H
Table 3.2.2 Operation Mode Pin Settings
Input Pins
Operation Mode
(1)
(2)
(3)
RESET
BOOT (P30)
AM1
AM0
0
1
0
―
1
1
1
1
1
0
Single Chip mode (Normal or User Boot mode)
Single Boot mode
Programmer mode
Although P30 is an output port, it becomes an input port with pull-up resistor only
during a reset. After a reset, P30 operates as follows depending on the operation mode.
•
Single chip mode: Output port (Without pull-up resistor)
•
Single boot mode: Pull-up (Input gate is invalid, and output gate is in high
impedance.)
(3)
Programmer
mode
Reset state
(1) or (2) ＋ RESET = 0
(1)
(2)
RESET = 0
RESET = 0
Single Chip mode
Single Boot
mode
User Boot
mode
Normal mode
Switching method
to be set by user
On-board programming
mode
Numbers in ( ) correspond to the operation mode pin settings shown in Table 3.2.2
Figure 3.2.2 Mode Transition Diagram
3.2.3.2
Reset Operation
To reset the device, hold the RESET input at “0” for at least 10 system clocks while the
power supply voltage is within the rated operating voltage range and the internal
high-frequency oscillator is oscillating stably.
91FW27-10
2007-11-02
TMP91FW27
3.2.3.3 Memory Map for Each Operation Mode
In this product, the memory map varies with operation mode. The memory map and
sector address ranges for each operation mode are shown below.
Single Chip mode
000000H
001000H
Internal I/O
Internal RAM
12KB
Single Boot mode
000000H
001000H
Internal I/O
Programmer mode
000000H
Internal RAM
12KB
Internal Flash ROM
128KB
004000H
004000H
External memory
010000H
020000H
(予約)
External memory
Internal内蔵
Flash ROM
128KB
Flash ROM
Reserved
030000H
External memory
FE0000H
Internal Flash ROM
128KB
FFFF00H
FFFFFFH
(Interrupt vector 256B)
FFF000H Internal Boot ROM
4KB
FFFF00H
FFFFFFH (Interrupt vector 256B)
FFFFFFH
Figure 3.2.3 TMP91FW27 Memory Map for Each Operation Mode
91FW27-11
2007-11-02
TMP91FW27
Table 3.2.3 Sector Address Ranges for Each Operation Mode
Sector-0
Sector-1
Sector-2
Sector-3
Sector-4
Sector-5
Sector-6
Sector-7
Sector-8
Sector-9
Sector-10
Sector-11
Sector-12
Sector-13
Sector-14
Sector-15
Sector-16
Sector-17
Sector-18
Sector-19
Sector-20
Sector-21
Sector-22
Sector-23
Sector-24
Sector-25
Sector-26
Sector-27
Sector-28
Sector-29
Sector-30
Sector-31
Single Chip Mode
Single Boot Mode
FE0000H to FE0FFFH
FE1000H to FE1FFFH
FE2000H to FE2FFFH
FE3000H to FE3FFFH
FE4000H to FE4FFFH
FE5000H to FE5FFFH
FE6000H to FE6FFFH
FE7000H to FE7FFFH
FE8000H to FE8FFFH
FE9000H to FE9FFFH
FEA000H to FEAFFFH
FEB000H to FEBFFFH
FEC000H to FECFFFH
FED000H to FEDFFFH
FEE000H to FEEFFFH
FEF000H to FEFFFFH
FF0000H to FF0FFFH
FF1000H to FF1FFFH
FF2000H to FF2FFFH
FF3000H to FF3FFFH
FF4000H to FF4FFFH
FF5000H to FF5FFFH
FF6000H to FF6FFFH
FF7000H to FF7FFFH
FF8000H to FF8FFFH
FF9000H to FF9FFFH
FFA000H to FFAFFFH
FFB000H to FFBFFFH
FFC000H to FFCFFFH
FFD000H to FFDFFFH
FFE000H to FFEFFFH
FFF000H to FFFFFFH
10000H to 10FFFH
11000H to 11FFFH
12000H to 12FFFH
13000H to 13FFFH
14000H to 14FFFH
15000H to 15FFFH
16000H to 16FFFH
17000H to 17FFFH
18000H to 18FFFH
19000H to 19FFFH
1A000H to 1AFFFH
1B000H to 1BFFFH
1C000H to 1CFFFH
1D000H to 1DFFFH
1E000H to 1EFFFH
1F000H to 1FFFFH
20000H to 20FFFH
21000H to 21FFFH
22000H to 22FFFH
23000H to 23FFFH
24000H to 24FFFH
25000H to 25FFFH
26000H to 26FFFH
27000H to 27FFFH
28000H to 28FFFH
29000H to 29FFFH
2A000H to 2AFFFH
2B000H to 2BFFFH
2C000H to 2CFFFH
2D000H to 2DFFFH
2E000H to 2EFFFH
2F000H to 2FFFFH
91FW27-12
2007-11-02
TMP91FW27
3.2.4
Single Boot Mode
In Single Boot mode, the internal boot ROM (mask ROM) is activated to transfer a
program/erase routine (user-created boot program) from an external source into the
internal RAM. This program/erase routine is then used to program/erase the flash memory.
In this mode, the internal boot ROM is mapped into an area containing the interrupt vector
table, in which the boot ROM program is executed. The flash memory is mapped into an
address space different from the one into which the boot ROM is mapped (see Figure 3.2.3).
3H
The device’s SIO (SIO1) and the controller are connected to transfer the program/erase
routine from the controller to the device’s internal RAM. This program/erase routine is
then executed to program/erase the flash memory.
The program/erase routine is executed by sending commands and write data from the
controller. The communications protocol between the device and the controller is described
later in this manual. Before the program/erase routine can be transferred to the RAM, user
password verification is performed to ensure the security of user ROM data. If the
password is not verified correctly, the RAM transfer operation cannot be performed. In
Single Boot mode, disable interrupts and use the interrupt request flags to check for an
interrupt request.
Note: In Single Boot mode, the boot-ROM programs are executed in Normal mode. Do not change to
another operation mode in the program/erase routine.
91FW27-13
2007-11-02
TMP91FW27
3.2.4.1 Using the program/erase algorithm in the internal boot ROM
(Step-1) Environment setup
Since the program/erase routine and write data are transferred via SIO (SIO1),
connect the device’s SIO (SIO1) and the controller on the board. The user must prepare
the program/erase routine (a) on the controller.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW27)
Boot ROM
(Controller)
SIO1
Flash memory
Old user application
program
(or erased state)
RAM
(Step-2) Starting up the internal boot ROM
Release the reset with the relevant input pins set for entering Single Boot mode.
When the internal boot ROM starts up, the program/erase routine (a) is transferred
from the controller to the internal RAM via SIO according to the communications
procedure for Single Boot mode. Before this can be carried out, the password entered
by the user is verified against the password written in the user application program.
(If the flash memory has been erased, 12 bytes of “0xFF” are used as the password.)
New user application
program
(a) Program/erase routine
(I/O)
(TMP91FW27)
Boot ROM
0 → 1 RESET
(Controller)
SIO1
Flash memory
Condition for entering
Single Boot mode
Old user application
program
(or erased state)
RAM
91FW27-14
2007-11-02
TMP91FW27
(Step-3) Copying the program/erase routine to the RAM
After password verification is completed, the boot ROM copies the program/erase
routine (a) from the controller to the RAM using serial communications. The
program/erase routine must be stored within the RAM address range of 001000H to
003DFFH.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW27)
Boot ROM
(Controller)
SIO1
Flash memory
Old user application
program
(or erased state)
(a) Program/erase routine
RAM
(Step-4) Executing the program/erase routine in the RAM
Control jumps to the program/erase routine (a) in the RAM. If necessary, the old
user application program is erased (sector erase or chip erase).
Note:
The boot ROM is provided with an erase command, which enables the entire chip to be erased from the
controller without using the program/erase routine. If it is necessary to erase data on a sector basis,
incorporate the necessary code in the program/erase routine.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW27)
Boot ROM
(Controller)
SIO1
Flash memory
(a) Program/erase routine
Erased
RAM
91FW27-15
2007-11-02
TMP91FW27
(Step-5) Copying the new user application program
The program/erase routine (a) loads the new user application program from the
controller into the erased area of the flash memory.
In the example below, the new user application program is transferred under the
same communications conditions as those used for transferring the program/erase
routine. However, after the program/erase routine has been transferred, this routine
can be used to change the transfer settings (data bus and transfer source). Configure
the board hardware and program/erase routine as desired.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW27)
Boot ROM
(Controller)
SIO1
Flash memory
New user application
program
(a) Program/erase routine
RAM
(Step-6) Executing the new user application program
After the programming operation has been completed, turn off the power to the
board and remove the cable connecting the device and the controller. Then, turn on the
power again and start up the device in Single Chip mode to execute the new user
application program.
(TMP91FW27)
Boot ROM
0 → 1 RESET
(Controller)
SIO1
Flash memory
Condition for
entering Single Chip
mode (Normal
mode)
New user application
program
RAM
91FW27-16
2007-11-02
TMP91FW27
3.2.4.2 Connection Examples for Single Boot Mode
In Single Boot mode the flash memory is programmed by serial transfer. Therefore,
on-board programming is performed by connecting the device’s SIO (SIO1) and the
controller (programming tool) and sending commands from the controller to the device.
Figure 3.2.4 shows an example of connection between the target board and a
programming controller. Figure 3.2.5 shows an example of connection between the
target board and an RS232C board.
4H
5H
On-Board Programming Controller
Target Board
VCC
Reg.
Power supply
VCC
VCC
TMP91FW27
DVCC
AM0
AM1
Mode control
MCU
Program
controller
Mode control
Target board
operation
ROM
RESET
RESET
BOOT
Boot
mode
switching
circuit
BOOT (P30)
RAM
P95
P92
RXD
RS232C
P95
P92
RXD1 (P94)
TXD
TXD1 (P93)
VSS
DVSS
PC
Figure 3.2.4 Example of Connection with an External Controller in Single Boot Mode
91FW27-17
2007-11-02
TMP91FW27
Target Board
RS232C Board
VCC
VCC
Power supply
VCC
TMP91FW27
DVCC
AM0
AM1
RESET
RESET
BOOT
RXD
RS232C
Boot
mode
switching
circuit
BOOT (P30)
RXD1 (P94)
TXD
TXD1 (P93)
VSS
VSS
DVSS
PC
Figure 3.2.5 Example of Connection with an RS232C Board in Single Boot Mode
91FW27-18
2007-11-02
TMP91FW27
3.2.4.3 Mode Setting
To perform on-board programming, the device must be started up in Single Boot
mode by setting the input pins as shown below.
・AM0,AM1
=1
・ BOOT
=0
・ RESET
=0→1
Set the AM0, AM1, and BOOT pins as shown above with the RESET pin held at “0”.
Then, setting the RESET pin to “1” will start up the device in Single Boot mode.
3.2.4.4 Memory Maps
Figure 3.2.6 shows a comparison of the memory map for Normal mode (in Single
Chip mode) and the memory map for Single Boot mode. In Single Boot mode, the flash
memory is mapped to addresses 10000H to 2FFFFH (physical addresses) and the boot
ROM (mask ROM) is mapped to addresses FFF000H to FFFFFFH.
6H
Single Chip mode
000000H
001000H
Single Boot mode
000000H
Internal I/O
Internal RAM
12KB
001000H
Internal I/O
Internal RAM
12KB
004000H
004000H
External
Memory
010000H
External
Memory
(予約)
Internal内蔵
Flash ROM
128KB
Flash ROM
030000H
External
Memory
FE0000H
FFFF00H
FFFFFFH
Internal Flash ROM
128KB
FFF000H
(Interrupt vector 256B)
FFFF00H
FFFFFFH
Internal Boot ROM
4KB
(Interrupt vector 256B)
Figure 3.2.6 Comparison of Memory Maps
91FW27-19
2007-11-02
TMP91FW27
3.2.4.5 Interface Specifications
The SIO communications format in Single Boot mode is shown below. The device
supports the UART (asynchronous communications) serial operation mode.
To perform on-board programming, the same communications format must also be
set on the programming controller’s side.
● UART (asynchronous ) communications
・Communications channel : SIO channel 1 (For the pins to be used, see Table 3.2.4.)
・Serial transfer mode
: UART (asynchronous communications) mode
・Data length
: 8 bits
・Parity bit
: None
・Stop bit
: 1 bit
・Baud rate
: See Table 3.2.5 and Table 3.2.6.
7H
8H
9H
Table 3.2.4 Pin Connections
Pins
Power supply
pins
Mode setting pins
UART
{
{
DVCC
DVSS
AM1,AM0,
{
BOOT
Reset pin
RESET
{
TXD1
RXD1
{
{
Communications
pins
Note: Unused pins are in the initial state after reset release.
