 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| 32bit TX System RISC TX19 family TMP1942FDU/XBG Rev1.0 March 29, 2007 TMP1942FD 32-Bit RISC Microprocessor TX19 Family TMP1942FDU/FDXBG 1. Features The TX19 is a family of high-performance 32-bit microprocessors that offers the speed of a 32-bit RISC solution with the added advantage of a significantly reduced code size of a 16-bit architecture. The instruction set of the TX19 includes as a subset the 32-bit instructions of the TX39, which is based on the MIPS R3000ATM architecture. Additionally, the TX19 supports the MIPS16 Application-Specific Extensions (ASE) for improved code density. The TMP1942 is built on a TX19 core processor and a selection of intelligent peripherals. The TMP1942 is suitable for low-voltage and low-power applications. Features of the TMP1942 include the following: RESTRICTIONS ON PRODUCT USE * The information contained herein is subject to change without notice. 021023_D 070122EBP * TOSHIBA is continually working to improve the quality and reliability of its products. Nevertheless, semiconductor devices in general can malfunction or fail due to their inherent electrical sensitivity and vulnerability to physical stress. It is the responsibility of the buyer, when utilizing TOSHIBA products, to comply with the standards of safety in making a safe design for the entire system, and to avoid situations in which a malfunction or failure of such TOSHIBA products could cause loss of human life, bodily injury or damage to property. In developing your designs, please ensure that TOSHIBA products are used within specified operating ranges as set forth in the most recent TOSHIBA products specifications. Also, please keep in mind the precautions and conditions set forth in the "Handling Guide for Semiconductor Devices," or "TOSHIBA Semiconductor Reliability Handbook" etc. 021023_A * The TOSHIBA products listed in this document are intended for usage in general electronics applications (computer, personal equipment, office equipment, measuring equipment, industrial robotics, domestic appliances, etc.). These TOSHIBA products are neither intended nor warranted for usage in equipment that requires extraordinarily high quality and/or reliability or a malfunction or failure of which may cause loss of human life or bodily injury ("Unintended Usage"). Unintended Usage include atomic energy control instruments, airplane or spaceship instruments, transportation instruments, traffic signal instruments, combustion control instruments, medical instruments, all types of safety devices, etc. Unintended Usage of TOSHIBA products listed in this document shall be made at the customer's own risk. 021023_B * The products described in this document shall not be used or embedded to any downstream products of which manufacture, use and/or sale are prohibited under any applicable laws and regulations. 060106_Q * The information contained herein is presented only as a guide for the applications of our products. No responsibility is assumed by TOSHIBA for any infringements of patents or other rights of the third parties which may result from its use. No license is granted by implication or otherwise under any patents or other rights of TOSHIBA or the third parties. 070122_C * The products described in this document are subject to foreign exchange and foreign trade control laws. 060925_E * For a discussion of how the reliability of microcontrollers can be predicted, please refer to Section 1.3 of the chapter entitled Quality and Reliability Assurance/Handling Precautions. 030619_S TMP1942FD-1 TMP1942FD (1) TX19 core processor 1) Two instruction set architecture (ISA) modes: 16-bit ISA for code efficiency and 32-bit ISA for performance. * * 2) The 16-bit ISA is object-code compatible with the code-efficient MIPS16TM ASE. The 32-bit ISA is object-code compatible with the high-performance TX39 family. High performance combined with low power consumption - High performance * * * * * * * Single clock cycle execution for most instructions 3-operand arithmetic instructions for high instruction throughput 5-stage pipeline On-chip high-speed memory DSP function: Executes 32-bit x 32-bit multiply operations in a single clock cycle. Optimized design using a low-power cell library Programmable standby modes in which processor clocks are stopped Distinct starting locations for each interrupt service routine Automatically generated vectors for each interrupt source Automatic updates of the interrupt mask level - Low power consumption 3) Fast interrupt response suitable for real-time control * * * (2) On-chip RAM: TMP1942FDU/FDXB On-chip FROM TMP1942FDU/FDXB 512 KB 20 KB ROM correction function (8 words x 4 blocks) (In the flash-version product, only the registers exist and no correction is performed.) (3) External memory expansion * * * * * * * 16-Mbyte off-chip address space for code and data External bus interface with dynamic bus sizing for 8-bit and 16-bit data ports Interrupt- or software-triggered 12-channel 8-bit interval timer 6-channel 16-bit interval timer 6-channel 8-bit PPG output Two channels support two-phase input pulse counter mode. (4) 4-channel DMA controller (5) 6-channel 8-bit PWM timer (6) 14-channel 16-bit timer (7) 1-channel RTC timer (8) 5-channel general-purpose serial interface * Supports both UART and synchronous transfer modes. TMP1942FD-2 TMP1942FD (9) 1-channel serial bus interface * * Either I2C bus mode or clock-synchronous mode can be selected. Conversion time: 2 s (throughput), 4 s to 5 s (latency) (10) 16-channel 10-bit A/D converter (with internal sample/hold) (11) 3-channel 10-bit D/A converter (12) Watchdog timer (13) 4-channel chip select/wait controller (14) Interrupt sources * * * 4 CPU interrupts: software interrupt instruction 45 internal interrupts: 7 priority levels, with the exception of the watchdog timer interrupt 29 external interrupts: 7 priority levels, with the exception of the NMI interrupt Of the 29, 14 are used for key-on wakeup and share an interrupt vector. INTB, INTC, INTD, and INTE are extended interrupts which share an interrupt vector and are distinguished by flags. Therefore, a total of 13 interrupt sources are available. (15) 108-pin input/output ports (16) Three standby (HALT) modes * * * * IDLE, SLEEP, STOP RTC clock: Low-speed clock (32.768 kHz) On-chip PLL (x4) Clock gear: Divides the high-speed clock to 1/2, 1/4, or 1/8. (17) Dual clocks (18) Clock generator (19) Operating voltage range: 2.7 V to 3.6 V 2.7 V to 3.6 V or 4.5 V to 5.25 V for Port C and Port F supporting 5-V operation (20) Operating frequency * * * * 32 MHz (Vcc 3.0 V) (Interleave mode) 28 (Vcc 2.7 V) 144-pin QFP (16 mm x16 mm x 1.4 mm thick, 0.4 mm pitch): TMP1942FDU 177-pin CSP (13 mm x 13 mm x 1.4 mm thick, 0.8 mm pitch): TMP1942FDXBG (21) Packages Note: The TMP1942FDXBG packaged in a 177-pin CSP is under development. TMP1942FD-3 TMP1942FD TX19/L Proccessor Core TX19 CPU MAC DSU 512 KB Flash ROM 20 KB RAM 6 KB BOOT ROM ROM correction X1 X2 XT1 (PD6) XT2 (PD7) SCOUT (P44) PLLOFF DMAC (4ch) NMI INT0 (PF6) INT12 (PE67) INT34 (PA01) INT56 (PA34) INT7 (PB7) INT8A (PC02) AN07 (P5057) AN815 (P6067) ADTRG (P57) AVCC/AVSS VREFH/VREFL CG G-Bus INTC EBIF RESET I/Obus I/F 10-bit ADC (16ch) BW0/1 INTLV (PE7) DAOUT03 DAVCC/DAVSS DAREFH 10-bit DAC (3ch) PORT0 AD07 (P00P07) TXD0 (PD0) RXD0 (PD1) SCLK0/CTS0 (PD2) PORT1 SIO0 PORT2 AD8/A8AD15/A15 (P10P17) A0/A16A7/A23 (P20P27) TXD1 (PD3) RXD1 (PD4) SCLK1/CTS1 (PD5) RD (P30) TXD3 (PE0) RXD3 (PE1) SCLK3/CTS3 (PE2) WR (P31) HWR (P32) WAIT (P33) BUSRQ (P34) BUSAK (P35) R/W (P36) P37(DSU) SIO1 SIO3 PORT3 SCK (PF3) SO/SDA (PF4) SI/SCL (PF5) TXD4 (PE3) RXD4 (PE4) SCLK4/CTS4 (PE5) TXD5 (PF0) RXD5 (PF1) SCLK5/CTS5 (PF2) TB4IN1 (PB5), TB7IN01 (P9596), TB8IN01 (PC67), TB9IN01 (PD01), TBAIN01 (PD56), TB0OUT (PA2), TB1OUT (PA5), TB2OUT (PB2), TB3OUT (PB5), TA1OUT (PA6), TA3OUT (PB6), TA5OUT (PC3), TA0IN (PA7), TA2IN (PB7), TA4IN (PC0), TB0IN01 (PA01) TB1IN01 (PA34) TB2IN01 (PB01) TB3IN01 (PB34) TB4IN0 (PB2) TB4OUT (P92) TB5OUT (P93) TB6OUT (P94) TB7OUT (P97) TA7OUT (PC5) TA9OUT (PC7) TABOUT (PD5) TA6IN (PC1) TA8IN (PC2) TAAIN (PC4) SERIAL BUS I/F SIO4 PORT4 CS0CS3 (P40P43) SIO5 WDT 16-bit TMR0-D (14ch) Real-Time Counter (RTC) INTBCDE 8-bit TMR0/1 A/B (12ch) INTBC (PB01) INTDE (PB34) KWUP JTAG Figure1.1.1 TMP1942 Block Diagram TMP1942FD-4 TMP1942FD 2. Signal Descriptions This section contains pin assignments for the TMP1942FD as well as brief descriptions of the TMP1942FD input and output signals. 2.1 Pin Assignments Table 2.1.1 lists the pin assignments for the TMP1942FD in a 144-pin package. 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 TMP1942FD-5 TMP1942FD Table 2.1.1 144-Pin LQFP Pin Assignments Pin # 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 Pin Function VREFH VREFL P50/AN0 P51/AN1 P52/AN2 P53/AN3 DAVCC DAVSS DAREH DAOUT0 DAOUT1 DAOUT2 P54/AN4 P55/AN5 P56/AN6 P57/AN7/ ADTRG P60/AN8/KEY0 DVSS P61/AN9/KEY1 P62/AN10/KEY2 P63/AN11/KEY3 P64/AN12/KEY4 P65/AN13/KEY5 P66/AN14/KEY6 P67/AN15/KEY7 DVCC3 P00/AD0 P01/AD1 P02/AD2 P03/AD3 P04/AD4 P05/AD5 P06/AD6 P07/AD7 DVSS P10/AD8/A8 Pin #. 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 Pin Function P11/AD9/A9 P12/AD10/A10 P13/AD11/A11 P14/AD12/A12 P15/AD13/A13 P16/AD14/A14 P17/AD15/A15 P20/A0/A16 P21/A1/A17 P22/A2/A18 P23/A3/A19 P24/A4/A20 P25/A5/A21 P26/A6/A22 P27/A7/A23 TEST0 PLLOFF Pin # 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 Pin Function P90/KEY8/DCLK P91/KEY9/PCST2 P92/TB4OUT/PCST1 P93/TB5OUT/PCST0 P94/TB6OUT/SDAO/TPC P95/TB7IN0/ DBGE P96/TB7IN1/ DINT P97/TB7OUT/ DRESET DVCC3 PA0/TB0IN0/INT3 PA1/TB0IN1/INT4 PA2/TB0OUT PA3/TB1IN0/INT5 PA4/TB1IN1/INT6 PA5/TB1OUT PA6/TA1OUT PA7/TA0IN/KEYA DVSS RSTPUP PC0/TA4IN/INT8 PC1/TA6IN/INT9 PC2/TA8IN/INTA PC3/TA5OUT PC4/TAAIN PC5/TA7OUT PC6/TB8IN0/KEYC PC7/TB8IN1/TA9OUT DVCC52 PF0/TXD5 PF1/RXD5/KEYD PF2/SCLK5/ CTS5 PF3/SCK PF4/SO/SDA PF5/SI/SCL PF6/INT0 DVCC51 Pin # 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 CVCC X2 CVSS X1 Pin Function TEST1 RESET PD6/XT1 PD7/XT2 NMI BW0 PB0/TB2IN0/INTB PB1/TB2IN1/INTC PB2/TB2OUT/TB4IN0 PB3/TB3IN0/INTD PB4/TB3IN1/INTE PB5/TB3OUT/TB4IN1 PB6/TA3OUT DVSS DVCC3 PB7/TA2IN/INT7/KEYB PD0/TXD0/TB9IN0 PD1/RXD0/TB9IN1 PD2/SCLK0/ CTS0 PD3/TXD1/TBAIN0 PD4/RXD1/TBAIN1 PD5/SCLK1/ CTS1 /TABOUT PE0/TXD3 PE1/RXD3 PE2/SCLK3/ CTS3 PE3/TXD4 PE4/RXD4 PE5/SCLK4/ CTS4 PE6/INT1/ BOOT PE7/INT2/INTLV AVCC AVSS FVSS ALE DVCC3 BW1 P30/ RD P31/ WR P32/ HWR P33/ WAIT P34/ BUSRQ P35/ BUSAK P36/ R / W P37/ DSU DVSS FVCC P40/ CS0 P41/ CS1 P42/ CS2 P43/ CS3 P44/SCOUT TMP1942FD-6 TMP1942FD Table 2.2.2 lists the pin assignments for the TMP1942FD in a 177-pin package. A1 B1 C1 D1 E1 F1 G1 H1 J1 K1 L1 M1 N1 P1 R1 A2 B2 C2 D2 E2 F2 G2 H2 J2 K2 L2 M2 N2 P2 R2 A3 B3 C3 D3 E3 F3 G3 H3 J3 K3 L3 M3 N3 P3 R3 A4 B4 C4 D4 E4 F4 G4 H4 J4 K4 L4 M4 N4 P4 R4 A5 B5 C5 D5 A6 B6 C6 D6 A7 B7 C7 D7 A8 B8 C8 D8 A9 B9 C9 D9 A10 B10 C10 D10 A11 B11 C11 D11 A12 B12 C12 D12 E12 F12 G12 H12 J12 K12 L12 A13 B13 C13 D13 E13 F13 G13 H13 J13 K13 L13 M13 N13 P13 R13 A14 B14 C14 D14 E14 F14 G14 H14 J14 K14 L14 M14 N14 P14 R14 A15 B15 C15 D15 E15 F15 G15 H15 J15 K15 L15 M15 N15 P15 R15 M5 N5 P5 R5 M6 N6 P6 R6 M7 N7 P7 R7 M8 N8 P8 R8 M9 N9 P9 R9 M10 N10 P10 R10 M11 N11 P11 R11 M12 N12 P12 R12 TMP1942FD-7 TMP1942FD Table 2.1.2 177-Pin CSP Pin Assignments Pin # A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 B14 B15 C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13 C14 C15 Pin Function VREFL AVSS AVCC PE7/INT2/INTLV PE3/TXD4 TCK (JTAG) PD2/SCLK0/ CTS0 PB5/TB3OUT/ TB4IN1 PB1/TB2IN1/INTC PD7/TX2 PD6/TX1 X1 X2 CVCC NC NC NC PE6/INT1 PE4/RXD4 TRST (JTAG) Pin # D1 D2 D3 D4 D5 D6 D7 D8 D9 D10 D11 D12 D13 D14 D15 E1 E2 E3 E4 E5 E12 E13 E14 E15 F1 F2 F3 F4 F12 F13 F14 F15 G1 G2 G3 G4 G12 G13 G14 G15 H1 H2 H3 H4 H12 Pin Function P50/AN0 DAVSS P52/AN2 P51/AN1 PE0/TXD3 PD3/TXD1/TBAIN0 PB7/TA2IN/INT7/ KEYB DVSS PB2/TB2OUT/ TB4IN0 NMI Pin # H13 H14 H15 J1 J2 J3 J4 J12 J13 J14 J15 K1 K2 K3 K4 K12 K13 K14 K15 L1 L2 L3 L4 L12 L13 L14 L15 M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11 M12 M14 M15 N1 N2 N3 NC NC DVSS Pin Function Pin # N4 N5 N6 N7 N8 N9 N10 N11 N12 N13 N14 N15 P1 P2 P3 P4 P5 P6 P7 P8 P9 P10 P11 P12 P13 P14 P15 R1 R2 R3 R4 R5 R6 R7 R8 R9 R10 R11 R12 R13 R14 R15 Pin Function P16/AD14/A14 P21/A1/A17 P25/A5/A21 DVSS TEST0 P30/ RD P32/ HWR P37/ DSU DVSS P41/ CS1 P91/KEY9 NC NC P10/AD8/A8 P12/AD10/A10 P20/A0/A16 P22/A2/A18 P26/A6/A22 TDO (JTAG) ALE BW1 P33/ WAIT TDI (JTAG) P40/ CS0 P42/ CS2 P44/SCOUT NC P11/AD9/A9 NC NC P13/AD11/A11 P17/AD15/A15 P23/A3/A19 P27/A7/A23 NC P31/ WR P35/ BUSAK DVCC3 P43/ CS3 NC NC P90/KEY8 P67/AN15/KEY7 P65/AN13/KEY5 P66/AN14/KEY6 P64/AN12/KEY4 PA6/TA1OUT PA7/TA0IN/KEYA NC PA5/TB1OUT P01/AD1 DVCC3 NC NC PA2/TB0OUT PA3/TB1IN0/INT5 PA4/TB1IN1/INT6 PA1/TB0IN1/INT4 P04/AD4 P02/AD2 TMS (JTAG) P00/AD0 P97/TB7OUT DVCC3 PA0/TB0IN0/INT3 P96/TB7IN1 P07/AD7 P05/AD5 P03/AD3 P14/AD12/A12 P15/AD13/A13 P24/A4/A20 PLLOFF NC NC PF1/RXD5/KEYD PF3/SCK PF6/INT0 DAVCC DAOUT0 DAREFH P53/AN3 NC(not bonded) PC6/TB8IN0/KEYC DVCC52 PF0/TXD5 PF2/SCLK5/ CTS5 DAOUT1 P55/AN5 P54/AN4 DAOUT2 PC2/TA8IN/INTA PC4/TAAIN PC5/TA7OUT PC7/TB8IN1/ TA9OUT P56/AN6 P61/AN9/KEY1 NC P60/AN8/KEY0 PC0/TA4IN/INT8 PC1/TA6IN/INT9 NC PC3/TA5OUT DVSS P63/AN11/KEY3 P57/AN7/ ADTRG P62/AN10/KEY2 RSTPUP PD5/SCLK1/ CTS1 / TABOUT PD0/TXD0/TB9IN0 DVCC3 PB4/TB3IN1/INTE PB0/TB2IN0/INTB NC RESET CVSS DVCC51 NC VREFH NC PE5/SCLK4/ CTS4 PE2/SCLK3/ CTS3 PE1/RXD3 PD4/RXD1/TBAIN1 PD1/RXD0/TB9IN1 PB6/TA3OUT PB3/TB3IN0/INTD BW0 NC TEST1 PF4/SO/SDA PF5/SI/SCL NC NC DVCC3 P34/ BUSRQ P36/ R / W P93/TB5OUT P95/TB7IN0 P92/TB4OUT NC DVSS P06/AD6 M13 P94/TB6OUT TMP1942FD-8 TMP1942FD 2.2 Pin Usage Information Table 2.2.1 lists the input and output pins of the