Safeguarding the Microcontroller under Out-of-Spec Noise Conditions

Application Note, V1.0, Aug. 2007
AP08064
XC866/886/888
Safeguarding the Microcontroller under
Out-of-Spec Noise Conditions
Microcontrollers
Edition 2007-08
Published by
Infineon Technologies AG
81726 München, Germany
© Infineon Technologies AG 2007.
All Rights Reserved.
LEGAL DISCLAIMER
THE INFORMATION GIVEN IN THIS APPLICATION NOTE IS GIVEN AS A HINT FOR THE IMPLEMENTATION
OF THE INFINEON TECHNOLOGIES COMPONENT ONLY AND SHALL NOT BE REGARDED AS ANY
DESCRIPTION OR WARRANTY OF A CERTAIN FUNCTIONALITY, CONDITION OR QUALITY OF THE
INFINEON TECHNOLOGIES COMPONENT. THE RECIPIENT OF THIS APPLICATION NOTE MUST VERIFY
ANY FUNCTION DESCRIBED HEREIN IN THE REAL APPLICATION. INFINEON TECHNOLOGIES HEREBY
DISCLAIMS ANY AND ALL WARRANTIES AND LIABILITIES OF ANY KIND (INCLUDING WITHOUT
LIMITATION WARRANTIES OF NON-INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OF ANY
THIRD PARTY) WITH RESPECT TO ANY AND ALL INFORMATION GIVEN IN THIS APPLICATION NOTE.
Information
For further information on technology, delivery terms and conditions and prices please contact your nearest
Infineon Technologies Office (www.infineon.com).
Warnings
Due to technical requirements components may contain dangerous substances. For information on the types in
question please contact your nearest Infineon Technologies Office.
Infineon Technologies Components may only be used in life-support devices or systems with the express written
approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure
of that life-support device or system, or to affect the safety or effectiveness of that device or system. Life support
devices or systems are intended to be implanted in the human body, or to support and/or maintain and sustain
and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may
be endangered.
AP08064
Safeguarding the Microcontroller Against Noise
XC866/886/888
Revision History: V1.0, 2007-08
Previous Version(s):
none
Page
Subjects (major changes since last revision)
We Listen to Your Comments
Any information within this document that you feel is wrong, unclear or missing at all?
Your feedback will help us to continuously improve the quality of this document.
Please send your proposal (including a reference to this document) to:
[email protected]
Application Note
V1.0, 2007-08
AP08064
Safeguarding the Microcontroller Against Noise
Overview
1
Overview
When the XC866/886/888 is operated under out-of-spec high noise conditions, in a worst
case scenario, it might malfunction though the probability is very low.
Table 1 and Table 2 show extracts of the devices’ data sheets on operating condition
parameters and input/output characteristics respectively. Out-of-spec high noise
conditions refers to these parameter limits being exceeded.
This application note describes the failure mechanisms and the measures that can be
taken to further reduce the probability that such a malfunction might occur.
There are altogether two known failure mechanisms:
•
•
Noise on XTAL1/2
Noise on VDDC
Table 1
Operating Condition Parameters
Parameter
Symbol
Digital power supply voltage
VDDP
VDDP
VSS
VDDC
TA
Digital power supply voltage
Digital ground voltage
Digital core supply voltage
Ambient temperature
Table 2
Limit Values
min.
max.
Unit Notes/
Conditions
4.5
5.5
V
5V devices
3.0
3.6
V
3.3V devices
0
V
2.3
2.7
V
-40
85
°C
SAF-XC8...
-40
125
°C
SAK-XC8...
Input/Output Characteristics (Operating Conditions apply)
Parameter
Symbol
Limit Values
min.
max.
Unit Test Conditions
Remarks
VDDP = 5V Range
Input Hysteresis on port HYS CC
pins1)
0.08 × –
V
XC866 devices
V
XC886/888 devices
VDDP
0.07 × –
VDDP
Input Hysteresis on
XTAL11)
Application Note
HYSX CC
0.07 × –
V
VDDC
4
V1.0, 2007-08
AP08064
Safeguarding the Microcontroller Against Noise
Overview
Table 2
Input/Output Characteristics (Operating Conditions apply)
Parameter
Symbol
Limit Values
min.
max.
Unit Test Conditions
Remarks
VDDP = 3.3V Range
Input Hysteresis on port HYS CC
pins1)
0.03 × –
HYSX CC
0.07 × –
Input Hysteresis on
XTAL11)
V
VDDP
V
VDDC
1) Not subjected to production test, verified by design/characterization. Hysteresis is implemented to avoid
meta stable states and switching due to internal ground bounce. It cannot be guaranteed that it suppresses
switching due to external system noise.
