TOSHIBA TMP91FW40FG

TOSHIBA Original CMOS 16-Bit Microcontroller
TLCS-900/L1 Series
TMP91FW40FG
Semiconductor Company
Preface
Thank you very much for making use of Toshiba microcomputer LSIs.
Before use this LSI, refer the section, “Points of Note and Restrictions”.
Especially, take care below cautions.
TMP91FW40
Low Voltage/Low Power Consumption
CMOS 16-Bit Microcontroller
TMP91FW40FG
1.
Outline and Features
The TMP91FW40 is a high-speed, high-performance 16-bit microcontroller capable of
low-voltage, low-power-consumption operation.
This microcontroller comes in a 100-pin flat package and has the following features:
(1) Toshiba proprietary 16-bit CPU (900/L1 CPU)
•
Instruction mnemonics are upwardly compatible with the TLCS-90 and TLCS-900.
•
16-Mbyte linear address space
•
Architecture based on general-purpose registers and register banks
•
16-bit multiply/divide instructions and bit transfer/arithmetic instructions
•
Micro DMA: 4 channels (593 ns/2 bytes at 27 MHz)
(2) Minimum instruction execution time: 148 ns (at 27 MHz)
RESTRICTIONS ON PRODUCT USE
20070701-EN GENERAL
• The information contained herein is subject to change without notice.
• TOSHIBA is continually working to improve the quality and reliability of its products. Nevertheless, semiconductor
devices in general can malfunction or fail due to their inherent electrical sensitivity and vulnerability to physical
stress. It is the responsibility of the buyer, when utilizing TOSHIBA products, to comply with the standards of safety
in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such
TOSHIBA products could cause loss of human life, bodily injury or damage to property.
In developing your designs, please ensure that TOSHIBA products are used within specified operating ranges as
set forth in the most recent TOSHIBA products specifications. Also, please keep in mind the precautions and
conditions set forth in the “Handling Guide for Semiconductor Devices,” or “TOSHIBA Semiconductor Reliability
Handbook” etc.
• The TOSHIBA products listed in this document are intended for usage in general electronics applications (computer,
personal equipment, office equipment, measuring equipment, industrial robotics, domestic appliances, etc.).These
TOSHIBA products are neither intended nor warranted for usage in equipment that requires extraordinarily high
quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury
(“Unintended Usage”). Unintended Usage include atomic energy control instruments, airplane or spaceship
instruments, transportation instruments, traffic signal instruments, combustion control instruments, medical
instruments, all types of safety devices, etc.. Unintended Usage of TOSHIBA products listed in his document shall
be made at the customer’s own risk.
• The products described in this document shall not be used or embedded to any downstream products of which
manufacture, use and/or sale are prohibited under any applicable laws and regulations.
• The information contained herein is presented only as a guide for the applications of our products. No responsibility
is assumed by TOSHIBA for any infringements of patents or other rights of the third parties which may result from its
use. No license is granted by implication or otherwise under any patents or other rights of TOSHIBA or the third
parties.
• Please contact your sales representative for product-by-product details in this document regarding RoHS
compatibility. Please use these products in this document in compliance with all applicable laws and regulations that
regulate the inclusion or use of controlled substances. Toshiba assumes no liability for damage or losses occurring
as a result of noncompliance with applicable laws and regulations.
This product uses the Super Flash® technology under the license of Silicon Storage Technology,Inc.
Super Flash® is a registered trademark of Silicon Storage Technology,Inc.
91FW40-1
2008-10-22
TMP91FW40
(3) Internal RAM: 4 Kbytes
(4) Internal ROM: 128 Kbytes Flash memory
4 Kbytes mask ROM (used for booting)
(5) 8-bit timer: 4 channels
(6) 16-bit timer: 3 channels
(7) Divider output
(8) General-purpose serial interface: 4 channels
•
Both UART and synchronous transfer modes are supported.
(9) 10-bit AD converter (with sample-and-hold): 4 channels
(10) Watchdog timer
(11) Key-on wakeup: 4 channels
(12) Real-time clock (RTC)
•
Based on the TC8521A specifications
(13) Melody/Alarm generator (MLD)
(14) Program patch logic: 6 banks
(15) LCD driver/controller (voltage reducer type, reference voltage = VCC)
•
LCD direct drive possible (8 to 40 segments x 4 commons)
•
1/4 duty, 1/3 duty, 1/2 duty or static drive selectable
(16) Interrupts: 43 sources
•
9 CPU interrupts: Triggered by a software interrupt instruction or undefined instruction
•
27 internal interrupts: 7 priority levels
•
7 external interrupts: 7 priority levels
(Two interrupts support selection of triggering edge.)
(17) Input/output ports: 61 pins
(18) Standby function
Three HALT modes (programmable IDLE2, IDLE1, STOP)
(19) Clock control function
•
Low-frequency clock (fs = 32.768 kHz)
(20) Operating voltage range
•
Vcc = 2.7 to 3.6 V (fc max = 27 MHz at flash memory read)
•
Vcc = 2.2 to 3.6 V (fc max = 16 MHz at flash memory read)
•
Vcc = 2.7 to 3.6 V (fc max = 27 MHz at flash memory erase and program)
(21) Package: LQFP100-P-1414-0.50F
91FW40-2
2008-10-22
TMP91FW40
Input/output ports (Segment outputs)
SEG7
to
SEG0
Common outputs
COM3 to COM0
Power supply
pins
P27 (SEG15) P17 (SEG23)
to
to
P20 (SEG8) P10 (SEG16)
DVDD
DVSS
P2
LCD driver (Automatic display)
LCD driver
power supply
Reset pin
Test pins
C0
C1
V1
V2
V3
RESET
AM1, AM0
EMU1, EMU0
TLCS-900/L1
CPU
P0
PB
RAM
4 KB
ROM
128 KB
RTC
MLD
System controller
Interrupt controller
NMI
Low-frequency
oscillator
connecting pins
P1
Address/data bus
LCD power
supply circuit
Standby controller
High-frequency
oscillator
connecting pins
P07 (SEG31) PB7 (SEG39)
to
to
P00 (SEG24) PB0 (SEG32)
X1
X2
Highfrequency
XT1
XT2
Lowfrequency
Watchdog
timer
Clock
generator
16-bit
timer/counter
8-bit
timer/counter
Asynchronous/
synchronous serial
interface
TC1 TC2 TC3 TC5 TC6 TC7 TC8 SIO0 SIO1 SIO2 SIO3
Address/data bus
P6
10-bit AD
converter
P60(INT0)
P61(INT1)
P62( ALARM
P5
AVCC,AVSS P50(AN0/KWI0)
VREFH,VREFL P51(AN1/KWI1)
P52(AN2/KWI2)
P53(AN3/ ADTRG
/KWI3)
Input ports
AD converter power supply
Analog reference power supply
/ BOOT )
P7
P70(ECNT1)
P71(ECNT2)
P72(ECNT3/ DVO
/ MLDALM )
P73(ECIN1)
P74(ECIN2)
P75(ECIN3)
P8
P9
PA
P80(TC5OUT) P90(TXD0) PA0(TXD2)
P81(TC6OUT) P91(RXD0) PA1(RXD2)
P82(TC7OUT) P92(SCLK0/ PA2(SCLK2/
P83(TC8OUT)
CTS0 )
CTS2 )
P93(TXD1) PA3(TXD3)
P94(RXD1) PA4(RXD3)
P95(SCLK1/ PA5(SCLK3/
CTS1
)
CTS3
)
Input/output ports
Figure 1.1 TMP91FW40 Block Diagram
91FW40-3
2008-10-22
TMP91FW40
2.
Pin Assignments and Pin Functions
2.1
Pin Assignments
COM2
COM3
SEG0
SEG1
SEG2
SEG3
SEG4
SEG5
80
75
85
COM0
COM1
C1
C0
V3
V2
V1
P51/AN1/KWI1
P50/AN0/KWI0
VREFL
VREFH
P80/TC5OUT
AVCC
AVSS
P53/AN3/ADTRG/KWI3
P52/AN2/KWI2
90
1
95
P82/TC7OUT
P83/T C8OUT
100
P81/TC6OUT
Figure 2.1.1 shows the pin assignments of the TMP91FW40.
DVSS
DVCC
BOOT /P62/ ALARM
DVSS
P20/SEG8
5
70
P90/TXD0
P91/RXD0
P92/SCLK0/ CTS0
P93/TXD1
P94/RXD1
10
TMP91FW40FG
PA1/RXD2
PA2/SCLK2/ CTS2
65
P27/SEG15
Top View
P10/SEG16
P11/SEG17
P12/SEG18
15
60
PA5/SCLK3/ CTS3
NMI
20
50
P13/SEG19
P14/SEG20
P15/SEG21
P16/SEG22
P17/SEG23
P00/SEG24
P01/SEG25
P02/SEG26
P03/SEG27
P04/SEG28
P05/SEG29
PB3/SEG35
PB2/SEG34
PB1/SEG33
PB0/SEG32
DVSS
DVCC
P07/SEG31
P06/SEG30
PB4/SEG36
45
40
PB6/SEG38
PB5/SEG37
P74/ECNI2
P75/ECIN3
PB7/SEG39
35
EMU1
P73/ECIN1
XT2
EMU0
XT1
AM1
X2
25
RESET
30
55
DVSS
X1
P72/ECNT3/ DVO / MLDALM
AM0
DVCC
P25/SEG13
P26/SEG14
LQFP100
PA4/RXD3
P60/INT0
P61/INT1
P70/ECNT1
P71/ECNT2
P21/SEG9
P22/SEG10
P23/SEG11
P24/SEG12
P95/SCLK1/ CTS1
PA0/TXD2
PA3/TXD3
SEG6
SEG7
DVCC
Figure 2.1.1 TMP91FW40 Pin Assignments (100-pin LQFP, top view)
91FW40-4
2008-10-22
TMP91FW40
2.2
Pin Names and Functions
Table 2.2.1 to Table 2.2.2 list the names and functions of the input and output pins of the
TMP91FW40.
Table 2.2.1 Pin Names and Functions (1/2)
Pin Name
P50 to P53
Number
of Pins
Function
Input
Port 5: Input port
AN0 to AN3
Input
Analog input: Input to the AD converter
ADTRG
Input
AD trigger: External start request pin for the AD converter (multiplexed with P53)
KWI0 to KWI3
Input
Key-on wakeup input (multiplexed with P50 to P53)
Input
Port 60: Input port
Input
Interrupt request pin 0: Programmable as high-level, low-level, rising-edge or falling-edge sensitive
P60
4
I/O
1
INT0
P61
1
INT1
I/O
Input
P62
ALARM
BOOT
1
P70
1
I/O
Output
Input
Port 61: Input/output port
Interrupt request pin 1: Programmable as high-level, low-level, rising-edge or falling-edge sensitive
Port 62: Input/output port
RTC alarm output pin
Boot mode control pin for flash memory (specifically designed for 91FW40; to be pulled up
during the reset period)
When released reset, Single boot mode is started at Low level.
ECNT1
P71
I/O
Input
1
ECNT2
I/O
Port 70: Input/output port
16-bit timer 1 input: Count control input for 16-bit timer TC1
Port 71: Input/output port
Input
16-bit timer 2 input: Count control input for 16-bit timer TC2
1
I/O
Input
Output
Output
Port 72: Input/output port
16-bit timer 3 input: Count control input for 16-bit timer TC3
Divider output pint
Melody/Alarm output pin
P73
ECIN1
1
I/O
Input
Port 73: Input/output port
16-bit timer 1 input: Count input for 16-bit timer TC1
P74
ECIN2
1
I/O
Input
Port 74: Input/output port
16-bit timer 2 input: Count input for 16-bit timer TC2
P75
ECIN3
1
I/O
Input
Port 75: Input/output port
16-bit timer 3 input: Count input for 16-bit timer TC3
P80
TC5OUT
1
I/O
Output
Port 80: Input/output port (large-current port)
8-bit timer 5 output: Output pin for 8-bit timer TC5
Open-drain output mode by programmable
P81
TC6OUT
1
I/O
Output
Port 81: Input/output port (large-current port)
8-bit timer 6 output: Output pin for 8-bit timer TC6
Open-drain output mode by programmable
P82
TC7OUT
1
I/O
Output
Port 82: Input/output port (large-current port)
8-bit timer 7 output: Output pin for 8-bit timer TC7
Open-drain output mode by programmable
P83
TC8OUT
1
I/O
Output
Port 83: Input/output port (large-current port)
8-bit timer 8 output: Output pin for 8-bit timer TC8
Open-drain output mode by programmable
P90
TXD0
1
I/O
Output
Port 90: Input/output port
Serial 0 transmit data
Open-drain output mode by programmable
P91
RXD0
1
I/O
Input
Port 91: Input/output port
Serial 0 receive data
P92
SCLK0
CTS0
1
I/O
I/O
Input
Port 92: Input/output port
Serial 0 clock input/output
Serial 0 data transmit enable (Clear to send)
P72
ECNT3
DVO
MLDALM
91FW40-5
2008-10-22
TMP91FW40
Table 2.2.2 Pin Names and Functions (2/2)
Pin Name
Number
of Pins
I/O
Function
P93
TXD1
1
I/O
Output
Port 93: Input/output port
Serial 1 transmit data
Open-drain output mode by programmable
P94
RXD1
1
I/O
Input
Port 94: Input/output port
Serial 1 receive data
P95
SCLK1
CTS1
1
I/O
I/O
Input
Port 95: Input/output port
Serial 1 clock input/output
Serial 1 data transmit enable (Clear to send)
PA0
TXD2
1
I/O
Output
PA1
RXD2
1
I/O
Input
Port A1: Input/output port
Serial 2 receive data
PA2
SCLK2
CTS2
1
I/O
I/O
Input
Port A2: Input/output port
Serial 2 clock input/output
Serial 2 data transmit enable (Clear to send)
PA3
TXD3
1
I/O
Output
PA4
RXD3
1
I/O
Input
Port A4: Input/output port
Serial 3 receive data
PA5
SCLK3
CTS3
1
I/O
I/O
Input
Port A5: Input/output port
Serial 3 clock input/output
Serial 3 data transmit enable (Clear to send)
SEG0 to SEG7
8
Output
Segment output
P20 to P27
SEG8 to SEG15
8
I/O
Output
Port 2: Input/output port
Segment output
P10 to P17
SEG16 to SEG23
8
I/O
Output
Port 1: Input/output port
Segment output
P00 to P07
SEG24 to SEG31
8
I/O
Output
Port 0: Input/output port
Segment output
PB0 to PB7
SEG32 to SEG39
8
I/O
Output
Port B: Input/output port
Segment output
Port A0: Input/output port
Serial 2 transmit data
Open-drain output mode by programmable
Port 3: Input/output port
Serial 3 transmit data
Open-drain output mode by programmable
C0,C1
2
LCD drive power supply
V1 to V3
3
LCD drive power supply
COM0 to COM3
4
NMI
1
Input
Common output
Nonmaskable interrupt request pin: Causes an NMI interrupt on the falling edge;
programmable to be rising-edge sensitive (Schmitt input).