TMP1942FD, including alternate pin names and functions for multi-function pins. Table 2.2.1 Pin Names and Functions Pin Name P00-P07 AD0-AD7 P10-P17 AD8-AD15 A8-A15 P20-P27 A0-A7 A16-A23 P30 RD # of Pins 8 8 Type Input/Output Input/Output Input/Output Input/Output Output Function Port 0: Individually programmable as input or output Address (Lower): Bits0-7 of the address/data bus Port 1: Individually programmable as input or output Address/Data (Upper): Bits 8-15 of the address/data bus Address: Bits 8-15 of the address bus Port 2: Individually programmable as input or output Address: Bits 0-7 of the address bus Address: Bits 16-23 of the address bus Port 30: Output-only Read Strobe: Asserted during a read operation from an external memory device Port 31: Output-only Write Strobe: Asserted during a write operation on D0-D7 Port 32: Programmable as input or output (with internal pull-up resistor) Higher Write Strobe: Asserted during a write operation on D8-D15 Port 33: Programmable as input or output (with internal pull-up resistor) Wait: Causes the CPU to suspend external bus activity Port 34: Programmable as input or output (with internal pull-up resistor) Bus Request: Asserted by an external bus master to request bus mastership Port 35: Programmable as input or output (with internal pull-up resistor) Bus Acknowledge: Indicates that the CPU has relinquished the bus in response to BUSRQ 8 Input/Output Output Output 1 1 1 1 1 1 Output Output Output Output Input/Output Output Input/Output Input Input/Output Input Input/Output Output P31 WR P32 HWR P33 WAIT P34 BUSRQ P35 BUSAK P36 R/W 1 Input/Output Output Port 36: Programmable as input or output (with internal pull-up resistor) Read/Write: Indicates the direction of data transfer on the bus: 1 = read or dummy cycle, 0 = write cycle Port 37: Programmable as input or output (with internal pull-up resistor) DSU enable signal: DSU is enabled when this pin is sampled low at the rising edge of RESET . To enable DSU, this pin should be pulled down. (Flash version only) Port 40: Programmable as input or output (with internal pull-up resistor) Chip Select 0: Asserted low to enable external devices at programmed addresses Port 41: Programmable as input or output (with internal pull-up resistor) Chip Select 1: Asserted low to enable external devices at programmed addresses Port 42: Programmable as input or output (with internal pull-up resistor) Chip Select 2: Asserted low to enable external devices at programmed addresses Port 43: Programmable as input or output (with internal pull-up resistor) Chip Select 3: Asserted low to enable external devices at programmed addresses Port 44: Programmable as input or output System Clock Output: Drives out a clock signal at the same frequency as the CPU clock (high-speed or low-speed) Port 5: Input-only Analog Input: Input to the on-chip A/D converter External A/D trigger pin for starting an A/D conversion (multiplexed with P57) Port 6: Input-only Analog Input: Input to the on-chip A/D converter Key-On Wakeup Input (dynamic pull-up selectable) (with internal pull-up resistor) Port 90: Programmable as input or output DSU pin Key-On Wakeup Input (dynamic pull-up selectable) (with internal pull-up resistor) Port 91: Programmable as input or output DSU pin Key-On Wakeup Input (dynamic pull-up selectable) (with internal pull-up resistor) P37 DSU 1 Input/Output Input P40 CS0 1 1 1 1 1 Input/Output Output Input/Output Output Input/Output Output Input/Output Output Input/Output Output P41 CS1 P42 CS2 P43 CS3 P44 SCOUT P50-P57 AN0-AN7 ADTRG 8 Input Input Input P60-P67 AN8-AN15 KEY0-KEY7 P90 DSU (DCLK) KEY8 P91 DSU (PCST2) KEY9 1 Input/Output Input Input 1 Input/Output Output Input 1 Input/Output Output Input TMP1942FD-9 TMP1942FD Pin Name P92 DSU (PCST1) TB40UT P93 DSU (PCST0) TB5OUT P94 DSU (SDAO/TPC) TB6OUT P95 DSU ( DBGE ) TB7IN0 P96 DSU ( DINT ) TB7IN1 P97 DSU( DRESET ) TB7OUT PA0 TB0IN0 INT3 PA1 TB0IN1 INT4 PA2 TB0OUT PA3 TB1IN0 INT5 PA4 TB1IN1 INT6 PA5 TB1OUT PA6 TA1OUT PA7 TA0IN KEYA PB0 TB2IN0 INTB PB1 TB2IN1 INTC PB2 TB2OUT TB4IN0 PB3 TB3IN0 INTD PB4 TB3IN1 INTE # of Pins 1 Type Input/Output Output Output Input/Output Output Output Input/Output Output Output Input/Output Input Input/Output Input Input/Output Input Output Input/Output Input Input Input/Output Input Input Input/Output Output Input/Output Input Input Input/Output Input Input Input/Output Output Input/Output Output Input/Output Input Input Input/Output Input Input Input/Output Input Input Input/Output Output Input Input/Output Input Input Input/Output Input Input Function Port 92: Programmable as input or output DSU pin 16-Bit Timer 4 Output: Output from 16-bit Timer 4 Port 93: Programmable as input or output DSU pin 16-Bit Timer 5 Output: Output from 16-bit Timer 5 Port 94: Programmable as input or output DSU pin 16-Bit Timer 6 Output: Output from 16-bit Timer 6 Port 95: Programmable as input or output DSU pin 16-Bit Timer 7 Input 0: Count/capture trigger input to 16-bit Timer 7 Port 96: Programmable as input or output DSU pin 16-Bit Timer 7 Input 0: Capture trigger input to 16-bit Timer 7 Port 97: Programmable as input or output DSU pin 16-Bit Timer 7 Output: Output from 16-bit Timer 7 Port A0: Programmable as input or output 16-Bit Timer 0 Input 0: Count/capture trigger input to 16-bit Timer 0 Interrupt Request 3: Programmable as high-level, low-level, rising-edge or falling-edge sensitive Port A1: Programmable as input or output 16-Bit Timer 0 Input 1: Capture trigger input to 16-bit Timer 0 Interrupt Request 4: Programmable to be high-level, low-level, rising-edge or falling edge sensitive Port A2: Programmable as input or output 16-Bit Timer 0 Output: Output from 16-bit Timer 0 Port A3: Programmable as input or output 16-Bit Timer 1 Input 0: Count/capture trigger input to 16-bit Timer 1 Interrupt Request 5: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port A4: Programmable as input or output 16-Bit Timer 1 Input 1: Capture trigger input to 16-bit Timer 1 Interrupt Request 6: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port A5: Programmable as input or output 16-Bit Timer 1 Output: Output from 16-bit Timer 1 Port A6: Programmable as input or output 8-Bit Timer 01 Output: Output from 8-bit Timer 0 or Timer 1 Port A7: Programmable as input or output 8-Bit Timer 0 Input: Input to 8-bit Timer 0 Key-On Wakeup Input (dynamic pull-up selectable) (with internal pull-up resistor) Port B0: Programmable as input or output 16-Bit Timer 2 Input 0: Count/capture trigger input to 16-bit Timer 2 or two-phase input pulse counter input Interrupt Request 7: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port B1: Programmable as input or output 16-Bit Timer 2 Input 1: Capture trigger input to 16-bit Timer 2 or two-phase input pulse counter input Interrupt Request 8: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port B2: Programmable as input or output 16-Bit Timer 2 Output: Output from 16-bit Timer 2 16-Bit Timer 4 Input 0: Count/capture trigger input to 16-bit Timer 4 Port B3: Programmable as input or output 16-Bit Timer 3 Input 0: Count/capture trigger input to 16-bit Timer 3 or two-phase input pulse counter input Interrupt Request B: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port B4: Programmable as input or output 16-Bit Timer 3 Input 1: Capture trigger input to 16-bit Timer 3 or two-phase input pulse counter input Interrupt Request C: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 TMP1942FD-10 TMP1942FD Pin Name PB5 TB3OUT TB4IN1 PB6 TA3OUT PB7 TA2IN INT7 KEYB PC0 TA4IN INT8 PC1 TA6IN INT9 PC2 TA8IN INTA PC3 TA5OUT PC4 TAAIN PC5 TA7OUT PC6 TB8IN0 KEYC PC7 TB8IN1 TA9OUT PD0 TXD0 TB9IN0 PD1 RXD0 TB9IN1 PD2 SCLK0 CTS0 # of Pins 1 Type Input/Output Output Input Input/Output Output Input/Output Input Input Input Input/Output Input Input Input/Output Input Input Input/Output Input Input Input/Output Output Input/Output Input Input/Output Output Input/Output Input Input Input/Output Input Output Input/Output Output Input Input/Output Input Input Input/Output Input/Output Input Input/Output Output Input Input/Output Input Input Input/Output Input/Output Input Output Function Port B5: Programmable as input or output 16-Bit Timer 3 Output: Output from 16-Bit Timer 3 16-Bit Timer 4 Input 1: Capture trigger input to 16-bit Timer 4 Port B6: Programmable as input or output 8-Bit Timer 23 Output: Output from 8-bit Timer 2 or Timer 3 Port B7: Programmable as input or output 8-Bit Time 2 Input: Input to 8-bit Timer 2 Interrupt Request 7: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Key-On Wakeup Input (dynamic pull-up selectable) (with internal pull-up resistor) Port C0: Programmable as input or output 8-Bit Timer 4 Input: Input to 8-bit Timer 4 Interrupt Request 8: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port C1: Programmable as input or output 8-Bit Timer 6 Input: Input to 8-bit Timer 6 Interrupt Request 9: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port C2: Programmable as input or output 8-Bit Timer 8 Input: Input to 8-bit Timer 8 Interrupt Request A: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Port C3: Programmable as input or output 8-Bit Timer 45 Output: Output from 8-bit Timer 4 or Timer 5 Port B7: Programmable as input or output 8-Bit Timer A Input: Input to 8-bit Timer A Port C5: Programmable as input or output 8-Bit Timer 67 Output: Output to 8-bit Timer 6 or Timer 7 Port C6: Programmable as input or output 16-Bit Timer 8 Input 0: Count/capture trigger input to 16-bit Timer 8 Key-On Wakeup Input (dynamic pull up selectable) (with internal pull-up resistor) Port C7: Programmable as input or output 16-Bit Timer 8 Input: Capture trigger input to 16-bit Timer 8 8-Bit Timer 89 Output: Output from 8-bit Timer 8 or Timer 9 Port D0: Programmable as input or output Serial Transmit Data 0 Programmable as push-pull or open-drain output 16-Bit Timer 9 Input 0: Count/capture trigger input to 16-bit Timer 9 Port D1: Programmable as input or output Serial Receive Data 0 16-Bit Timer 9 Input 1: Capture trigger input to 16-bit Timer 9 Port D2: Programmable as input or output Serial Clock Input/Output 0 Serial Clear-to-Send 0 Programmable as a push-pull or open-drain output Port d3: Programmable as input or output Serial Transmit Data 1 Programmable as a push-pull or open-drain output 16-Bit Timer A Input 0: Count/capture trigger input to 16-bit Timer A Port D4: Programmable as input or output Serial Receive Data 1 16-Bit Timer A Input 1: Capture trigger input to 16-bit Timer A Port D5: Programmable as input or output Serial Clock Input/Output 1 Serial Clear-to-Send 1 Programmable as a push-pull or open-drain output 8-Bit Timer AB Output: Output from 8-bit Timer A or Timer B Port D6: Programmable as input or open-drain output Connection pin for a low-speed crystal Port D7: Programmable as input or open-drain output Connection pin for a low-speed crystal Port E0: Programmable as input or output Serial Transmit Data 3 Programmable as push-pull or open-drain output 1 1 1 1 1 1 1 1 1 1 1 1 1 PD3 TXD1 TBAIN0 PD4 RXD1 TBAIN1 PD5 SCLK1 CTS1 1 1 1 TABOUT PD6 XT1 PD7 XT2 PE0 TXD3 1 1 1 Input/Output Input Input/Output Output Input/Output Output TMP1942FD-11 TMP1942FD Pin Name PE1 RXD3 PE2 SCLK3 CTS3 # of Pins 1 1 Type Input/Output Input Input/Output Input/Output Input Input/Output Output Input/Output Input Input/Output Input/Output Input Input/Output Input Function Port E1: Programmable as input or output Serial Receive Data 3 Port E2: Programmable as input or output Serial Clock Input/Output 3 Serial Clear-to-Send 3 Programmable as push-pull or open-drain output Port E3: Programmable as input or output Serial Transmit Data 4 Programmable as push-pull or open-drain output Port E4: Programmable as input or output Serial Receive Data 4 Port E5: Programmable as input or output Serial Clock Input/Output 4 Serial Clear-to-Send 4 Programmable as push-pull or open-drain output Port E6: Programmable as input or output Interrupt Request 1: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Single Boot Mode: The on-chip flash memory enters Single Boot mode to allow re-programming when this pin is sampled low. This pin should be pulled up to a logic 1 to put the flash memory in Normal mode or when the device contains a mask ROM. Port E7: Programmable as input or output Interrupt Request 2: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Interleave Mode: This pin should be pulled up to a logic 1 when Interleave mode is used, and pulled down to a logic 0 when Interleave mode is not used. Port F0: Programmable as input or output Serial Transmit Data 5 Programmable as push-pull or open-drain output Port F1: Programmable as input or output Serial Receive Data 5 Key-On wakeup Input (dynamic pull-up selectable) (with internal pull-up resistor) Port F2: Programmable as input or output Serial Clock Input/Output 5 Serial Clear-to-Send 5 Programmable as push-pull or open-drain output Port F3: Programmable as input or output Clock input/output pin when the Serial Bus Interface is in SIO mode Port F4: Programmable as input or output Data transmit pin when the Serial Bus Interface is in SIO mode 2 Data transmit/receive pin when the Serial Bus Interface is in I C mode Programmable as push-pull or open-drain output Port F5: Programmable as input or output Data receive pin when the Serial Bus Interface is in SIO mode 2 Clock input/output pin when the Serial Bus Interface is in I C mode Programmable as push-pull or open-drain output Port F6: Programmable as input or output Interrupt Request 0: Programmable to be high-level, low-level, rising-edge or falling-edge sensitive Address Latch Enable (This signal is driven out only when external memory is accessed.) Test pin Test