Table 3.2.5 Baud Rate Table
SIO
Transfer Rate (bps)
UART
115200
57600
38400
91FW27-20
19200
9600
2007-11-02
91FW27-21
19176
−0.13
38352
⎯
39063
38400
38400
39063
0
⎯
57600
⎯
⎯
⎯
⎯
⎯
0
⎯
⎯
57600
0
⎯
57600
⎯
0
115200
⎯
⎯
⎯
frequencies outside of the supported range.
The range of clock frequencies that are detected as each reference frequency. It may not be possible to perform Single Boot operations at clock
⎯
⎯
⎯
⎯
⎯
⎯
⎯
⎯
⎯
⎯
0
⎯
⎯
⎯
⎯
(%)
⎯
⎯
⎯
115200
⎯
⎯
⎯
57600
⎯
⎯
⎯
⎯
⎯
⎯
To program the flash memory using Single Boot mode, one of the reference frequencies must be selected as a high-speed clock.
−0.13
⎯
+1.73
0
0
+1.73
⎯
⎯
⎯
⎯
0
0
38400
38400
⎯
⎯
⎯
(bps)
⎯
(%)
⎯
(bps)
57600
oscillation frequency error must be within ±2% in total.
Note: To automatically detect the reference frequency (microcontroller clock frequency), the transfer baud rate error of the flash memory programming controller and the
Supported Range:
⎯
⎯
0
−0.13
+1.73
0
0
19531
+1.73
19200
19200
+1.73
0
+0.16
0
0
0
+1.73
⎯
(%)
39063
38400
The frequency of the high-speed oscillation circuit that can be used in Single Boot mode.
9588
26.50∼27.57
27
Reference frequency:
9600
25.29∼26.32
25.8048
25
9766
0
24.09∼25.06
9600
24.5760
0
19531
+1.73
9600
19200
0
21.68∼22.56
19231
+0.16
22.1184
9615
15.66∼16.29
16
19200
19200
19200
0
9766
9600
14.46∼15.04
14.7456
0
19.27∼20.05
9600
12.05∼12.53
12.2880
0
20
9600
10.84∼11.28
11.0592
+1.73
19531
+1.73
9600
9766
9.64∼10.02
10
⎯
⎯
⎯
+0.16
18.07∼18.80
9615
7.83∼8.14
8
(bps)
(%)
(bps)
19200
Error (%)
18.4320
Baud Rate
(bps)
Supported Range
(MHz)
9600
Reference Frequency
(MHz)
Reference Baud Rate (bps)
TMP91FW27
Table 3.2.6 Correspondence between Operating Frequency and Baud Rate in Single Boot Mode
2007-11-02
TMP91FW27
3.2.4.6 Data Transfer Formats
Table 3.2.7 to Table 3.2.13 show the operation command data and the data transfer
format for each operation mode.
10H
1H
Table 3.2.7 Operation Command Data
Operation Command
Data
10H
20H
30H
40H
60H
Operation Mode
RAM Transfer
Flash Memory SUM
Product Information Read
Flash Memory Chip Erase
Flash Memory Protect Set
91FW27-22
2007-11-02
TMP91FW27
Table 3.2.8 Transfer Format of Single Boot Program [RAM Transfer]
Transfer
Byte
Number
Boot
ROM
1st byte
Transfer Data
from Controller to Device
Baud rate setting
UART
Operation command data
Note 4:
Transfer Data
from Device to Controller
⎯
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
(10H)
⎯
ACK response to operation command
(Note 2)
Normal
10H
Error
x1H
Protection applied (Note 4)
x6H
Communications error
x8H
⎯
5th byte
to
16th byte
Password data (12 bytes)
17th byte
CHECKSUM value for 5th to 16th bytes
(02FEF4H to 02FEFFH)
⎯
18th byte
⎯
ACK response to CHECKSUM value (Note 2)
Normal
10H
Error
11H
Communications error
18H
19th byte
RAM storage start address 31 to 24 (Note 3)
⎯
20th byte
RAM storage start address 23 to 16 (Note 3)
⎯
21st byte
RAM storage start address 15 to 8 (Note 3)
⎯
22nd byte
RAM storage start address 7 to 0 (Note 3)
⎯
23rd byte
RAM storage byte count 15 to 8 (Note 3)
⎯
24th byte
RAM storage byte count 7 to 0 (Note 3)
⎯
25th byte
CHECKSUM value for 19th to 24th bytes
(Note 3)
⎯
⎯
26th byte
Note 1:
Note 2:
Note 3:
Desired
baud rate
(Note 1)
⎯
4th byte
RAM
86H
⎯
2nd byte
3rd byte
Baud
Rate
ACK response to CHECKSUM value (Note 2)
Normal
10H
Error
11H
Communications error
18H
⎯
27th byte
to
m’th byte
RAM storage data
(m+1)th byte
CHECKSUM value for 27th to m’th bytes
(m+2)th byte
⎯
(m+3)th byte
⎯
⎯
ACK response to CHECKSUM value (Note 2)
Normal
10H
Error
11H
Communications error
18H
Jump to RAM storage start address
For the desired baud rate setting, see Table 3.2.6.
After sending an error response, the device waits for operation command data (3rd byte).
The data to be transferred in the 19th to 25th bytes should be programmed within the RAM address range of
001000H to 003DFFH (11.5Kbytes).
When read protection or write protection is applied, the device aborts the received operation command and waits
for the next operation command data (3rd byte).
91FW27-23
2007-11-02
TMP91FW27
Table 3.2.9 Transfer Format of Single Boot Program [Flash Memory SUM]
Transfer
Byte
Number
Boot
ROM
1st byte
Transfer Data
from Controller to Device
Baud
Rate
Transfer Data
from Device to Controller
⎯
Desired
Baud rate setting
UART
86H
baud rate
(Note1)
2nd byte
⎯
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
3rd byte
Note 1:
Note 2:
Operation command data
⎯
(20H)
4th byte
⎯
5th byte
⎯
SUM (upper)
6th byte
⎯
SUM (lower)
7th byte
⎯
CHECKSUM value for 5th and 6th bytes
8th byte
(Wait for the next operation command data)
ACK response to operation command (Note 2)
Normal
20H
Error
x1H
x8H
Communications error
⎯
For the desired baud rate setting, see Table 3.2.6.
After sending an error response, the device waits for operation command data (3rd byte).
91FW27-24
2007-11-02
TMP91FW27
Table 3.2.10 Transfer Format of Single Boot Program [Product Information Read] (1/2)
Transfer
Byte
Number
Boot
ROM
1st byte
Transfer Data
from Controller to Device
Baud
Rate
Baud rate setting
Desired
UART
86H
Transfer Data
from Device to Controller
⎯
baud rate
(Note 1)
2nd byte
3rd byte
⎯
Operation command data
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
(30H)
⎯
4th byte
⎯
ACK response to operation command (Note 2)
Normal
30H
Error
x1H
Communications error
x8H
5th byte
⎯
Flash memory data (address 02FEF0H)
6th byte
⎯
Flash memory data (address 02FEF1H)
7th byte
⎯
Flash memory data (address 02FEF2H)
8th byte
⎯
Flash memory data (address 02FEF3H)
9th byte
to
20th byte
⎯
Part number (ASCII code, 12 bytes)
‘TMP91FW27_ _ _ ’ (from 9th byte)
21st byte
to
24th byte
⎯
Password comparison start address (4 bytes)
F4H, FEH, 02H, 00H (from 21st byte)
25th byte
to
28th byte
⎯
RAM start address (4 bytes)
00H, 10H, 00H, 00H (from 25th byte)
29th byte
to
32nd byte
⎯
RAM (user area) end address (4 bytes)
FFH, 3DH, 00H, 00H (from 29th byte)
33rd byte
to
36th byte
⎯
RAM end address (4 bytes)
FFH, 3FH, 00H, 00H (from 33rd byte)
37th byte
to
40th byte
⎯
Dummy data (4 bytes)
00H,00H,00H,00H (from 37th byte)
41st byte
to
44th byte
⎯
Dummy data (4 bytes)
00H, 00H, 00H, 00H (from 41st byte)
45th byte
to
46th byte
⎯
FUSE information (2 bytes from 45th byte)
Read protection/Write protection
1) Applied/Applied
: 00H, 00H
2) Not applied/Applied
: 01H, 00H
3) Applied/Not applied
: 02H, 00H
4) Not applied/Not applied
: 03H, 00H
47th byte
to
50th byte
⎯
Flash memory start address (4 bytes)
00H, 00H, 01H, 00H (from 47th byte)
51st byte
to
54th byte
⎯
Flash memory end address (4 bytes)
FFH, FFH, 02H, 00H (from 51st byte)
55th byte
to
56th byte
⎯
Number of sectors in flash memory (2 bytes)
20H, 00H (from 55th byte)
57th byte
to
60th byte
⎯
Start address of flash memory sectors of the
same size (4 bytes)
00H, 00H, 01H, 00H (from 57th byte)
91FW27-25
2007-11-02
TMP91FW27
Table 3.2.11 Transfer Format of Single Boot Program [Product Information Read] (2/2)
Transfer
Byte
Number
Boot
ROM
61st byte
Transfer Data
from Controller to Device
⎯
Transfer Data
from Device to Controller
Size (in half words) of flash memory sectors
of the same size (4 bytes)
to
00H, 08H, 00H, 00H (from 61st byte)
64th byte
65th byte
Baud
Rate
⎯
Number of flash memory sectors of the same
size (1 byte)
20H
Note 1:
Note 2:
66th byte
⎯
67th byte
(Wait for the next operation command data)
CHECKSUM value for 5th to 65th bytes
⎯
For the desired baud rate setting, see Table 3.2.6.
After sending an error response, the device waits for operation command data (3rd byte).
91FW27-26
2007-11-02
TMP91FW27
Table 3.2.12 Transfer Format of Single Boot Program [Flash Memory Chip Erase]
Transfer
Byte
Number
Boot
ROM
1st byte
Transfer Data
from Controller to Device
Baud rate setting
Baud
Rate
Transfer Data
from Device to Controller
⎯
Desired
UART
86H
baud rate
(Note 1)
2nd byte
3rd byte
4th byte
5th byte
⎯
Operation command data
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
Erase Enable command data
⎯
(40H)
⎯
ACK response to operation command (Note2)
Normal
40H
Error
x1H
Communications error
x8H
⎯
(54H)
6th byte
⎯
ACK response to operation command (Note 2)
Normal
54H
Error
x1H
Communications error
x8H
7th byte
⎯
ACK response to Erase command
Normal
Error
4FH
4CH
ACK response
Normal
Error
5DH
60H
8th byte
9th byte
⎯
(Wait for the next operation command data)
⎯
Note 1: For the desired baud rate setting, see Table 3.2.6.
Note 2: After sending an error response, the device waits for operation command data (3rd byte).
91FW27-27
2007-11-02
TMP91FW27
Table 3.2.13 Transfer Format of Single Boot Program [Flash Memory Protect Set]
Transfer
Byte
Number
Boot
ROM
1st byte
Transfer Data
from Controller to Device
Baud rate setting
Baud
Rate
Transfer Data
from Device to Controller
⎯
Desired
UART
86H
baud rate
(Note 1)
2nd byte
⎯
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
3rd byte
4th byte
⎯
(60H)
⎯
ACK response to operation command (Note2)
Normal
60H
Error
x1H
Communications error
x8H
⎯
5th byte
to
16th byte
Password data (12 bytes)
17th byte
CHECKSUM value for 5th to 16th bytes
(02FEF4H to 02FEFFH)
⎯
18th byte
⎯
ACK response to checksum value (Note 2)
Normal
60H
Error
61H
Communications error
68H
19th byte
⎯
ACK response to Protect Set command
Normal
6FH
Error
6CH
20th byte
⎯
ACK response
Normal
Error
21st byte
Note 1:
Note 2:
Operation command data
(Wait for the next operation command data)
31H
34H
⎯
For the desired baud rate setting, see Table 3.2.6.
After sending an error response, the device waits for operation command data (3rd byte).
91FW27-28
2007-11-02
TMP91FW27
3.2.4.7 Boot Program
When the device starts up in Single Boot mode, the boot program is activated.
The following explains the commands that are used in the boot program to
communicate with the controller when the device starts up in Single Boot mode. Use
this information for creating a controller for using Single Boot mode or for building a
user boot environment.
1.
RAM Transfer command
In RAM transfer, data is transferred from the controller and stored in the device’s
internal RAM. When the transfer completes normally, the boot program will start
running the transferred user program. Up to 11.5 Kbytes of data can be
transferred as a user program. (This limit is implemented in the boot program to
protect the stack pointer area.) The user program starts executing from the RAM
storage start address.
This RAM transfer function enables a user-created program/erase routine to be
executed, allowing the user to implement their own on-board programming
method. To perform on-board programming with a user program, the flash
memory command sequences (see section 3.2.6) must be used. After the RAM
Transfer command has been completed, the entire internal RAM area can be used.
If read protection or write protection is applied on the device or a password error
occurs, this command will not be executed.
12H
2.