AM0, AM1
2
Input
Operation mode
Both AM0 and AM1 should be held at logic 1.
EMU0
1
Output
This pin should be left open.
EMU1
1
Output
This pin should be left open.
RESET
1
Input
Reset: Initializes the TMP91FW40. (Schmitt input, with pull-up resistor)
VREFH
1
Input
Input pin for high reference voltage for the AD converter
VREFL
1
Input
AVCC
1
Power supply pin for the AD converter
AVSS
1
Ground pin for the AD converter (0 V)
X1/X2
2
I/O
XT1/XT2
2
I/O
DVCC
DVSS
4
4
Input pin for low reference voltage for the AD converter
Connection pins for a high-frequency oscillator
Connection pins for a low-frequency oscillator
Power supply pins (The DVCC pins should be connected to power supply.)
Ground pins (The DVSS pins should be connected to ground (0 V).)
91FW40-6
2008-10-22
TMP91FW40
3.
Operation
This section describes the functions and basic operation of the TMP91FW40.
For the functions of this device that are not described here, refer to the TMP91CW40 data sheet.
3.1
CPU
The TMP91FW40 contains a high-performance 16-bit CPU (900/L1 PCU). For a detailed
description of the CPU, refer to “TLCS-900/L1 CPU” in the preceding chapter.
Functions unique to the TMP91FW40 not covered in “TLCS-900/L1 CPU” are described
below.
3.1.1
Reset Operation
To reset the TMP91FW40, ensure that the power supply voltage is within the operating
voltage range, and that the internal high-frequency oscillator has stabilized. Then, set the
RESET input to low level for at least 10 system clocks (1µs at 27 MHz). After turning on the
power to the TMP91FW40, hold the RESET input at low level for at least 10 system clocks
with the power supply voltage within the operating voltage range and the internal
high-frequency oscillator oscillating stably.
Reset operation initializes the system clock fSYS to fc/2. The CPU performs the following
operations as a result of a reset:
•
Sets the program counter (PC) according to the reset vector stored at addresses
FFFF00H to FFFF02H.
PC<7:0>
←
Value at address FFFF00H
PC<15:8>
←
Value at address FFFF01H
PC<23:16>
←
Value at address FFFF02H
•
Sets the stack pointer (XSP) to 100H.
•
Sets the <IFF2:0> bits of the status register (SR) to 111 (setting the interrupt level
mask register to level 7).
•
Sets the <MAX> bit of the status register (SR) to 1 (selecting maximum mode).
•
Clears the <RFP2:0> bits of the status register (SR) to 000 (selecting register bank
0).
After the reset state is released, the CPU starts executing instructions according to the
PC. CPU internal registers other than the above are not changed.
The internal I/O peripherals, ports and other pins are initialized as follows upon a reset:
Note:
•
All internal I/O registers are initialized.
•
All port pins, including those multiplexed with internal I/O functions, are
configured either as general-purpose inputs or general-purpose outputs.
Reset operation does not affect the contents of the internal RAM or the CPU registers other than PC, SR
and XSP.
Figure 3.1.1 shows reset timings of the TMP91FW40.
0
91FW40-7
2008-10-22
91FW40-8
P62
TMP91FW40 only,
P62
P70 to P75
P80 to P83
P90 to P95, PA0 to PA5
COM0 to COM3
Sampling
indicates high-impedance state.
PB0 to PB7(SEG32 to SEG39)
P00 to P07(SEG24 to SEG31)
P10 to P17(SEG16 to SEG23)
P20 to P27(SEG8 to SEG15)
SEG0 to SEG7
RESET
fFPH
(Pull-up)
(Input mode)
(Input mode)
(Output mode)
(Input mode)
Sampling
TMP91FW40
Figure 3.1.1 TMP91FW40 Reset Timings
2008-10-22
TMP91FW40
3.1.2
Outline of Operation Modes
There are single-chip and single-boot modes. Which mode is selected depends on the device’s
pin state after a reset.
Single-chip mode:
The device normally operations in this mode. After a reset, the device starts
executing the internal memory program.
Single-boot mode:
This mode is used to rewrite the internal flash memory by serial transfer
(UART).
After a reset, internal boot program starts up, executing an on-board rewrite
program.
Table 3.1.1 Operation Mode Setup Table
Mode Setup Input Pin
Operation Mode
RESET
(P62)
BOOT
Single-chip mode
H
Single-boot mode
L
91FW40-9
AM0
AM1
H
H
2008-10-22
TMP91FW40
3.2
Memory Map
Figure 3.2.1 shows a memory map of the TMP91FW40 in single-chip mode and its memory
areas that can be accessed in each addressing mode of the CPU.
1
000000H
Internal I/O
Direct area
(n)
(4 Kbytes)
000100H
001000H
64-Kbyte area
(nn)
Internal RAM
(4 Kbytes)
002000H
010000H
External memory
(Access prohibited)
16-Mbyte area
(R)
(−R)
(R+)
(R + R8/16)
(R + d8/16)
(nnn)
FE0000H
128 Kbytes
Internal ROM
FFFF00H
FFFFFFH
Vector table (256 bytes)
(
= Internal area)
Figure 3.2.1 Memory Map
91FW40-10
2008-10-22
TMP91FW40
3.3
Flash Memory
The TMP91FW40 incorporates flash memory that can be electrically erased and programmed
using a single 3V power supply.
The flash memory is programmed and erased using JEDEC-standard commands. After a
program or erase command is input, the corresponding operation is automatically performed
internally. Erase operations can be performed by the entire chip (chip erase) or on a sector basis
(sector erase).
The configuration and operations of the flash memory are described below.
3.3.1
Features
• Power supply voltage for program/erase operations • Sector size
Vcc = 2.7 V to 3.6 V (-10 °C to 40 °C)
• Configuration
64 K × 16 bits (128 Kbytes)
• Functions
Single-word programming
Chip erase
Sector erase
Data polling/Toggle bit
3.3.2
4 Kbytes × 32
• Mode control
JEDEC-standard commands
• Programming method
On-board programming
Parallel programmer
• Security
Write protection
Read protection
Block Diagram
Internal address bus
Internal data bus
Internal control bus
Mode
setting pins
Mode control
ROM controller
Control
Address
Data
Flash memory
Command
register
Address latch
Data latch
Column decoder/Sense amp
Row decoder
Control
circuit
(including
automatic
sequence
control
circuit)
Flash memory cells
128 KB
Erase sector decoder
Figure 3.3.1 Block Diagram of Flash Memory Unit
91FW40-11
2008-10-22
TMP91FW40
3.3.3
Operation Modes
3.3.3.1 Overview
The following three types of operation modes are available to control program/erase
operations on the flash memory.
Table 3.3.1 Description of Operation Modes
Operation Mode Name
Single Chip mode
Normal mode
User Boot mode
Single Boot mode
Programmer mode
Description
After reset release, the device starts up from the internal flash memory.
Single Chip mode is further divided into two modes: “Normal mode” is a mode in which user application
programs are executed, and “User Boot mode” is used to program the flash memory on-board.
The means of switching between these two modes can be set by the user as desired. For example, it
can be set so that Port 00 = ‘1’ selects Normal mode and Port 00 = ‘0’ selects User Boot mode. The user
must include a routine to handle mode switching in a user application program.
In this mode, the device starts up from a user application program.
In this mode, the flash memory can be programmed by a user-specified method.
After reset release, the device starts up from the internal boot ROM (mask ROM). The boot ROM
includes an algorithm which allows a program for programming/erasing the flash memory on-board via a
serial port to be transferred to the device’s internal RAM. The transferred program is then executed in
the internal RAM so that the flash memory can be programmed/erased by receiving data from an
external host and issuing program/erase commands.
This mode enables the internal flash memory to be programmed/erased using a general-purpose
programmer. For programmers that can be used, please contact your local Toshiba sales
representative.
Of the modes listed in Table 3.3.1, the internal flash memory can be programmed in
User Boot mode, Single Boot mode and Programmer mode.
The mode in which the flash memory can be programmed/erased while mounted on
the user board is defined as the on-board programming mode. Of the modes listed
above, Single Boot mode and User Boot mode are classified as on-board programming
modes. Single Boot mode supports Toshiba’s proprietary programming/erase method
using serial I/O. User Boot mode (within Single Chip mode) allows the flash memory to
be programmed/erased by a user-specified method.
Programmer mode is provided with a read protect function which prohibits reading
of ROM data. By enabling the read protect function upon completion of programming,
the user can protect ROM data from being read by third parties.
91FW40-12
2008-10-22
TMP91FW40
The operation mode ⎯ Single Chip mode, Single Boot mode or Programmer mode ⎯ is
determined during reset by externally setting the input levels on the AM0, AM1 and BOOT
(P62) pins.
Except in Programmer mode which is entered with RESET held at “0”, the CPU will
start operating in the selected mode after the reset state is released. Once the operation
mode has been set, make sure that the input levels on the mode setting pins are not
changed during operation. Table 3.3.2 shows how to set each operation mode, and Figure
3.3.2 shows a mode transition diagram.
Table 3.3.2 Operation Mode Pin Settings
Input Pins
Operation Mode
(1)
(2)
(3)
RESET
BOOT (P62)
AM1
AM0
0
1
0
―
1
1
1
1
1
0
Single Chip mode (Normal or User Boot mode)
Single Boot mode
Programmer mode
(3)
Programmer
mode
Reset state
(1) or (2) ＋ RESET = 0
(1)
(2)
RESET = 0
RESET = 0
Single Chip mode
Single Boot
mode
User Boot
mode
Normal mode
Switching method
to be set by user
On-board programming
mode
Numbers in ( ) correspond to the operation mode pin settings shown in Table 3.3.2.
Figure 3.3.2 Mode Transition Diagram
3.3.3.2
Reset Operation
To reset the device, hold the RESET input at “0” for at least 10 system clocks while
the power supply voltage is within the rated operating voltage range and the internal
high-frequency oscillator is oscillating stably.
91FW40-13
2008-10-22
TMP91FW40
3.3.3.3 Memory Map for Each Operation Mode
In this product, the memory map varies with operation mode. The memory map and
sector address ranges for each operation mode are shown below.
Single Chip mode
000000H
001000H
Internal I/O
Internal RAM
4KB
Single Boot mode
000000H
001000H
Internal I/O
Programmer mode
000000H
Internal RAM
4KB
Internal Flash ROM
128KB
002000H
002000H
External memory
020000H
(Access prohibited)
010000H
(予約)
External memory
Internal内蔵
Flash ROM
128KB
Flash ROM
(Access prohibited)
Reserved
030000H
External memory
(Access prohibited)
FE0000H
Internal Flash ROM
128KB
FFFF00H
FFFFFFH
(Interrupt vector 256B)
FFF000H Internal Boot ROM
4KB
FFFF00H
FFFFFFH (Interrupt vector 256B)
FFFFFFH
Figure 3.3.3 TMP91FW40 Memory Map for Each Operation Mode
91FW40-14
2008-10-22
TMP91FW40
Table 3.3.3 Sector Address Ranges for Each Operation Mode
Sector-0
Sector-1
Sector-2
Sector-3
Sector-4
Sector-5
Sector-6
Sector-7
Sector-8
Sector-9
Sector-10
Sector-11
Sector-12
Sector-13
Sector-14
Sector-15
Sector-16
Sector-17
Sector-18
Sector-19
Sector-20
Sector-21
Sector-22
Sector-23
Sector-24
Sector-25
Sector-26
Sector-27
Sector-28
Sector-29
Sector-30
Sector-31
Single Chip Mode
Single Boot Mode
FE0000H to FE0FFFH
FE1000H to FE1FFFH
FE2000H to FE2FFFH
FE3000H to FE3FFFH
FE4000H to FE4FFFH
FE5000H to FE5FFFH
FE6000H to FE6FFFH
FE7000H to FE7FFFH
FE8000H to FE8FFFH
FE9000H to FE9FFFH
FEA000H to FEAFFFH
FEB000H to FEBFFFH
FEC000H to FECFFFH
FED000H to FEDFFFH
FEE000H to FEEFFFH
FEF000H to FEFFFFH
FF0000H to FF0FFFH
FF1000H to FF1FFFH
FF2000H to FF2FFFH
FF3000H to FF3FFFH
FF4000H to FF4FFFH
FF5000H to FF5FFFH
FF6000H to FF6FFFH
FF7000H to FF7FFFH
FF8000H to FF8FFFH
FF9000H to FF9FFFH
FFA000H to FFAFFFH
FFB000H to FFBFFFH
FFC000H to FFCFFFH
FFD000H to FFDFFFH
FFE000H to FFEFFFH
FFF000H to FFFFFFH
10000H to 10FFFH
11000H to 11FFFH
12000H to 12FFFH
13000H to 13FFFH
14000H to 14FFFH
15000H to 15FFFH
16000H to 16FFFH
17000H to 17FFFH
18000H to 18FFFH
19000H to 19FFFH
1A000H to 1AFFFH
1B000H to 1BFFFH
1C000H to 1CFFFH
1D000H to 1DFFFH
1E000H to 1EFFFH
1F000H to 1FFFFH
20000H to 20FFFH
21000H to 21FFFH
22000H to 22FFFH
23000H to 23FFFH
24000H to 24FFFH
25000H to 25FFFH
26000H to 26FFFH
27000H to 27FFFH
28000H to 28FFFH
29000H to 29FFFH
2A000H to 2AFFFH
2B000H to 2BFFFH
2C000H to 2CFFFH
2D000H to 2DFFFH
2E000H to 2EFFFH
2F000H to 2FFFFH
91FW40-15
2008-10-22
TMP91FW40
3.3.4
Single Boot Mode
In Single Boot mode, the internal boot ROM (mask ROM) is activated to transfer a
program/erase routine (user-created boot program) from an external source into the
internal RAM. This program/erase routine is then used to program/erase the flash memory.
In this mode, the internal boot ROM is mapped into an area containing the interrupt vector
table, in which the boot ROM program is executed. The flash memory is mapped into an
address space different from the one into which the boot ROM is mapped (see Figure 3.3.3).
The device’s SIO (SIO1) and the controller are connected to transfer the program/erase
routine from the controller to the device’s internal RAM. This program/erase routine is
then executed to program/erase the flash memory.
The program/erase routine is executed by sending commands and write data from the
controller. The communications protocol between the device and the controller is described
later in this manual. Before the program/erase routine can be transferred to the RAM, user
password verification is performed to ensure the security of user ROM data. If the
password is not verified correctly, the RAM transfer operation cannot be performed. In
Single Boot mode, disable interrupts and use the interrupt request flags to check for an
interrupt request.
Note: In Single Boot mode, the boot-ROM programs are executed in Normal mode. Do not change to
another operation mode in the program/erase routine.
91FW40-16
2008-10-22
TMP91FW40
3.3.4.1 Using the program/erase algorithm in the internal boot ROM
(Step-1) Environment setup
Since the program/erase routine and write data are transferred via SIO (SIO1),
connect the device’s SIO (SIO1) and the controller on the board. The user must prepare
the program/erase routine (a) on the controller.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW40)
Boot ROM
(Controller)
SIO1
Flash memory
Old user application
program
(or erased state)
RAM
(Step-2) Starting up the internal boot ROM
Release the reset with the relevant input pins set for entering Single Boot mode.