pin The pull-up resistors for Port 3 and Port 4 are enabled when this signal is high at reset, and they are disabled when this signal is low at reset. DA Output Nonmaskable Interrupt Request: Causes an NMI interrupt on the falling edge Both BW0 and BW1 should be tied to logic 1. This pin should be tied to logic 1 when the frequency multiplied clock from the PLL is used; otherwise, it should be tied to logic 0. Reset (with internal pull-up resistor): Initializes the whole TMP1942FD Input pin for high reference voltage for the A/D Converter Input pin for low reference voltage for the A/D Converter PE3 TXD4 PE4 RXD4 PE5 SCLK4 CTS4 1 1 1 PE6 INT1 BOOT 1 PE7 INT2 INTLV 1 Input/Output Input PF0 TXD5 PF1 RXD5 KEYD PF2 SCLK5 CTS5 1 Input/Output Output Input/Output Input Input Input/Output Input/Output Input Input/Output Input/Output Input/Output Output Input/Output Input/Output Input Input/Output Input/Output Input Output Input Input Input Output Input Input Input Input Input Input 1 1 PF3 SCK PF4 SO SDA PF5 SI SCL PF6 INT0 ALE TEST0 TEST1 RSTPUP DAOUT0-2 NMI 1 1 1 1 1 1 1 3 1 2 1 1 1 1 BW0-1 PLLOFF RESET VREFH VREFL TMP1942FD-12 TMP1942FD Pin Name AVCC # of Pins 1 Type Function Power supply pin for the A/D Converter This pin should always be connected to power supply even when the A/D Converter is not used. Ground pin for the A/D Converter (0V) This pin should always be connected to ground even when the A/D Converter is not used. Power supply pin for the D/A Converter This pin should always be connected to power supply even when the D/A Converter is not used. Ground pin for the D/A Converter (0V) This pin should always be connected to ground even when the D/A Converter is not used. Poser supply input pin for the D/A converter Connection pins for high-speed crystal Power supply pin for the on-chip flash memory (DVCC in the mask-version product) Ground pin for the on-chip flash memory (DVSS in the mask-version product) Power supply pin for an oscillator Ground pin for an oscillator (0V) Power supply pins Power supply pin (Port F) Power supply pin (Port C) Ground pins (0V) AVSS DAVCC 1 1 DAVSS DAREFH X1/X2 FVCC FVSS CVCC CVSS DVCC3 DVCC51 DVCC52 DVSS 1 1 2 1 1 1 1 4 1 1 5 Input/Output Port C functions as a 5-V port when DVCC52 is connected to a 5-V power supply. Port F functions as a 5-V port when DVCC51 is connected to a 5-V power supply. Note: When the DSU is enabled, Port 9 functions as an interface to a processor probe regardless of the setting of the Port 9 Control Register (P9CR). The following JTAG pins are available in the TMP1942 FD in a CSP package. Pin Name TRST # of Pins 1 1 1 1 1 Type Input Input Input Output Input Function JTAG reset pin (with internal pull-up resistor) JTAG clock pin JTAG data input pin (with internal pull-up resistor) JTAG data output pin JTAG mode switch input pin (with internal pull-up resistor) TCK TDI TDO TMS TMP1942FD-13 TMP1942FD 3. Flash Memory This chapter describes the hardware configuration and functionality of the flash memory contained in the TMP1942FD. 3.1 Features (1) Organization The TMP1942FD contains 4 Mbits (512 Kbytes) of flash memory, which is divided into a total of 16 blocks (32 Kbytes x 16) to allow independent protection from program and erase for each block. While the CPU can access information in the flash memory through a full 32-bit data bus, an external flash programmer can only perform 16-bit data bus writes to the flash memory. (2) Access Types The flash memory of the TMP1942FD provides two selectable access types: one-clock access and interleaved access. (3) Program/Erase Times Chip program time: 6 seconds (typ.), including program verify operations (20 s per long word) Chip erase time: 30 seconds (typ.), including erase verify operations Note: These program and erase times are typical values and do not include data transfer overhead. The actual chip program and erase times depend on the programming method used. (4) Programming Modes On-Board Programming modes allow re-programming of the flash memory while the chip is soldered on a printed circuit board. Programmer mode utilizes an EPROM programmer to re-program the flash memory. * On-Board Programming modes 1) User Boot mode Supports use of a user-written programming algorithm. 2) Single Boot mode Downloads new program code using a Toshiba-defined serial interface protocol. * Programmer mode Supports use of a general-purpose EPROM programmer. (Planned) (5) Re-programming The flash memory contained in the TMP1942FD is compatible with the JEDEC standards, except a few unique functions. Thus, it is easy to migrate from a discrete flash memory device to the TMP1942FD on-chip flash memory. The TMP1942FD contains hardware to perform programming and erase operations automatically. This eliminates the need for the user to code complex program and erase sequences. The security feature of the TMP1942FD flash memory prevents the stored data from being read while it is being re-programmed with programming equipment. The TMP1942FD also allows the user to protect individual blocks of the flash memory against program or erase through software commands; however, 12-V VPP programming does not support data protection on a block-by-block basis. TMP1942FD-14 TMP1942FD JEDEC Standards *Auto Program * Auto Chip Erase * Auto Block Erase * Auto Multi-Block Erase *Data Polling/Toggle Bit Changes and Enhancements Added feature: Security Auto Program Changed feature: Block protection is available only under software control. Removed feature: Erase Resume/Suspend mode 3.1.1 Block Diagram Internal Address Bus Internal Data Bus Internal Control Bus Mode Setup Pins Mode Control Control ROM Controller / Interleave Control Address Data Flash Memory Row Decoder Control Logic (Including Automatic Sequence Control Logic) RDY/BSY Output Command Register Address Latch Data Latch Column Decoder / Sense Amp Flash Memory Array 512 KB Erase Block Decoder Figure 3.1.1 Flash Memory Block Diagram TMP1942FD-15 TMP1942FD 3.2 Operating Modes The TMP1942FD offers a total of five operating modes, including the one in which the flash memory is unused. Table 3.2.1 Operating Modes Operating Mode Single-Chip Mode Description After a reset, the TX19 core processor executes out of the on-chip flash memory. Either fast (one-clock) or interleave mode operation is selected through the INTLV pin when the reset state is released. Single-Chip mode is further divided into Normal mode in which the user application executes and User Boot mode which allows re-programming of the flash memory while the TMP1942FD is installed on a printed circuit board. The user can freely define how to switch between Normal mode and User Boot mode. For example, the logic state on, for example, Port 00 can be used to determine whether to put the flash memory in Normal mode or User Boot mode. The user must include a routine in the application program to test the state of that port. After a reset, the TX19 core processor executes out of the on-chip boot ROM (which is a mask ROM).The boot ROM contains a routine to aid users in performing on-board programming of the flash memory via a serial port of the TMP1942FD. The serial port is connected to an external host which transfers new data according to a prescribed protocol. This mode allows re-programming of the flash memory with a general-purpose EPROM programmer. Use the programmer and programming adaptor recommended by Toshiba. Normal Mode User Boot Mode Single Boot Mode Writer Mode The on-chip flash memory can be re-programmed in one of the following three modes: User Boot mode, Single Boot mode and Writer mode. Of these modes, User Boot mode and Single Boot mode are collectively referred to as on-board programming modes. TMP1942FD-16 TMP1942FD The logic states on the BW0, BW1, BOOT and INTLV pins during a reset sequence determine the mode of operation for the flash memory, as shown in Table 3.2.2. After RESET is released, PE6 ( BOOT ) and PE7 (INTLV) can be configured as general-purpose I/O or timer output pins. After RESET is released, the CPU starts operating in the selected mode, except for Writer mode. When Writer mode is selected, RESET must be held at logic 0. The input pins listed in Table 3.2.2 must remain stable once the flash memory is put in a given mode of operation. Table 3.2.2 Modes of Operation Operating Mode RESET Input Pins BW0 1 1 1 0 BW1 1 1 1 1 BOOT INTLV 1 0 (Note 1) (Note 1) (1) (2) (3) (4) Single-Chip Mode (Interleave) Single-Chip Mode (Single-Clock) Single Boot Mode Writer Mode (Note 2) 01 01 01 0 1 1 0 (Note 1) Note 1: Note 2: Don't care; however, the pins must be held at 0 or 1. In Writer mode, P40 must be held at 1, and P41 and P42 must be held at 0. For how to set other pins, refer to Section 3.4.2.3, Pin Functions and Settings. (4) Writer Mode Reset Any condition other than (4) RESET = 0 (1) or (2) / RESET = 0 (3) / RESET = 0 Single-Chip Mode Single Boot Mode Normal Mode User Boot Mode User-defined condition On-Board Programming Mode Parenthesized numbers indicate that the relevant pins are at the logic states shown in Table 3.2.2. Figure 3.2.1 Mode Transitions 3.2.1 Reset Operation To reset the TMP1942FD, RESET must be asserted for at least 12 system clock periods after the power supply voltage and the internal high-frequency oscillator have stabilized. This time is typically 3 s at 32 MHz when the on-chip PLL is utilized. TMP1942FD-17 TMP1942FD 3.2.2 Memory Maps The memory map for the TMP1942FD varies according to the operation mode selected for the on-chip flash memory. Following are the memory maps in each operation mode. Normal Mode On-Chip Peripherals Single Boot Mode 0xFFFF_FFFF 0xFFFF_E000 On-Chip Peripherals Writer Mode 0xFFFF_FFFF 0xFFFF_E000 Inaccessible 0xFFFF_FFFF (Reserved) On-Chip RAM (20 KB) (Reserved) 0xFFFF_CFFF 0xFFFF_8000 0xFF3F_FFFF 0xFF20_0000 On-Chip RAM (20 KB) 0xFFFF_CFFF 0xFFFF_8000 0xFF3F_FFFF 0xFF20_0000 (Reserved) Used for debugging (Reserved) (Reserved) (Reserved) Used for debugging (Reserved) 0xFF00_0000 0xC000_0000 0xBF00_0000 0x4007_FFFF 0x4000_0000 (Reserved) 0xFF00_0000 0xC000_0000 0xBF00_0000 0x4007_FFFF 0x4000_0000 Inaccessible 0x2000_0000 (512 MB) Inaccessible Inaccessible 0xC000_0000 (Reserved) (Reserved) On-Chip ROM Shadow Inaccessible (512 MB) On-Chip Flash ROM Inaccessible 0x4000_0000 0x2000_0000 (512 MB) 0x2000_0000 0x1FC7_FFFF User Program Area Maskable Interrupt Area Exception Vector Area 0x1FC0_0400 0x1FC0_17FF 0x0007_FFFF 0x1FC0_0000 0x0000_0000 On-Chip Flash ROM 0x0000_0000 Boot MROM (6 KB) 0x1FC0_0000 0x0000_0000 Note: The addresses shown above are physical addresses. Figure 3.2.2 TMP1942FD Memory Maps TMP1942FD-18 TMP1942FD Low 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB 32 KB Block-0 Block-1 Block-2 Block-3 Block-4 Block-5 Block-6 Block-7 Block-8 Block-9 Block-10 Block-11 Block-12 Block-13 Block-14 Block-15 Address 512 KB High Figure 3.2.3 Flash Memory Block Architecture Table 3.2.3 Block Addresses User Boot Mode Block-0 Block-1 Block-2 Block-3 Block-4 Block-5 Block-6 Block-7 Block-8 Block-9 Block-10 Block-11 Block-12 Block-13 Block-14 Block-15 0x1FC0_0000 - 0x1FC0_7FFF (or 0x4000_0000 - 0x4000_7FFF) 0x1FC0_8000 - 0x1FC0_FFFF (or 0x4000_8000 - 0x4000_FFFF) 0x1FC1_0000 - 0x1FC1_7FFF (or 0x40010000 - 0x4001_7FFF) 0x1FC1_8000 - 0x1FC1_FFFF (or 0x4001_8000 - 0x4001_FFFF) 0x1FC2_0000 - 0x1FC2_7FFF (or 0x4002_0000 - 0x4002_7FFF) 0x1FC2_8000 - 0x1FC2_FFFF (or 0x4002_8000 - 0x4002_FFFF) 0x1FC3_0000 - 0x1FC3_7FFF (or 0x4003_0000 - 0x4003_7FFF) 0x1FC3_8000 - 0x1FC3_FFFF (or 0x4003_8000 - 0x4003_FFFF) 0x1FC4_0000 - 0x1FC4_7FFF (or 0x4004_0000 - 0x4004_7FFF) 0x1FC4_8000 - 0x1FC4_FFFF (or 0x4004_8000 - 0x4004_FFFF) 0x1FC5_0000 - 0x1FC5_7FFF (or 0x4005_0000 - 0x4005_7FFF) 0x1FC5_8000 - 0x1FC5_FFFF (or 0x4005_8000 - 0x4005_FFFF) 0x1FC6_0000 - 0x1FC6_7FFF (or 0x4006_0000 - 0x4006_7FFF) 0x1FC6_8000 - 0x1FC6_FFFF (or 0x4006_8000 - 0x4006_FFFF) 0x1FC7_0000 - 0x1FC7_7FFF (or 0x4007_0000 - 0x4007_7FFF) 0x1FC7_8000 - 0x1FC7_FFFF (or 0x4007_8000 - 0x4007_FFFF) Boot Mode 0x1FC0_0000 - 0x1FC0_7FFF 0x1FC0_8000 - 0x1FC0_FFFF 0x1FC1_0000 - 0x1FC1_7FFF 0x1FC1_8000 - 0x1FC1_FFFF 0x1FC2_0000 - 0x1FC2_7FFF 0x1FC2_8000 - 0x1FC2_FFFF 0x1FC3_0000 - 0x1FC3_7FFF 0x1FC3_8000 - 0x1FC3_FFFF 0x1FC4_0000 - 0x1FC4_7FFF 0x1FC4_8000 - 0x1FC4_FFFF 0x1FC5_0000 - 0x1FC5_7FFF 0x1FC5_8000 - 0x1FC5_FFFF 0x1FC6_0000 - 0x1FC6_7FFF 0x1FC6_8000 - 0x1FC6_FFFF 0x1FC7_0000 - 0x1FC7_7FFF 0x1FC7_8000 - 0x1FC7_FFFF Writer Mode 0x0000_0000 - 0x0000_7FFF 0x0000_8000 - 0x0000_FFFF 0x0001_0000 - 0x0001_7FFF 0x0001_8000 - 0x0001_FFFF 0x0002_0000 - 0x0002_7FFF 0x0002_8000 - 0x0002_FFFF 0x0003_0000 - 0x0003_7FFF 0x0003_8000 - 0x0003_FFFF 0x0004_0000 - 0x0004_7FFF 0x0004_8000 - 0x000_4FFFF 0x0005_0000 - 0x0005_7FFF 0x0005_8000 - 0x0005_FFFF 0x0006_0000 - 0x0006_7FFF 0x0006_8000 - 0x0006_FFFF 0x0007_0000 - 0x0007_7FFF 0x0007_8000 - 0x0007_FFFF TMP1942FD-19 TMP1942FD 3.2.3 Interleave Mode If Port E7 (PE7) is sampled high at the rising edge of RESET , the flash memory enters Interleave mode. When the system clock (fsys) operates at 16 MHz or faster, the flash memory must be configured into Interleave mode. The TMP1942FD flash memory is comprised of two banks which are distinguished by the second lowest bit of an address. The memory controller of the TMP1942FD core processor provides addresses for each bank. Each bank can be accessed in two system clock cycles. Switching between the two banks enables each address to be accessed in a single system clock cycle, unless a branch occurs (see Figure 3.2.4). Memory Controller TMP1942FD Core Processor Address A Bank A Address B Bank B Address B Bank Switching Data Data D0 D1 D2 D3 A1 A3 Address A A0 A2 A4 Address A0 A1 A2 A3 A4 Figure 3.2.4 Interleave Configuration 3.2.4 Block Protection