Flash Memory SUM command
This command calculates the SUM of 128 Kbytes of data in the flash memory and
returns the result. There is no operation command available to the boot program
for reading data from the entire area of the flash memory. Instead, this Flash
Memory SUM command can be used. Reading the SUM value enables revision
management of the application program.
3.
Product Information Read command
This command returns the information about the device including its part number
and memory details stored in the flash memory at addresses 02FEF0H to
02FEF3H. This command can also be used for revision management of the
application program.
4.
Flash Memory Chip Erase command
This command erases all the sectors in the flash memory. If read protection or
write protection is applied on the device, all the sectors in the flash memory are
erased and the read protection or write protection is cleared.
Since this command is also used to restore the operation of the boot program when
the password is forgotten, it does not include password verification.
5.
Flash Memory Protect Set command
This command sets both read protection and write protection on the device.
However, if a password error occurs, this command will not be executed.
When read protection is set, the flash memory cannot be read in Programmer
mode. When write protection is set, the flash memory cannot be written in
Programmer mode.
91FW27-29
2007-11-02
TMP91FW27
3.2.4.8 RAM Transfer Command (See Table 3.2.8)
13H
1.
From the controller to the device
The data in the 1st byte is used to determine the baud rate. The 1st byte is
transferred with receive operation disabled (SC1MOD0<RXE> = 0). (The baud
rate is determined using an internal timer.)
• To communicate in UART mode
Send the value 86H from the controller to the target board using UART
settings at the desired baud rate. If the serial operation mode is determined
as UART, the device checks to see whether or not the desired baud rate can be
set. If the device determines that the desired baud rate cannot be set,
operation is terminated and no communications can be established.
2.
From the device to the controller
The data in the 2nd byte is the ACK response returned by the device for the serial
operation mode setting data sent in the 1st byte. If the data in the 1st byte is
found to signify UART and the desired baud rate can be set, the device returns
86H.
• Baud rate determination
The device determines whether or not the desired baud rate can be set. If it is
found that the baud rate can be set, the boot program rewrites the BR1CR
and BR1ADD values and returns 86H. If it is found that the desired baud
rate cannot be set, operation is terminated and no data is returned. The
controller sets a time-out time (5 seconds) after it has finished sending the
1st byte. If the controller does not receive the response (86H) normally within
the time-out time, it should be considered that the device is unable to
communicate. Receive operation is enabled (SC1MOD0<RXE> = 1) before
86H is written to the transmission buffer.
3.
From the controller to the device
The data in the 3rd byte is operation command data. In this case, the RAM
Transfer command data (10H) is sent from the controller to the device.
4.
From the device to the controller
The data in the 4th byte is the ACK response to the operation command data in
the 3rd byte. First, the device checks to see if the received data in the 3rd byte
contains any error. If a receive error is found, the device returns the ACK response
data for communications error (bit 3) x8H and waits for the next operation
command data (3rd byte). The upper four bits of the ACK response data are
undefined (They are the upper four bits of the immediately preceding operation
command data).
Next, if the data received in the 3rd byte corresponds to one of the operation
commands given in Table 3.2.7, the device echoes back the received data (ACK
response for normal reception). In the case of the RAM Transfer command, if read
or write protection is not applied, 10H is echoed back and then execution branches
to the RAM transfer processing routine. If protection is applied, the device returns
the corresponding ACK response data (bit 2/1) x6H and waits for the next
operation command data (3rd byte). The upper four bits of the ACK response data
are undefined. (They are the upper four bits of the immediately preceding
operation command data.)
After branching to the RAM transfer processing routine, the device checks the
data in the password area. For details, see 3.2.4.15 “Password”.
14H
15H
91FW27-30
16H
2007-11-02
TMP91FW27
If the data in the 3rd byte does not correspond to any operation command, the
device returns the ACK response data for operation command error (bit0) x1H and
waits for the next operation command data (3rd byte). The upper four bits of the
ACK response data are undefined. (They are the upper four bits of the
immediately preceding operation command data.)
5.
From the controller to the device
The 5th to 16th bytes contain password data (12 bytes). The data in the 5th to
16th bytes is verified against the data at addresses 02FEF4H to 02FEFFH in the
flash memory, respectively.
6.
From the controller to the device
The 17th byte contains CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing
the data in the 5th to 16th bytes by unsigned 8-bit addition (ignoring any
overflow). For details on CHECKSUM, see 3.2.4.17 “How to Calculate
CHECKSUM.”
17H
7.
18H
From the device to the controller
The data in the 18th byte is the ACK response data to the 5th to 17th bytes (ACK
response to the CHECKSUM value). The device first checks to see whether the
data received in the 5th to 17th bytes contains any error. If a receive error is found,
the device returns the ACK response data for communications error (bit 3) 18H
and waits for the next operation command data (3rd byte). The upper four bits of
the ACK response data are the upper four bits of the immediately preceding
operation command data, so the value of these bits is “1”.
Next, the device checks the CHECKSUM data in the 17th byte. This check is
made to see if the lower 8-bit value obtained by summing the data in the 5th to
17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value
is not 00H, the device returns the ACK response data for CHECKSUM error (bit
0) 11H and waits for the next operation command data (3rd byte).
Finally, the device examines the result of password verification. If all the data in
the 5th to 16th bytes is not verified correctly, the device returns the ACK response
data for password error (bit 0) 11H and waits for the next operation command
data (3rd byte).
If no error is found in all the above checks, the device returns the ACK response
data for normal reception 10 H.
8.
From the controller to the device
The data in the 19th to 22nd bytes indicates the RAM start address for storing
block transfer data. The 19th byte corresponds to address bits 31 to 24, the 20th
byte to address bits 23 to 16, the 21st byte to address bits 15 to 8, and the 22nd
byte to address bits 7 to 0.
9.
From the controller to the device
The data in the 23rd and 24th bytes indicates the number of bytes to be
transferred. The 23rd byte corresponds to bits 15 to 8 of the transfer byte count
and the 24th byte corresponds to bits 7 to 0.
91FW27-31
2007-11-02
TMP91FW27
10. From the controller to the device
The data in the 25th byte is CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing
the data in the 19th to 24th bytes by unsigned 8-bit addition (ignoring any
overflow). For details on CHECKSUM, see 3.2.4.17 “How to Calculate
CHECKSUM .”
19H
20H
Note: The data in the 19th to 25th bytes should be placed within addresses 001000H to 003DFFH (11.5
Kbytes) in the internal RAM.
11. From the device to the controller
The data in the 26th byte is the ACK response data to the data in the 19th to 25th
bytes (ACK response to the CHECKSUM value).
The device first checks to see whether the data received in the 19th to 25th bytes
contains any error. If a receive error is found, the device returns the ACK response
data for communications error (bit 3) 18H and waits for the next operation
command (3rd byte). The upper four bits of the ACK response data are the upper
four bits of the immediately preceding operation command data, so the value of
these bits is “1”.
Next, the device checks the CHECKSUM data in the 25th byte. This check is
made to see if the lower 8-bit value obtained by summing the data in the 19th to
25th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value
is not 00H, the device returns the ACK response data for CHECKSUM error (bit
0) 11H and waits for the next operation command data (3rd byte).
12. From the controller to the device
The data in the 27th to m’th bytes is the data to be stored in the RAM. This data is
written to the RAM starting at the address specified in the 19th to 22nd bytes.
The number of bytes to be written is specified in the 23rd and 24th bytes.
13. From the controller to the device
The data in the (m+1)th byte is CHECKSUM data. The CHECKSUM data sent by
the controller is the two’s complement of the lower 8-bit value obtained by
summing the data in the 27th to m’th bytes by unsigned 8-bit addition (ignoring
any overflow). For details on CHECKSUM, see 3.2.4.17 ”How to Calculate
CHECKSUM.”
21H
91FW27-32
2H
2007-11-02
TMP91FW27
14. From the device to the controller
The data in the (m + 2) th byte is the ACK response data to the 27th to (m+1)th
bytes (ACK response to the CHECKSUM value).
The device first checks to see whether the data in the 27th to (m+1)th byte
contains any error. If a receive error is found, the device returns the ACK response
data for communications error (bit 3) 18H and waits for the next operation
command (3rd byte). The upper four bits of the ACK response are the upper four
bits of the immediately preceding operation command data, so the value of these
bits is “1”.
Next, the device checks the CHECKSUM data in the (m+1)th byte. This check is
made to see if the lower 8-bit value obtained by summing the data in the 27th to
(m+1)th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the
value is not 00H, the device returns the ACK response data for CHECKSUM error
(bit 0) 11H and waits for the next operation command data (3rd byte).
If no error is found in all the above checks, the device returns the ACK response
data for normal reception 10H.
15. From the device to the controller
If the ACK response data in the (m + 2)th byte is 10H (normal reception), the boot
program then jumps to the RAM start address specified in the 19th to 22nd bytes.
91FW27-33
2007-11-02
TMP91FW27
3.2.4.9 Flash Memory SUM command (See Table 3.2.9)
23H
1.
The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2.
From the controller to the device
The data in the 3rd byte is operation command data. The Flash Memory SUM
command data (20H) is sent here.
3.
From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data
in the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a
receive error is found, the device returns the ACK response data for
communications error (bit 3) x8H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are undefined. (They are
the upper four bits of the immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command
values given in Table 3.2.7, the device echoes back the received data (ACK
response for normal reception). In this case, 20H is echoed back and execution
then branches to the flash memory SUM processing routine. If the data in the 3rd
byte does not correspond to any operation command, the device returns the ACK
response data for operation command error (bit 0) x1H and waits for the next
operation command data (3rd byte). The upper four bits of the ACK response data
are undefined. (They are the upper four bits of the immediately preceding
operation command data.)
24H
4.
From the device to the controller
The data in the 5th and 6th bytes is the upper and lower data of the SUM value,
respectively. For details on SUM, see 3.2.4.16 “How to Calculate SUM .”
25H
5.
26H
From the device to the controller
The data in the 7th byte is CHECKSUM data. This is the two’s complement of the
lower 8-bit value obtained by summing the data in the 5th and 6th bytes by
unsigned 8-bit addition (ignoring any overflow).
6.
From the controller to the device
The data in the 8th byte is the next operation command data.
91FW27-34
2007-11-02
TMP91FW27
3.2.4.10
Product Information Read command (See Table 3.2.10 and Table 3.2.11)
27H
28H
1.
The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2.
From the controller to the device
The data in the 3rd byte is operation command data. The Product Information
Read command data (30H) is sent here.
3.
From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data
in the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a
receive error is found, the device returns the ACK response data for
communications error (bit 3) x8H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are undefined. (They are
the upper four bits of the immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command
values given in Table 3.2.7, the device echoes back the received data (ACK
response for normal reception). In this case, 30H is returned and execution then
branches to the product information read processing routine. If the data in the 3rd
byte does not correspond to any operation command, the device returns the ACK
response data for operation command error (bit 0) x1H and waits for the next
operation command data (3rd byte). The upper four bits of the ACK response data
are undefined. (They are the upper four bits of the immediately preceding
operation command data.)
29H
4.
From the device to the controller
The data in the 5th to 8th bytes is the data stored at addresses 02FEF0H to
02FEF3H in the flash memory. By writing the ID information of software at these
addresses, the version of the software can be managed. (For example, 0002H can
indicate that the software is now in version 2.)
5.
From the device to the controller
The data in the 9th to 20th bytes denotes the part number of the device.
‘TMP91FW27_ _ _’ is sent in ASCII code starting from the 9th byte.
Note: An underscore (‘_’) indicates a space.
6.
From the device to the controller
The data in the 21st to 24th bytes is the password comparison start address. F4H,
FEH, 02H and 00H are sent starting from the 21st byte.
7.
From the device to the controller
The data in the 25th to 28th bytes is the RAM start address. 00H, 10H, 00H and
00H are sent starting from the 25th byte.
8.
From the device to the controller
The data in the 29th to 32nd bytes is the RAM (user area) end address. FFH, 3DH,
00H and 00H are sent starting from the 29th byte.
91FW27-35
2007-11-02
TMP91FW27
9.
From the device to the controller
The data in the 33rd to 36th bytes is the RAM end address. FFH, 3FH, 00H and
00H are sent starting from the 33rd byte.
10. From the device to the controller
The data in the 37th to 44th bytes is dummy data.
11. From the device to the controller
The data in the 45th and 46th bytes contains the protection status and sector
division information of the flash memory.
● Bit 0 indicates the read protection status.
•0: Read protection is applied.
•1: Read protection is not applied.
● Bit 1 indicates the write protection status.
•0: Write protection is applied.
•1: Write protection is not applied.
● Bit 2 indicates whether or not the flash memory is divided into sectors.
•0: The flash memory is divided into sectors.
•1: The flash memory is not divided into sectors.
● Bits 3 to 15 are sent as “0”.
12. From the device to the controller
The data in the 47th to 50th bytes is the flash memory start address. 00H, 00H,
01H and 00H are sent starting from the 47th byte.