When the internal boot ROM starts up, the program/erase routine (a) is transferred
from the controller to the internal RAM via SIO according to the communications
procedure for Single Boot mode. Before this can be carried out, the password entered
by the user is verified against the password written in the user application program.
(If the flash memory has been erased, 12 bytes of “0xFF” are used as the password.)
New user application
program
(a) Program/erase routine
(I/O)
(TMP91FW40)
Boot ROM
0 → 1 RESET
(Controller)
SIO1
Flash memory
Condition for entering
Single Boot mode
Old user application
program
(or erased state)
RAM
91FW40-17
2008-10-22
TMP91FW40
(Step-3) Copying the program/erase routine to the RAM
After password verification is completed, the boot ROM copies the program/erase
routine (a) from the controller to the RAM using serial communications. The
program/erase routine must be stored within the RAM address range of 001000H to
001DFFH.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW40)
Boot ROM
(Controller)
SIO1
Flash memory
Old user application
program
(or erased state)
(a) Program/erase routine
RAM
(Step-4) Executing the program/erase routine in the RAM
Control jumps to the program/erase routine (a) in the RAM. If necessary, the old
user application program is erased (sector erase or chip erase).
Note:
The boot ROM is provided with an erase command, which enables the entire chip to be erased from the
controller without using the program/erase routine. If it is necessary to erase data on a sector basis,
incorporate the necessary code in the program/erase routine.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW40)
Boot ROM
(Controller)
SIO1
Flash memory
(a) Program/erase routine
Erased
RAM
91FW40-18
2008-10-22
TMP91FW40
(Step-5) Copying the new user application program
The program/erase routine (a) loads the new user application program from the
controller into the erased area of the flash memory.
In the example below, the new user application program is transferred under the
same communications conditions as those used for transferring the program/erase
routine. However, after the program/erase routine has been transferred, this routine
can be used to change the transfer settings (data bus and transfer source). Configure
the board hardware and program/erase routine as desired.
New user application
program
(I/O)
(a) Program/erase routine
(TMP91FW40)
Boot ROM
(Controller)
SIO1
Flash memory
New user application
program
(a) Program/erase routine
RAM
(Step-6) Executing the new user application program
After the programming operation has been completed, turn off the power to the
board and remove the cable connecting the device and the controller. Then, turn on the
power again and start up the device in Single Chip mode to execute the new user
application program.
(TMP91FW40)
Boot ROM
0 → 1 RESET
(Controller)
SIO1
Flash memory
Condition for
entering Single Chip
mode (Normal
mode)
New user application
program
RAM
91FW40-19
2008-10-22
TMP91FW40
3.3.4.2 Connection Examples for Single Boot Mode
In Single Boot mode the flash memory is programmed by serial transfer. Therefore,
on-board programming is performed by connecting the device’s SIO (SIO1) and the
controller (programming tool) and sending commands from the controller to the device.
Figure 3.3.4 shows an example of connection between the target board and a
programming controller. Figure 3.3.5 shows an example of connection between the
target board and an RS232C board.
On-Board Programming Controller
Target Board
VCC
Reg.
Power supply
VCC
VCC
TMP91FW40
DVCC
AM0 (24pin)
AM1 (29pin)
Mode control
MCU
Program
controller
Mode control
Target board
operation
ROM
RESET
BOOT
RESET (30pin)
Boot
mode
switching
circuit
BOOT (5pin)
RAM
P95
P92
RXD
RS232C
TXD
P95 (11pin)
P92 (8pin)
RXD1 (10pin)
TXD1 (9Pin）
VSS
DVSS
PC
Figure 3.3.4 Example of Connection with an External Controller in Single Boot Mode
91FW40-20
2008-10-22
TMP91FW40
Target Board
RS232C Board
VCC
VCC
Power supply
VCC
TMP91FW40
DVCC
AM0 (24pin)
AM1 (29pin)
RESET
BOOT
RXD
RS232C
TXD
RESET (30pin)
Boot
mode
switching
circuit
BOOT (5pin)
RXD1 (10pin)
TXD1 (9Pin）
VSS
VSS
DVSS
PC
Figure 3.3.5 Example of Connection with an RS232C Board in Single Boot Mode
91FW40-21
2008-10-22
TMP91FW40
3.3.4.3 Mode Setting
To perform on-board programming, the device must be started up in Single Boot
mode by setting the input pins as shown below.
・AM0,AM1 = 1
・ BOOT
=0
・ RESET
=0→1
Set the AM0, AM1, and BOOT pins as shown above with the RESET pin held at “0”.
Then, setting the RESET pin to “1” will start up the device in Single Boot mode.
3.3.4.4 Memory Maps
Figure 3.3.6 shows a comparison of the memory map for Normal mode (in Single
Chip mode) and the memory map for Single Boot mode. In Single Boot mode, the flash
memory is mapped to addresses 10000H to 2FFFFH (physical addresses) and the boot
ROM (mask ROM) is mapped to addresses FFF000H to FFFFFFH.
Single Chip mode
000000H
001000H
Single Boot mode
000000H
Internal I/O
Internal RAM
4KB
001000H
Internal I/O
Internal RAM
4KB
002000H
002000H
External Memory
(Access prohibited)
010000H
(予約)
External Memory
(Access prohibited)
Internal内蔵
Flash ROM
128KB
Flash
ROM
030000H
External Memory
(Access prohibited)
FE0000H
FFFF00H
FFFFFFH
Internal Flash ROM
128KB
FFF000H
(Interrupt vector 256B)
FFFF00H
FFFFFFH
Internal Boot ROM
4KB
(Interrupt vector 256B)
Figure 3.3.6 Comparison of Memory Maps
91FW40-22
2008-10-22
TMP91FW40
3.3.4.5 Interface Specifications
The SIO communications format in Single Boot mode is shown below. The device
supports the UART (asynchronous communications) serial operation mode.
To perform on-board programming, the same communications format must also be
set on the programming controller’s side.
z
UART (asynchronous ) communications
• Communications channel: SIO channel 1 (For the pins to be used, see Table 3.3.4.)
• Serial transfer mode
: UART (asynchronous communications) mode
• Data length
: 8 bits
• Parity bit
: None
• Stop bit
: 1 bit
• Baud rate
: See Table 3.3.5 and Table 3.3.6.
Table 3.3.4 Pin Connections
Pins
Power supply
pins
Mode setting pins
UART
{
{
DVCC
DVSS
AM1,AM0,
{
BOOT
Reset pin
RESET
{
Communications
pins
TXD1
RXD1
{
{
Note: Unused pins are in the initial state after reset release.
Table 3.3.5 Baud Rate Table
SIO
UART
Transfer Rate (bps)
115200
57600
38400
91FW40-23
19200
9600
2008-10-22
○
○
×
○
×
Note 1
⎯
⎯
⎯
⎯
○
×
×
×
×
7.84∼10.02
7.84∼20.05
7.84∼27.54
10.84∼14.28
10.84∼27.54
8.0∼9.8304
8.0∼19.6608
8.0∼27.0
11.0592∼14.0
11.0592∼27.0
91FW40-24
○
×
×
⎯
⎯
⎯
×
×
×
15.68∼18.80
19.60∼20.40
21.68∼27.54
16.0∼18.4320
20.0
22.1184∼27.0
⎯
⎯
Note 1
Note 1
⎯
○
○
○
○
○
○
○
⎯
Note 1
○
○
○
Baud Rate (bps)
Note 1
Note 1
Note 1
Note
38400
×
⎯
○
○
○
○
○
○
×
Note 1
Note 1
Note 1
Note 1
Note 1
Note 1
Note 2
Note 2
Note 1
⎯
⎯
⎯
⎯
⎯
⎯
Note
frequencies outside of the supported range.
The range of clock frequencies that are detected as each reference frequency. It may not be possible to perform Single Boot operations at clock
○
○
○
○
×
×
×
⎯
Note 1
×
⎯
×
×
×
Baud Rate (bps)
Note 2
Note
115200
○
Baud Rate (bps)
To program the flash memory using Single Boot mode, one of the reference frequencies must be selected as a high-speed clock.
Note 1
Note 1
Note 1
Note 1
Note 1
Note 1
Note 1
Note 1
Note 1
Note 1
Note
57600
oscillation frequency error must be within ±2% in total.
Note 2: To automatically detect the reference frequency (microcontroller clock frequency), the transfer baud rate error of the flash memory programming controller and the
oscillation frequency error must be within ±3% in total.
Note 1: To automatically detect the reference frequency (microcontroller clock frequency), the transfer baud rate error of the flash memory programming controller and the
Supported Range:
Reference Frequency: The frequency of the high-speed oscillation circuit that can be used in Single Boot mode.
○
⎯
×
14.46∼15.04
14.7456
○
Note 1
○
7.84∼8.16
8.0
Baud Rate (bps)
19200
Note
9600
Baud Rate (bps)
(MHz)
Supported Range
Reference Frequency
(MHz)
Reference Baud Rate (bps)
TMP91FW40
Table 3.3.6 Correspondence between Operating Frequency and Baud Rate in Single Boot Mode
2008-10-22
TMP91FW40
3.3.4.6 Data Transfer Formats
Table 3.3.7 to Table 3.3.13 show the operation command data and the data transfer
format for each operation mode.
Table 3.3.7 Operation Command Data
Operation Command Data
Operation Mode
10H
20H
30H
40H
60H
RAM Transfer
Flash Memory SUM
Product Information Read
Flash Memory Chip Erase
Flash Memory Protect Set
91FW40-25
2008-10-22
TMP91FW40
Table 3.3.8 Transfer Format of Single Boot Program [RAM Transfer]
Transfer
Byte
Number
Boot
ROM
1st byte
Transfer Data
from Controller to Device
3rd byte
4th byte
Operation command data
⎯
5th byte
to
16th byte
17th byte
18th byte
Password data (12 bytes)
27th byte
to
m’th byte
(m + 1)th byte
(m + 2)th byte
Note 1:
Note 2:
Note 3:
Note 4:
86H
⎯
2nd byte
RAM
Desired
Baud rate setting
UART
19th byte
20th byte
21st byte
22nd byte
23rd byte
24th byte
25th byte
26th byte
(m + 3)th byte
Baud
Rate
Transfer Data
from Device to Controller
⎯
baud rate
(Note 1)
ACK response to baud rate setting
Normal (baud rate OK)
･UART
(10H)
(02FEF4H to 02FEFFH)
CHECKSUM value for 5th to 16th bytes
⎯
RAM storage start address 31 to 24 (Note 3)
RAM storage start address 23 to 16 (Note 3)
RAM storage start address 15 to 8 (Note 3)
RAM storage start address 7 to 0 (Note 3)
RAM storage byte count 15 to 8 (Note 3)
RAM storage byte count 7 to 0 (Note 3)
CHECKSUM value for 19th to 24th bytes (Note 3)
⎯
RAM storage data
CHECKSUM value for 27th to m’th bytes
⎯
⎯
86H
(If the desired baud rate cannot be set,
operation is terminated.)
⎯
ACK response to operation command (Note 2)
Normal
10H
Error
x1H
Protection applied (Note 4)
x6H
Communications error
x8H
⎯
⎯
ACK response to CHECKSUM value (Note 2)
Normal
10H
Error
11H
Communications error
18H
⎯
⎯
⎯
⎯
⎯
⎯
⎯
ACK response to CHECKSUM value (Note 2)
Normal
10H
Error
11H
Communications error
18H
⎯
⎯
ACK response to CHECKSUM value (Note 2)
Normal
10H
Error
11H
Communications error
18H
Jump to RAM storage start address
For the desired baud rate setting, see Table 3.3.6.
After sending an error response, the device waits for operation command data (3rd byte).
The data to be transferred in the 19th to 25th bytes should be programmed within the RAM address range of
001000H to 001DFFH (3.5 Kbytes).
When read protection or write protection is applied, the device aborts the received operation command and waits
for the next operation command data (3rd byte).
91FW40-26
2008-10-22
TMP91FW40
Table 3.3.9 Transfer Format of Single Boot Program [Flash Memory SUM]
Transfer
Byte
Number
Boot ROM
1st byte
Transfer Data
from Controller to Device
Baud rate setting
UART
86H
Baud Rate
Transfer Data
from Device to Controller
⎯
Desired
baud rate
(Note1)
2nd byte
3rd byte
4th byte
5th byte
6th byte
7th byte
8th byte
Note 1:
Note 2:
⎯
Operation command data
⎯
(20H)
⎯
⎯
⎯
(Wait for the next operation command data)
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
⎯
ACK response to operation command (Note 2)
Normal
20H
Error
x1H
Communications error
x8H
SUM (upper)
SUM (lower)
CHECKSUM value for 5th and 6th bytes
⎯
For the desired baud rate setting, see Table 3.3.6.
After sending an error response, the device waits for operation command data (3rd byte).
91FW40-27
2008-10-22
TMP91FW40
Table 3.3.10 Transfer Format of Single Boot Program [Product Information Read] (1/2)
Transfer Byte
Number
Boot ROM
1st byte
Transfer Data
from Controller to Device
Baud rate setting
Desired
UART
2nd byte
3rd byte
4th byte
Baud Rate
86H
5th byte
6th byte
7th byte
8th byte
9th byte
to
20th byte
21st byte
to
24th byte
25th byte
to
28th byte
29th byte
to
32nd byte
33rd byte
to
36th byte
37th byte
to
40th byte
41st byte
to
44th byte
45th byte
to
46th byte
⎯
⎯
⎯
⎯
⎯
47th byte
to
50th byte
51st byte
to
54th byte
55th byte
to
56th byte
57th byte
to
60th byte
⎯
⎯
baud rate
(Note 1)
⎯
Operation command data
⎯
Transfer Data
from Device to Controller
(30H)
⎯
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
⎯
ACK response to operation command (Note 2)
Normal
30H
Error
x1H
Communications error
x8H
Flash memory data (address 02FEF0H)
Flash memory data (address 02FEF1H)
Flash memory data (address 02FEF2H)
Flash memory data (address 02FEF3H)
Part number (ASCII code, 12 bytes)
‘TMP91FW40_ _ _ ’ (from 9th byte)
Password comparison start address (4 bytes)
F4H, FEH, 02H, 00H (from 21st byte)
⎯
RAM start address (4 bytes)
00H, 10H, 00H, 00H (from 25th byte)
⎯
RAM (user area) end address (4 bytes)
FFH, 1DH, 00H, 00H (from 29th byte)
⎯
RAM end address (4 bytes)
FFH, 1FH, 00H, 00H (from 33rd byte)
⎯
Dummy data (4 bytes)
00H,00H,00H,00H (from 37th byte)
⎯
Dummy data (4 bytes)
00H, 00H, 00H, 00H (from 41st byte)
⎯
FUSE information (2 bytes from 45th byte)
Read protection/Write protection
1) Applied/Applied
: 00H, 00H
2) Not applied/Applied
: 01H, 00H
3) Applied/Not applied
: 02H, 00H
4) Not applied/Not applied
: 03H, 00H
Flash memory start address (4 bytes)
00H, 00H, 01H, 00H (from 47th byte)
⎯
Flash memory end address (4 bytes)
FFH, FFH, 02H, 00H (from 51st byte)
⎯
Number of sectors in flash memory (2 bytes)
20H, 00H (from 55th byte)
⎯
Start address of flash memory sectors of the
same size (4 bytes)
00H, 00H, 01H, 00H (from 57th byte)
91FW40-28
2008-10-22
TMP91FW40
Table 3.3.11 Transfer Format of Single Boot Program [Product Information Read] (2/2)
Transfer
Byte
Number
Boot ROM
Note 1:
Note 2:
Transfer Data
from Controller to Device
61st byte
to
64th byte
⎯
65th byte
⎯
66th byte
67th byte
⎯
(Wait for the next operation command data)
Baud rate
Transfer Data
from Device to Controller
Size (in half words) of flash memory sectors
of the same size (4 bytes)
00H, 08H, 00H, 00H (from 61st byte)
Number of flash memory sectors of the
same size (1byte) 20H
CHECKSUM value for 5th to 65th bytes
⎯
For the desired baud rate setting, see Table 3.3.6.
