Application Note, V1.0, Aug. 2007 AP08064 XC866/886/888 Safeguarding the Microcontroller under Out-of-Spec Noise Conditions Microcontrollers Edition 2007-08 Published by Infineon Technologies AG 81726 München, Germany © Infineon Technologies AG 2007. All Rights Reserved. LEGAL DISCLAIMER THE INFORMATION GIVEN IN THIS APPLICATION NOTE IS GIVEN AS A HINT FOR THE IMPLEMENTATION OF THE INFINEON TECHNOLOGIES COMPONENT ONLY AND SHALL NOT BE REGARDED AS ANY DESCRIPTION OR WARRANTY OF A CERTAIN FUNCTIONALITY, CONDITION OR QUALITY OF THE INFINEON TECHNOLOGIES COMPONENT. THE RECIPIENT OF THIS APPLICATION NOTE MUST VERIFY ANY FUNCTION DESCRIBED HEREIN IN THE REAL APPLICATION. INFINEON TECHNOLOGIES HEREBY DISCLAIMS ANY AND ALL WARRANTIES AND LIABILITIES OF ANY KIND (INCLUDING WITHOUT LIMITATION WARRANTIES OF NON-INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OF ANY THIRD PARTY) WITH RESPECT TO ANY AND ALL INFORMATION GIVEN IN THIS APPLICATION NOTE. Information For further information on technology, delivery terms and conditions and prices please contact your nearest Infineon Technologies Office (www.infineon.com). Warnings Due to technical requirements components may contain dangerous substances. For information on the types in question please contact your nearest Infineon Technologies Office. Infineon Technologies Components may only be used in life-support devices or systems with the express written approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure of that life-support device or system, or to affect the safety or effectiveness of that device or system. Life support devices or systems are intended to be implanted in the human body, or to support and/or maintain and sustain and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may be endangered. AP08064 Safeguarding the Microcontroller Against Noise XC866/886/888 Revision History: V1.0, 2007-08 Previous Version(s): none Page Subjects (major changes since last revision) We Listen to Your Comments Any information within this document that you feel is wrong, unclear or missing at all? Your feedback will help us to continuously improve the quality of this document. Please send your proposal (including a reference to this document) to: [email protected] Application Note V1.0, 2007-08 AP08064 Safeguarding the Microcontroller Against Noise Overview 1 Overview When the XC866/886/888 is operated under out-of-spec high noise conditions, in a worst case scenario, it might malfunction though the probability is very low. Table 1 and Table 2 show extracts of the devices’ data sheets on operating condition parameters and input/output characteristics respectively. Out-of-spec high noise conditions refers to these parameter limits being exceeded. This application note describes the failure mechanisms and the measures that can be taken to further reduce the probability that such a malfunction might occur. There are altogether two known failure mechanisms: • • Noise on XTAL1/2 Noise on VDDC Table 1 Operating Condition Parameters Parameter Symbol Digital power supply voltage VDDP VDDP VSS VDDC TA Digital power supply voltage Digital ground voltage Digital core supply voltage Ambient temperature Table 2 Limit Values min. max. Unit Notes/ Conditions 4.5 5.5 V 5V devices 3.0 3.6 V 3.3V devices 0 V 2.3 2.7 V -40 85 °C SAF-XC8... -40 125 °C SAK-XC8... Input/Output Characteristics (Operating Conditions apply) Parameter Symbol Limit Values min. max. Unit Test Conditions Remarks VDDP = 5V Range Input Hysteresis on port HYS CC pins1) 0.08 × – V XC866 devices V XC886/888 devices VDDP 0.07 × – VDDP Input Hysteresis on XTAL11) Application Note HYSX CC 0.07 × – V VDDC 4 V1.0, 2007-08 AP08064 Safeguarding the Microcontroller Against Noise Overview Table 2 Input/Output Characteristics (Operating Conditions apply) Parameter Symbol Limit Values min. max. Unit Test Conditions Remarks VDDP = 3.3V Range Input Hysteresis on port HYS CC pins1) 0.03 × – HYSX CC 0.07 × – Input Hysteresis on XTAL11) V VDDP V VDDC 1) Not subjected to production test, verified by design/characterization. Hysteresis is implemented to avoid meta stable states and switching due to internal ground bounce. It cannot be guaranteed that it suppresses switching due to external system noise. Application Note 5 V1.0, 2007-08 AP08064 Safeguarding the Microcontroller Against Noise Noise on XTAL1/2 2 Noise on XTAL1/2 The XTAL1 pin supplies the external oscillator input to the XC866/886/888. High noise on XTAL1/2 distorts the external oscillator input and might cause the PLL to lose its lock to the oscillator, resulting