13. From the device to the controller
The data in the 51st to 54th bytes is the flash memory end address. FFH, FFH,
02H and 00H are sent starting from the 51st byte.
14. From the device to the controller
The data in the 55th and 56th bytes indicates the number of sectors in the flash
memory. 20H and 00H are sent starting from the 55th byte.
15. From the device to the controller
The data in the 57th to 65th bytes contains sector information of the flash memory.
Sector information is comprised of the start address (starting from the flash
memory start address), sector size and number of consecutive sectors of the same
size. Note that the sector size is represented in word units.
The data in the 57th to 65th bytes indicates 4 Kbytes of sectors (sector 0 to sector
31).
For the data to be transferred, see Table 3.2.10 and Table 3.2.11.
30H
31H
16. From the device to the controller
The data in the 66th byte is CHECKSUM data. This is the two’s complement of
the lower 8-bit value obtained by summing the data in the 5th to 65th bytes by
unsigned 8-bit addition (ignoring any overflow).
17. From the controller to the device
The data in the 67th byte is the next operation command data.
91FW27-36
2007-11-02
TMP91FW27
3.2.4.11
Flash Memory Chip Erase Command (See Table 3.2.12)
32H
1.
The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2.
From the controller to the device
The data in the 3rd byte is operation command data. The Flash Memory Chip
Erase command data (40H) is sent here.
3.
From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data
in the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a
receive error is found, the device returns the ACK response data for
communications error (bit 3) x8H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are undefined. (They are
the upper four bits of the immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command
values given in Table 3.2.7, the device echoes back the received data (ACK
response for normal reception). In this case, 40H is echoed back. If the data in the
3rd byte does not correspond to any operation command, the device returns the
ACK response data for operation command error (bit 0) x1H and waits for the next
operation command data (3rd byte). The upper four bits of the ACK response data
are undefined. (They are the upper four bits of the immediately preceding
operation command data.)
3H
4.
From the controller to the device
The data in the 5th byte is Erase Enable command data (54H).
5.
From the device to the controller
The data in the 6th byte is the ACK response data to the Erase Enable command
data in the 5th byte.
The device first checks to see if the data in the 5th byte contains any error. If a
receive error is found, the device returns the ACK response data for
communications error (bit 3) x8H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are undefined (They are
the upper four bits of the immediately preceding operation command data.)
Then, if the data in the 5th byte corresponds to the Erase Enable command data,
the device echoes back the received data (ACK response for normal reception). In
this case, 54H is echoed back and execution jumps to the flash memory chip erase
processing routine. If the data in the 5th byte does not correspond to the Erase
Enable command data, the device returns the ACK response data for operation
command error (bit 0 ) x1H and waits for the next operation command (3rd byte).
The upper four bits of the ACK response data are undefined. (They are the upper
four bits of the immediately preceding operation command data.)
91FW27-37
2007-11-02
TMP91FW27
6.
From the device to the controller
The data in the 7th byte indicates whether or not the erase operation has
completed successfully. If the erase operation has completed successfully, the
device returns the end code (4FH). If an erase error has occurred, the device
returns the error code (4CH).
7.
From the device to the controller
The data in the 8th byte is ACK response data. If the erase operation has
completed successfully, the device returns the ACK response for erase completion
(5DH). If an erase error has occurred, the device returns the ACK response for
erase error (60H).
8.
From the controller to the device
The data in the 9th byte is the next operation command data.
91FW27-38
2007-11-02
TMP91FW27
3.2.4.12 Flash Memory Protect Set command (See Table 3.2.13)
34H
1.
The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2.
From the controller to the device
The data in the 3rd byte is operation command data. The Flash Memory Protect
Set command data (60H) is sent here.
3.
From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data
in the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a
receive error is found, the device returns the ACK response data for
communications error (bit 3) x8H and waits for the next operation command data.
The upper four bits of the ACK response data are undefined. (They are the upper
four bits of the immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command
data values given in Table 3.2.7, the device echoes back the received data (ACK
response for normal reception). In this case, 60H is echoed back and execution
branches to the flash memory protect set processing routine.
After branching to this routine, the data in the password area is checked. For
details, see 3.2.4.15 ”Password.”
If the data in the 3rd byte does not correspond to any operation command, the
device returns the ACK response data for operation command error (bit 0) x1H
and waits for the next operation command data (3rd byte). The upper four bits of
the ACK response data are undefined. (They are the upper four bits of the
immediately preceding operation command data.)
35H
36H
4.
37H
From the controller to the device
The data in the 5th to 16th bytes is password data (12 bytes). The data in the 5th
byte is verified against the data at address 02FEF4H in the flash memory and the
data in the 6th byte against the data at address 02FEF5H. In this manner, the
received data is verified consecutively against the data at the specified address in
the flash memory. The data in the 16th byte is verified against the data at address
02FEFFH in the flash memory.
5.
From the controller to the device
The data in the 17th byte is CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing
the data in 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow).
For details on CHECKSUM, see 3.2.4.17 ”How to Calculate CHECKSUM.”
38H
91FW27-39
39H
2007-11-02
TMP91FW27
6.
From the device to the controller
The data in the 18th byte is the ACK response data to the data in the 5th to 17th
bytes (ACK response to the CHECKSUM value).
The device first checks to see whether the data in the 5th to 17th bytes contains
any error. If a receive error is found, the device returns the ACK response data for
communications error (bit 3) 68H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are the upper four bits of
the immediately preceding operation command data, so the value of these bits is
“6”.
Then, the device checks the CHECKSUM data in the 17th byte. This check is
made to see if the lower 8 bits of the value obtained by summing the data in the
5th to 17th bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the
value is not 00H, the device returns the ACK response data for CHECKSUM error
(bit 0) 61H and waits for the next operation command data (3rd byte).
Finally, the device examines the result of password verification. If all the data in
the 5th to 16th bytes is not verified correctly, the device returns the ACK response
data for password error (bit 0) 61H and waits for the next operation command
data (3rd byte).
If no error is found in the above checks, the device returns the ACK response data
for normal reception 60H.
7.
From the device to the controller
The data in the 19th byte indicates whether or not the protect set operation has
completed successfully. If the operation has completed successfully, the device
returns the end code (6FH). If an error has occurred, the device returns the error
code (6CH).
8.
From the device to the controller
The data in the 20th byte is ACK response data. If the protect set operation has
completed successfully, the device returns the ACK response data for normal
completion (31H). If an error has occurred, the device returns the ACK response
data for error (34H).
9.
From the device to the controller
The data in the 21st byte is the next operation command data.
91FW27-40
2007-11-02
TMP91FW27
3.2.4.13
ACK Response Data
The boot program notifies the controller of its processing status by sending various
response data. Table 3.2.14 to Table 3.2.19 show the ACK response data returned for
each type of received data. The upper four bits of ACK response data are a direct
reflection of the upper four bits of the immediately preceding operation command data.
Bit 3 indicates a receive error and bit 0 indicates an operation command error,
CHECKSUM error or password error.
40H
41H
Table 3.2.14 ACK Response Data to Serial Operation Mode Setting Data
Transfer Data
86H
Meaning
The device can communicate in UART mode. (Note)
Note: If the desired baud rate cannot be set, the device returns no data and terminates operation.
Table 3.2.15 ACK Response Data to Operation Command Data
Transfer Data
x8H (Note)
x6H (Note)
x1H (Note)
10H
20H
30H
40H
60H
Meaning
A receive error occurred in the operation command data.
Terminated receive operation due to protection setting.
Undefined operation command data was received normally.
Received the RAM Transfer command.
Received the Flash Memory SUM command.
Received the Product Information Read command.
Received the Flash Memory Chip Erase command.
Received the Flash Memory Protect Set command.
Note: The upper four bits are a direct reflection of the upper four bits of the immediately preceding
operation command data.
Table 3.2.16 ACK Response data to CHECKSUM Data for RAM Transfer Command
Transfer Data
18H
11H
10H
Meaning
A receive error occurred.
A CHECKSUM error or password error occurred.
Received the correct CHECKSUM value.
Table 3.2.17 ACK Response Data to Flash Memory Chip Erase Operation
Transfer Data
54H
4FH
4CH
5DH (Note)
60H (Note)
Meaning
Received the Erase Enable command.
Completed erase operation.
An erase error occurred.
Reconfirmation of erase operation
Reconfirmation of erase error
Note: These codes are returned for reconfirmation of communications.
91FW27-41
2007-11-02
TMP91FW27
Table 3.2.18 ACK Response Data to CHECKSUM Data for Flash Memory Protect Set Command
Transfer Data
68H
61H
60H
Meaning
A receive error occurred.
A CHECKSUM or password error occurred.
Received the correct CHECKSUM value.
Table 3.2.19 ACK Response Data to Flash Memory Protect Set Operation
Transfer Data
6FH
6CH
31H (Note)
34H (Note)
Meaning
Completed the protect (read/write) set operation.
A protect (read/write) set error occurred.
Reconfirmation of protect (read/write) set operation
Reconfirmation of protect (read/write) set error
Note: These codes are returned for reconfirmation of communications.
91FW27-42
2007-11-02
TMP91FW27
3.2.4.14
Determining Serial Operation Mode
To communicate in UART mode, the controller should transmit the data value 86H
as the first byte at the desired baud rate. Figure 3.2.7 shows the waveform of this
operation.
42H
Start
bit 0
Point A
bit 1
bit 2
Point B
bit 3
bit 4
bit 5
Point C
bit 6
bit 7
Stop
Point D
UART (86H)
tAB
tAC
tAD
Figure 3.2.7 Data for Determining Serial Operation Mode
The boot program receives the first byte (86H) after reset release not as serial
communications data. Instead, the boot program uses the first byte to determine the
baud rate. The baud rate is determined by the output periods of tAB, tAC and tAD as
shown in Figure 3.2.7 using the procedure shown in Figure 3.2.8.
43H
4H
The CPU monitors the level of the receive pin. Upon detecting a level change, the
CPU captures the timer value to determine the baud rate.
91FW27-43
2007-11-02
TMP91FW27
Start
Initialize 16-bit timer B0
(φT1 = 8/fc, clear counter)
Start the prescaler
Point A
Receive pin changed from
High to Low?
YES
Start counting up of 16-bit timer B0
Point B
Receive pin changed
from Low to High?
YES
Capture timer value (tAB) by software
Point C
Receive pin changed
from High to Low?
YES
Capture timer value (tAC) by software
Point D
Receive pin changed
from Low to High?
YES
Capture timer value (tAD) by software
Stop 16-bit timer B0
tAC ≥ tAD?
YES
Back up tAD value
Stop operation
(Endless loop)
End
Figure 3.2.8 Flowchart for Serial Operation Mode Receive Operation
91FW27-44
2007-11-02
TMP91FW27
3.2.4.15
Password
When the RAM Transfer command (10H) or the Flash Memory Protect Set
command (60H) is received as operation command data, password verification is
performed. First, the device echoes back the operation command data (10H to 60H)
and checks the data (12 bytes) in the password area (addresses 02FEF4H to
02FEFFH).
Then, the device verifies the password data received in the 5th to 16th bytes against
the data in the password area as shown in Table 3.2.20.
45H
Unless all the 12 bytes are verified correctly, a password error will occur.
A password error will also occur if all the 12 bytes of password data contain the same
value. Only exception is when all the 12 bytes are “FFH” and verified correctly and the
reset vector area (addresses 02FF00H to 02FF02H) is all “FFH”. In this case, a blank
device will be assumed and no password error will occur.
If a password error has occurred, the device returns the ACK response data for
password error in the 18th byte.
Table 3.2.20 Password Verification Table
Receive data
5th byte
6th byte
7th byte
8th byte
9th byte
10th byte
11th byte
12th byte
13th byte
14th byte
15th byte
16th byte
Data to be verified against
Data at address 02FEF4H
Data at address 02FEF5H
Data at address 02FEF6H
Data at address 02FEF7H
Data at address 02FEF8H
Data at address 02FEF9H
Data at address 02FEFAH
Data at address 02FEFBH
Data at address 02FEFCH
Data at address 02FEFDH
Data at address02FEFEH
Data at address 02FEFFH
Example of data that cannot be specified as a password
For blank products (Note)
・The password of a blank product must be all “FFH” (FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH).
Note:
A blank product is a product in which all the bytes in the password area (addresses 02FEF4H to 02FEFFH) and
the reset vector area (addresses 02FF00H to 02FF02H) are “FFH”.
For programmed products
・The same 12 consecutive bytes cannot be specified as a password.
The table below shows password error examples.
Programmed
product
Error example 1
Error example 2
Error example 3
1
2
3
4
5
6
7
8
9
10
11
12
Note
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
All ”FF”
All ”00”
All ”5A”
91FW27-45
2007-11-02
TMP91FW27
3.2.4.16
How to Calculate SUM
SUM is calculated by summing the values of all data read from the flash memory by
unsigned 8-bit addition and is returned as a word (16-bit) value. The resulting SUM
value is sent to the controller in order of upper 8 bits and lower 8 bits. All the 128
Kbytes of data in the flash memory are included in the calculation of SUM. When the
Flash Memory SUM command is executed, SUM is calculated in this way.