After sending an error response, the device waits for operation command data (3rd byte).
91FW40-29
2008-10-22
TMP91FW40
Table 3.3.12 Transfer Format of Single Boot Program [Flash Memory Chip Erase]
Transfer
Byte
Number
Boot ROM
1st byte
Transfer Data
from Controller to Device
Transfer Data
from Device to Controller
⎯
Desired
Baud rate setting
86H baud rate
(Note 1)
UART
2nd byte
Baud Rate
⎯
3rd byte
4th byte
Operation command data
⎯
(40H)
5th byte
6th byte
Erase Enable command data
⎯
(54H)
7th byte
⎯
8th byte
⎯
9th byte
(Wait for the next operation command data)
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
⎯
ACK response to operation command (Note2)
Normal
40H
Error
x1H
Communications error
x8H
⎯
ACK response to operation command (Note 2)
Normal
54H
Error
x1H
Communications error
x8H
ACK response to Erase command
Normal
4FH
Error
4CH
ACK response
Normal
5DH
Error
60H
⎯
Note 1: For the desired baud rate setting, see Table 3.3.6.
Note 2: After sending an error response, the device waits for operation command data (3rd byte).
91FW40-30
2008-10-22
TMP91FW40
Table 3.3.13 Transfer Format of Single Boot Program [Flash Memory Protect Set]
Transfer
Byte
Number
Boot ROM
1st byte
Transfer Data
from Controller to Device
Note 1:
Note 2:
Transfer Data
from Device to Controller
⎯
Desired
Baud rate setting
UART
2nd byte
Baud Rate
86H
baud rate
(Note 1)
⎯
3rd byte
4th byte
Operation command data
⎯
5th byte
to
16th byte
17th byte
18th byte
Password data (12 bytes)
(60H)
(02FEF4H to 02FEFFH)
CHECKSUM value for 5th to 16th bytes
⎯
19th byte
⎯
20th byte
⎯
21st byte
(Wait for the next operation command data)
ACK response to baud rate setting
Normal (baud rate OK)
･UART
86H
(If the desired baud rate cannot be set,
operation is terminated.)
⎯
ACK response to operation command (Note2)
Normal
60H
Error
x1H
Communications error
x8H
⎯
⎯
ACK response to checksum value (Note 2)
Normal
60H
Error
61H
Communications error
68H
ACK response to Protect Set command
Normal
6FH
Error
6CH
ACK response
Normal
31H
Error
34H
⎯
For the desired baud rate setting, see Table 3.3.6.
After sending an error response, the device waits for operation command data (3rd byte).
91FW40-31
2008-10-22
TMP91FW40
3.3.4.7 Boot Program
When the device starts up in Single Boot mode, the boot program is activated.
The following explains the commands that are used in the boot program to
communicate with the controller when the device starts up in Single Boot mode. Use
this information for creating a controller for using Single Boot mode or for building a
user boot environment.
1. RAM Transfer command
In RAM transfer, data is transferred from the controller and stored in the device’s
internal RAM. When the transfer completes normally, the boot program will start
running the transferred user program. Up to 3.5 Kbytes of data can be transferred as a
user program. (This limit is implemented in the boot program to protect the stack
pointer area.) The user program starts executing from the RAM storage start address.
This RAM transfer function enables a user-created program/erase routine to be
executed, allowing the user to implement their own on-board programming method. To
perform on-board programming with a user program, the flash memory command
sequences (see section 3.3.6) must be used. After the RAM Transfer command has been
completed, the entire internal RAM area can be used.
If read protection or write protection is applied on the device or a password error occurs,
this command will not be executed.
2. Flash Memory SUM command
This command calculates the SUM of 128 Kbytes of data in the flash memory and
returns the result. There is no operation command available to the boot program for
reading data from the entire area of the flash memory. Instead, this Flash Memory
SUM command can be used. Reading the SUM value enables revision management of
the application program.
3. Product Information Read command
This command returns the information about the device including its part number and
memory details stored in the flash memory at addresses 02FEF0H to 02FEF3H. This
command can also be used for revision management of the application program.
4. Flash Memory Chip Erase command
This command erases all the sectors in the flash memory. If read protection or write
protection is applied on the device, all the sectors in the flash memory are erased and
the read protection or write protection is cleared.
Since this command is also used to restore the operation of the boot program when the
password is forgotten, it does not include password verification.
5. Flash Memory Protect Set command
This command sets both read protection and write protection on the device. However, if
a password error occurs, this command will not be executed.
When read protection is set, the flash memory cannot be read in Programmer mode.
When write protection is set, the flash memory cannot be written in Programmer
mode.
91FW40-32
2008-10-22
TMP91FW40
3.3.4.8 RAM Transfer Command (See Table 3.3.8)
1. From the controller to the device
The data in the 1st byte is used to determine the baud rate. The 1st byte is transferred
with receive operation disabled (SC1MOD0<RXE> = 0).
•
To communicate in UART mode
Send the value 86H from the controller to the target board using UART
settings at the desired baud rate. If the serial operation mode is determined as
UART, the device checks to see whether or not the desired baud rate can be set.
If the device determines that the desired baud rate cannot be set, operation is
terminated and no communications can be established.
2. From the device to the controller
The data in the 2nd byte is the ACK response returned by the device for the serial
operation mode setting data sent in the 1st byte. If the data in the 1st byte is found to
signify UART and the desired baud rate can be set, the device returns 86H.
•
Baud rate determination
The device determines whether or not the desired baud rate can be set. If it is
found that the baud rate can be set, the boot program rewrites the BR1CR and
BR1ADD values and returns 86H. If it is found that the desired baud rate
cannot be set, operation is terminated and no data is returned. The controller
sets a time-out time (5 seconds) after it has finished sending the 1st byte. If
the controller does not receive the response (86H) normally within the
time-out time, it should be considered that the device is unable to
communicate. Receive operation is enabled (SC1MOD0<RXE> = 1) before 86H
is written to the transmission buffer.
3. From the controller to the device
The data in the 3rd byte is operation command data. In this case, the RAM Transfer
command data (10H) is sent from the controller to the device.
4. From the device to the controller
The data in the 4th byte is the ACK response to the operation command data in the 3rd
byte. First, the device checks to see if the received data in the 3rd byte contains any
error. If a receive error is found, the device returns the ACK response data for
communications error (bit 3) x8H and waits for the next operation command data (3rd
byte). The upper four bits of the ACK response data are undefined (They are the upper
four bits of the immediately preceding operation command data).
Next, if the data received in the 3rd byte corresponds to one of the operation commands
given in Table 3.3.7, the device echoes back the received data (ACK response for
normal reception). In the case of the RAM Transfer command, if read or write
protection is not applied, 10H is echoed back and then execution branches to the RAM
transfer processing routine. If protection is applied, the device returns the
corresponding ACK response data (bit 2/1) x6H and waits for the next operation
command data (3rd byte). The upper four bits of the ACK response data are undefined.
(They are the upper four bits of the immediately preceding operation command data.)
After branching to the RAM transfer processing routine, the device checks the data in
the password area. For details, see 3.3.4.14 “Password”.
If the data in the 3rd byte does not correspond to any operation command, the device
returns the ACK response data for operation command error (bit0) x1H and waits for
the next operation command data (3rd byte). The upper four bits of the ACK response
data are undefined. (They are the upper four bits of the immediately preceding
operation command data.)
91FW40-33
2008-10-22
TMP91FW40
5. From the controller to the device
The 5th to 16th bytes contain password data (12 bytes). The data in the 5th to 16th
bytes is verified against the data at addresses 02FEF4H to 02FEFFH in the flash
memory, respectively.
6. From the controller to the device
The 17th byte contains CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing the
data in the 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). For
details on CHECKSUM, see 3.3.4.16 “How to Calculate CHECKSUM.”
7. From the device to the controller
The data in the 18th byte is the ACK response data to the 5th to 17th bytes (ACK
response to the CHECKSUM value). The device first checks to see whether the data
received in the 5th to 17th bytes contains any error. If a receive error is found, the
device returns the ACK response data for communications error (bit 3) 18H and waits
for the next operation command data (3rd byte). The upper four bits of the ACK
response data are the upper four bits of the immediately preceding operation command
data, so the value of these bits is “1”.
Next, the device checks the CHECKSUM data in the 17th byte. This check is made to
see if the lower 8-bit value obtained by summing the data in the 5th to 17th bytes by
unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H, the
device returns the ACK response data for CHECKSUM error (bit 0) 11H and waits for
the next operation command data (3rd byte).
Finally, the device examines the result of password verification. If all the data in the
5th to 16th bytes is not verified correctly, the device returns the ACK response data for
password error (bit 0) 11H and waits for the next operation command data (3rd byte).
If no error is found in all the above checks, the device returns the ACK response data
for normal reception 10 H.
8. From the controller to the device
The data in the 19th to 22nd bytes indicates the RAM start address for storing block
transfer data. The 19th byte corresponds to address bits 31 to 24, the 20th byte to
address bits 23 to 16, the 21st byte to address bits 15 to 8, and the 22nd byte to address
bits 7 to 0.
9. From the controller to the device
The data in the 23rd and 24th bytes indicates the number of bytes to be transferred.
The 23rd byte corresponds to bits 15 to 8 of the transfer byte count and the 24th byte
corresponds to bits 7 to 0.
10. From the controller to the device
The data in the 25th byte is CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing the
data in the 19th to 24th bytes by unsigned 8-bit addition (ignoring any overflow). For
details on CHECKSUM, see 3.3.4.16 “How to Calculate CHECKSUM .”
Note:
The data in the 19th to 25th bytes should be placed within addresses 001000H to 001DFFH (3.5 Kbytes) in
the internal RAM.
91FW40-34
2008-10-22
TMP91FW40
11. From the device to the controller
The data in the 26th byte is the ACK response data to the data in the 19th to 25th
bytes (ACK response to the CHECKSUM value).
The device first checks to see whether the data received in the 19th to 25th bytes
contains any error. If a receive error is found, the device returns the ACK response
data for communications error (bit 3) 18H and waits for the next operation command
(3rd byte). The upper four bits of the ACK response data are the upper four bits of the
immediately preceding operation command data, so the value of these bits is “1”.
Next, the device checks the CHECKSUM data in the 25th byte. This check is made to
see if the lower 8-bit value obtained by summing the data in the 19th to 25th bytes by
unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H, the
device returns the ACK response data for CHECKSUM error (bit 0) 11H and waits for
the next operation command data (3rd byte).
12. From the controller to the device
The data in the 27th to m’th bytes is the data to be stored in the RAM. This data is
written to the RAM starting at the address specified in the 19th to 22nd bytes. The
number of bytes to be written is specified in the 23rd and 24th bytes.
13. From the controller to the device
The data in the (m+1) th byte is CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing the
data in the 27th to m’th bytes by unsigned 8-bit addition (ignoring any overflow). For
details on CHECKSUM, see 3.3.4.16 ”How to Calculate CHECKSUM.”
14. From the device to the controller
The data in the (m + 2)th byte is the ACK response data to the 27th to (m+1)th bytes
(ACK response to the CHECKSUM value).
The device first checks to see whether the data in the 27th to (m+1)th byte contains
any error. If a receive error is found, the device returns the ACK response data for
communications error (bit 3) 18H and waits for the next operation command (3rd byte).
The upper four bits of the ACK response are the upper four bits of the immediately
preceding operation command data, so the value of these bits is “1”.
Next, the device checks the CHECKSUM data in the (m+1)th byte. This check is made
to see if the lower 8-bit value obtained by summing the data in the 27th to (m+1)th
bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H,
the device returns the ACK response data for CHECKSUM error (bit 0) 11H and waits
for the next operation command data (3rd byte).
If no error is found in all the above checks, the device returns the ACK response data
for normal reception 10H.
15. From the device to the controller
If the ACK response data in the (m + 2)th byte is 10H (normal reception), the boot
program then jumps to the RAM start address specified in the 19th to 22nd bytes.
91FW40-35
2008-10-22
TMP91FW40
3.3.4.9 Flash Memory SUM command (See Table 3.3.9)
1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2. From the controller to the device
The data in the 3rd byte is operation command data. The Flash Memory SUM
command data (20H) is sent here.
3. From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data in
the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a receive
error is found, the device returns the ACK response data for communications error (bit
3) x8H and waits for the next operation command data (3rd byte). The upper four bits
of the ACK response data are undefined. (They are the upper four bits of the
immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command values
given in Table 3.3.7, the device echoes back the received data (ACK response for
normal reception). In this case, 20H is echoed back and execution then branches to the
flash memory SUM processing routine. If the data in the 3rd byte does not correspond
to any operation command, the device returns the ACK response data for operation
command error (bit 0) x1H and waits for the next operation command data (3rd byte).
The upper four bits of the ACK response data are undefined. (They are the upper four
bits of the immediately preceding operation command data.)
4. From the device to the controller
The data in the 5th and 6th bytes is the upper and lower data of the SUM value,
respectively. For details on SUM, see 3.3.4.15 “How to Calculate SUM .”
5. From the device to the controller
The data in the 7th byte is CHECKSUM data. This is the two’s complement of the
lower 8-bit value obtained by summing the data in the 5th and 6th bytes by unsigned
8-bit addition (ignoring any overflow).
6. From the controller to the device
The data in the 8th byte is the next operation command data.
91FW40-36
2008-10-22
TMP91FW40
3.3.4.10
Product Information Read command (See Table 3.3.10 and Table 3.3.11)
1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2. From the controller to the device
The data in the 3rd byte is operation command data. The Product Information Read
command data (30H) is sent here.
3. From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data in
the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a receive
error is found, the device returns the ACK response data for communications error (bit
3) x8H and waits for the next operation command data (3rd byte). The upper four bits
of the ACK response data are undefined. (They are the upper four bits of the
immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command values
given in Table 3.3.7, the device echoes back the received data (ACK response for
normal reception). In this case, 30H is returned and execution then branches to the
product information read processing routine. If the data in the 3rd byte does not
correspond to any operation command, the device returns the ACK response data for
operation command error (bit 0) x1H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are undefined. (They are the
upper four bits of the immediately preceding operation command data.)