The TMP1942FD flash memory is organized into a total of 16 blocks (32 Kbytes x 16). To protect stored data from any program and erase operations, each block has a protect bit, which can be set by executing the Block Protect command sequence. Blocks in protection mode are protected from even the Chip Erase and Multi-Block Erase commands; these commands erase only unprotected blocks. Since protection status is stored in flash memory cells, it is retained even if the chip is powered off. TMP1942FD-20 TMP1942FD 3.2.5 DSU-ICE Interface If Port 37 (P37) is sampled high at the rising edge of RESET , the TMP1942FD enters DSU mode, which is used for software debugging using an external DSU-ICE unit. In DSU mode, Port A serves as an interface to the DSU-ICE, and cannot be used for other functions. Consult the DSU-ICE operation manual for a description of debugging using the DSU-ICE. When the TMP1942FD is in DSU mode, the on-chip flash memory provides a security feature. (1) Flash security feature The TMP1942FD supports on-board debugging using a DSU-ICE while it is installed on a printed circuit board. The TMP1942FD provides a security feature to prevent intrusive access to the flash memory. When the flash memory is in the secure state, a DSU-ICE is denied access to the entirety of the flash memory. (2) Securing the flash memory (Disabling debugging with a DSU-ICE) Once program debugging is completed, set the FSE bit in the Flash Control/Status Register and write the Auto Security On command. This turns on the security feature. While the flash memory is in the secure state, a DSU-ICE cannot read its contents. When the chip is powered off and powered on again, the SEQON bit in the SEQMOD register is automatically set, which disables debugging using a DSU-ICE until the flash memory is unsecured. (3) Unsecuring the flash memory (Enabling debugging with a DSU-ICE) The flash memory may only be unsecured by clearing the SEQON bit in the SEQMOD register and then writing a special code (0x0000_00C5) to the Security Control (SEQCNT) register. This prevents runaway software from inadvertently turning off the security feature. Unsecuring the flash memory enables the DSU interface. The flash memory can be secured again by setting the SEQON bit in the SEQMOD and writing 0x0000_00C5 to the SEQCNT while the chip is powered. 7 SEQMOD (0xFFFF_E510) 6 5 4 3 2 1 0 SEQON R/W 1 1: Security on 0: Security off Bit Symbol Read/Write Reset Value Function Note: This register must be read as a 32-bit quantity. Bits 1 to 31 are read as 0s. TMP1942FD-21 TMP1942FD 7 SEQCNT (0xFFFF_E514) 6 5 4 W 3 2 1 0 Bit Symbol Read/Write Reset Value Function 15 14 13 Must be written as 0x0000_00C5. 12 W Must be written as 0x0000_00C5. 23 22 21 20 W Must be written as 0x0000_00C5. 31 30 29 28 W Must be written as 0x0000_00C5. 27 26 25 24 19 18 17 16 11 10 9 8 Bit Symbol Read/Write Reset Value Function Bit Symbol Read/Write Reset Value Function Bit Symbol Read/Write Reset Value Function Note: The security feature of the TMP1942FD flash memory is not intended to guarantee rigid security protection. In cases where security protection is of utmost importance, use the mask ROM version of this product. (4) Application example The following flowchart shows an example of how to use the security feature with a DSU-ICE. TMP1942 Security on at power-up External port data, etc. Protect/unprotect judgment routine (user-created) No Turn off security feature? Yes Program SEQMOD and SEQCNT to turn off security feature Security remains on. DSU-ICE cannot be used. Security is turned off. DSU-ICE can be used until the chip is powered off. Figure 3.2.5 Using the Security Feature TMP1942FD-22 TMP1942FD 3.3 On-Board Programming Mode On-board programming modes allow re-programming of the flash memory while the TMP1942FD is soldered on a printed circuit board. In Single Boot mode, new data comes from a serial port under control of a Toshiba-provided routine in the boot ROM. User Boot mode allows you to create an algorithm of your own for flash memory erase and program operations. The TMP1942FD flash memory provides a security feature to prevent intrusive access to the flash memory while in Programmer mode. This security feature can be enabled upon completion of on-board programming to reduce the potential risk of software leaks to third parties. 3.3.1 User Boot Mode (Single-Chip Mode) User Boot mode allows you to create a programming algorithm of your own. This mode supports situations where the flash memory is to be re-programmed via a bus other than serial I/O. User Boot mode is one of the two submodes in Single-Chip mode; the other submode is Normal mode in which the CPU executes the user application. To re-program the flash memory, the mode of operation must be switched from Normal mode to User Boot mode. The user application code must include a mode judgment routine as part of the reset procedure. The user must define the conditions for mode switching, based on the logic states on I/O ports of the TMP1942FD. Additionally, the user must incorporate a programming algorithm into the user application code that is to be executed after User Boot mode is entered. It is not possible to read from the flash memory while it is being erased or programmed; therefore, the programming algorithm must be placed and executed outside of the flash memory. Once re-programming is complete, it is recommended to protect relevant flash blocks from accidental corruption. All interrupts including the non-maskable (NMI) interrupt must be globally disabled while the flash memory is being erased or programmed. The pages that follow describe the general procedures for two cases where the programming routine is: a) stored within the TMP1942FD flash memory, and b) loaded from an external controller. For a detailed description of the erase and program sequence, refer to Section 3.4. On-Board Programming and Erasure. TMP1942FD-23 TMP1942FD User Boot Mode (1-A) Method 1: Storing a Programming Routine in the Flash Memory (1) Determine the conditions (e.g. pin states) required for the flash memory to enter User Boot mode and the I/O bus to be used to transfer new program code. Create hardware and software accordingly. Before installing the TMP1942FD on a printed circuit board, write the following program routines into an arbitrary flash block using programming equipment. * Mode judgment routine: Code to determine whether or not to switch to User Boot mode * Programming routine: * Copy routine: Code to download new program code from a host controller and re-program the flash memory Code to copy the flash programming routine from the TMP1942FD flash memory to either the TMP1942FD on-chip RAM or an external memory device. Host Controller New Application Program Code TMP1942FD Flash Memory Old Application Program Code [Reset Procedure] (a) Mode Judgment Routine (b) Programming Routine (c) Copy Routine I/O RAM (2) After RESET is released, the reset procedure determines whether to put the TMP1942FD flash memory in User Boot mode. If mode switching conditions are met, the flash memory enters User Boot mode. (All interrupts including NMI must be globally disabled while in User Boot mode.) New Application Program Code Host Controller TMP1942FD Flash Memory Old Application Program Code [Reset Procedure] (a) Mode Judgment Routine (b) Programming Routine (c) Copy Routine I/O 0 1 RESET RAM Conditions for entering User Boot mode (defined by the user) TMP1942FD-24 TMP1942FD (3) Once User Boot mode is entered, execute the copy routine to copy the flash programming routine to either the TMP1942FD on-chip RAM or an external memory device. (In the following figure, the on-chip RAM is used.) Host Controller New Application Program Code TMP1942FD Flash Memory Old Application Program Code I/O (b) Programming Routine [Reset Procedure] (a) Mode Judgment Routine (b) Programming Routine (c) Copy Routine RAM (4) Jump program execution to the flash programming routine in the on-chip RAM to erase a flash block containing the old application program code. Host Controller New Application Program Code TMP1942FD Flash Memory Erased I/O (b) (b) Programming Routine [Reset Procedure] (a) Mode Judgment Routine (b) Programming Routine (c) Copy Routine RAM TMP1942FD-25 TMP1942FD (5) Continue executing the flash programming routine to download new program code from the host controller and program it into the erased flash block. Once programming is complete, turn on the protection of that flash block. Host Controller New Application Program Code TMP1942FD Flash Memory New Application Program Code I/O (b) (b) Programming Routine [Reset Procedure] (a) Mode Judgment Routine (b) Programming Routine (c) Copy Routine RAM (6) Drive RESET low to reset the TMP1942FD. Upon reset, the on-chip flash memory is put in Normal mode. After RESET is released, the CPU will start executing the new application program code. Host Controller TMP1942FD Flash Memory New Application Program Code [Reset Procedure] (a) Mode Judgment Routine (b) Programming Routine (c) Copy Routine I/O 0 1 RESET Set to Normal mode RAM TMP1942FD-26 TMP1942FD (1-B) Method 2: Transferring a Programming Routine from an External Host (1) Determine the conditions (e.g., pin states) required for the flash memory to enter User Boot mode and the I/O bus to be used to transfer new program code. Create hardware and software accordingly. Before installing the TMP1942FD on a printed circuit board, write the following program routines into an arbitrary flash block using programming equipment. * Mode judgment routine: Code to determine whether or not to switch to User Boot mode * Transfer routine: Code to download new program code from a host controller Also, prepare a programming routine on the host controller * Programming routine: Code to download new program code from an external host controller and re-program the flash memory Host Controller I/O New Application Program Code (c) Programming Routine TMP1942FD Flash Memory Old Application Program Code [Reset Procedure] (a) Mode Judgment Routine (b)Transfer Routine RAM (2) After RESET is released, the reset procedure determines whether to put the TMP1942FD flash memory in User Boot mode. If mode switching conditions are met, the flash memory enters User Boot mode. (All interrupts including NMI must be globally disabled while in User Boot mode.) New Application Program Code (c) Programming Routine Host Controller I/O TMP1942FD Flash Memory Old Application Program Code [Reset Procedure] (a) Mode Judgment Routine (b) Transfer Routine 0 1 RESET RAM Conditions for entering User Boot mode (defined by the user) TMP1942FD-27 TMP1942FD (3) Once User Boot mode is entered, execute the transfer routine to download the flash programming routine from the host controller to either the TMP1942FD on-chip RAM or an external memory device. (In the following figure, the on-chip RAM is used.) New Application Program Code (c) Programming Routine Host Controller I/O TMP1942FD Flash Memory Old Application Program Code (c) Programming Routine [Reset Procedure] (a) Mode Judgment Routine (b) Transfer Routine RAM (4) Jump program execution to the flash programming routine in the on-chip RAM to erase a flash block containing the old application program code. Host Controller I/O New Application Program Code (c) Programming Routine TMP1942FD Flash Memory Erased (c) Programming Routine [Reset Procedure] (a) Mode Judgment Routine (b) Transfer Routine RAM TMP1942FD-28 TMP1942FD (5) Continue executing the flash programming routine to download new program code from the host controller and program it into the erased flash block. Once programming is complete, turn on the protection of that flash block. Host Controller I/O New Application Program Code (c) Programming Routine TMP1942FD Flash Memory New Application Program Code (c) Programming Routine [Reset Procedure] (a) Mode judgment Routine (b) Transfer Routine RAM (6) Drive RESET low to reset the TMP1942FD. Upon reset, the on-chip flash memory is put in Normal mode. After is RESET released, the CPU will start executing the new application program code. Host Controller I/O TMP1942FD Flash Memory New Application Program Code 0 1 RESET Set to Normal mode [Reset Procedure] (a) Mode Judgment Routine (b) Transfer Routine RAM TMP1942FD-29 TMP1942FD 3.3.2 Single Boot Mode In Single Boot mode, the flash memory can be re-programmed by using a program contained in the TMP1942FD on-chip boot ROM. This boot ROM is a masked ROM. When Single Boot mode is selected upon reset, the boot ROM is mapped to the address region including the interrupt vector table while the flash memory is mapped to an address region different from it (See Figure 3.2.2). Single Boot mode allows serial programming of the flash memory. Channel 0 of the SIO (SIO0) of the TMP1942FD is connected to an external host controller. Via this serial link, a programming routine is downloaded from the host controller to the TMP1942FD on-chip RAM. Then, the flash memory is re-programmed by executing the programming routine. The host sends out both commands and programming data to re-program the flash memory. Communications between the SIO0 and the host must follow the protocol described later. To secure the contents of the flash memory, the validity of the application's password is checked before a programming routine is downloaded into the on-chip RAM. If password matching fails, the transfer of a programming routine itself is aborted. As in the case of User Boot mode, all interrupts including non-maskable (NMI) interrupt must be globally disabled in Single Boot mode while the flash memory is being erased or programmed. Once re-programming is complete, it is recommended to protect relevant flash blocks from