Example:
A1H
When SUM is calculated from the four data entries
shown to the left, the result is as follows:
A1H + B2H + C3H + D4H = 02EAH
SUM upper 8 bits: 02H
SUM lower 8 bits: EAH
B2H
C3H
D4H
3.2.4.17
Thus, the SUM value is sent to the controller in order of
02H and EAH.
How to Calculate CHECKSUM
CHECKSUM is calculated by taking the two’s complement of the lower 8-bit value
obtained by summing the values of received data by unsigned 8-bit addition (ignoring
any overflow). When the Flash Memory SUM command or the Product Information
Read command is executed, CHECKSUM is calculated in this way. The controller
should also use this CHECKSUM calculation method for sending CHECKSUM
values.
Example: Calculating CHECKSUM for the Flash Memory SUM command
When the upper 8-bit data of SUM is E5H and the lower 8-bit data is F6H,
CHECKSUM is calculated as shown below.
First, the upper 8 bits and lower 8 bits of the SUM value are added by unsigned
operation.
E5H + F6H = 1DBH
Then, the two’s complement of the lower 8 bits of this result is obtained as shown
below. The resulting CHECKSUM value (25H) is sent to the controller.
0 − DBH = 25H
91FW27-46
2007-11-02
TMP91FW27
3.2.5
User Boot Mode (in Single Chip Mode)
User Boot mode, which is a sub mode of Single Chip mode, enables a user-created flash
memory program/erase routine to be used. To do so, the operation mode of Single Chip
mode must be changed from Normal mode for executing a user application program to User
Boot mode for programming/erasing the flash memory.
For example, the reset processing routine of a user application program may include a
routine for selecting Normal mode or User Boot mode upon entering Single Chip mode. Any
mode-selecting condition may be set using the device’s I/O to suit the user system.
To program/erase the flash memory in User Boot mode, a program/erase routine must be
incorporated in the user application program in advance. Since the processor cannot read
data from the internal flash memory while it is being programmed or erased, the
program/erase routine must be executed from the outside of the flash memory. While the
flash memory is being programmed/erased in User Boot mode, interrupts must be disabled.
The pages that follow explain the procedure for programming the flash memory using
two example cases. In one case the program/erase routine is stored in the internal flash
memory (1-A); in the other the program/erase routine is transferred from an external
source (1-B).
91FW27-47
2007-11-02
TMP91FW27
3.2.5.1 (1-A) Program/Erase Procedure Example 1
When the program/erase routine is stored in the internal flash memory
(Step-1) Environment setup
First, the condition (e.g. pin status) for entering User Boot mode must be set and the
I/O bus for transferring data must be determined. Then, the device’s peripheral
circuitry must be designed and a corresponding program must be written. Before
mounting the device on the board, it is necessary to write the following four routines
into one of the sectors in the flash memory.
(a) Mode select routine : Selects Normal mode or User Boot mode.
(b) Program/erase routine : Loads program/erase data from an external source and
programs/erases the flash memory.
(c) Copy routine 1
(d) Copy routine 2
: Copies routines (a) to (d) into the internal RAM or
external memory.
: Copies routines (a) to (d) from the internal RAM or
external memory into the flash memory.
Note: The above (d) is a routine for reconstructing the program/erase routine on the flash memory. If the
entire flash memory is always programmed and the program/erase routine is included in the new user
application program, this copy routine is not needed.
New user application
program
(TMP91FW27)
(I/O)
Flash memory
(Controller)
Old user application
program
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
(Step-2) Entering User Boot mode (using the reset processing)
After reset release, the reset processing program determines whether or not the
device should enter User Boot mode. If the condition for entering User Boot mode is
true, User Boot mode is entered to program/erase the flash memory.
New user application
program
(TMP91FW27)
(I/O)
0 → 1 RESET
Flash memory
(Controller)
Old user application
program
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
RAM
Condition for
entering User Boot
mode
(user-specified)
(c) Copy routine 1
(d) Copy routine 2
91FW27-48
2007-11-02
TMP91FW27
(Step-3) Copying the program/erase routine
After the device has entered User Boot mode, the copy routine 1 (c) copies the
routines (a) to (d) into the internal RAM or external memory (The routines are copied
into the internal RAM here.)
New user application
program
(I/O)
(TMP91FW27)
Flash memory
(Controller)
Old user application
program
(a) Mode select routine
[Reset processing program]
(b) Program/erase routine
(c) Copy routine 1
(a) Mode select routine
(d) Copy routine 2
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
(Step-4) Erasing the flash memory by the program/erase routine
Control jumps to the program/erase routine in the RAM and the old user program
area is erased (sector erase or chip erase). (In this case, the flash memory erase
command is issued from the RAM.)
Note: If data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, only the
program/erase routine (b) need be copied into the RAM.
New user application
program
(TMP91FW27)
(I/O)
Flash memory
(Controller)
(a) Mode select routine
(b)Program/erase routine
(c) Copy routine 1
Erased
(d) Copy routine 2
RAM
91FW27-49
2007-11-02
TMP91FW27
(Step-5) Restoring the user boot program in the flash memory
The copy routine 2 (d) in the RAM copies the routines (a) to (d) into the flash
memory.
Note:
If data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, step 5 is not
needed.
New user application
program
(I/O)
(TMP91FW27)
(Controller)
Flash memory
(a) Mode select routine
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
(c) Copy routine 1
(d) Copy routine 2
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
(Step-6) Writing the new user application program to the flash memory
The program/erase routine in the RAM is executed to load the new user application
program from the controller into the erased area of the flash memory.
New user application
program
(TMP91FW27)
(I/O)
(Controller)
Flash memory
New user application
program
(a) Mode select routine
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
(c) Copy routine 1
(d) Copy routine 2
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
91FW27-50
2007-11-02
TMP91FW27
(Step-7) Executing the new user application program
The RESET input pin is driven Low (“0”) to reset the device. The mode setting
condition is set for Normal mode. After reset release, the device will start executing
the new user application program.
(TMP91FW27)
(I/O)
0 → 1 RESET
Flash memory
(Controller)
New user application
program
Condition for entering
Normal mode
[Reset processing program
(a) Mode select routine
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
91FW27-51
2007-11-02
TMP91FW27
3.2.5.2 (1-B) Program/Erase Procedure Example 2
In this example, only the boot program (minimum requirement) is stored in the
flash memory and other necessary routines are supplied from the controller.
(Step-1) Environment setup
First, the condition (e.g. pin status) for entering User Boot mode must be set and the
I/O bus for transferring data must be determined. Then, the device’s peripheral
circuitry must be designed and a corresponding program must be written. Before
mounting the device on the board, it is necessary to write the following two routines
into one on the sectors in the flash memory.
(a) Mode select routine : Selects Normal mode or User Boot mode.
(b) Transfer routine
: Loads the program/erase routine from an external
source.
The following routines are prepared on the controller.
(c) Program/erase routine : Programs/erases the flash memory.
(d) Copy routine 1
: Copies routines (a) and (b) into the internal RAM or
external memory.
(e) Copy routine 2
: Copies routines (a) and (b) from the internal RAM or
external memory into the flash memory.
New user application
program
(I/O)
(c) Program/erase routine
(TMP91FW27)
(d) Copy routine 1
Flash memory
(e) Copy routine 2
Old user application
program
(Controller)
[Reset processing routine]
(a) Mode select routine
RAM
(b) Transfer routine
(Step-2) Entering User Boot mode (using the reset processing)
The following explanation assumes that these routines are incorporated in the reset
processing program. After reset release, the reset processing program first determines
whether or not the device should enter User Boot mode. If the condition for entering
User Boot mode is true, User Boot mode is entered to program/erase the flash memory.
New user application
program
(I/O)
(TMP91FW27)
0 → 1 RESET
Flash memory
Old user application
program
(d) Copy routine 1
(e) Copy routine 2
(Controller)
[Reset processing routine]
(a)Mode Select routine
(c) Program/erase routine
RAM
Condition for
entering User Boot
mode
(user-specified)
(b)Transfer routine
91FW27-52
2007-11-02
TMP91FW27
(Step-3) Copying the program/erase routine to the internal RAM
After the device has entered User Boot mode, the transfer routine (b) transfers the
routines (c) to (e) from the controller to the internal RAM (or external memory). (The
routines are copied into the internal RAM here.)
New user application
program
(c) Program/erase routine
(d) Copy routine 1
(TMP91FW27)
(e) Copy routine 2
(I/O)
(Controller)
Flash memory
Old user application
program
(c) Program/erase routine
[Reset processing routine]
(a) Mode select routine
(d) Copy routine 1
(e) Copy routine 2
(b) Transfer routine
RAM
(Step-4) Executing the copy routine 1 in the internal RAM
Control jumps to the internal RAM and the copy routine 1 (d) copies the routines (a)
and (b) into the internal RAM.
New user application
program
(c) Program/erase routine
(TMP91FW27)
(d) Copy routine 1
(I/O)
(e) Copy routine 2
(Controller)
Flash memory
Old user application
program
(a)Mode select routine
(b) Transfer routine
(c) Program/erase routine
[Reset processing routine]
(a) Mode select routine
(b) Transfer routine
(d) Copy routine 1
(e) Copy routine 2
RAM
91FW27-53
2007-11-02
TMP91FW27
(Step-5) Erasing the flash memory by the program/erase routine
The program/erase routine (c) erases the old user program area.
New user application
program
(TMP91FW27)
(c) Program/erase routine
(I/O)
(d) Copy routine 1
(e) Copy routine 2
(Controller)
Flash memory
(a)Mode select routine
(b)Transfer routine
(c) Program/erase routine
Erased
(d) Copy routine 1
(e) Copy routine 2
RAM
(Step-6) Restoring the user boot program in the flash memory
The copy routine (e) copies the routines (a) and (b) from the internal RAM into the
flash memory.
New user application
program
(c) Program/erase routine
(d) Copy routine 1
(TMP91FW27)
(I/O)
(e) Copy routine 2
(Controller)
Flash memory
(a)Mode select routine
(b) Transfer routine
(c) Program/erase routine
[Reset processing program]
(a) Mode select routine
(b) Transfer routine
(d) Copy routine 1
(e) Copy routine 2
RAM
91FW27-54
2007-11-02
TMP91FW27
(Step-7) Writing the new user application program to the flash memory
The program/erase routine (c) in the RAM is executed to load the new user
application program from the controller into the erased area of the flash memory.
New user application
program
(c) Program/erase routine
(d) Copy routine 1
(I/O)
(e) Copy routine 2
(TMP91FW27)
Flash memory
New user application
program
(Controller)
(a)Mode select routine
(b)Transfer routine
(c) Program/erase routine
[Reset processing program]
(a) Mode select routine
(d) Copy routine 1
(e) Copy routine 2
(b) Transfer routine
RAM
(Step-8) Executing the new user application program
The RESET input pin is driven Low (“0”) to reset the device. The mode setting
condition is set for Normal mode. After reset release, the device will start executing
the new user application program.
(TMP91FW27)
(I/O)
0 → 1 RESET
Flash memory
(Controller)
New user application
program
Condition for
entering Normal
mode
[Reset processing program]
(a)Mode select routine
RAM
(b) Transfer routine
91FW27-55
2007-11-02
TMP91FW27
3.2.6
Flash Memory Command Sequences
The operation of the flash memory is comprised of six commands, as shown in Table
3.2.21. Addresses specified in each command sequence must be in an area where the flash
memory is mapped. For details, see Table 3.2.3.
46H
47H
Table 3.2.21 Command Sequences
1st Bus
Write Cycle
Command
2nd Bus
Write Cycle
3rd Bus
Write Cycle
4th Bus
Write Cycle
5th Bus
Write Cycle
6th Bus
Write Cycle
Addr.
Addr.
Data
Addr.
Data
Sequence
Addr.
Data Addr. Data
Addr.
Data
Data
PA
PD
(Note 1) (Note 1)
1
Single Word Program
AAAH
AAH
554H
55H
AAAH
A0H
2
Sector Erase
(4-KB Erase)
AAAH
AAH
554H
55H
AAAH
80H
AAAH
AAH
554H
55H
SA
(Note 2)
30H
3
Chip Erase
(All Erase)
AAAH
AAH
554H
55H
AAAH
80H
AAAH
AAH
554H
55H
AAAH
10H
4
Product ID Entry
AAAH
AAH
554H
55H
AAAH
90H
Product ID Exit
xxH
F0H
Product ID Exit
AAAH
AAH
554H
55H
AAAH
F0H
Read Protect Set
AAAH
AAH
554H
55H
AAAH
A5H
77EH
F0H
(Note3)
Write Protect Set
AAAH
AAH
554H
55H
AAAH
A5H
77EH
0FH
(Note3)
5
6
Note 1:
PA = Program Word address, PD = Program Word data
Set the address and data to be programmed. Even-numbered addresses should be specified here.