4. From the device to the controller
The data in the 5th to 8th bytes is the data stored at addresses 02FEF0H to 02FEF3H
in the flash memory. By writing the ID information of software at these addresses, the
version of the software can be managed. (For example, 0002H can indicate that the
software is now in version 2.)
5. From the device to the controller
The data in the 9th to 20th bytes denotes the part number of the device. ‘TMP91FW40_
_ _’ is sent in ASCII code starting from the 9th byte.
Note: An underscore (‘_’) indicates a space.
6. From the device to the controller
The data in the 21st to 24th bytes is the password comparison start address. F4H, FEH,
02H and 00H are sent starting from the 21st byte.
7. From the device to the controller
The data in the 25th to 28th bytes is the RAM start address. 00H, 10H, 00H and 00H
are sent starting from the 25th byte.
8. From the device to the controller
The data in the 29th to 32nd bytes is the RAM (user area) end address. FFH, 1DH, 00H
and 00H are sent starting from the 29th byte.
91FW40-37
2008-10-22
TMP91FW40
9. From the device to the controller
The data in the 33rd to 36th bytes is the RAM end address. FFH, 1FH, 00H and 00H
are sent starting from the 33rd byte.
10. From the device to the controller
The data in the 37th to 44th bytes is dummy data.
11. From the device to the controller
The data in the 45th and 46th bytes contains the protection status and sector division
information of the flash memory.
•
•
•
•
Bit 0 indicates the read protection status.
•
0: Read protection is applied.
•
1: Read protection is not applied.
Bit 1 indicates the write protection status.
•
0: Write protection is applied.
•
1: Write protection is not applied.
Bit 2 indicates whether or not the flash memory is divided into sectors.
•
0: The flash memory is divided into sectors.
•
1: The flash memory is not divided into sectors.
Bits 3 to 15 are sent as “0”.
12. From the device to the controller
The data in the 47th to 50th bytes is the flash memory start address. 00H, 00H, 01H
and 00H are sent starting from the 47th byte.
13. From the device to the controller
The data in the 51st to 54th bytes is the flash memory end address. FFH, FFH, 02H
and 00H are sent starting from the 51st byte.
14. From the device to the controller
The data in the 55th and 56th bytes indicates the number of sectors in the flash
memory. 20H and 00H are sent starting from the 55th byte.
15. From the device to the controller
The data in the 57th to 65th bytes contains sector information of the flash memory.
Sector information is comprised of the start address (starting from the flash memory
start address), sector size and number of consecutive sectors of the same size. Note that
the sector size is represented in word units.
The data in the 57th to 65th bytes indicates 4 Kbytes of sectors (sector 0 to sector 31).
For the data to be transferred, see Table 3.3.10 and Table 3.3.11.
16. From the device to the controller
The data in the 66th byte is CHECKSUM data. This is the two’s complement of the
lower 8-bit value obtained by summing the data in the 5th to 65th bytes by unsigned
8-bit addition (ignoring any overflow).
17. From the controller to the device
The data in the 67th byte is the next operation command data.
91FW40-38
2008-10-22
TMP91FW40
3.3.4.11
Flash Memory Chip Erase Command (See Table 3.3.12)
1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2. From the controller to the device
The data in the 3rd byte is operation command data. The Flash Memory Chip Erase
command data (40H) is sent here.
3. From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data in
the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a receive
error is found, the device returns the ACK response data for communications error (bit
3) x8H and waits for the next operation command data (3rd byte). The upper four bits
of the ACK response data are undefined. (They are the upper four bits of the
immediately preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command values
given in Table 3.3.7, the device echoes back the received data (ACK response for
normal reception). In this case, 40H is echoed back. If the data in the 3rd byte does not
correspond to any operation command, the device returns the ACK response data for
operation command error (bit 0) x1H and waits for the next operation command data
(3rd byte). The upper four bits of the ACK response data are undefined. (They are the
upper four bits of the immediately preceding operation command data.)
4. From the controller to the device
The data in the 5th byte is Erase Enable command data (54H).
5. From the device to the controller
The data in the 6th byte is the ACK response data to the Erase Enable command data
in the 5th byte.
The device first checks to see if the data in the 5th byte contains any error. If a receive
error is found, the device returns the ACK response data for communications error (bit
3) x8H and waits for the next operation command data (3rd byte). The upper four bits
of the ACK response data are undefined (They are the upper four bits of the
immediately preceding operation command data.)
Then, if the data in the 5th byte corresponds to the Erase Enable command data, the
device echoes back the received data (ACK response for normal reception). In this case,
54H is echoed back and execution jumps to the flash memory chip erase processing
routine. If the data in the 5th byte does not correspond to the Erase Enable command
data, the device returns the ACK response data for operation command error (bit 0 )
x1H and waits for the next operation command (3rd byte). The upper four bits of the
ACK response data are undefined. (They are the upper four bits of the immediately
preceding operation command data.)
91FW40-39
2008-10-22
TMP91FW40
6. From the device to the controller
The data in the 7th byte indicates whether or not the erase operation has completed
successfully. If the erase operation has completed successfully, the device returns the
end code (4FH). If an erase error has occurred, the device returns the error code (4CH).
7. From the device to the controller
The data in the 8th byte is ACK response data. If the erase operation has completed
successfully, the device returns the ACK response for erase completion (5DH). If an
erase error has occurred, the device returns the ACK response for erase error (60H).
8. From the controller to the device
The data in the 9th byte is the next operation command data.
91FW40-40
2008-10-22
TMP91FW40
3.3.4.12 Flash Memory Protect Set command (See Table 3.3.13)
1. The data in the 1st and 2nd bytes is the same as in the case of the RAM Transfer
command.
2. From the controller to the device
The data in the 3rd byte is operation command data. The Flash Memory Protect Set
command data (60H) is sent here.
3. From the device to the controller
The data in the 4th byte is the ACK response data to the operation command data in
the 3rd byte.
The device first checks to see if the data in the 3rd byte contains any error. If a receive
error is found, the device returns the ACK response data for communications error (bit
3) x8H and waits for the next operation command data. The upper four bits of the ACK
response data are undefined. (They are the upper four bits of the immediately
preceding operation command data.)
Then, if the data in the 3rd byte corresponds to one of the operation command data
values given in Table 3.3.7, the device echoes back the received data (ACK response for
normal reception). In this case, 60H is echoed back and execution branches to the flash
memory protect set processing routine.
After branching to this routine, the data in the password area is checked. For details,
see 3.3.4.14 “Password.”
If the data in the 3rd byte does not correspond to any operation command, the device
returns the ACK response data for operation command error (bit 0) x1H and waits for
the next operation command data (3rd byte). The upper four bits of the ACK response
data are undefined. (They are the upper four bits of the immediately preceding
operation command data.)
4. From the controller to the device
The data in the 5th to 16th bytes is password data (12 bytes). The data in the 5th byte
is verified against the data at address 02FEF4H in the flash memory and the data in
the 6th byte against the data at address 02FEF5H. In this manner, the received data is
verified consecutively against the data at the specified address in the flash memory.
The data in the 16th byte is verified against the data at address 02FEFFH in the flash
memory.
5. From the controller to the device
The data in the 17th byte is CHECKSUM data. The CHECKSUM data sent by the
controller is the two’s complement of the lower 8-bit value obtained by summing the
data in 5th to 16th bytes by unsigned 8-bit addition (ignoring any overflow). For details
on CHECKSUM, see 3.3.4.16 “How to Calculate CHECKSUM.”
91FW40-41
2008-10-22
TMP91FW40
6. From the device to the controller
The data in the 18th byte is the ACK response data to the data in the 5th to 17th bytes
(ACK response to the CHECKSUM value).
The device first checks to see whether the data in the 5th to 17th bytes contains any
error. If a receive error is found, the device returns the ACK response data for
communications error (bit 3) 68H and waits for the next operation command data (3rd
byte). The upper four bits of the ACK response data are the upper four bits of the
immediately preceding operation command data, so the value of these bits is “6”.
Then, the device checks the CHECKSUM data in the 17th byte. This check is made to
see if the lower 8 bits of the value obtained by summing the data in the 5th to 17th
bytes by unsigned 8-bit addition (ignoring any overflow) is 00H. If the value is not 00H,
the device returns the ACK response data for CHECKSUM error (bit 0) 61H and waits
for the next operation command data (3rd byte).
Finally, the device examines the result of password verification. If all the data in the
5th to 16th bytes is not verified correctly, the device returns the ACK response data for
password error (bit 0) 61H and waits for the next operation command data (3rd byte).
If no error is found in the above checks, the device returns the ACK response data for
normal reception 60H.
7. From the device to the controller
The data in the 19th byte indicates whether or not the protect set operation has
completed successfully. If the operation has completed successfully, the device returns
the end code (6FH). If an error has occurred, the device returns the error code (6CH).
8. From the device to the controller
The data in the 20th byte is ACK response data. If the protect set operation has
completed successfully, the device returns the ACK response data for normal
completion (31H). If an error has occurred, the device returns the ACK response data
for error (34H).
9. From the device to the controller
The data in the 21st byte is the next operation command data.
91FW40-42
2008-10-22
TMP91FW40
3.3.4.13
ACK Response Data
The boot program notifies the controller of its processing status by sending various
response data. Table 3.3.14 to Table 3.3.19 show the ACK response data returned for
each type of received data. The upper four bits of ACK response data are a direct
reflection of the upper four bits of the immediately preceding operation command data.
Bit 3 indicates a receive error and bit 0 indicates an operation command error,
CHECKSUM error or password error.
Table 3.3.14 ACK Response Data to Serial Operation Mode Setting Data
Transfer Data
Meaning
86H
The device can communicate in UART mode. (Note)
Note: If the desired baud rate cannot be set, the device returns no data and terminates operation.
Table 3.3.15 ACK Response Data to Operation Command Data
Transfer Data
x8H (Note)
x6H (Note)
x1H (Note)
10H
20H
30H
40H
60H
Meaning
A receive error occurred in the operation command data.
Terminated receive operation due to protection setting.
Undefined operation command data was received normally.
Received the RAM Transfer command.
Received the Flash Memory SUM command.
Received the Product Information Read command.
Received the Flash Memory Chip Erase command.
Received the Flash Memory Protect Set command.
Note: The upper four bits are a direct reflection of the upper four bits of the immediately preceding
operation command data.
Table 3.3.16 ACK Response data to CHECKSUM Data for RAM Transfer Command
Transfer Data
18H
11H
10H
Meaning
A receive error occurred.
A CHECKSUM error or password error occurred.
Received the correct CHECKSUM value.
Table 3.3.17 ACK Response Data to Flash Memory Chip Erase Operation
Transfer Data
Meaning
54H
4FH
4CH
5DH (Note)
Received the Erase Enable command.
Completed erase operation.
An erase error occurred.
Reconfirmation of erase operation
60H (Note)
Reconfirmation of erase error
Note: These codes are returned for reconfirmation of communications.
91FW40-43
2008-10-22
TMP91FW40
Table 3.3.18 ACK Response Data to CHECKSUM Data for Flash Memory Protect Set Command
Transfer Data
68H
61H
60H
Meaning
A receive error occurred.
A CHECKSUM or password error occurred.
Received the correct CHECKSUM value.
Table 3.3.19 ACK Response Data to Flash Memory Protect Set Operation
Transfer Data
Meaning
6FH
6CH
31H (Note)
Completed the protect (read/write) set operation.
A protect (read/write) set error occurred.
Reconfirmation of protect (read/write) set operation
34H (Note)
Reconfirmation of protect (read/write) set error
Note: These codes are returned for reconfirmation of communications.
91FW40-44
2008-10-22
TMP91FW40
3.3.4.14
Password
When the RAM Transfer command (10H) or the Flash Memory Protect Set
command (60H) is received as operation command data, password verification is
performed. First, the device echoes back the operation command data (10H to 60H)
and checks the data (12 bytes) in the password area (addresses 02FEF4H to
02FEFFH).
Then, the device verifies the password data received in the 5th to 16th bytes against
the data in the password area as shown in Table 3.3.20.
Unless all the 12 bytes are verified correctly, a password error will occur.
A password error will also occur if all the 12 bytes of password data contain the same
value. Only exception is when all the 12 bytes are “FFH” and verified correctly and the
reset vector area (addresses 02FF00H to 02FF02H) is all “FFH”. In this case, a blank
device will be assumed and no password error will occur.
If a password error has occurred, the device returns the ACK response data for
password error in the 18th byte.
Table 3.3.20 Password Verification Table
Receive data
Data to be verified against
5th byte
6th byte
7th byte
8th byte
9th byte
10th byte
11th byte
12th byte
13th byte
14th byte
15th byte
16th byte
Data at address 02FEF4H
Data at address 02FEF5H
Data at address 02FEF6H
Data at address 02FEF7H
Data at address 02FEF8H
Data at address 02FEF9H
Data at address 02FEFAH
Data at address 02FEFBH
Data at address 02FEFCH
Data at address 02FEFDH
Data at address02FEFEH
Data at address 02FEFFH
Example of data that cannot be specified as a password
For blank products (Note)
・The password of a blank product must be all “FFH” (FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH, FFH).
Note:
A blank product is a product in which all the bytes in the password area (addresses 02FEF4H to 02FEFFH) and
the reset vector area (addresses 02FF00H to 02FF02H) are “FFH”.
For programmed products
・The same 12 consecutive bytes cannot be specified as a password.
The table below shows password error examples.
Programmed
product
Error example 1
Error example 2
Error example 3
1
2
3
4
5
6
7
8
9
10
11
12
Note
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
FFH
00H
5AH
All ”FF”
All ”00”
All ”5A”
91FW40-45
2008-10-22
TMP91FW40
3.3.4.15
How to Calculate SUM
SUM is calculated by summing the values of all data read from the flash memory by
unsigned 8-bit addition and is returned as a word (16-bit) value. The resulting SUM
value is sent to the controller in order of upper 8 bits and lower 8 bits. All the 128
Kbytes of data in the flash memory are included in the calculation of SUM. When the
Flash Memory SUM command is executed, SUM is calculated in this way.
Example:
A1H
B2H
C3H
D4H
When SUM is calculated from the four data entries
shown to the left, the result is as follows:
A1H + B2H + C3H + D4H = 02EAH
SUM upper 8 bits: 02H
SUM lower 8 bits: EAH
Thus, the SUM value is sent to the controller in order of
02H and EAH.
3.3.4.16 How to Calculate CHECKSUM
CHECKSUM is calculated by taking the two’s complement of the lower 8-bit value
obtained by summing the values of received data by unsigned 8-bit addition (ignoring
any overflow). When the Flash Memory SUM command or the Product Information
Read command is executed, CHECKSUM is calculated in this way. The controller
should also use this CHECKSUM calculation method for sending CHECKSUM
values.
Example: Calculating CHECKSUM for the Flash Memory SUM command
When the upper 8-bit data of SUM is E5H and the lower 8-bit data is F6H,
CHECKSUM is calculated as shown below.