accidental corruption during subsequent Single-Chip (Normal mode) operations. For a detailed description of the erase and program sequences, refer to section 3.4. On-Board Programming and Erasure. Note: In Single Boot mode, the boot ROM programs are executed in Normal mode. Do not switch to any other mode in the programming routine. TMP1942FD-30 TMP1942FD Boot Mode (2-A) General Procedure: Using the Program in the On-Chip Boot ROM (1) The flash block containing the older version of the program code need not be erased before executing the programming routine. Since a programming routine and programming data are transferred via the SIO0, the SIO0 must be connected to a host controller. Prepare a programming routine on the host controller. Host Controller I/O New Application Program Code (a) Programming Routine TMP1942FD Boot ROM Flash Memory Old Application Program Code (or Erased State) RAM SIO0 (2) Reset the TMP1942FD with the mode setting pins held at appropriate logic values, so that the CPU re-boots from the on-chip boot ROM. The 12-byte password transferred from the host controller is first compared to the contents of the special flash memory locations. (If the flash block has already been erased, the password is 0xFFFF). Host Controller I/O New Application Program Code (a) Programming Routine TMP1942FD Boot ROM Flash Memory Old Application Program Code (or Erased State) RAM SIO0 0 1 RESET Conditions for entering Single Boot mode TMP1942FD-31 TMP1942FD (3) If the password was correct, the boot program downloads, via the SIO0, the programming routine from the host controller into the on-chip RAM of the TMP1942FD. The programming routine must be stored in the address range 0xFFFF_8000 - 0xFFFF_BFFF. Host Controller (I/O) New Application Program Code (a) Programming Routine TMP1942FD Boot ROM Flash Memory Old Application Program Code (or Erased State) SIO0 (a) Programming Routine RAM (4) The CPU jumps to the programming routine in the on-chip RAM to erase the flash block containing the old application program code. The Block Erase or Chip Erase command may be used. Host Controller I/O New Application Program Code (a) Programming Routine TMP1942FD Boot ROM Flash Memory SIO0 (a) Programming Routine Erased RAM Note: At this time, r29 (sp) points to 0xFFFF_9100. TMP1942FD-32 TMP1942FD (5) Next, the programming routine (a) downloads new application program code from the host controller and programs it into the erased flash block. Once programming is complete, protection of that flash block is turned on. It is not allowed to move program control from the programming routine (a) back to the boot ROM. In the example below, new program code comes from the same host controller via the same SIO channel as for the programming routine. However, once the programming routine has begun to execute, it is free to change the transfer path and the source of the transfer. Create board hardware and a programming routine to suit your particular needs. Host Controller I/O New Application Program Code (a) Programming Routine TMP1942FD Boot ROM Flash Memory (a) Programming Routine SIO0 New Application Program Code RAM (6) When programming of the flash memory is complete, power off the board and disconnect the cable leading from the host to the target board. Turn on the power again so that the TMP1942FD re-boots in Single-Chip (Normal) mode to execute the new program. Host Controller TMP1942FD Boot ROM Flash Memory SIO0 0 1 RESET New Application Program Code RAM Set to Single-Chip (Normal) mode TMP1942FD-33 TMP1942FD 3.3.3 Host-to-Target Connection Examples In Single Boot mode, serial transfer is used to re-program the flash memory while the TMP1942FD is installed on the board. In this mode, channel 0 of the SIO (SIO0) of the TMP1942FD is connected to a host controller, which is to issue commands to the target board. Figure 3.3.1 and Figure 3.3.2 show examples of host-to-target connections. Host Controller AC 100V VCC VCC Reg. Target Board Reg. VCC TMP1942FD Mode Control MCU DVCC(3V) BW1 BW0 NMI RESET Boot Mode Selection Logic RESET Mode Control TMODE BOOT (PE6) ROM RAM RX RXD0 (PD1) RS232C TX TXD0 (PD0) VSS DVSS PC Figure 3.3.1 Example of a Connection between a Host Controller and a Target Board (When the SIO0 is Configured for UART Mode) TMP1942FD-34 TMP1942FD Host Controller AC 100V VCC VCC Reg. Target Board Reg. VCC TMP1942FD Mode Control MCU DVCC(3V) BW1 BW0 NMI RESET RESET Mode Control TMODE Boot Mode Selection Logic BOOT (PE6) ROM RAM TCK RX SCLK0 (PD2) RXD0 (PD1) RS232C TX TBUSY VSS TXD0 (PD0) PB6 DVSS PC Figure 3.3.2 Example of a Connection between a Host Controller and a Target Board (When the SIO0 is Configured for I/O Interface Mode) The NET IMPRESS (flash programmer) from Yokogawa Digital Computer Corporation is being planned as our recommended programming controller. TMP1942FD-35 TMP1942FD 3.3.4 Configuring for Single Boot Mode For on-board programming, boot the TMP1942FD in Single Boot mode, as follows: BW0 BW1 RESET =1 =1 =01 BOOT (PE6) = 0 Set the RESET input at logic 0, and the BW0, BW1 and BOOT (PE6) inputs at the logic values shown above, and then release RESET (high). 3.3.5 Memory Map Figure 3.3.3 shows a comparison of the memory maps in Normal and Single Boot modes. In Single Boot mode, the on-chip flash memory is mapped to physical addresses 0x4000_0000 through 0x4007_FFFF, virtual addresses 0x0000_0000 through 0x0007_FFFF, and the on-chip boot ROM is mapped to physical addresses 0x1FC0_0000 through 0x1FC0_17FF. Normal Mode On-Chip Peripherals Single Boot Mode 0xFFFF_FFFF 0xFFFF_E000 On-Chip Peripherals 0xFFFF_FFFF 0xFFFF_E000 (Reserved) On-Chip RAM (16 KB) (Reserved) 0xFFFF_BFFF 0xFFFF_8000 0xFF3F_FFFF 0xFF20_0000 On-Chip RAM (16 KB) 0xFFFF_BFFF 0xFFFF_8000 0xFF3F_FFFF 0xFF20_0000 (Reserved) (Reserved) Used for debugging (Reserved) Used for debugging (Reserved) (Reserved) 0xFF00_0000 0xC000_0000 0xBF00_0000 0x4007_FFFF 0x4000_0000 (Reserved) 0xFF00_0000 0xC000_0000 0xBF00_0000 0x4007_FFFF 0x4000_0000 (Reserved) (Reserved) On-Chip ROM Shadow Inaccessible (512 MB) On-Chip Flash ROM Inaccessible 0x2000_0000 (512 MB) 0x2000_0000 User Program Area 0x1FC7_FFFF 0x1FC0_0400 0x1FC0_17FF On-Chip ROM Maskable Interrupt Area Exception Vector Area Boot MROM (6 KB) 0x1FC0_0000 0x0000_0000 0x1FC0_0000 0x0000_0000 Figure 3.3.3 Memory Maps for Normal and Single Boot Modes (Physical Addresses) TMP1942FD-36 TMP1942FD 3.3.6 Interface Specifications In Single Boot mode, an SIO channel is used for communications with a programming controller. Both UART (asynchronous) and I/O Interface (synchronous) modes are supported. The communication formats are shown below. To perform on-board programming, the programming controller must also be set for the same communication format. * UART mode Communication channel: Transfer mode: Data length: Parity bits: STOP bits: Baud rate: I/O Interface mode Communication channel: Transfer mode: Synchronization clock (SCLK0): Handshaking signal : Baud rate: SIO channel 0 (SIO0) UART (asynchronous) mode, full-duplex 8 bits None 1 bit Arbitrary baud rate * SIO channel 0 (SIO0) I/O Interface mode, half-duplex Input PB6 configured as an output Arbitrary baud rate Table 3.3.1 Required Pin Connections Pin Power Supply Pins Mode Setting Pin Reset Pin Communication Pins DVCC (3V) DVSS Interface UART Mode Required Required Required Required Required Required Not required Not required I/O Interface Mode Required Required Required Required Required Required Required (Input mode) Required (Output mode) BOOT RESET TXD0 RXD0 SCLK0 PB6 3.3.7 Data Transfer Format The host controller is to issue one of the commands listed in Table 3.3.2 to the target board. Table 3.3.3 to Table 3.3.6 show the sequence of two-way communications that should occur in response to each command. Table 3.3.2 Single Boot Mode Commands Code 10H 20H 30H RAM Transfer Show Flash Memory Sum Show Product Information Command TMP1942FD-37 TMP1942FD Table 3.3.3 Transfer Format for the RAM Transfer Command Byte Boot ROM 1st byte Data Transferred from the Controller to the TMP1942FD Serial operation mode and baud rate For UART mode 86H For I/O Interface mode 30H - Baud Rate Desired baud rate (Note 1) Data Transferred from the TMP1942FD to the Controller - 2nd byte ACK for the serial operation mode byte For UART mode Normal acknowledge 86H (The boot program aborts if the baud rate cannot be set correctly.) For I/O Interface mode Normal acknowledge 30H (10H) ACK for the command code byte (Note 2) Normal acknowledge 10H Negative acknowledge x 1H Communication error x 8H - 3rd byte 4th byte Command code - 5th byte to 16th byte 17th byte 18th byte Password sequence (12 bytes) (0x4000_03F4 - 0x4000_03FF) Checksum value for the 5th to 16th bytes - ACK for the checksum byte (Note 2) Normal acknowledge Negative acknowledge Communication error ACK for the checksum byte (Note 2) Normal acknowledge Negative acknowledge Communication error 10H 11H 18H 10H 11H 18H 19th byte 20th byte 21st byte 22nd byte 23rd byte 24th byte 25th byte 26th byte RAM storage start address (bits 31-24) RAM storage start address (bits 23-16) RAM storage start address (bits 15-8) RAM storage start address (bits 7-0) RAM storage byte count (bits 15-8) RAM storage byte count (bits 7-0) Checksum value for the 19th to 24th bytes - 27th byte to mth byte (m + 1)th byte (m + 2)th byte RAM storage data Checksum value for the 27th to mth bytes - ACK for the checksum byte (Note 2) Normal acknowledge Negative acknowledge Communication error Jump to RAM storage start address 10H 11H 18H RAM (m + 3)th byte - Note 1: Note 2: Note 3: In I/O Interface mode, the baud rate for the transfers of the 1st and 2nd bytes must be 1/16 of the desired baud rate. In case of any negative acknowledge, the boot program returns to a state in which it waits for a command code (3rd byte). In I/O Interface mode, if a communication error occurs, a negative acknowledge does not occur. The 19th to 25th bytes must be within the RAM address range of 0xFFFF_8000 to 0xFFFF_BFFF. TMP1942FD-38 TMP1942FD Table 3.3.4 Transfer Format for the Show Flash Memory Sum Command Byte Boot ROM 1st byte Data Transferred from the Controller to the TMP1942FD Serial operation mode and baud rate For UART mode 86H For I/O Interface mode 30H - Baud Rate Desired baud rate (Note 1) Data Transferred from the Controller to the TMP1942FD - 2nd byte ACK for the serial operation mode byte For UART mode Normal acknowledge 86H (The boot program aborts if the baud rate cannot be set correctly.) For I/O Interface mode Normal acknowledge 30H (20H) AK for the command code byte (Note 2) Normal acknowledge 20H Negative acknowledge x1H Communication error x8H SUM (upper byte) SUM (lower byte) Checksum value for the 5th and 6th bytes - 3rd byte 4th byte Command data - 5th byte 6th byte 7th byte 8th byte (Wait for the next command code) Note 1: Note 2: In I/O Interface mode, the baud rate for the transfers of the 1st and 2nd bytes must be 1/16 of the desired baud rate. In case of any negative acknowledge, the boot program returns to a state in which it waits for a command code (3rd byte.) In I/O Interface mode, if a communication error occurs, a negative acknowledge does not occur. TMP1942FD-39 TMP1942FD Table 3.3.5 Transfer Format for the Show Product Information Command (1/2) Byte Boot ROM 1st byte Data Transferred from the Controller to the TMP1942FD Serial operation mode and baud rate For UART mode 86H For I/O Interface mode 30H - Baud Rate Desired baud rate (Note 1) Data Transferred from the TMP1942FD to the Controller - 2nd byte 3rd byte 4th byte Command code - (30H) 5th byte 6th byte 7th byte 8th byte 9th byte to 20th byte 21st byte to 24th byte 25th byte to 28th byte 29th byte to 32nd byte 33rd byte to 36th byte 37th byte to 40th byte 41st byte to 44th byte 45th byte to 46th byte 47th byte to 50th byte 51st byte to 54th byte 55th byte to 56th byte 57th byte to 60th byte - ACK for the serial operation mode byte For UART mode Normal acknowledge (The boot program aborts if the baud rate cannot be set correctly.) 