Note 2:
SA = Sector Erase address, Each sector erase range is selected by address A23 to A12.
Note 3:
When apply read protect and write protect, be sure to program the data of 00H.
Table 3.2.22 Hardware Sequence Flags
Status
During auto operation
D7
D6
Single Word Program
D7
Toggle
Sector Erase/Chip Erase
0
Toggle
Read Protect Set/Write Protect Set
Cannot be
used
Toggle
Note: D15 to D8 and D5 to D0 are “don’t care”.
91FW27-56
2007-11-02
TMP91FW27
3.2.6.1 Single Word Program
The Single Word Program command sequence programs the flash memory on a word
basis. The address and data to be programmed are specified in the 4th bus write cycle.
It takes a maximum of 60 μs to program a single word. Another command sequence
cannot be executed until the write operation has completed. This can be checked by
reading the same address in the flash memory repeatedly until the same data is read
consecutively. While a write operation is in progress, bit 6 of data is toggled each time
it is read.
Note:
To rewrite data to Flash memory addresses at which data (including FFFFH) is already written, make
sure to erase the existing data by “sector erase” or “chip erase” before rewriting data.
3.2.6.2 Sector Erase (4-Kbyte Erase)
The Sector Erase command sequence erases 4 Kbytes of data in the flash memory at
a time. The flash memory address range to be erased is specified in the 6th bus write
cycle. For the address range of each sector, see Table 3.2.3. This command sequence
cannot be used in Programmer mode.
48H
It takes a maximum of 75 ms to erase 4 Kbytes. Another command sequence cannot
be executed until the erase operation has completed. This can be checked by reading
the same address in the flash memory repeatedly until the same data is read
consecutively. While a erase operation is in progress, bit 6 of data is toggled each time
it is read.
3.2.6.3 Chip Erase (All Erase)
The Chip Erase command sequence erases the entire area of the flash memory.
It takes a maximum of 300 ms to erase the entire flash memory. Another command
sequence cannot be executed until the erase operation has completed. This can be
checked by reading the same address in the flash memory repeatedly until the same
data is read consecutively. While an erase operation is in progress, bit 6 of data is
toggled each time it is read.
Erase operations clear data to FFH.
3.2.6.4 Product ID Entry
When the Product ID Entry command is executed, Product ID mode is entered. In
this mode, the vendor ID, flash macro ID, flash size ID, and read/write protect status
can be read from the flash memory. In Product ID mode, the data in the flash memory
cannot be read.
3.2.6.5 Product ID Exit
This command sequence is used to exit Product ID mode.
91FW27-57
2007-11-02
TMP91FW27
3.2.6.6 Read Protect Set
The Read Protect Set command sequence applies read protection on the flash
memory. When read protection is applied, the flash memory cannot be read in
Programmer mode and the RAM Transfer command cannot be executed in Single Boot
mode.
To cancel read protection, it is necessary to execute the Chip Erase command
sequence. To check whether or not read protection is applied, read xxx77EH in Product
ID mode. It takes a maximum of 60 μs to set read protection on the flash memory.
Another command sequence cannot be executed until the read protection setting has
completed. This can be checked by reading the same address in the flash memory
repeatedly until the same data can be read consecutively. While a read protect
operation is in progress, bit 6 of data is toggled each time it is read.
3.2.6.7 Write Protect Set
The Write Protect Set command sequence applies write protection on the flash
memory. When write protection is applied, the flash memory cannot be written to in
Programmer mode and the RAM Transfer command cannot be executed in Single Boot
mode.
To cancel write protection, it is necessary to execute the Chip Erase command
sequence. To check whether or not write protection is applied, read xxx77EH in
Product ID mode. It takes a maximum of 60 μs to set write protection. Another
command sequence cannot be executed until the write protection setting has
completed. This can be checked by reading the same address in the flash memory
repeatedly until the same data can be read consecutively. While a write protect
operation is in progress, bit 6 of data is toggled each time it is read.
3.2.6.8 Hardware Sequence Flags
The following hardware sequence flags are available to check the auto operation
execution status of the flash memory.
1) Data polling (D7)
When data is written to the flash memory, D7 outputs the complement of its
programmed data until the write operation has completed. After the write
operation has completed, D7 outputs the proper cell data. By reading D7,
therefore, the operation status can be checked. While the Sector Erase or Chip
Erase command sequence is being executed, D7 outputs “0”. After the command
sequence is completed, D7 outputs “1” (cell data). Then, the data written to all the
bits can be read after waiting for 1 μs.
When read/write protection is applied, the data polling function cannot be used.
Instead, use the toggle bit (D6) to check the operation status.
91FW27-58
2007-11-02
TMP91FW27
2) Toggle bit (D6)
When the Flash Memory Program, Sector Erase, Chip Erase, Write Protect Set, or
Read Protect Set command sequence is executed, bit 6 (D6) of the data read by
read operations outputs “0” and “1” alternately each time it is read until the
processing of the executed command sequence has completed. The toggle bit (D6)
thus provides a software means of checking whether or not the processing of each
command sequence has completed. Normally, the same address in the flash
memory is read repeatedly until the same data is read successively. The initial
read of the toggle bit always returns “1”.
Note:
The flash memory incorporated in the TMP91FW27 does not have an exceed-time-limit bit (D5). It is
therefore necessary to set the data polling time limit and toggle bit polling time limit so that polling can be
stopped if the time limit is exceeded.
3.2.6.9 Data Read
Data is read from the flash memory in byte units or word units. It is not necessary to
execute a command sequence to read data from the flash memory.
91FW27-59
2007-11-02
TMP91FW27
3.2.6.10
Programming the Flash Memory by the Internal CPU
The internal CPU programs the flash memory by using the command sequences and
hardware sequence flags described above. However, since the flash memory cannot be
read during auto operation mode, the program/erase routine must be executed outside
of the flash memory.
The CPU can program the flash memory either by using Single Boot mode or by
using a user-created protocol in Single Chip mode (User Boot).
1) Single Boot:
The microcontroller is started up in Single Boot mode to program the flash
memory by the internal boot ROM program. In this mode, the internal boot ROM
is mapped to an area including the interrupt vector table, in which the boot ROM
program is executed. The flash memory is mapped to an address area different
from the boot ROM area. The boot ROM program loads data into the flash memory
by serial transfer. In Single Boot mode, interrupts must be disabled including
non-maskable interrupts ( NMI , etc.).
For details, see 3.2.4“Single Boot Mode”
49H
50H
2) User Boot:
In this method, the flash memory is programmed by executing a user-created
routine in Single Chip mode (normal operation mode). In this mode, the
user-created program/erase routine must also be executed outside of the flash
memory. It is also necessary to disable interrupts including non-maskable
interrupts.
The user should prepare a flash memory program/erase routine (including
routines for loading write data and writing the loaded data into the flash memory).
In the main program, normal operation is switched to flash memory programming
operation to execute the flash memory program/erase routine outside of the flash
memory area. For example, the flash memory program/erase routine may be
transferred from the flash memory to the internal RAM and executed there or it
may be prepared and executed in external memory.
For details, see 3.2.5“Flash Memory”.
51H
52H
91FW27-60
2007-11-02
TMP91FW27
Flowcharts: Flash memory access by the internal CPU
Single Word Program
Start
Program
Program command
command sequence
sequence
(See
(See the
the flowchart
flowchart below)
below)
Toggle bit (D6)
Timeout (60 μs)
Word read
Addr. = Program address
Read data matched
program data?
No
Yes
Word read
Addr. = Program address
Read data matched
program data?
No
Yes
Address = Address + 2
(Even-numbered address/
word units)
No
Last address?
Yes
Program end
Abnormal end
Program Command Sequence (Address/Data)
xxxAAAH/AAH
xxx554H/55H
xxxAAAH/A0H
Even-numbered program address (A0 = 0)
/ program data (word units)
91FW27-61
2007-11-02
TMP91FW27
Chip Erase/Sector Erase
Start
Erase command sequence
(See the flowchart below)
Timeout
(Chip: 300 ms, Sector: 75 ms)
Toggle bit (D6)
Read data = blank?
No
Yes
Erase end
Abnormal end
Note: In Chip Erase, whether or not the entire flash memory is blank is checked.
In Sector Erase, whether or not the selected sector is blank is checked.
Chip Erase Command Sequence
(Address/Data)
Sector Erase Command Sequence
(Address/Data)
xxxAAAH/AAH
xxxAAAH/AAH
xxx554H/55H
xxx554H/55H
xxxAAAH/80H
xxxAAAH/80H
xxxAAAH/AAH
xxxAAAH/AAH
xxx554H/55H
xxx554H/55H
xxxAAAH/10H
Sector address/30H
91FW27-62
2007-11-02
TMP91FW27
Read/Write Protect Set
Start
Protect Set command sequence
(See the flowchart below)
Timeout (60 μs)
Toggle bit (D6)
Product ID Entry
Byte read (D7 to D0)
Addr. = xxx77EH
Product ID Exit
Read data matched
program data?
No
Yes
Protect Set end
Abnormal end
Protect Set Command Sequence
(Address/Data)
xxxAAAH/AAH
xxx554H/55H
xxxAAAH/A5H
Set read protect
xxx77EH/F0H
Set write protect
xxx77EH/0FH
Set both read protect and write protect
xxx77EH/00H
91FW27-63
2007-11-02
TMP91FW27
Data Polling (D7)
Start
Byte read (D7 to D0)
Addr. = VA
(VA: Valid Address)
No
D7 = Data?
Yes
Operation end
Toggle Bit (D6)
Start
Byte read (D7 to D0)
Addr. = VA
Byte read (D7 to D0)
Addr. = VA
Yes
D6 = Toggle?
No
Operation end
Note: Hardware sequence flags are read from the flash memory in byte units or word units.
VA:
In Single Word Program, VA denotes the address to be programmed.
In Sector Erase, VA denotes any address in the selected sector.
In Chip Erase, VA denotes any address in the flash memory.
In Read Protect Set, VA denotes the protect set address (xx77EH).
In Write Protect Set, VA denotes the protect set address (xx77EH).
91FW27-64
2007-11-02
TMP91FW27
Product ID Entry
Start
xxxAAAH/AAH
xxx554H/55H
xxxAAAH/90H
Wait for 300 nsec or longer
(ID access and exit time = max. 300 nsec)
[Product ID mode start]
Product ID read
(See the table below)
Read Values in Product ID Mode
Vendor ID
Flash macro ID
Flash size ID
Read/Write
Protect status
Address
xxxx00H
xxxx02H
xxxx04H
xxx77EH
Read Value
98H
42H
1FH
Data programmed when protection is set.
When protection is not set, FFH.
Product ID Exit
Start
Start
xxxAAAH/AAH
xxxxxxH/F0H
xxx554H/55H
Wait for 300 nsec or longer
(ID access and exit time = max. 300 nsec)
xxxAAAH/F0H
Product ID mode end
Wait for 300fnsec or longer
(ID access and exit time = max.300 nsec)
Product ID mode end
91FW27-65
2007-11-02
TMP91FW27
(Example: Program to be loaded and executed in RAM)
Erase the flash memory (chip erase) and then write 0706H to address FE0000H.
;#### Flash memory chip erase processing ####
ld
XIX, 0xFE0000
CHIPERASE:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0x80
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0x10
cal
TOGGLECHK
CHIPERASE_LOOP:
ld
WA, (XIX+)
cp
WA, 0xFFFF
j
ne, CHIPERASE_ERR
cp
XIX, 0xFFFFFF
j
ULT, CHIPERASE_LOOP
;#### Flash memory program processing ####
ld
XIX, 0xFE0000
ld
WA, 0x0706
PROGRAM:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0xA0
ld
(XIX), WA
cal
TOGGLECHK
ld
cp
j
ld
cp
j
BC, (XIX)
WA, BC.
ne, PROGRAM_ERR
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
PROGRAM_END:
j
PROGRAM_END
;#### Toggle bit (D6) check processing ####
TOGGLECHK:
ld
L, (XIX)
and
L, 0y01000000
ld
H, L
TOGGLECHK1:
ld
L, (XIX)
and
L, 0y01000000
cp
L, H
j
z, TOGGLECHK2
ld
H, L
j
TOGGLECHK1
TOGGLECHK2:
ret
; set start address
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; 5th bus write cycle
; 6th bus write cycle
; check toggle bit
; read data from flash memory
; blank data?
; if not blank data, jump to error processing
; end address (0xFFFFFF)?
; check entire memory area and then end loop processing
; set program address
; set program data
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; check toggle bit
; read data from flash memory
; if programmed data cannot be read, error is determined
; read data from flash memory
; if programmed data cannot be read, error is determined
; program operation end
; check toggle bit (D6)
; save first toggle bit data
; check toggle bit (D6)
; toggle bit = toggled?