First, the upper 8 bits and lower 8 bits of the SUM value are added by unsigned
operation.
E5H + F6H = 1DBH
Then, the two’s complement of the lower 8 bits of this result is obtained as
shown below. The resulting CHECKSUM value (25H) is sent to the controller.
0 − DBH = 25H
91FW40-46
2008-10-22
TMP91FW40
3.3.5
User Boot Mode (in Single Chip Mode)
User Boot mode, which is a sub mode of Single Chip mode, enables a user-created flash
memory program/erase routine to be used. To do so, the operation mode of Single Chip
mode must be changed from Normal mode for executing a user application program to User
Boot mode for programming/erasing the flash memory.
For example, the reset processing routine of a user application program may include a
routine for selecting Normal mode or User Boot mode upon entering Single Chip mode. Any
mode-selecting condition may be set using the device’s I/O to suit the user system.
To program/erase the flash memory in User Boot mode, a program/erase routine must be
incorporated in the user application program in advance. Since the processor cannot read
data from the internal flash memory while it is being programmed or erased, the
program/erase routine must be executed from the outside of the flash memory. While the
flash memory is being programmed/erased in User Boot mode, interrupts must be disabled.
The pages that follow explain the procedure for programming the flash memory using
two example cases. In one case the program/erase routine is stored in the internal flash
memory (1-A); in the other the program/erase routine is transferred from an external
source (1-B).
91FW40-47
2008-10-22
TMP91FW40
3.3.5.1 (1-A) Program/Erase Procedure Example 1
When the program/erase routine is stored in the internal flash memory
(Step-1) Environment setup
First, the condition (e.g. pin status) for entering User Boot mode must be set and the
I/O bus for transferring data must be determined. Then, the device’s peripheral
circuitry must be designed and a corresponding program must be written. Before
mounting the device on the board, it is necessary to write the following four routines
into one of the sectors in the flash memory.
(a) Mode select routine
(b) Program/erase routine
(c)
Copy routine 1
(d) Copy routine 2
: Selects Normal mode or User Boot mode.
: Loads program/erase data from an external
source and programs/erases the flash memory.
: Copies routines (a) to (d) into the internal RAM
or external memory.
: Copies routines (a) to (d) from the internal RAM
or external memory into the flash memory.
Note: The above (d) is a routine for reconstructing the program/erase routine on the flash memory. If the
entire flash memory is always programmed and the program/erase routine is included in the new
user application program, this copy routine is not needed.
New user application
program
(TMP91FW40)
(I/O)
Flash memory
(Controller)
Old user application
program
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
(Step-2) Entering User Boot mode (using the reset processing)
After reset release, the reset processing program determines whether or not the
device should enter User Boot mode. If the condition for entering User Boot mode is
true, User Boot mode is entered to program/erase the flash memory.
New user application
program
(TMP91FW40)
(I/O)
0 → 1 RESET
Flash memory
(Controller)
Old user application
program
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
RAM
Condition for
entering User Boot
mode
(user-specified)
(c) Copy routine 1
(d) Copy routine 2
91FW40-48
2008-10-22
TMP91FW40
(Step-3) Copying the program/erase routine
After the device has entered User Boot mode, the copy routine 1 (c) copies the
routines (a) to (d) into the internal RAM or external memory (The routines are copied
into the internal RAM here.)
New user application
program
(I/O)
(TMP91FW40)
Flash memory
(Controller)
Old user application
program
(a) Mode select routine
[Reset processing program]
(b) Program/erase routine
(c) Copy routine 1
(d) Copy routine 2
(a) Mode select routine
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
(Step-4) Erasing the flash memory by the program/erase routine
Control jumps to the program/erase routine in the RAM and the old user program
area is erased (sector erase or chip erase). (In this case, the flash memory erase
command is issued from the RAM.)
Note: If data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, only the
program/erase routine (b) need be copied into the RAM.
New user application
program
(TMP91FW40)
(I/O)
Flash memory
(Controller)
(a) Mode select routine
(b)Program/erase routine
Erased
(c) Copy routine 1
(d) Copy routine 2
RAM
91FW40-49
2008-10-22
TMP91FW40
(Step-5) Restoring the user boot program in the flash memory
The copy routine 2 (d) in the RAM copies the routines (a) to (d) into the flash
memory.
Note:
If data is erased on a sector basis and the routines (a) to (d) are left in the flash memory, step 5 is not
needed.
New user application
program
(I/O)
(TMP91FW40)
(Controller)
Flash memory
(a) Mode select routine
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
(c) Copy routine 1
(d) Copy routine 2
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
(Step-6) Writing the new user application program to the flash memory
The program/erase routine in the RAM is executed to load the new user application
program from the controller into the erased area of the flash memory.
New user application
program
(I/O)
(TMP91FW40)
(Controller)
Flash memory
New user application
program
(a) Mode select routine
[Reset processing program]
(a) Mode select routine
(b) Program/erase routine
(c) Copy routine 1
(d) Copy routine 2
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
91FW40-50
2008-10-22
TMP91FW40
(Step-7) Executing the new user application program
The RESET input pin is driven Low (“0”) to reset the device. The mode setting
condition is set for Normal mode. After reset release, the device will start executing
the new user application program.
(TMP91FW40)
(I/O)
0 → 1 RESET
Flash memory
(Controller)
New user application
program
Condition for entering
Normal mode
[Reset processing program
(a) Mode select routine
(b) Program/erase routine
RAM
(c) Copy routine 1
(d) Copy routine 2
91FW40-51
2008-10-22
TMP91FW40
3.3.5.2 (1-B) Program/Erase Procedure Example 2
In this example, only the boot program (minimum requirement) is stored in the
flash memory and other necessary routines are supplied from the controller.
(Step-1) Environment setup
First, the condition (e.g. pin status) for entering User Boot mode must be set and the
I/O bus for transferring data must be determined. Then, the device’s peripheral
circuitry must be designed and a corresponding program must be written. Before
mounting the device on the board, it is necessary to write the following two routines
into one on the sectors in the flash memory.
(a) Mode select routine
: Selects Normal mode or User Boot mode.
(b) Transfer routine
: Loads the program/erase routine from an
external source. The following routines are
prepared on the controller.
(c) Program/erase routine : Programs/erases the flash memory.
(d) Copy routine 1
: Copies routines (a) and (b) into the internal RAM
or external memory.
(e) Copy routine 2
: Copies routines (a) and (b) from the internal
RAM or external memory into the flash memory.
New user application
program
(I/O)
(c) Program/erase routine
(TMP91FW40)
(d) Copy routine 1
(e) Copy routine 2
Flash memory
Old user application
program
(Controller)
[Reset processing routine]
(a) Mode select routine
RAM
(b) Transfer routine
(Step-2) Entering User Boot mode (using the reset processing)
The following explanation assumes that these routines are incorporated in the reset
processing program. After reset release, the reset processing program first determines
whether or not the device should enter User Boot mode. If the condition for entering
User Boot mode is true, User Boot mode is entered to program/erase the flash memory.
New user application
program
(I/O)
(TMP91FW40)
0 → 1 RESET
Flash memory
Old user application
program
(d) Copy routine 1
(e) Copy routine 2
(Controller)
[Reset processing routine]
(a)Mode Select routine
(c) Program/erase routine
RAM
Condition for
entering User Boot
mode
(user-specified)
(b)Transfer routine
91FW40-52
2008-10-22
TMP91FW40
(Step-3) Copying the program/erase routine to the internal RAM
After the device has entered User Boot mode, the transfer routine (b) transfers the
routines (c) to (e) from the controller to the internal RAM (or external memory). (The
routines are copied into the internal RAM here.)
New user application
program
(c) Program/erase routine
(TMP91FW40)
(d) Copy routine 1
(e) Copy routine 2
(I/O)
(Controller)
Flash memory
Old user application
program
(c) Program/erase routine
[Reset processing routine]
(a) Mode select routine
(d) Copy routine 1
(e) Copy routine 2
(b) Transfer routine
RAM
(Step-4) Executing the copy routine 1 in the internal RAM
Control jumps to the internal RAM and the copy routine 1 (d) copies the routines (a)
and (b) into the internal RAM.
New user application
program
(c) Program/erase routine
(TMP91FW40)
(d) Copy routine 1
(e) Copy routine 2
(I/O)
(Controller)
Flash memory
Old user application
program
(a)Mode select routine
(b) Transfer routine
(c) Program/erase routine
[Reset processing routine]
(a) Mode select routine
(b) Transfer routine
(d) Copy routine 1
(e) Copy routine 2
RAM
91FW40-53
2008-10-22
TMP91FW40
(Step-5) Erasing the flash memory by the program/erase routine
The program/erase routine (c) erases the old user program area.
New user application
program
(TMP91FW40)
(c) Program/erase routine
(I/O)
(d) Copy routine 1
(e) Copy routine 2
(Controller)
Flash memory
(a)Mode select routine
(b)Transfer routine
(c) Program/erase routine
Erased
(d) Copy routine 1
(e) Copy routine 2
RAM
(Step-6) Restoring the user boot program in the flash memory
The copy routine (e) copies the routines (a) and (b) from the internal RAM into the
flash memory.
New user application
program
(c) Program/erase routine
(TMP91FW40)
(d) Copy routine 1
(e) Copy routine 2
(I/O)
(Controller)
Flash memory
(a)Mode select routine
(b) Transfer routine
(c) Program/erase routine
[Reset processing program]
(a) Mode select routine
(b) Transfer routine
(d) Copy routine 1
(e) Copy routine 2
RAM
91FW40-54
2008-10-22
TMP91FW40
(Step-7) Writing the new user application program to the flash memory
The program/erase routine (c) in the RAM is executed to load the new user
application program from the controller into the erased area of the flash memory.
New user application
program
(c) Program/erase routine
(d) Copy routine 1
(e) Copy routine 2
(I/O)
(TMP91FW40)
Flash memory
New user application
program
(Controller)
(a)Mode select routine
(b)Transfer routine
(c) Program/erase routine
[Reset processing program]
(a) Mode select routine
(d) Copy routine 1
(e) Copy routine 2
(b) Transfer routine
RAM
(Step-8) Executing the new user application program
The RESET input pin is driven Low (“0”) to reset the device. The mode setting
condition is set for Normal mode. After reset release, the device will start executing
the new user application program.
(TMP91FW40)
(I/O)
0 → 1 RESET
Flash memory
(Controller)
New user application
program
Condition for
entering Normal
mode
[Reset processing program]
(a)Mode select routine
RAM
(b) Transfer routine
91FW40-55
2008-10-22
TMP91FW40
3.3.6
Flash Memory Command Sequences
The operation of the flash memory is comprised of six commands, as shown in Table
3.3.21. Addresses specified in each command sequence must be in an area where the flash
memory is mapped. For details, see Table 3.3.3.
Table 3.3.21 Command Sequences
Command
1st Bus
Write Cycle
2nd Bus
Write Cycle
3rd Bus
Write Cycle
4th Bus
Write Cycle
5th Bus
Write Cycle
6th Bus
Write Cycle
Addr.
Addr.
Data
Addr.
Data
Sequence
Addr.
Data Addr. Data
Addr.
Data
Data
PA
PD
(Note 1) (Note 1)
1
Single Word Program
AAAH
AAH
554H
55H
AAAH
A0H
2
Sector Erase
(4-KB Erase)
AAAH
AAH
554H
55H
AAAH
80H
AAAH
AAH
554H
55H
SA
(Note 2)
30H
3
Chip Erase
(All Erase)
AAAH
AAH
554H
55H
AAAH
80H
AAAH
AAH
554H
55H
AAAH
10H
4
Product ID Entry
AAAH
AAH
554H
55H
AAAH
90H
Product ID Exit
xxH
F0H
Product ID Exit
AAAH
AAH
554H
55H
AAAH
F0H
Read Protect Set
AAAH
AAH
554H
55H
AAAH
A5H
77EH
F0H
(Note3)
Write Protect Set
AAAH
AAH
554H
55H
AAAH
A5H
77EH
0FH
(Note3)
5
6
Note 1:
PA = Program Word address, PD = Program Word data
Set the address and data to be programmed. Even-numbered addresses should be specified here.
Note 2:
SA = Sector Erase address, Each sector erase range is selected by address A23 to A12.
Note 3:
When apply read protect and write protect, be sure to program the data of 00H.
Table 3.3.22 Hardware Sequence Flags
During auto operation
Status
D7
D6
Single Word Program
D7
Toggle
0
Toggle
Cannot be used
Toggle
Sector Erase/Chip Erase
Read Protect Set/Write Protect
Set
Note: D15 to D8 and D5 to D0 are “don’t care”.
91FW40-56
2008-10-22
TMP91FW40
3.3.6.1 Single Word Program
The Single Word Program command sequence programs the flash memory on a word
basis. The address and data to be programmed are specified in the 4th bus write cycle.
It takes a maximum of 60 μs to program a single word. Another command sequence
cannot be executed until the write operation has completed. This can be checked by
reading the same address in the flash memory repeatedly until the same data is read
consecutively. While a write operation is in progress, bit 6 of data is toggled each time
it is read.
Note:
To rewrite data to Flash memory addresses at which data (including FFFFH) is already written, make
sure to erase the existing data by “sector erase” or “chip erase” before rewriting data.
3.3.6.2 Sector Erase (4-Kbyte Erase)
The Sector Erase command sequence erases 4 Kbytes of data in the flash memory at
a time. The flash memory address range to be erased is specified in the 6th bus write
cycle. For the address range of each sector, see Table 3.3.3. This command sequence
cannot be used in Programmer mode.
It takes a maximum of 75 ms to erase 4 Kbytes. Another command sequence cannot
be executed until the erase operation has completed. This can be checked by reading
the same address in the flash memory repeatedly until the same data is read
consecutively. While an erase operation is in progress, bit 6 of data is toggled each time
it is read.
3.3.6.3 Chip Erase (All Erase)
The Chip Erase command sequence erases the entire area of the flash memory.
It takes a maximum of 300 ms to erase the entire flash memory. Another command
sequence cannot be executed until the erase operation has completed. This can be
checked by reading the same address in the flash memory repeatedly until the same
data is read consecutively. While an erase operation is in progress, bit 6 of data is
toggled each time it is read.
Erase operations clear data to FFH.
3.3.6.4 Product ID Entry
When the Product ID Entry command is executed, Product ID mode is entered. In
this mode, the vendor ID, flash macro ID, flash size ID, and read/write protect status
can be read from the flash memory. In Product ID mode, the data in the flash memory
cannot be read.
3.3.6.5 Product ID Exit
This command sequence is used to exit Product ID mode.
91FW40-57
2008-10-22
TMP91FW40
3.3.6.6 Read Protect Set
The Read Protect Set command sequence applies read protection on the flash
memory. When read protection is applied, the flash memory cannot be read in
Programmer mode and the RAM Transfer command cannot be executed in Single Boot
mode.
To cancel read protection, it is necessary to execute the Chip Erase command
sequence. To check whether or not read protection is applied, read xxx77EH in Product
ID mode. It takes a maximum of 60 μs to set read protection on the flash memory.