86H For I/O Interface mode Normal acknowledge 30H ACK for the command code byte (Note 2) Normal acknowledge 10H Negative acknowledge x 1H Communication error x 8H Flash memory data (at address 0x4000_03F0) Flash memory data (at address 0x4000_03F1) Flash memory data (at address 0x4000_03F2) Flash memory data (at address 0x4000_03F3) Product name (12-byte ASCII code) "TX1942" from the 9th byte Password comparison start address (4 bytes) F4H, 03H, 00H, 00H from the 21st byte RAM start address (4 bytes) 00H, 80H, FFH, FFH from the 25th byte Dummy data (4 bytes) FFH, 8FH, FFH, FFH from the 29th byte RAM end address (4 bytes) FFH, BFH, FFH, FFH from the 33rd byte Dummy data (4 bytes) 00H, 91H, FFH, FFH from the 37th byte Dummy data (4 bytes) FFH, AFH, FFH, FFH from the 41st byte Fuse information (2 bytes) 00H, 00H from the 45th byte Flash memory start address (4 bytes) 00H, 00H, 00H, 00H from the 47th byte Flash memory end address (4 bytes) FFH, FFH, 07H, 00H from the 51st byte Flash memory block count (2 bytes) 13H, 00H from the 55th byte Start address of a group of the same-size flash blocks (4 bytes) 00H, 00H, 00H, 00H from the 57th byte - - - - - - - - - - - TMP1942FD-40 TMP1942FD Table 3.3.6 Transfer Format for the Show Product Information Command (2/2) Byte Boot ROM 61st byte to 64th byte 65th byte 66th byte to 69th byte 70th byte to 73rd byte 74th byte 75th byte to 78th byte 79th byte to 82nd byte 83rd byte 84th byte to 87th byte 88th byte to 91st byte 92nd byte 93rd byte 94th byte Data Transferred from the Controller to the TMP1942FD - Baud Rate Data Transferred from the TMP1942FD to the Controller Size (in words) of the same-size flash blocks (4 bytes) 00H, 40H, 00H, 00H from the 61st byte Number of flash blocks of the same size (1byte) 0FH Start address of a group of the same-size flash blocks (4 bytes) 00H, 80H, 07H, 00H from the 66th byte Size (in words) of the same-size flash blocks (4 bytes) 00H, 20H, 00H, 00H from the 70th byte Number of flash blocks of the same size (1 byte) 01H Start address of a group of the same-size flash blocks (4 bytes) 00H, C0H, 07H, 00H from the 75th byte Size (in words) of the same-size flash blocks (4 bytes) 00H, 10H, 00H, 00H from the 79th byte Number of flash blocks of the same size (1byte) 01H Start address of a group of the same-size flash blocks (4 bytes) 00H, E0H, 07H, 00H from the 84th byte Size (in words) of the same-size flash blocks (4 bytes) 00H, 08H, 00H, 00H from the 88th byte Number of flash blocks of the same size (1 byte) 02H Checksum value for the 5th to 92nd bytes - - - - - - - (Wait for the next command data) Note 1: Note 2: In I/O Interface mode, the baud rate for the transfers of the 1st and 2nd bytes must be 1/16 of the desired baud rate. In case of any negative acknowledge, the boot program returns to a state in which it waits for a command code (3rd byte). In I/O Interface mode, if a communication error occurs, a negative acknowledge does not occur. TMP1942FD-41 TMP1942FD 3.3.8 Overview of the Boot Program Commands When Single Boot mode is selected, the boot program is automatically executed on startup. The boot program offers the following three commands, the details of which are provided in the following subsections. * RAM Transfer command The RAM Transfer command stores program code transferred from a host controller to the on-chip RAM and executes the program once the transfer is successfully completed. The maximum program size is 16 Kbytes. The RAM storage start address must be within the range. The RAM Transfer command can be used to download a flash programming routine of your own; this provides the ability to control on-board programming of the flash memory in a unique manner. The programming routine must utilize the flash memory command sequences described in Section 3.4. Before initiating a transfer, the RAM Transfer command checks a password sequence coming from the controller against that stored in the flash memory. If they do not match, the RAM Transfer command aborts. * Show Flash Memory Sum command The Show Flash Memory Sum command adds the contents of the 512 Kbytes of the flash memory together. The boot program does not provide a command to read out the contents of the flash memory. Instead, the Flash Memory Sum command can be used for software revision management. * Show Product Information command The Show Product Information command provides the product name, on-chip memory configuration and the like. This command also reads out the contents of the flash memory locations at addresses 0x0000_03F0 through 0x0000_03F3. In addition to the Show Flash Memory Sum command, these locations can be used for software revision management. TMP1942FD-42 TMP1942FD 3.3.9 RAM Transfer Command See Table 3.3.3. (1) The 1st byte specifies which one of the two serial operation modes is used. For a detailed description of how the serial operation mode is determined, see 3.3.13. If it is determined as UART mode, the boot program then checks if the SIO0 is programmable to the baud rate at which the 1st byte was transferred. During the first-byte interval, the RXE bit in the SC0MOD register is cleared. * To communicate in UART mode Send, from the controller to the target board, 86H in UART data format at the desired baud rate. If the serial operation mode is determined as UART, then the boot program checks if the SIO0 can be programmed to the baud rate at which the 1st byte was transferred. If that baud rate is not possible, the boot program aborts, disabling any subsequent communications. To communicate in I/O Interface mode Send, from the controller to the target board, 30H in I/O Interface data format at 1/16 of the desired baud rate. Also send the 2nd byte at the same baud rate. Then send all subsequent bytes at a rate equal to the desired baud rate. In I/O Interface mode, the CPU sees the serial receive pin as if it were a general input port in monitoring its logic transitions. If the baud rate of the incoming data is high or the chip's operating frequency is high, the CPU may not be able to keep up with the speed of logic transitions. To prevent such situations, the 1st and 2nd bytes must be transferred at 1/16 of the desired baud rate; then the boot program calculates 16 times that as the desired baud rate. When the serial operation mode is determined as I/O Interface mode, the SIO0 is configured for SCLK Input mode. Beginning with the 3rd byte, the controller must ensure that its AC timing restrictions are satisfied at the selected baud rate. In the case of I/O Interface mode, the boot program does not check the receive error flag; thus there is no such thing as error acknowledge (x8H). * (2) The 2nd byte, transmitted from the target board to the controller, is an acknowledge response to the 1st byte. The boot program echoes back the 1st byte: 86H for UART mode and 30H for I/O Interface mode. * UART mode If the SIO0 can be programmed to the baud rate at which the 1st byte was transferred, the boot program programs the BR0CR and sends back 86H to the controller as an acknowledge. If the SIO0 is not programmable at that baud rate, the boot program simply aborts with no error indication. Following the 1st byte, the controller should allow for a time-out period of five seconds. If it does not receive 86H within the allotted time-out period, the controller should give up the communication. The boot program sets the RXE bit in the SC0MOD register to enable reception before loading the SIO transmit buffer with 86H. * I/O Interface mode The boot program programs the SC0MOD and SC0CR registers to configure the SIO0 in I/O Interface mode (clocked by the rising edge of SCLK0), and writes 30H TMP1942FD-43 TMP1942FD to the SC0BUF. Then, the SIO0 waits for the SCLK0 signal to come from the controller. Following the transmission of the 1st byte, the controller should send the SCLK clock to the target board after a certain idle time (several microseconds). This must be done at 1/16 the desired baud rate. If the 2nd byte, which is from the target board to the controller, is 30H, then the controller should take it as a go-ahead. The controller must then deliver the 3rd byte to the target board at a rate equal to the desired baud rate. The boot program sets the RXE bit in the SC0MOD register to enable reception before loading the SIO transmit buffer with 30H. (3) The 3rd byte, which the target board receives from the controller, is a command. The code for the RAM Transfer command is 10H. (4) The 4th byte, transmitted from the target board to the controller, is an acknowledge response to the 3rd byte. Before sending back the acknowledge response, the boot program checks for a receive error. If there was a receive error, the boot program transmits x8H and returns to the state in which it waits for a command again. In this case, the upper four bits of the acknowledge response are undefined - they hold the same values as the upper four bits of the previously issued command. When the SIO0 is configured for I/O Interface mode, the boot program does not check for a receive error. If the 3rd byte is equal to any of the command codes listed in Table 3.3.2, the boot program echoes it back to the controller. When the RAM Transfer command was received, the boot program echoes back a value of 10H and then branches to the RAM Transfer routine. Once this branch is taken, a password check is done. Password checking is detailed in Section 3.3.14. If the 3rd byte is not a valid command, the boot program sends back x1H to the controller and returns to the state in which it waits for a command again. In this case, the upper four bits of the acknowledge response are undefined - they hold the same values as the upper four bits of the previously issued command. (5) The 5th to 16th bytes, which the target board receives from the controller, are a 12-byte password. The 5th byte is compared to the contents of address 0x0000_03F4 in the flash memory; the 6th byte is compared to the contents of address 0x0000_03F5 in the flash memory; likewise, the 16th byte is compared to the contents of address 0x0000_03FF in the flash memory. If the password checking fails, the RAM transfer routine sets the password error flag. (6) The 17th byte is a checksum value for the password sequence (5th to 16th bytes). To calculate the checksum value for the 12-byte password, add the 12 bytes together, drop the carries and take the two's complement of the total sum. Transmit this checksum value from the controller to the target board. The checksum calculation is described in detail in Section 3.3.16. (7) The 18th byte, transmitted from the target board to the controller, is an acknowledge response to the 5th to 17th bytes. First, the RAM Transfer routine checks for a receive error in the 5th to 17th bytes. If there was a receive error, the boot program sends back 18H and returns to the state in which it waits for a command (i.e., the 3rd byte) again. In this case, the upper four bits of the acknowledge response are the same as those of the previously issued command (i.e., all 1s). When the SIO0 is configured for I/O Interface mode, the RAM Transfer TMP1942FD-44 TMP1942FD routine does not check for a receive error. Next, the RAM Transfer routine performs the checksum operation to ensure data integrity. Adding the series of the 5th to 17th bytes must result in zero (with the carries dropped). If it is not zero, one or more bytes of data has been corrupted. In case of a checksum error, the RAM Transfer routine sends back 11H to the controller and returns to the state in which it waits for a command (i.e., the 3rd byte) again. Finally, the RAM Transfer routine examines the result of the password check. The following two cases are treated as a password error. In these cases, the RAM Transfer routine sends back 11H to the controller and returns to the state in which it waits for a command (i.e., the 3rd byte) again. * Irrespective of the result of the password comparison, all of the 12 bytes of a password in the flash memory are the same value other than FFH. * Not the entire password bytes transmitted from the controller matched those contained in the flash memory. When all the above checks have been successful, the RAM Transfer routine returns a normal acknowledge response (10H) to the controller. (8) The 19th to 22nd bytes, which the target board receives from the controller, indicate the start address of the RAM region where subsequent data (e.g., a flash programming routine) should be stored. The 19th byte corresponds to bits 31-24 of the address, and the 22nd byte corresponds to bits 7-0 of the address. (9) The 23rd and 24th bytes, which the target board receives from the controller, indicate the number of bytes that will be transferred from the controller to be stored in the RAM. The 23rd byte corresponds to bits 15-8 of the number of bytes to be transferred, and the 24th byte corresponds to bits 7-0 of the number of bytes. (10) The 25th byte is a checksum value for the 19th to 24th bytes. To calculate the checksum value, add all these bytes together, drop the carries and take the two's complement of the total sum. Transmit this checksum value from the controller to the target board. The checksum calculation is described in detail in Section 3.3.16. (11)The 26th byte, transmitted from the target board to the controller, is an acknowledge response to the 19th to 25th bytes of data. First, the RAM Transfer routine checks for a receive error in the 19th to 25th bytes. If there was a receive error, the RAM Transfer routine sends back 18H and returns to the state in which it waits for a command (i.e., the 3rd byte) again. In this case, the upper four bits of the acknowledge response are the same as those of the previously issued command (i.e., all 1s). When the SIO0 is configured for I/O Interface mode, the RAM Transfer routine does not check for a receive error. Next, the RAM Transfer routine performs the checksum operation to ensure data integrity. Adding the series of the 19th to 25th bytes must result in zero (with the carries dropped). If it is not zero, one or more bytes of data has been corrupted. In case of a checksum error, the RAM Transfer routine sends back 11H to the controller and returns to the state in which it waits for a command (i.e., the 3rd byte) again. * The RAM storage start address must be within the range of 0xFFFF_8000 to 0xFFFF_BFFF. TMP1942FD-45 TMP1942FD When the above checks have been successful, the RAM Transfer routine returns a normal acknowledge response (10H) to the controller. (12) The 27th to mth bytes from the controller are stored in the on-chip RAM of the TMP1942FD. Storage begins at the address specified by the 19th to 22nd bytes and continues for the number of bytes specified by the 23rd and 24th bytes. (13) The (m+1)th byte is a checksum value. To calculate the checksum value, add the 27th to mth bytes together, drop the carries and take the two's complement of the total sum. Transmit this checksum value from the controller to the target board. The checksum calculation is described in detail in Section 3.3.16. (14) The (m+2) byte is an acknowledge response to the 27th to (m+1)th bytes. First, the RAM Transfer routine checks for a receive error in the 27th to (m+1)th bytes. If there was a receive error, the RAM Transfer routine sends back 18H and returns to the state in which it waits for a command (i.e., the 3rd byte) again. In this case, the upper