; if not toggled, end processing
; save current toggle bit state
; recheck toggle bit
;#### Error processing ####
CHIPERASE_ERR:
j
CHIPERASE_ERR
; chip erase error
PROGRAM_ERR:
j
PROGRAM_ERR
; program error
91FW27-66
2007-11-02
TMP91FW27
(Example: Program to be loaded and executed in RAM)
Erase data at addresses FF0000H to FF0FFFH (sector erase) and then write 0706H to address FF0000H.
;#### Flash memory sector erase processing ####
ld
XIX, 0xFF0000
SECTORERASE:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0x80
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(XIX), 0x30
cal
TOGGLECHK
SECTORERASE_LOOP:
ld
WA, (XIX+)
cp
WA, 0xFFFF
j
ne, SECTORERASE_ERR
cp
XIX, 0xFF0FFF
j
ULT, SECTORERASE_LOOP
;#### Flash memory program processing ####
ld
XIX, 0xFF0000
ld
WA, 0x0706
PROGRAM:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0xA0
ld
(XIX), WA
; set start address
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; 5th bus write cycle
; 6th bus write cycle
; check toggle bit
; read data from flash memory
; blank data?
; if not blank data, jump to error processing
; end address (0xFF0FFF)?
; check erased sector area and then end loop processing
; set program address
; set program data
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
cal
TOGGLECHK
; check toggle bit
ld
cp
j
ld
cp
j
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
; read data from flash memory
PROGRAM_END:
j
PROGRAM_END
;#### Toggle bit (D6) check processing ####
TOGGLECHK:
ld
L, (XIX)
and
L, 0y01000000
ld
H, L
TOGGLECHK1:
ld
L, (XIX)
and
L, 0y01000000
cp
L, H
j
z, TOGGLECHK2
ld
H, L
j
TOGGLECHK1
TOGGLECHK2:
ret
; if programmed data cannot be read, error is determined
; read data from flash memory
; if programmed data cannot be read, error is determined
; program operation end
; check toggle bit (D6)
; save first toggle bit data
; check toggle bit (D6)
; toggle bit = toggled?
; If not toggled, end processing
; save current toggle bit state
; Recheck toggle bit
;#### Error processing ####
SECTORERASE_ERR:
j
SECTORERASE_ERR
; sector erase error
PROGRAM_ERR:
j
PROGRAM_ERR
; program error
91FW27-67
2007-11-02
TMP91FW27
(Example: Program to be loaded and executed in RAM)
Set read protection and write protection on the flash memory.
;#### Flash Memory Protect Set processing ####
ld
XIX, 0xFE077E
PROTECT:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0xA5
ld
(XIX), 0x00
cal
cal
ld
cal
cp
j
TOGGLECHK
PID_ENTRY
A, (XIX)
PID_EXIT
A, 0x00
ne, PROTECT_ERR
; set protect address
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; check toggle bit
;
; read protected address
;
;(0xFE077E)=0x00?
; protected?
PROTECT_END:
j
PROTECT_END
; protect set operation completed
PROTECT_ERR:
j
PROTECT_ERR
; protect set error
;#### Product ID Entry processing ####
PID_ENTRY:
ld
(0xFE0AAA), 0xAA
; 1st bus write cycle
ld
(0xFE0554), 0x55
; 2nd bus write cycle
ld
(0xFE0AAA), 0x90
; 3rd bus write cycle
; --- wait for 300 nsec or longer (execute NOP instruction [148nsec/@fFPH=27MHz] three times) --nop
nop
nop
; wait for 444 nsec
ret
;#### Product ID Exit processing ####
PID_EXIT:
ld
(0xFE0000), 0xF0
; 1st bus write cycle
; --- wait for 300 nsec or longer (execute NOP instruction [148nsec/@fFPH=27MHz] three times) --nop
nop
nop
; wait for 444 nsec
ret
;#### Toggle bit (D6) check processing ####
TOGGLECHK:
ld
L, (XIX)
and
L, 0y01000000
ld
H, L
TOGGLECHK1:
ld
L, (XIX)
and
L, 0y01000000
cp
L, H
j
z, TOGGLECHK2
ld
H, L
j
TOGGLECHK1
TOGGLECHK2:
ret
; check toggle bit (D6)
; save first toggle bit data
; check toggle bit (D6)
; toggle bit = toggled?
; if not toggled, end processing
; save current toggle bit state
; recheck toggle bit
(Example: Program to be loaded and executed in RAM)
Read data from address FE0000H.
;#### Flash memory read processing ####
READ:
ld
WA, (0xFE0000)
; read data from flash memory
91FW27-68
2007-11-02
TMP91FW27
4.
4.1
Electrical Characteristics
Absolute Maximum Ratings
Parameter
Symbol
Rating
Power supply voltage
Vcc
−0.5 to 4.0
Input voltage
VIN
−0.5 to Vcc + 0.5
Output current (1 pin)
IOL
2
Output current (1 pin)
IOH
−2
Output current (Total)
ΣIOL
80
Output current (Total)
ΣIOH
−80
Power dissipation (Ta = 85°C)
PD
600
Soldering temperature (10 s)
TSOLDER
260
Storage temperature
TSTG
−65 to 150
Operation temperature
TOPR
−40 to 85
Number of Times Program
Erase
NEW
Unit
V
mA
mW
°C
100
Cycle
Note: The absolute maximum ratings are rated values that must not be exceeded
during operation, even for an instant. Any one of the ratings must not be
exceeded. If any absolute maximum rating is exceeded, a device may break
down or its performance may be degraded, causing it to catch fire or explode
resulting in injury to the user. Thus, when designing products that include
this device, ensure that no absolute maximum rating value will ever be
exceeded.
Solderability of lead free products
Test
parameter
Solderability
Test condition
Note
Use of Sn−37Pb solder Bath
Pass:
Solder bath temperature =230°C, Dipping time = 5 seconds
solderability rate until forming ≥ 95%
The number of times = one, Use of R-type flux
Use of Sn−3.0Ag−0.5Cu solder bath
Solder bath temperature = 245°C, Dipping time = 5 seconds
The number of times = one, Use of R-type flux (use of lead free)
91FW27-69
2007-11-02
TMP91FW27
4.2
DC Characteristics (1/2)
Parameter
Power supply voltage
AVCC = DVCC
AVSS = DVSS = 0 V
Power supply voltage
AVCC = DVCC
AVSS = DVSS = 0 V
Symbol
VCC
VCC
for erase/program
Condition
fc = 4 to 27 MHz
fc = 2 to 16 MHz
Min
fs = 30 to
34 kHz
fc = 4 to 27 MHz
Typ.(Note)
Unit
3.6
V
3.6
V
2.7
2.2
2.7
Ta = −10∼40°C
Max
operations of flash memory
P00 to P17
Input low voltage
(AD0 to AD15)
P20 to P97 (Except P63)
RESET , NMI
P63 (INT0)
VIL1
VIL2
AM0 and AM1
VIL3
X1
VIL4
P00 to P17
(AD0 to AD15)
Input high voltage
VIL
P20 to P97 (Except P63)
RESET , NMI ,
P63 (INT0)
VIH
VIH1
VIH2
AM0 and AM1
VIH3
X1
VIH4
Output low voltage
VOL
Output high voltage
VOH
Vcc ≥ 2.7 V
0.6
Vcc < 2.7 V
Vcc ≥ 2.7 V
0.2 Vcc
0.3 Vcc
Vcc < 2.7 V
0.2 Vcc
Vcc ≥ 2.7 V
0.25 Vcc
−0.3
Vcc < 2.7 V
0.15 Vcc
Vcc ≥ 2.7 V
0.3
Vcc < 2.7 V
0.3
Vcc ≥ 2.7 V
0.2 Vcc
Vcc < 2.7 V
0.1 Vcc
Vcc ≥ 2.7 V
2.0
Vcc < 2.7 V
0.7 Vcc
Vcc ≥ 2.7 V
0.7 Vcc
Vcc < 2.7 V
0.8 Vcc
Vcc ≥ 2.7 V
0.75 Vcc
Vcc < 2.7 V
0.85 Vcc
Vcc ≥ 2.7 V
Vcc − 0.3
Vcc < 2.7 V
Vcc − 0.3
Vcc ≥ 2.7 V
0.8 Vcc
Vcc < 2.7 V
0.9 Vcc
IOL = 1.6mA
V
Vcc + 0.3
Vcc ≥ 2.7 V
0.45
0.15 Vcc
IOL = 0.4mA
Vcc < 2.7 V
IOH = −400 μA
Vcc ≥ 2.7 V
Vcc − 0.3
IOH = −200 μA
Vcc < 2.7 V
0.8 Vcc
V
V
Note: Typical values are for when Ta = 25°C and VCC = 3.0 V uncles otherwise noted.
91FW27-70
2007-11-02
TMP91FW27
DC Characteristics (2/2)
Parameter
Symbol
Condition
Min
Typ.
(Note1)
Max
Input leakage current
ILI
0.0 ≤ VIN ≤ Vcc
0.02
±5
Output leakage current
ILO
0.2 ≤ VIN ≤ Vcc − 0.2
0.05
±10
Power down voltage
RRST
RESET pull-up resistor
Pin capacitance
VTH
RESET , NMI , INT0
Programmable pull-up resistor
V IH2 = 0.8 Vcc
2.2
3.6
Vcc = 2.7 V to 3.6 V
100
400
Vcc = 2.2 V
200
1000
fc = 1 MHz
CIO
Schmitt width
NORMAL
V IL2 = 0.2 Vcc,
VSTOP
(@STOP, RAM back up)
RKH
(Note 2)
IDLE2
10
1.0
Vcc < 2.7 V
0.3
0.8
Vcc = 2.7 V to 3.6 V
100
400
Vcc = 2.2 V
200
1000
IDLE1
NORMAL
(Note 2)
IDLE1
SLOW
(Note 2)
Iccp-p
9
3.4
4.5
1.5
2.9
20
55
20
44
10
40
Vcc = 2.2 V to 3.6 V
1
25
Vcc = 2.2V to 3.6V
20
fs = 32.768 kHz
Peak current by intermitt
operation
7
8
IDLE1
STOP
20
4.8
Vcc = 2.2 V to 3.6 V
IDLE2
13
3.0
fc = 16 MHz
Icc
V
5.5
Vcc = 2.2 V (Typ. = 2.2V)
IDLE2
kΩ
PF
0.4
fc = 27 MHz
μA
V
Vcc ≥ 2.7 V
Vcc = 2.7 V to 3.6 V
Unit
kΩ
mA
mA
μA
μA
mA
Note 1: Typical values are for when Ta = 25°C and VCC = 3.0 V unless otherwise noted.
Note 2: Icc measurement conditions (NORMAL, SLOW):
All functions are operational; output pins are open and input pins are fixed.
When the program is operating by the flash memory, or when data reed from the flash memory, the flash
memory operate intermittently. Therefore, it outputs a peak current like a following diagram, momentarily. In
this case, the power supply current; Icc (NORMAL/SLOW mode) is the sum of average value of a peak
current and a MCU current value.
When designing the power supply, set to a circuit which a peak current can be supplyed. In SLOW mode, a
defference of peak current and average current is large.
Program counter (PC)
n
n+2
n+4
Flash current which flows momentarily.
Max. current
Iccp-p
[mA]
Typ. current
The average of Peak current
+ MCU current
MCU current
Flash memory intermittent operation
91FW27-71
2007-11-02
TMP91FW27
4.3
AC Characteristics
(1) Vcc = 2.7 V to 3.6 V
No.
Parameter
Variable
Symbol
fFPH = 27 MHz
Min
Max
Min
31250
37.0
Unit
Max
1
fFPH period ( = x)
tFPH
37.0
2
A0 to A15 valid → ALE falling
tAL
0.5x − 6
12
ns
3
ALE falling → A0 to A15 hold
tLA
0.5x − 16
2
ns
4
ALE high pulse width
tLL
x − 20
17
ns
5
ALE falling → RD / WR falling
tLC
0.5x − 14
4
ns
6
RD rising → ALE rising
tCLR
0.5x − 10
8
ns
7
WR rising → ALE rising
tCLW
x − 10
27
ns
8
A0 to A15 vlalid → RD / WR falling
tACL
x − 23
14
ns
9
A0 to A21 valid → RD / WR falling
tACH
1.5x − 26
29
ns
10
RD rising → A0 to A21 hold
tCAR
0.5x − 13
5
ns
11
WR rising → A0 to A21 hold
tCAW
x − 13
12
A0 to A15 valid → D0 to D15 input
tADL
3.0x − 38
73
ns
13
A0 to A21 valid → D0 to D15 input
tADH
3.5x − 41
88
ns
14
RD falling → D0 to D15 input
tRD
2.0x − 30
44
ns
15
RD low puse width
tRR
2.0x − 15
59
ns
16
RD rising → D0 to D15 hold
tHR
0
0
ns
17
RD rising → A0 to A15 output
tRAE
x − 15
22
ns
18
WR low pulse width
tWW
1.5x − 15
40
ns
19
D0 to D15 valid → WR rising
tDW
1.5x − 35
20
ns
20
WR rising → D0 to D15 hold
tWD
x − 25
12
ns
21
A0 to A21 valid → Port input
tAPH
22
A0 to A21 valid → Port hold
tAPH2
23
A0 to A21 valid → Port valid
tAP
Ns
24
3.5x − 89
3.5x
ns
40
ns
209
ns
129
3.5x + 80
ns
AC measurement conditions
・Output level: High 0.7 × Vcc/Low 0.3 × VCC, CL = 50 pF
・Input level: High 0.9 × Vcc/Low 0.1 × VCC
Note: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock
fSYS for CPU core.