Another command sequence cannot be executed until the read protection setting has
completed. This can be checked by reading the same address in the flash memory
repeatedly until the same data can be read consecutively. While a read protect
operation is in progress, bit 6 of data is toggled each time it is read.
3.3.6.7 Write Protect Set
The Write Protect Set command sequence applies write protection on the flash
memory. When write protection is applied, the flash memory cannot be written to in
Programmer mode and the RAM Transfer command cannot be executed in Single Boot
mode.
To cancel write protection, it is necessary to execute the Chip Erase command
sequence. To check whether or not write protection is applied, read xxx77EH in
Product ID mode. It takes a maximum of 60 μs to set write protection. Another
command sequence cannot be executed until the write protection setting has
completed. This can be checked by reading the same address in the flash memory
repeatedly until the same data can be read consecutively. While a write protect
operation is in progress, bit 6 of data is toggled each time it is read.
3.3.6.8 Hardware Sequence Flags
The following hardware sequence flags are available to check the auto operation
execution status of the flash memory.
1)
Data polling (D7)
When data is written to the flash memory, D7 outputs the complement of its
programmed data until the write operation has completed. After the write operation
has completed, D7 outputs the proper cell data. By reading D7, therefore, the operation
status can be checked. While the Sector Erase or Chip Erase command sequence is
being executed, D7 outputs “0”. After the command sequence is completed, D7 outputs
“1” (cell data). Then, the data written to all the bits can be read after waiting for 1 μs.
When read/write protection is applied, the data polling function cannot be used.
Instead, use the toggle bit (D6) to check the operation status.
91FW40-58
2008-10-22
TMP91FW40
2)
Toggle bit (D6)
When the Flash Memory Program, Sector Erase, Chip Erase, Write Protect Set, or
Read Protect Set command sequence is executed, bit 6 (D6) of the data read by read
operations outputs “0” and “1” alternately each time it is read until the processing of
the executed command sequence has completed. The toggle bit (D6) thus provides a
software means of checking whether or not the processing of each command sequence
has completed. Normally, the same address in the flash memory is read repeatedly
until the same data is read successively. The initial read of the toggle bit always
returns “1”.
Note:
The flash memory incorporated in the TMP91FW40 does not have an exceed-time-limit bit (D5). It is
therefore necessary to set the data polling time limit and toggle bit polling time limit so that polling can be
stopped if the time limit is exceeded.
3.3.6.9 Data Read
Data is read from the flash memory in byte units or word units. It is not necessary to
execute a command sequence to read data from the flash memory.
91FW40-59
2008-10-22
TMP91FW40
3.3.6.10
Programming the Flash Memory by the Internal CPU
The internal CPU programs the flash memory by using the command sequences and
hardware sequence flags described above. However, since the flash memory cannot be
read during auto operation mode, the program/erase routine must be executed outside
of the flash memory.
The CPU can program the flash memory either by using Single Boot mode or by
using a user-created protocol in Single Chip mode (User Boot).
1)
Single Boot:
The microcontroller is started up in Single Boot mode to program the flash memory by
the internal boot ROM program. In this mode, the internal boot ROM is mapped to an
area including the interrupt vector table, in which the boot ROM program is executed.
The flash memory is mapped to an address area different from the boot ROM area. The
boot ROM program loads data into the flash memory by serial transfer. In Single Boot
mode, interrupts must be disabled including non-maskable interrupts ( NMI , etc.).
For details, see 3.3.4 “Single Boot Mode”
2)
User Boot:
In this method, the flash memory is programmed by executing a user-created routine
in Single Chip mode (normal operation mode). In this mode, the user-created
program/erase routine must also be executed outside of the flash memory. It is also
necessary to disable interrupts including non-maskable interrupts.
The user should prepare a flash memory program/erase routine (including routines for
loading write data and writing the loaded data into the flash memory). In the main
program, normal operation is switched to flash memory programming operation to
execute the flash memory program/erase routine outside of the flash memory area. For
example, the flash memory program/erase routine may be transferred from the flash
memory to the internal RAM and executed there or it may be prepared and executed in
external memory.
For details, see 3.3.5 “User Boot Mode (in Single Chip Mode)”
91FW40-60
2008-10-22
TMP91FW40
Flowcharts: Flash memory access by the internal CPU
Single Word Program
Start
Program
Program command
command sequence
sequence
(See
(See the
the flowchart
flowchart below)
below)
Toggle bit (D6)
Timeout (60 μs)
Word read
Addr. = Program address
Read data matched
program data?
No
Yes
Word read
Addr. = Program address
Read data matched
program data?
No
Yes
Address = Address + 2
(Even-numbered address/
word units)
No
Last address?
Yes
Program end
Abnormal end
Program Command Sequence (Address/Data)
xxxAAAH/AAH
xxx554H/55H
xxxAAAH/A0H
Even-numbered program address (A0 = 0)
/ program data (word units)
91FW40-61
2008-10-22
TMP91FW40
Chip Erase/Sector Erase
Start
Erase command sequence
(See the flowchart below)
Timeout
(Chip: 300ms, Sector: 75ms)
Toggle bit (D6)
Read data = blank?
No
Yes
Erase end
Note:
Abnormal end
In Chip Erase, whether or not the entire flash memory is blank is checked.
In Sector Erase, whether or not the selected sector is blank is checked.
Sector Erase Command Sequence
(Address/Data)
Chip Erase Command Sequence
(Address/Data)
xxxAAAH/AAH
xxxAAAH/AAH
xxx554H/55H
xxx554H/55H
xxxAAAH/80H
xxxAAAH/80H
xxxAAAH/AAH
xxxAAAH/AAH
xxx554H/55H
xxx554H/55H
xxxAAAH/10H
Sector address/30H
91FW40-62
2008-10-22
TMP91FW40
Read/Write Protect Set
Start
Protect Set command sequence
(See the flowchart below)
Timeout (60μs)
Toggle bit (D6)
Product ID Entry
Byte read (D7 to D0)
Addr. = xxx77EH
Product ID Exit
Read data matched
program data?
No
Yes
Protect Set end
Abnormal end
Protect Set Command Sequence
(Address/Data)
xxxAAAH/AAH
xxx554H/55H
xxxAAAH/A5H
Set read protect
xxx77EH/F0H
Set write protect
xxx77EH/0FH
Set both read protect and write protect
xxx77EH/00H
91FW40-63
2008-10-22
TMP91FW40
Data Polling (D7)
Start
Byte read (D7 to D0)
Addr. = VA
(VA: Valid Address)
No
D7 = Data?
Yes
Operation end
Toggle Bit (D6)
Start
Byte read (D7 to D0)
Addr. = VA
Byte read (D7 to D0)
Addr. = VA
Yes
D6 = Toggle?
No
Operation end
Note: Hardware sequence flags are read from the flash memory in byte units or word units.
VA: In Single Word Program, VA denotes the address to be programmed.
In Sector Erase, VA denotes any address in the selected sector.
In Chip Erase, VA denotes any address in the flash memory.
In Read Protect Set, VA denotes the protect set address (xxx77EH).
In Write Protect Set, VA denotes the protect set address (xxx77EH).
91FW40-64
2008-10-22
TMP91FW40
Product ID Entry
Start
xxxAAAH/AAH
xxx554H/55H
xxxAAAH/90H
Wait for 300 nsec or longer
(ID access and exit time = max. 300 nsec)
[Product ID mode start]
Product ID read
(See the table below)
Read Values in Product ID Mode
Vendor ID
Flash macro ID
Flash size ID
Read/Write
Protect status
Address
Read Value
xxxx00H
xxxx02H
xxxx04H
xxx77EH
98H
42H
1FH
Data programmed when protection is set.
When protection is not set, FFH.
Product ID Exit
Start
Start
xxxAAAH/AAH
xxxxxxH/F0H
xxx554H/55H
Wait for 300 nsec or longer
(ID access and exit time = max. 300 nsec)
xxxAAAH/F0H
Product ID mode end
Wait for 300 nsec or longer
(ID access and exit time = max.300 nsec)
Product ID mode end
91FW40-65
2008-10-22
TMP91FW40
(Example: Program to be loaded and executed in RAM)
Erase the flash memory (chip erase) and then write 0706H to address FE0000H.
;#### Flash memory chip erase processing ####
ld
XIX, 0xFE0000
CHIPERASE:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0x80
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0x10
cal
TOGGLECHK
CHIPERASE_LOOP:
ld
WA, (XIX+)
cp
WA, 0xFFFF
j
ne, CHIPERASE_ERR
cp
XIX, 0xFFFFFF
j
ULT, CHIPERASE_LOOP
;#### Flash memory program processing ####
ld
XIX, 0xFE0000
ld
WA, 0x0706
PROGRAM:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0xA0
ld
(XIX), WA
; set start address
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; 5th bus write cycle
; 6th bus write cycle
; check toggle bit
; read data from flash memory
; blank data?
; if not blank data, jump to error processing
; end address (0xFFFFFF)?
; check entire memory area and then end loop processing
; set program address
; set program data
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
cal
TOGGLECHK
; check toggle bit
ld
cp
j
ld
cp
j
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
; read data from flash memory
PROGRAM_END:
j
PROGRAM_END
;#### Toggle bit (D6) check processing ####
TOGGLECHK:
ld
L, (XIX)
and
L, 0y01000000
ld
H, L
TOGGLECHK1:
ld
L, (XIX)
and
L, 0y01000000
cp
L, H
j
z, TOGGLECHK2
ld
H, L
j
TOGGLECHK1
TOGGLECHK2:
ret
; if programmed data cannot be read, error is determined
; read data from flash memory
; if programmed data cannot be read, error is determined
; program operation end
; check toggle bit (D6)
; save first toggle bit data
; check toggle bit (D6)
; toggle bit = toggled?
; if not toggled, end processing
; save current toggle bit state
; recheck toggle bit
;#### Error processing ####
CHIPERASE_ERR:
j
CHIPERASE_ERR
; chip erase error
PROGRAM_ERR:
j
PROGRAM_ERR
; program error
91FW40-66
2008-10-22
TMP91FW40
(Example: Program to be loaded and executed in RAM)
Erase data at addresses FF0000H to FF0FFFH (sector erase) and then write 0706H to address FF0000H.
;#### Flash memory sector erase processing ####
ld
XIX, 0xFF0000
SECTORERASE:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0x80
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(XIX), 0x30
cal
TOGGLECHK
SECTORERASE_LOOP:
ld
WA, (XIX+)
cp
WA, 0xFFFF
j
ne, SECTORERASE_ERR
cp
XIX, 0xFF0FFF
j
ULT, SECTORERASE_LOOP
;#### Flash memory program processing ####
ld
XIX, 0xFF0000
ld
WA, 0x0706
PROGRAM:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0xA0
ld
(XIX), WA
; set start address
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; 5th bus write cycle
; 6th bus write cycle
; check toggle bit
; read data from flash memory
; blank data?
; if not blank data, jump to error processing
; end address (0xFF0FFF)?
; check erased sector area and then end loop processing
; set program address
; set program data
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
cal
TOGGLECHK
; check toggle bit
ld
cp
j
ld
cp
j
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
BC, (XIX)
WA, BC
ne, PROGRAM_ERR
; read data from flash memory
PROGRAM_END:
j
PROGRAM_END
;#### Toggle bit (D6) check processing ####
TOGGLECHK:
ld
L, (XIX)
and
L, 0y01000000
ld
H, L
TOGGLECHK1:
ld
L, (XIX)
and
L, 0y01000000
cp
L, H
j
z, TOGGLECHK2
ld
H, L
j
TOGGLECHK1
TOGGLECHK2:
ret
; if programmed data cannot be read, error is determined
; read data from flash memory
; if programmed data cannot be read, error is determined
; program operation end
; check toggle bit (D6)
; save first toggle bit data
; check toggle bit (D6)
; toggle bit = toggled?
; If not toggled, end processing
; save current toggle bit state
; Recheck toggle bit
;#### Error processing ####
SECTORERASE_ERR:
j
SECTORERASE_ERR
; sector erase error
PROGRAM_ERR:
j
PROGRAM_ERR
; program error
91FW40-67
2008-10-22
TMP91FW40
(Example: Program to be loaded and executed in RAM)
Set read protection and write protection on the flash memory.
;#### Flash Memory Protect Set processing ####
ld
XIX, 0xFE077E
PROTECT:
ld
(0xFE0AAA), 0xAA
ld
(0xFE0554), 0x55
ld
(0xFE0AAA), 0xA5
ld
(XIX), 0x00
cal
cal
ld
cal
cp
j
TOGGLECHK
PID_ENTRY
A, (XIX)
PID_EXIT
A, 0x00
ne, PROTECT_ERR
; set protect address
; 1st bus write cycle
; 2nd bus write cycle
; 3rd bus write cycle
; 4th bus write cycle
; check toggle bit
;
; read protected address
;
;(0xFE077E)=0x00?
; protected?
PROTECT_END:
j
PROTECT_END
; protect set operation completed
PROTECT_ERR:
j
PROTECT_ERR
; protect set error
;#### Product ID Entry processing ####
PID_ENTRY:
ld
(0xFE0AAA), 0xAA
; 1st bus write cycle
ld
(0xFE0554), 0x55
; 2nd bus write cycle
ld
(0xFE0AAA), 0x90
; 3rd bus write cycle
; --- wait for 300nsec or longer (execute NOP instruction [148nsec/@fFPH=27MHz] three times) --nop
nop
nop
; wait for 444 nsec
ret
;#### Product ID Exit processing ####
PID_EXIT:
ld
(0xFE0000), 0xF0
; 1st bus write cycle
; --- wait for 300nsec or longer (execute NOP instruction [148nsec/@fFPH=27MHz] three times) --nop
nop
nop
; wait for 444 nsec
ret
;#### Toggle bit (D6) check processing ####
TOGGLECHK:
ld
L, (XIX)
and
L, 0y01000000
ld
H, L
TOGGLECHK1:
ld
L, (XIX)
and
L, 0y01000000
cp
L, H
j
z, TOGGLECHK2
ld
H, L
j
TOGGLECHK1
TOGGLECHK2:
ret
; check toggle bit (D6)
; save first toggle bit data
; check toggle bit (D6)
; toggle bit = toggled?
; if not toggled, end processing
; save current toggle bit state
; recheck toggle bit
(Example: Program to be loaded and executed in RAM)
Read data from address FE0000H.
;#### Flash memory read processing ####
READ:
ld
WA, (0xFE0000)
; read data from flash memory
91FW40-68
2008-10-22
TMP91FW40
4.