four bits of the acknowledge response are the same as those of the previously issued command (i.e., all 1s). When the SIO0 is configured for I/O Interface mode, the RAM Transfer routine does not check for a receive error. Next, the RAM Transfer routine performs the checksum operation to ensure data integrity. Adding the series of the 27th to (m+1)th bytes must result in zero (with the carries dropped). If it is not zero, one or more bytes of data has been corrupted. In case of a checksum error, the RAM Transfer routine sends back 11H to the controller and returns to the state in which it waits for a command (i.e., the 3rd byte) again. When the above checks have been successful, the RAM Transfer routine returns a normal acknowledge response (10H) to the controller. (15)If the (m+2)th byte was a normal acknowledge response, a branch is made to the address specified by the 19th to 22nd bytes in 32-bit ISA mode. Note: At this time, r29 (sp) points to 0xFFFF_9100. Do not transfer program control from the RAM back to the boot ROM. TMP1942FD-46 TMP1942FD 3.3.10 Show Flash Memory Sum Command See Table 3.3.4. (1) The processing of the 1st and 2nd bytes are the same as for the RAM Transfer command. (2) The 3rd byte, which the target board receives from the controller, is a command. The code for the Show Flash Memory Sum command is 20H. (3) The 4th byte, transmitted from the target board to the controller, is an acknowledge response to the 3rd byte. Before sending back the acknowledge response, the boot program checks for a receive error. If there was a receive error, the boot program transmits x8H and returns to the state in which it waits for a command again. In this case, the upper four bits of the acknowledge response are undefined - they hold the same values as the upper four bits of the previously issued command. When the SIO0 is configured for I/O Interface mode, the boot program does not check for a receive error. If the 3rd byte is equal to any of the command codes listed in Table 3.3.2, the boot program echoes it back to the controller. When the Show Flash Memory Sum command was received, the boot program echoes back a value of 20H and then branches to the Show Flash Memory Sum routine. If the 3rd byte is not a valid command, the boot program sends back x1H to the controller and returns to the state in which it waits for a command again. In this case, the upper four bits of the acknowledge response are undefined - they hold the same values as the upper four bits of the previously issued command. (4) The Show Flash Memory Sum routine adds all the bytes of the flash memory together. The 5th and 6th bytes, transmitted from the target board to the controller, indicate the upper and lower bytes of this total sum, respectively. For details on sum calculation, see Section 3.3.15. (5) The 7th byte is a checksum value for the 5th and 6th bytes. To calculate the checksum value, add the 5th and 6th bytes together, drop the carry and take the two's complement of the sum. Transmit this checksum value from the controller to the target board. (6) The 8th byte is the next command code. TMP1942FD-47 TMP1942FD 3.3.11 Show Product Information Command See Table 3.3.5. (1) The processing of the 1st and 2nd bytes are the same as for the RAM Transfer command. (2) The 3rd byte, which the target board receives from the controller, is a command. The code for the Show Product Information command is 30H. (3) The 4th byte, transmitted from the target board to the controller, is an acknowledge response to the 3rd byte. Before sending back the acknowledge response, the boot program checks for a receive error. If there was a receive error, the boot program transmits x8H and returns to the state in which it waits for a command again. In this case, the upper four bits of the acknowledge response are undefined - they hold the same values as the upper four bits of the previously issued command. When the SIO0 is configured for I/O Interface mode, the boot program does not check for a receive error. If the 3rd byte is equal to any of the command codes listed in Table 3.3.2, the boot program echoes it back to the controller. When the Show Flash Memory Sum command was received, the boot program echoes back a value of 30H and then branches to the Show Flash Memory Sum routine. If the 3rd byte is not a valid command, the boot program sends back x1H to the controller and returns to the state in which it waits for a command (i.e., the 3rd byte) again. In this case, the upper four bits of the acknowledge response are undefined - they hold the same values as the upper four bits of the previously issued command. (4) The 5th to 8th bytes, transmitted from the target board to the controller, are the data read from addresses 0x4000_03F0 to 0x4000_03F3 in the flash memory. Software version management is possible by storing a software ID in these locations. (5) The 9th to 20th bytes, transmitted from the target board to the controller, indicate the product name, which is "TX1942" in ASCII code. (6) The 21st to 24th bytes, transmitted from the target board to the controller, indicate the start address of the flash memory area containing the password, i.e., F4H, 03H, 00H, and 00H. (7) The 25th to 28th bytes, transmitted from the target board to the controller, indicate the start address of the on-chip RAM, i.e., 00H, 80H, FFH, FFH. (8) The 29th to 32nd bytes, transmitted from the target board to the controller, are dummy data, i.e., FFH, 8FH, FFH, FFH. (9) The 33rd to 36th bytes, transmitted from the target board to the controller, indicate the end address of the on-chip RAM, i.e., FFH, BFH, FFH, FFH. (10) The 37th to 44th bytes, transmitted from the target board to the controller, are dummy data. TMP1942FD-48 TMP1942FD (11) The 45th and 46th bytes, transmitted from the target board to the controller, indicate the presence or absence of the security and protect bits and whether the flash memory is divided into blocks. Bit 0 indicates the presence or absence of the security bit; it is 0 if the security bit is available. Bit 1 indicates the presence or absence of the protect bits; it is 0 if the protect bits are available. If bit 2 is 0, it indicates that the flash memory is divided into blocks. The remaining bits are undefined. The 45th and 46th bytes are 00H, 00H. (12) The 47th to 50th bytes, transmitted from the target board to the controller, indicate the start address of the on-chip flash memory, i.e., 00H, 00H, 00H, and 00H. (13) The 51st to 54th bytes, transmitted from the target board to the controller, indicate the end address of the on-chip flash memory, i.e., FFH, FFH, 07H, and 00H. (14) The 55th and 56th bytes, transmitted from the target board to the controller, indicate the number of flash blocks available, i.e., 13H, 00H. (15) The 57th to 92nd bytes, transmitted from the target board to the controller, contain information about the flash blocks. Flash blocks of the same size are treated as a group. Information about the flash blocks indicate the start address of a group, the size of the blocks in that group (in words) and the number of the blocks in that group. The 57th to 65th bytes are the information about the 32-Kbyte blocks (Block 0 to Block 14). The 66th to 74th bytes are the information about the 16-Kbyte block (Block 15). The 75th to 83rd bytes are the information about the 8-Kbyte block (Block 16). The 84th to 92nd bytes are the information about the 4-Kbyte blocks (Block 17 and Block 18). See Table 3.3.5 for the values of bytes transmitted. (16) The 93rd byte, transmitted from the target board to the controller, is a checksum value for the 5th to 92nd bytes. The checksum value is calculated by adding all these bytes together, dropping the carries and taking the two's complement of the total sum. (17) The 94th byte is the next command code. TMP1942FD-49 TMP1942FD 3.3.12 Acknowledge Responses The boot program represents processing states with specific codes. Table 3.3.7 to Table 3.3.9 show the values of possible acknowledge responses to the received data. The upper four bits of the acknowledge response are equal to those of the command being executed. Bit 3 of the code indicates a receive error. Bit 0 indicates an invalid command error, a checksum error or a password error. Bit 1 and bit 2 are always 0. Receive error checking is not done in I/O Interface mode. Table 3.3.7 ACK Response to the Serial Operation Mode Byte Return Value 86H 30H Meaning The SIO can be configured to operate in UART mode. (See Note) The SIO can be configured to operate in I/O Interface mode. Note: If the serial operation mode is determined as UART, the boot program checks if the SIO can be programmed to the baud rate at which the operation mode byte was transferred. If that baud rate is not possible, the boot program aborts without sending back any response. Table 3.3.8 ACK Response to the Command Byte Return Value x8H (See Note) x1H (See Note) 10H 20H 30H Meaning A receive error occurred while getting a command code. An undefined command code was received. The RAM Transfer command was received. The Show Flash Memory Sum command was received. The Show Product Information command was received. Note: The upper four bits of the ACK response are the same as those of the previous command code. Table 3.3.9 ACK Response to the Checksum Byte Return Value 18H 11H 10H A receive error occurred. A checksum or password error occurred. The checksum was correct. Meaning TMP1942FD-50 TMP1942FD 3.3.13 Determination of a Serial Operation Mode The first byte from the controller determines the serial operation mode. To use UART mode for communications between the controller and the target board, the controller must first send a value of 86H at a desired baud rate to the target board. To use I/O Interface mode, the controller must send a value of 30H at 1/16 the desired baud rate. Figure shows the waveforms of the first byte. Start Point A UART (86H) tAB tCD bit 0 bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 Stop Point B Point C Point D bit 0 Point A I/O Interface (30H) bit 1 bit 2 bit 3 bit 4 bit 5 bit 6 bit 7 Point D Point B Point C tAB tCD Figure 3.3.4 Serial Operation Mode Byte After RESET is released, the boot program monitors the first serial byte from the controller with the SIO reception disabled, and calculates the intervals of tAB, tAC and tAD. Figure 3.3.5 shows a flowchart describing the steps to determine the intervals of tAB, tAC and tAD. As shown in the flowchart, the boot program captures timer counts each time a logic transition occurs in the first serial byte. Consequently, the calculated tAB, tAC and tAD intervals are bound to have slight errors. If the transfer goes at a high baud rate, the CPU might not be able to keep up with the speed of logic transitions at the serial receive pin. In particular, I/O Interface mode is more prone to this problem since its baud rate is generally much higher than that for UART mode. To avoid such a situation, the controller should send the first serial byte at 1/16 the desired baud rate. The flowchart in Figure 3.3.6 shows how the boot program distinguishes between UART and I/O Interface modes. If the length of tAB is equal to or less than the length of tCD, the serial operation mode is determined as UART mode. If the length of tAB is greater than the length of tCD, the serial operation mode is determined as I/O Interface mode. Bear in mind that if the baud rate is too high or the timer operating frequency is too low, the timer resolution will be coarse, relative to the intervals between logic transitions. This becomes a problem due to inherent errors caused by the way in which timer counts are captured by software; consequently the boot program might not be able to determine the serial operation mode correctly. For example, the serial operation mode may be determined to be I/O Interface mode when the intended mode is UART mode. To avoid such a situation, when UART mode is utilized, the controller should allow for a time-out period within which it expects to receive an echo-back (86H) from the target board. The controller should give up the communication if it fails to get that echo-back within the allotted time. When I/O Interface mode is utilized, once the first serial byte has been transmitted, the controller should send the SCLK clock after a certain idle time to get an acknowledge response. If the received acknowledge response is not 30H, the controller should give up further communications. TMP1942FD-51 TMP1942FD Start Initialize 16-bit Timer 0 (T1 = 8/f, counter cleared) Set TB0RG1 to 0xFFFF Prescaler is on. Point A High-to-low transition on serial receive pin? Yes 16-bit Timer 0 starts counting up Point B Low-to-high transition on serial receive pin? Yes Software-capture and save timer value (tAB) Point C High-to-low transition on serial receive pin? Yes Software-capture and save timer value (tAC) Point D Low-to-high transition on serial receive pin? Yes Software-capture and save timer value (tAD) 16-bit Timer 0 stops counting tAC tAD? Yes Make backup copy of tAD value Stop operation (infinite loop) Done Figure 3.3.5 Serial Operation Mode Byte Reception Flow TMP1942FD-52 TMP1942FD Start tCD tAD - tAC tAB > tCD? Yes UART Mode I/O Interface Mode Figure 3.3.6 Serial Operation Mode Determination Flow TMP1942FD-53 TMP1942FD 3.3.14 Password The RAM Transfer command (10H) causes the boot program to perform a password check. Following an echo-back of the command code, the boot program checks the contents of the 12-byte password area (0x4000_03F4 to 0x4000_03FF) within the flash memory. If all these address locations contain the same bytes of data other than FFH, a password area error occurs. In this case, the boot program returns