The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator
frequency.
91FW27-72
2007-11-02
TMP91FW27
(2) Vcc = 2.2 V to 3.6 V
No.
Parameter
Variable
Symbol
fFPH = 16 MHz
Unit
Min
Max
Min
62.5
31250
62.5
ns
13
ns
1
fFPH period ( = x)
tFPH
2
A0 to A15 valid → ALE falling
tAL
0.5x − 18
Max
3
ALE falling → A0 to A15 hold
tLA
0.5x − 25
6
ns
4
ALE high pulse width
tLL
x − 30
32
ns
5
ALE falling → RD / WR falling
tLC
0.5x − 25
6
ns
6
RD rising → ALE rising
tCLR
0.5x − 15
16
ns
7
WR rising → ALE rising
tCLW
x − 15
47
ns
8
A0 to A15 vlalid → RD / WR falling
tACL
x − 30
32
ns
9
ns
A0 to A21 valid → RD / WR falling
tACH
1.5x − 30
63
10
RD rising → A0 to A21 hold
tCAR
0.5x − 21
10
ns
11
WR rising → A0 to A21 hold
tCAW
x − 25
37
ns
12
A0 to A15 valid → D0 to D15 input
tADL
3.0x − 50
137
ns
13
A0 to A21 valid → D0 to D15 input
tADH
3.5x − 56
162
ns
14
RD falling → D0 to D15 input
tRD
75
ns
15
RD low puse width
tRR
2.0x − 28
97
ns
16
RD rising → D0 to D15 hold
tHR
0
0
ns
17
RD rising → A0 to A15 output
tRAE
x − 25
37
ns
18
WR low pulse width
tWW
1.5x − 29
64
ns
19
D0 to D15 valid → WR rising
tDW
1.5x − 60
33
ns
20
WR rising → D0 to D15 hold
tWD
x − 40
22
ns
21
A0 to A21 valid → Port input
tAPH
22
A0 to A21 valid → Port hold
tAPH2
23
A0 to A21 valid → Port valid
tAP
2.0x − 50
3.5x − 100
3.5x
68
ns
368
ns
218
3.5x + 150
ns
AC measurement conditions
・Output level: High 0.7 × Vcc/Low 0.3 × VCC, CL = 50 pF
・Input level: High 0.9 × Vcc/Low 0.1 × VCC
Note: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock
fSYS for CPU core.
The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator
frequency.
91FW27-73
2007-11-02
TMP91FW27
(3) Read cycle
tFPH
fFPH
A0 to A21
CS0 to CS2
tAPH
tAPH2
Port input
(Note)
tADH
RD
tCAR
tRR
tAC
tRAE
tACL
tRD
tADL
tLC
A0 to A15
AD0 to AD15
tAL
ALE
tHR
D0 to D15
tLA
tCLR
tLL
Note: Since the CPU accesses the internal area to read data from a port, the control signals of external
pins such as RD and CS are not enabled. Therefore, the above waveform diagram should be
regarded as depicting internal operation. Please also note that the timing and AC characteristics of
port input/output shown above are typical representation. For details, contact your local Toshiba
sales representative.
91FW27-74
2007-11-02
TMP91FW27
(4) Write cycle
fFPH
A0 to A21
CS0 to CS2
tAP
Port output
(Note)
tCAW
tWW
WR , HWR
tDW
AD0 to AD15
A0 to A15
tWD
D0 to D15
tCLW
ALE
Note: Since the CPU accesses the internal area to write data to a port, the control signals of external pins
such as WR and CS are not enabled. Therefore, the above waveform diagram should be regarded
as depicting internal operation. Please also note that the timing and AC characteristics of port
input/output shown above are typical representation. For details, contact your local Toshiba sales
representative.
91FW27-75
2007-11-02
TMP91FW27
4.4
AD Conversion Characteristics
AVCC = VCC, AVSS = VSS
Parameter
Analog input voltage
Error
(Not including quantization
errors)
Symbol
Condition
VAIN
−
Min
Typ.
AVSS
VCC = 2.2 V to 3.6 V
±1.0
Max
Unit
AVCC
V
±4.0
LSB
Note 1: 1 LSB = (AVCC − AVSS)/1024 [V]
Note 2: Minimum operation frequency:
The operaion of AD converter is guranteed only using fc (High frequency oscillator).
fs (Low frequency oscillator) is not guranteed. But When frequency of clock selected by clock gear
is more than and eqaull 4 MHz in using fc, it is guranteed (fFPH ≥ 4 MHz).
Note 3: The value for Icc (Current of VCC pin) includes the current which flows through the AVCC pin.
91FW27-76
2007-11-02
TMP91FW27
4.5
Serial Channel Timing (I/O interface mode)
(1) SCLK input mode
Parameter
Symbol
SCLK period
tSCY
Variable
Min
10 MHz
Max
16X
→ Output data hold
SCLK rising /falling
→ Input data hold
SCLK rising/falling
290
38
(VCC = 2.2 V)
220
−
tOHS
tSCY/2 + 2X + 0
1000
370
ns
tHSR
3X + 10
310
121
ns
→ Valid data input
tSRD
→ SCLK rising/falling
tRDS
Valid data input
μs
0.59
tOSS
SCLK rising/falling
Unit
Min Max Min Max
1.6
tSCY/2 − 4X − 110
Output data → SCLK rising/falling
27 MHz
(VCC = 2.7 V to 3.6 V)
ns
tSCY/2 − 4X − 180
tSCY − 0
0
1600
592
0
0
10 MHz
27 MHz
ns
ns
(2) SCLK ouptut mode
Parameter
SCLK period
Output data
→ SCLK rising/falling
SCLK rising/falling
→ Output data hold
SCLK rising/falling
→ Input data hold
SCLK rising/falling
→ Valid data input
Valid data input
→ SCLK rising/falling
Symbol
Variable
Unit
Min
Max
tSCY
16X
8192X
tOSS
tSCY/2 − 40
760
256
ns
tOHS
tSCY/2 − 40
760
256
ns
tHSR
0
0
0
ns
1.6
tSCY − 1X − 180
tSRD
tRDS
Min Max Min Max
1X + 180
819
0.59
1320
280
μs
303
375
ns
217
ns
Note 1: SCLK rising/falling: The rising edge is used in SCLK rising mode.
The falling edge is used in SCLK falling mode.
Note 2: 27 MHz and 10 MHz values are calculated from tSCY = 16X case.
Note 3: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock
fSYS for CPU core.
The period of clock fFPH depends on the clock gear setting or the selection of high/low
oscillator frequency.
tSCY
SCLK
Output mode/
input rising mode
SCLK
(Input falling mode)
tOHS
tOSS
Output data
TXD
0
Input data
RXD
0
1
tSRD
Valid
91FW27-77
tRDS
1
Valid
2
3
2
3
Valid
Valid
tHSR
2007-11-02
TMP91FW27
4.6
Event Counter (TA0IN, TA4IN, TB0IN0 and TB0IN1)
Parameter
Clock period
4.7
Variable
Symbol
Min
tVCK
10 MHz
Max
27 MHz
Max
Unit
Min Max
Min
8X + 100
900
396
ns
Clock low level pulse width
tVCKL
4X + 40
440
188
ns
Clock high level pulse width
tVCKH
4X + 40
440
188
ns
Interrupt and Capture
(1) NMI and INT0 Interrupts
Parameter
Variable
Symbol
Min
10 MHz
Max
27 MHz
Min Max
Min
Unit
Max
NMI and INT0 low level pulse width
tINTAL
4X + 40
440
188
ns
NMI and INT0 high level pulse width
tINTAH
4X + 40
440
188
ns
(2) INT5 and INT6 interrupts, capture
INT5 and INT6 input pulse width depend on the system clock selection and clock
selection for prescaler. Below table show pulse width of each operation clock.
System
Clock
Selection
SYSCR1
<SYSCK>
Clock
Selection for
Prescaler
SYSCR0
<PRCK1:0>
0 (fc)
1 (fs)
tINTBL
tINTBH
(INT5 and INT6 low level pulse width)
(INT5 and INT6 high level pulse width )
Valiable
fFPH = 27MHz
Valiable
fFPH = 27MHz
Min
Min
Min
Min
Unit
00 (fFPH)
8X + 100
396
8X + 100
396
ns
10 (fc/16)
128Xc + 0.1
4.8
128Xc + 0.1
4.8
00 (fFPH)
8X + 0.1
244.3
8X + 0.1
244.3
μs
Note 1: “Xc” shows period of clock fc in high frequency oscillator.
Note 2: Symbol [x] in the above table means the period of clock fFPH. It’s half period the system clock fSYS
for CPU core.
The period of clock fFPH depends on the clock gear setting or the selection of high/low oscillator
frequency.
4.8
Flash Characteristics
(1) Rewriting
Parameter
Guarantee on Flash-memory
rewriting
Condition
Min
Typ
Max
Unit
−
−
100
Times
Vcc = 2.7V to 3.6V,
fc = 4 to 27 MHz
Ta = −10 to 40 ºC
91FW27-78
2007-11-02
TMP91FW27
5.
Port Section Equivalent Circuit Diagrams
• Reading the circuit diagrams
Basically, the gate symbols written are the same as those used for the standard CMOS logic IC
[74HCXX] series.
The dedicated signal is described below.
STOP : This signal becomes active 1 when the HALT mode setting register is set to the
STOP mode (SYSCR2<HALTM1:0> = “01”) and the CPU executes the HALT instruction.
When the drive enable bit SYSCR2<DRVE> is set to “1”, however STOP remains at “0”.
• The input protection resistance ranges from several tens of ohms to several hundreds of ohms.
■
P0 (AD0~AD7), P1 (AD8~AD15, A8~A15), P2 (A16~A21, A0~A5), P60, P70~P74, P80~P83,
P91~P92, P94~P95
VCC
Output data
P-ch
Output enable
STOP
N-ch
I/O
Input data
Input enable
■
P30 ( RD ), P31 ( WR )
Vcc
Output data
P-ch
Output
STOP
N-ch
91FW27-79
2007-11-02
TMP91FW27
■ P32, P40~P42
Vcc
Output data
Vcc
Programmable
pull-up resistor
Output enable
STOP
I/O
Input data
Input enable
■ P5 (AN0~AN3)
Analog input
channel select
Analog input
Input
Input data
Input enable
■ P63 (INT0)
Vcc
Output data
P-ch
Output enable
STOP
N-ch
I/O
Input data
Schmitt
91FW27-80
2007-11-02
TMP91FW27
■ P61 (SO/SDA), P62 (SI/SCL), P90 (TXD0), P93 (TXD1)
Vcc
Output data
P-ch
Open-drain
Output enable
N-ch
Output enable
STOP
I/O
Input enable
Input enable
■ P96 (XT1), P97 (XT2)
Input enable
Clock
Oscillator
Input enable
P97 (XT2)
Ouput data
Output enable
N-ch
Input enable
Input enable
P96 (XT1)
Ouput data
Output enable
N-ch
STOP
Low-frequency
oscillation enable
■ NMI
NMI
Input
Schmitt
91FW27-81
2007-11-02
TMP91FW27
■ AM0~AM1
Input
■ ALE
Vcc
Internal ALE
P-ch
Output
N-ch
Output enable
■ RESET
Vcc
P-ch
Input
Reset
Schmitt
WDTOUT
Reset enable
■ X1, X2
Oscillator
X2
High-frequen
cy oscillation
STOP
P-ch
N-ch
X1
Clock
91FW27-82
2007-11-02
TMP91FW27
■ VREFH, VREFL
VREFON
P-ch
AVCC
String resistance
AVSS
91FW27-83
2007-11-02
TMP91FW27
Package Dimensions
LQFP64-P-1010-0.50D
Unit: mm
1.25 typ
10.0 0.2
48
33
49
32
64
17
0.6 0.15
91FW27-84
1.6max
0.25
(0~10 )
0.145 0.055
0.08
1.4 0.05
16
0.1 0.05
1
12.0 0.2
10.0 0.2
0.5
0.08 M
12.0 0.2
0.22 0.05
6.
2007-11-02
TMP91FW27
QFP64-P-1414-0.80A
Unit: mm
91FW27-85
2007-11-02