4.1
Electrical Characteristics
Absolute Maximum Ratings
Parameter
Symbol
Rating
Unit
V
Supply voltage
Vcc
−0.5 to 4.0
Input voltage
VIN
−0.5 to Vcc + 0.5
V
Output current (per pin)
IOL (other than Port8)
2
mA
IOL (Port8)
20
mA
Output current (per pin)
IOH
−2
mA
Output current (total)
Σ IOL (other than Port8)
60
mA
Σ IOL (Port8)
80
mA
Σ IOH
−80
mA
Output current (total)
Power dissipation (Ta = 85°C)
PD
600
mW
Soldering temperature (10 s)
TSOLDER
260
°C
°C
Storage temperature
TSTG
−65 to 150
Operating temperature
TOPR
−40 to 85
°C
Number of Times Program Erase
NEW
100
Cycle
Note: Absolute Maximum ratings are limiting values of operating and environmental conditions that should not
be exceeded under the worst possible conditions. The equipment manufacturer should design so that no
absolute maximum rating value is exceeded. Exposure to conditions beyond those listed above may
cause permanent damage to the device or affect device reliability, which could increase potential risks of
personal injury due to IC blowout and/or burning.
Solderability of lead free products
Test
parameter
Test condition
Solderability
Use of Sn-37Pb solder Bath
Note
Pass:
Solder bath temperature =230°C, Dipping time = 5 seconds
solderability rate until forming ≥ 95%
The number of times = one, Use of R-type flux
Use of Sn-3.0Ag-0.5Cu solder bath
Solder bath temperature =245°C, Dipping time = 5 seconds
The number of times = one, Use of R-type flux (use of lead free)
91FW40-69
2008-10-22
TMP91FW40
4.2
DC Electrical Characteristics (1/2)
Parameter
Symbol
Power supply voltage
AVCC = DVCC
Condition
fc = 8 to 27 MHz
VCC
fc= 8 to 16 MHz
AVSS = DVSS = 0 V
Min
fs = 30 to
34 kHz
2.7
Typ. (Note)
Max
Unit
3.6
V
3.6
V
2.2
Power supply voltage
AVCC = DVCC
AVSS = DVSS = 0 V
VCC
for erase/program
fc = 8 to 27 MHz
2.7
Ta = −10 ∼ 40°C
High-level input voltage
Low-level input voltage
operations of flash memory
P0, P1, P2, P5, P62, P7, P8,
P9, PA, PB
RESET , NMI ,
P60(INT0), P61(INT1)
VIL1
VIL2
AM0, AM1
VIL3
X1
VIL4
P0, P1, P2, P5, P62, P7, P8,
P9, PA, PB
RESET , NMI ,
P60(INT0), P61(INT1)
AM0, AM1
X1
Low-level output voltage
VIH1
VIH2
VIH3
VIH4
VOL
High-level output voltage
VOH
Low-level output current (Port 8)
IOL
Vcc ≥ 2.7 V
0.3 Vcc
Vcc < 2.7 V
0.2 Vcc
Vcc ≥ 2.7 V
0.25 Vcc
Vcc < 2.7 V
0.15 Vcc
−0.3
Vcc ≥ 2.7 V
Vcc < 2.7 V
0.3
V
0.3
Vcc ≥ 2.7 V
0.2 Vcc
Vcc < 2.7 V
0.1 Vcc
Vcc ≥ 2.7 V
0.7 Vcc
Vcc < 2.7 V
0.8 Vcc
Vcc ≥ 2.7 V
0.75 Vcc
Vcc < 2.7 V
0.85 Vcc
Vcc ≥ 2.7 V
Vcc − 0.3
Vcc < 2.7 V
Vcc − 0.3
Vcc ≥ 2.7 V
0.8 Vcc
Vcc < 2.7 V
0.9 Vcc
Vcc + 0.3
IOL = 1.6 mA
Vcc ≥ 2.7 V
0.45
IOL = 0.4 mA
Vcc < 2.7 V
0.15 Vcc
IOH = −400 μA
Vcc ≥ 2.7 V
VOL = 1.0 V
Vcc ≥ 2.7 V
15
VOL = 1.0 V
Vcc ≥ 2.2 V
10
Vcc − 0.3
V
V
V
mA
Note: Ta = 25°C, Vcc = 3.0 V, unless otherwise noted.
91FW40-70
2008-10-22
TMP91FW40
DC Electrical Characteristics (2/2)
Typ. (Note 1)
Max
Input leakage current
Parameter
ILI
Symbol
0.0 ≤ VIN ≤ Vcc
0.02
±5
Output leakage current
ILO
0.2 ≤ VIN ≤ Vcc − 0.2
0.05
±10
Power down voltage
(while RAM is being backed
up in STOP mode)
VSTOP
RESET pull-up resistor
RRST
Pin capacitance
CIO
Schmitt width
RESET , NMI , INT0, INT1
NORMAL
(Note 2)
VTH
Icc
IDLE2
Condition
Min
V IL2 = 0.2 Vcc,
2.2
3.6
Vcc = 2.7 V to 3.6 V
100
400
Vcc = 2.2 V
200
1000
fc = 1 MHz
0.4
Vcc < 2.7 V
0.3
(Note 2)
IDLE2
38
25
30
20
28
fc = 16 MHz
13
18
9
13
Vcc = 2.2 V to 3.6 V
55
75
40
60
35
45
Vcc = 2.2 V to 3.6 V
1
25
Vcc = 2.2 V to 3.6 V
20
fs = 32.768 kHz
IDLE1
STOP
Peak current
Iccp-p
by intermitt operation
pF
50
30
IDLE1
SLOW
kΩ
V
40
Vcc = 2.7 V to 3.6 V
Vcc = 2.2 V to 3.6 V
IDLE2
V
10
Vcc ≥ 2.7 V
fc = 27 MHz
(Note 2)
μA
V IH2 = 0.8 Vcc
IDLE1
NORMAL
Unit
mA
mA
μA
μA
mA
Note 1:
Ta = 25°C, Vcc = 3.0 V, unless otherwise noted.
Note 2:
Test conditions for NORMAL and SLOW Icc: All blocks operating, output pins open, and input pin levels fixed.
When the program is operating by the flash memory, or when data reed from the flash memory, the flash memory operate intermittently.
Therefore, it outputs a peak current like a following diagram, momentarily. In this case, the power supply current; Icc (NORMAL/SLOW
mode) is the sum of average value of a peak current and a MCU current value.
When designing the power supply, set to a circuit which a peak current can be supplyed. In SLOW mode, a defference of peak current
and average current is large.
Program counter (PC)
n
n+2
n+4
Flash current which flows momentarily.
Max. current
Iccp-p
[mA]
Typ. current
The average of Peak current
+ MCU current
MCU current
Flash memory intermittent operation
91FW40-71
2008-10-22
TMP91FW40
4.3
AD Conversion Electrical Characteristics
AVCC=VCC、AVSS=VSS
Parameter
Analog reference voltage（＋）
Symbol
VREFH
Analog reference voltage（－）
VREFL
Analog input voltage
VAIN
Analog current for analog
reference voltage
<VREFON> = 1
<VREFON> = 0
(not including quantization error)
Condition
Typ.
Max
VCC－0.2V
VCC
VCC
Vcc < 2.7 V
VCC
VCC
VCC
Vcc ≥ 2.7V
VSS
VSS
VSS+0.2V
Vcc < 2.7 V
VSS
VSS
VSS
VREFL
IREF
(VREFL=0V)
Total error
Min
Vcc ≥ 2.7V
−
Note 1:
1 LSB = (VREFH − VREFL)/1024 [V]
Note 2:
Minimum operating frequency
Unit
V
VREFH
Vcc ≥ 2.7V
0.94
1.35
Vcc < 2.7 V
0.65
0.90
VCC = 2.2V to 3.6V
0.02
5.0
mA
Vcc ≥ 2.7V
±1.0
±4.0
Vcc < 2.7 V
±1.0
±4.0
μA
LSB
The operation of the AD converter is guaranteed only when the high-fequency oscillator (fc) is used (not guaranteed
with fs).
Note 3:
The supply current flowing through the AVCC pin is included in the VCC pin supply current (ICC).
91FW40-72
2008-10-22
TMP91FW40
4.4
SIO Timing (I/O Interface Mode)
(1) SCLK input mode
Equation
Parameter
16 MHz
Unit
Min
SCLK period
tSCY
Max
16X
→
SCLK rising
/falling edge*
SCLK rising
/falling edge*
SCLK rising
/falling edge*
Valid data input
/falling edge*
SCLK rising
/falling edge*
tOSS
Min
Max
Min
1.0
0.59
140
38
(VCC = 2.2 to 2.7 V )
70
−
tSCY/2 − 4X − 110
Output Data
27 MHz
Symbol
(VCC = 2.7 to 3.6 V)
Max
μs
ns
tSCY/2 − 4X − 180
→ Output Data hold
tOHS
tSCY/2 + 2X + 0
625
370
ns
→ Input Data hold
tHSR
3X + 10
198
121
ns
→ Valid Data hold
tSRD
→
SCLK rising
/falling edge*
tSCY − 0
0
tRDS
1000
592
0
0
16 MHz
27 MHz
ns
ns
(2) SCLK output mode
Equation
Parameter
SCLK period
SCLK rising
Symbol
Unit
Min
Max
Min
Max
Min
Max
tSCY
16X
8192X
1.0
512
0.59
303
tOSS
tSCY/2 − 40
460
256
ns
μs
Output Data
→
SCLK rising
→ Output Data hold
tOHS
tSCY/2 − 40
460
256
ns
→ Input Data hold
tHSR
0
0
0
ns
→ Valid Data hold
tSRD
/falling edge*
SCLK rising
/falling edge*
SCLK rising
/falling edge*
Valid data input
/falling edge*
→
/falling edge*
SCLK rising
/falling edge*
tRDS
tSCY − 1X − 180
1X + 180
757
375
243
217
ns
ns
tSCY
SCLK
Output mode/
active-high input mode
SCLK
(Active-low input mode)
Transmit data
TXD
tOSS
tOHS
0
1
tSRD
Receive data
RXD
0
Valid
tRDS
1
2
3
tHSR
Valid
2
3
Valid
Valid
Note 1:
SCLK rise or fall: Measured relative to the programmed active edge of SCLK.
Note 2:
The values shown in the 27 MHz and 16 MHz columns are measured with tSCY = 16X.
Note 3:
In the above tables, the letter x represents the fFPH cycle period, which is half the system clock (fSYS) cycle period used in
the CPU core. The fFPH cycle period varies depending whether the high-frequency or low frequency oscillator is used.
91FW40-73
2008-10-22
TMP91FW40
4.5
Timer/Counter Input (ECIN) Characteristics
Parameter
Timer/counter input
(ECIN1 to ECIN3 input)
4.6
Symbol
tTC1
Condition
Frequency
measurement mode
Count on a single edge
VCC =2.7 to 3.6 V
Count on both edges
Frequency
measurement mode
Count on a single edge
VCC =2.2 to 2.7 V
Count on both edges
Min
Typ.
−
−
Max
Unit
fc/2
(fc/2 = max. 8MHz)
−
MHz
−
Interrupts
(1) NMI , INT0 and INT1 interrupts
Equation
Parameter
16 MHz
27 MHz
Symbol
Unit
Min
Max
Min
Max
Min
Max
Low pulse width for NMI , INT0, INT1
tINTAL
4X + 40
290
188
ns
High pulse width for NMI , INT0, INT1
tINTAH
4X + 40
290
188
ns
Note 1:
Note 2:
Xc represents the cycle period of the high-frequency oscillator clock (fc).
In the above table, the letter x represents the fFPH cycle period, which is half the system clock (fSYS) cycle period used in
the CPU core. The fFPH cycle period varies depending whether the high-frequency or low frequency oscillator is used.
4.7
Flash Characteristics
(1) Rewriting
Parameter
Condition
Min
Typ
Max
Unit
―
―
100
Times
Vcc = 2.7V to 3.6V,
Gurantee on Flash-memory rewriting
fc = 8 to 27 MHz
Ta = -10 to 40ºC
91FW40-74
2008-10-22
TMP91FW40
4.8
Recommended Crystal Oscillation Circuit
TMP91FW40FG is evaluated by below oscillator vender. When selecting external parts, make
use of this information.
Note:
Total loads value of oscillator is sum of external loads (C1 and C2) and floating loads of
actual assemble board. There is a possibility of miss-operating using C1 and C2 value in
below table. When designing board, it should design minimum length pattern around
oscillator. And we recommend that oscillator evaluation try on your actual using board.
(1) Connection example
X1
XT1
X2
XT2
Rd
Rd
C1
C1
C2
High-frequency oscillator
C2
Low-frequency oscillator
(2) TMP91FW40FG recommended ceramic oscillator
The TMP91FW40FG recommend the high-frequency oscillator by Murata Manufacturing
Co., Ltd.
Please refer to the following URL
http://www.murata.com/
91FW40-75
2008-10-22
TMP91FW40
5.
Port Section Equivalent Circuit Diagrams
• Reading the circuit diagrams
Basically, the gate symbols written are the same as those used for the standard CMOS logic IC
[74HCxx] series.
The dedicated signal is described below.
STOP : This signal becomes active 1 when the HALT mode setting register is set to the STOP
mode (SYSCR2<HALTM1:0> = “01”) and the CPU executes the HALT instruction.
When the drive enable bit SYSCR2<DRVE> is set to “1”, however STOP remains at
“0”.
• The input protection resistance ranges from several tens of ohms to several hundreds of ohms.
■
P0 (SEG24~SEG31), P1 (SEG16~SEG23), P2 (SEG8~SEG15), PB (SEG32~SEG39)
VCC
SEG Output
Output data
P-ch
LCD Output enable
N-ch
Output enable
STOP
Input/Output
Input data
Input enable
■
P5 (AN0~AN3/KWI0~KWI3)
Analog input
Channel select
Analog input
Input
Input data
Input enable
■
P60 (INT0)
Input
Input data
Input enable
91FW40-76
2008-10-22
TMP91FW40
■
P61 (INT1)
Vcc
Output data
P-ch
Output enable
STOP
N-ch
Input/Output
Input data
Input enable
■
P62(ALARM), P70~P75(ECNT1~ECNT3, ECIN1~ECIN3), P91(RXD0), P92(SCLK0/CTS0), P94
(RXD1), P95(SCLK1/CTS1), PA1(RXD2), PA2(SCLK2/CTS2), PA4(RXD3), PA5(SCLK3/CTS3)
VCC
Output data
P-ch
Output enable
STOP
N-ch
Input/Output
Input data
Input enable
■
P80~P83(TC5OUT~TC8OUT), P90(TXD0), P93(TXD1), PA0(TXD2), PA3(TXD3)
VCC
Output data
P-ch
Open-drain
Output enable
N-ch
Output enable
STOP
Input/Output
Input data
Input enable
91FW40-77
2008-10-22
TMP91FW40
■
XT1, XT2
Clock
XT2
Low-frequency
oscillation enable
■
XT1
X1, X2
Oscillator circuit
X2
P-ch
High-frequency
oscillator enable
N-ch
X1
Clock
■
NMI
NMI
Input
Schmitt trigger
■
AM0~AM1
Input
91FW40-78
2008-10-22
TMP91FW40
■
RESET
Vcc
P-ch
Input
Reset
Schmitt trigger
WDTOUT
Reset enable
■
VREFH, VREFL
VREFON
P-ch
VREFH
Ladder resistors
VREFL
91FW40-79
2008-10-22
TMP91FW40
6.
Package
LQFP100-P-1414-0.50F
Unit: mm
91FW40-80
2008-10-22