in a PLL loss-of-lock condition. The PLL is especially more sensitive to input noise variation under cold temperature (-40°C). The XC866/886/888 can be made less susceptible to noise by having the following measures in place: • • Optimized external oscillator and foot point capacitors, where the capacitors are as large as possible, for example more than 20 pF for a 8 MHz crystal. An optimized printed circuit board (PCB) layout, for example short traces between external oscillator and chip. Note: If the internal on-chip oscillator is used instead of an external oscillator, noise on XTAL1/2 pins will not result in a PLL loss-of-lock condition nor the subsequent failure scenario. 2.1 Corruption of Program Counter (PC) From the time PLL detects the loss-of-lock until the time user software performs a lossof-lock recovery, the system might -- under worst case conditions (for example, at cold temperature) -- run at a higher frequency than specified. The higher frequency might cause the CPU to fetch code wrongly from the P-Flash, which might in turn result in a corrupted program counter (PC). Therefore, it is recommended that the user software enables PLL NMI (register bit NMICON.NMIPLL = 1) and disconnects the oscillator (set register bit PLL_CON.OSCDISC to 1) once the NMI routine is entered upon a PLL loss-of-lock. Disconnecting the oscillator forces the system to run at the much lower base frequency (10 to 80 MHz) further divided by the K factor. 2.1.1 Unexpected Program Flow If the PC is corrupted, it might jump to a random piece of code residing in the program memory space and execute the code from there, thus causing the device to enter an unexpected program flow. The Watchdog Timer (WDT) should always be enabled in the user application such that in the event of an unexpected program flow, the WDT will time out and trigger a WDT reset. In the worst case scenario, the part of the code preceding a Flash erase routine call might be entered. If registers R0-R7 contain non-zero values at this time, the Flash banks and sectors that are selected by these registers and not protected from erase by hardware, will be erased. To avoid the destruction of Flash contents during such an unexpected program flow, the Flash Erase/Program routines inside the boot ROM include a check for PLL loss-of-lock Application Note 6 V1.0, 2007-08 AP08064 Safeguarding the Microcontroller Against Noise Noise on XTAL1/2 (only valid for XC88x devices). In the event of PLL loss-of-lock and the Flash Erase/Program routine being accidentally called, the flash content will still be safe, as the Erase/Program operation will not be started. Note: For the XC88x devices, the program and erase will not proceed as expected if the PLL NMI flag NMISR.NMIPLL is set. It is important to ensure that the PLL is locked and the PLL NMI flag is cleared before calling the program and erase subroutines. To increase the level of protection (especially for XC866 devices) the flash hardware protection can be used. 2.1.1.1 Enable Flash Hardware Protection Two hardware protection modes are provided for Flash to protect against unauthorized code readout and Flash program/erase. In mode 0, P-Flash is protected from program and erase while D-Flash can only be erased by having the user software to set register bit MISC_CON.DFLASHEN each time before an erase operation. In mode 1, both the P-Flash and D-Flash are protected from program and erase. In either modes, selecting the Flash that is protected from program and erase for erase will have no effect. Application Note 7 V1.0, 2007-08 AP08064 Safeguarding the Microcontroller Against Noise Noise on VDDC 3 Noise on VDDC High noise on VDDC pin might cause disturbance on the device’s internal logic. For example, the Flash or memory read circuitry or peripherals such as the ADC might be disturbed. Corruption of registers might also occur. The XC866/886/888 can be made less susceptible to noise by having the following measures in place: • • A large VDDC stabilizing capacitor in the range of 220 nF or more between VDDC and VSSC. An optimized PCB layout, for example short traces between capacitor, VDDC and VSSC pins. 3.1 Corruption of Program Counter (PC) The disturbance of the Flash or memory read might also corrupt the PC and cause the device to enter an unexpected program flow. The consequences and measures to be taken are similar to those described for the PLL Loss-of-Lock (see Section 2.1.1 and Section 2.1.1.1). Application Note 8 V1.0, 2007-08 w w w . i n f i n e o n . c o m Published by Infineon Technologies AG