Application Note
5
V1.0, 2007-08
AP08064
Safeguarding the Microcontroller Against Noise
Noise on XTAL1/2
2
Noise on XTAL1/2
The XTAL1 pin supplies the external oscillator input to the XC866/886/888. High noise
on XTAL1/2 distorts the external oscillator input and might cause the PLL to lose its lock
to the oscillator, resulting in a PLL loss-of-lock condition. The PLL is especially more
sensitive to input noise variation under cold temperature (-40°C).
The XC866/886/888 can be made less susceptible to noise by having the following
measures in place:
•
•
Optimized external oscillator and foot point capacitors, where the capacitors are as
large as possible, for example more than 20 pF for a 8 MHz crystal.
An optimized printed circuit board (PCB) layout, for example short traces between
external oscillator and chip.
Note: If the internal on-chip oscillator is used instead of an external oscillator, noise on
XTAL1/2 pins will not result in a PLL loss-of-lock condition nor the subsequent
failure scenario.
2.1
Corruption of Program Counter (PC)
From the time PLL detects the loss-of-lock until the time user software performs a lossof-lock recovery, the system might -- under worst case conditions (for example, at cold
temperature) -- run at a higher frequency than specified.
The higher frequency might cause the CPU to fetch code wrongly from the P-Flash,
which might in turn result in a corrupted program counter (PC). Therefore, it is
recommended that the user software enables PLL NMI (register bit
NMICON.NMIPLL = 1) and disconnects the oscillator (set register bit
PLL_CON.OSCDISC to 1) once the NMI routine is entered upon a PLL loss-of-lock.
Disconnecting the oscillator forces the system to run at the much lower base frequency
(10 to 80 MHz) further divided by the K factor.
2.1.1
Unexpected Program Flow
If the PC is corrupted, it might jump to a random piece of code residing in the program
memory space and execute the code from there, thus causing the device to enter an
unexpected program flow. The Watchdog Timer (WDT) should always be enabled in the
user application such that in the event of an unexpected program flow, the WDT will time
out and trigger a WDT reset.
In the worst case scenario, the part of the code preceding a Flash erase routine call
might be entered. If registers R0-R7 contain non-zero values at this time, the Flash
banks and sectors that are selected by these registers and not protected from erase by
hardware, will be erased.
To avoid the destruction of Flash contents during such an unexpected program flow, the
Flash Erase/Program routines inside the boot ROM include a check for PLL loss-of-lock
Application Note
6
V1.0, 2007-08
AP08064
Safeguarding the Microcontroller Against Noise
Noise on XTAL1/2
(only valid for XC88x devices). In the event of PLL loss-of-lock and the Flash
Erase/Program routine being accidentally called, the flash content will still be safe, as the
Erase/Program operation will not be started.
Note: For the XC88x devices, the program and erase will not proceed as expected if the
PLL NMI flag NMISR.NMIPLL is set. It is important to ensure that the PLL is locked
and the PLL NMI flag is cleared before calling the program and erase subroutines.
To increase the level of protection (especially for XC866 devices) the flash hardware
protection can be used.
2.1.1.1
Enable Flash Hardware Protection
Two hardware protection modes are provided for Flash to protect against unauthorized
code readout and Flash program/erase.
In mode 0, P-Flash is protected from program and erase while D-Flash can only be
erased by having the user software to set register bit MISC_CON.DFLASHEN each time
before an erase operation.
In mode 1, both the P-Flash and D-Flash are protected from program and erase.
In either modes, selecting the Flash that is protected from program and erase for erase
will have no effect.
Application Note
7
V1.0, 2007-08
AP08064
Safeguarding the Microcontroller Against Noise
Noise on VDDC
3
Noise on VDDC
High noise on VDDC pin might cause disturbance on the device’s internal logic. For
example, the Flash or memory read circuitry or peripherals such as the ADC might be
disturbed. Corruption of registers might also occur.
The XC866/886/888 can be made less susceptible to noise by having the following
measures in place:
•
•
A large VDDC stabilizing capacitor in the range of 220 nF or more between VDDC and
VSSC.
An optimized PCB layout, for example short traces between capacitor, VDDC and VSSC
pins.
3.1
Corruption of Program Counter (PC)
The disturbance of the Flash or memory read might also corrupt the PC and cause the
device to enter an unexpected program flow. The consequences and measures to be
taken are similar to those described for the PLL Loss-of-Lock (see Section 2.1.1 and
Section 2.1.1.1).
Application Note
8
V1.0, 2007-08
w w w . i n f i n e o n . c o m
Published by Infineon Technologies AG