an error acknowledge (11H) in response to the checksum byte (the 17th byte), regardless of whether the password sequence sent from the controller is all FFHs. The password sequence received from the controller (the 5th to 16th bytes) is compared to the password stored in the flash memory. Table 3.3.10 show how they are compared byte by byte. All of the 12 bytes must match to pass the password check. Otherwise, a password error occurs, which causes the boot program to return an error acknowledge in response to the checksum byte (the 17th byte). Start Are all bytes the same? No Yes Are all bytes equal to FFH? Yes No Password area error Password area is normal. Figure 3.3.7 Password Area Check Flow Table 3.3.10 Relationship between Received Bytes and Flash Memory Locations Received Byte 5th byte 6th byte 7th byte 8th byte 9th byte 10th byte 11th byte 12th byte 13th byte 14th byte 15th byte 16th byte Compared Flash Memory Data Address 0x4000_03F4 Address 0x4000_03F5 Address 0x4000_03F6 Address 0x4000_03F7 Address 0x4000_03F8 Address 0x4000_03F9 Address 0x4000_03FA Address 0x4000_03FB Address 0x4000_03FC Address 0x4000_03FD Address0x4000_03FE Address 0x4000_03FF TMP1942FD-54 TMP1942FD 3.3.15 Calculation of the Show Flash Memory Sum Command The Show Flash Memory Sum command adds all 512 Kbytes of the flash memory together and provides the total sum as a word quantity. The sum is sent to the controller with the upper eight bits first, followed by the lower eight bits. Example: A1H B2H C3H For the interest of simplicity, assume the depth of the flash memory is four locations. Then the sum of the four bytes is calculated as: A1H + B2H + C3H + D4H = 02EAH D4H Hence, 02H is first sent to the controller, followed by 3.3.16 Checksum Calculation The checksum byte for a series of bytes of data is calculated by adding the bytes together, dropping the carries, and taking the two's complement of the total sum. The Show Flash Memory Sum command and the Show Product Information command perform the checksum calculation. The controller must perform the same checksum operation in transmitting checksum bytes. Example: Assume the Show Flash Memory Sum command provides the upper and lower bytes of the sum as E5H and F6H. To calculate the checksum for a series of E5H and F6H: (1) Add the bytes together. E5H + F6H = 1DBH (2) Drop the carry. (3) Take the two's complement of the sum, and that is the checksum byte. 0 - DBH = 25H TMP1942FD-55 TMP1942FD 3.3.17 General Boot Program Flowchart Figure 3.3.8 shows an overall flowchart of the boot program. Single Boot program starts Initialize Get SIO operation mode data SIO Operation Mode? UART Baud rate setting? Can be set Program UART mode and baud rate ACK data Received data (86H) (Send 86H) Normal response Cannot be set I/O Interface Set I/O Interface Mode ACK data Received data (30H) (Send 30H) Normal Response Stop operation Prepare to get a command ACK data ACK data & 0xF0 Receive routine Get a command Receive error? No RAM Transfer? Yes (10H) ACK data Received data (10H) Yes ACK data ACK data 0x08 Transmit routine (Send x8H: Receive error) Show Flash Memory Sum? YES (20H) ACK data Received data (20H) Transmit routine (Send 20H: Normal response) Show Product Information? YES (30H) ACK data Received data (30H) Transmit routine (Send 30H: Normal response) Command error ACK data ACK data | 0x01 Transmit routine (Send x1H: Command error) Transmit routine (Send 10H: Normal response) RAM Transfer processing Show Flash Memory Sum processing Show Product Information processing Processed normally? Yes Jump to RAM Figure 3.3.8 Overall Boot Program Flow TMP1942FD-56 TMP1942FD 3.4 On-Board Programming and Erasure The TMP1942FD flash memory is command set compatible with the JEDEC EEPROM standard, with a few exceptions. In User Boot mode and Single Boot mode (the RAM Transfer command), the flash memory can be programmed and erased by the CPU executing software commands. It is the user's responsibility to create a program/erase routine. Because the flash memory cannot be read while it is being programmed or erased, the program/erase routine must be executed out of the on-chip RAM or an external memory device. 3.4.1 Key Features The TMP1942FD flash memory commands are in principle compatible with the standard JEDEC commands. For program/erase operations, the system can issue a command sequence to the flash memory by using CPU instructions such as LD. After the command sequence is written, the flash memory does not require the system to provide further controls or timings. The flash memory initiates the embedded program or erase algorithm automatically. The entire flash memory or one or more flash blocks can be erased at a time. Table 3.4.1 Flash Memory Features Feature Description Programs and verifies the desired addresses in longword units automatically. Erases and verifies the entire memory array automatically. Erases and verifies all memory locations in the selected block automatically. Erases and verifies all memory locations in multiple selected blocks automatically. Provides several status bits such as the Data Polling bit and Toggle bit, which can be used to determine whether a program or erase operation is complete or in progress. Prevents intrusive access to the flash memory while in Programmer mode. When the security feature is turned off, the entire memory array is erased and verified automatically, regardless of whether a given block is protected or not. Disables both program and erase operations in any block. Auto Program Auto Chip Erase Auto Block Erase Auto Multi-Block Erase Write operation status Security feature Block protection Bear in mind that, due to the on-chip CPU interface, the TMP1942FD uses addresses different from those of the standard flash command sequences. Unless otherwise noted, programming is done in longword (32-bit) units; thus the longword (32-bit) load instruction should be used to write to the flash array. The byte load instruction can be used to issue commands to the flash memory. The program/erase operations in Programmer mode are very similar to those of the on-board programming modes, with a few exceptions such as the data bus width. Refer to Section 3.4.2 for a description of the program and erase operations in Programmer mode. TMP1942FD-57 TMP1942FD 3.4.1.1 Block Architecture 0xxxxx_0000 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 K bytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 0xxxx7_FFFF 32 Kbytes x: Depends on the TMP1942FD operation mode. Figure 3.4.1 Flash Memory Block Architecture 3.4.1.2 CPU-to-Flash Interface Figure 3.4.2 illustrates the internal iterface between the CPU and the flash memory in on-board programming modes. The diagram does not show the actual logic network; instead it is only a conceptual depiction of the CPU-to-flash interface. Single-Chip mode: 0x1FC0_0000-0x1FC7_FFFF (physical address) Boot mode: 0x4000_0000-0x4007_FFFF (physical address) Operation Mode Decoder CE (512 KB) A16 - A2 D31 - D0 WR RD CPU RESET Register AD14 - AD0 DQ31 - DQ0 WE OE RESET RDY/BSY CPU Flash Memory A31 - A17 Figure 3.4.2 Internal CPU-to-Flash Interface TMP1942FD-58 TMP1942FD 3.4.1.3 Read Mode and Embedded Operation Mode The flash memory of the TMP1942FD has the following two modes of operation: * * Read mode in which array data is read Embedded Operation mode in which the flash array is programmed or erased The flash memory enters Embedded Operation mode when a valid command is executed in Read mode. In Embedded Operation mode, array data cannot be read. 3.4.1.4 Reading Array Data The flash memory is automatically set to reading array data upon CPU reset after device power-up and after an embedded operation is successfully completed. If an embedded operation terminated abnormally or the flash memory is required to return to Read mode, the Read/Reset command (software reset) or hardware reset is used. 3.4.1.5 Writing Commands The operations of the flash memory are selected by commands or command sequences written into the internal command register. This uses the same mechanism as for JEDEC-standard EEPROMs. Commands are made up of data sequences written at specific addresses via the command register (see Table 3.4.3 and Table 3.4.4 ). Commands are written via DQ0-DQ7 except the fourth (read) cycle in the Read/Reset command sequence, the fourth (write) cycle in the Auto Program command sequence and the fourth (write) cycle in the Verify Block Protect command sequence. Thus, commands can be provided byte by byte. The command sequence being written can be canceled by issuing the Read/Reset command between sequence cycles. The Read/Reset command clears the command register and resets the flash memory to Read mode. Invalid command sequences also cause the flash memory to clear the command register and return to Read mode. 3.4.1.6 Reset * Read/Reset command (software reset) The flash memory does not return to Read mode if an embedded operation terminated abnormally. In this case, the Read/Reset command must be issued to put the flash memory back in Read mode. The Read/Reset command may also be written between sequence cycles of the command being written to clear the command register. Hardware reset As shown in Figure 3.4.2, the flash memory has a reset pin, which is connected to the reset signal of the CPU. When the system drives the RESET pin to VIL or when certain events such as a watchdog timer time-out causes a CPU reset, the flash memory immediately terminates any operation in progress and is reset to Read mode. * TMP1942FD-59 TMP1942FD The Read/Reset command is also tied to the RESET pin to reset the flash memory to Read mode. The embedded operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. For a description of the hardware reset operation, see Section 3.2.1, Reset Operation. When a valid reset is achieved, the CPU reads the Reset exception vector from the flash memory and services the Reset exception. 3.4.1.7 Auto Program Command A bit must be programmed to change its state from a 1 to a 0. A bit cannot be programmed from a 0 back to a 1. Only an erase operation can change a 0 back to a 1. In User Boot mode and the RAM Transfer command of Single Boot mode, the Auto Program command programs the desired addresses in 32-bit (longword) units. The Auto Program command requires four bus cycles; the program address and data are written in the fourth cycle, upon completion of which the program operation will commence. As programming is performed in 32-bit units, the program address must be a multiple of four. Writing data shorter than a 32-bit longword requires special considerations for the bits that are not to be altered. The longword in the memory does not need to be in the erased state prior to programming. If the longword is in the erased state, a 32-bit write must be performed, with all the bits not to be altered set to 1. If the longword is not in the erased state, it must be loaded into the CPU first to modify necessary bits, and the modified word must be written to the flash memory. Examples: 1) When a longword location is in the erased state To program the least-significant byte to 55H, 0xFFFF_FF55 must be written to the longword address. 2) When a longword location is not in the erased state and contains 0x8888_88FF To program the least-significant byte to AAH, 0x8888_88AA must be written to the longword address. The Auto Program command executes a sequence of internally timed events to program the desired bits of the addressed memory location and verify that the desired bits are sufficiently programmed. The system can determine the status of the programming operation by using write status flags (See Table 3.4.6). Any commands written during the programming operation are ignored. A hardware reset immediately terminates the programming operation. The programming operation that was interrupted should be re-initiated once the flash memory is ready to accept another command because data may be corrupted. The block protection feature disables programming operations in any block. If an attempt is made to program a protected block, the Auto Program command does nothing; the flash memory returns to Read mode in approximately 3 s after the completion of the fourth bus cycle of the command sequence. When the embedded Auto Program algorithm is complete, the flash memory returns to Read mode. If any failure occurs during the programming operation, the flash memory remains locked in Embedded Operation mode. The system can determine this status by using write status flags. To put the flash memory back in Read mode, use the Read/Reset command to TMP1942FD-60 TMP1942FD reset the flash memory or a hardware reset to reset the whole chip. In case of a programming failure, it is recommended to replace the chip or discontinue the use of the failing flash block. 3.4.1.8 Auto Chip Erase Command The Auto Chip Erase command requires six bus cycles. After completion of the sixth bus cycle, the Auto Chip Erase operation will commence immediately. The embedded Auto Chip Erase algorithm automatically preprograms the entire memory for an all-0 data pattern prior to the erase; then it automatically erases and verifies the entire memory for an all-1 data pattern. The system can determine the status of the chip erase operation by using write status flags (see Table 3.4.6). Any commands written during the chip erase operation are ignored. A hardware reset immediately terminates the chip erase operation. The chip erase operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. The block protection feature disables erase operations in any block. The Auto Chip Erase algorithm erases the unprotected blocks and ignores the protected blocks. If all the blocks are protected, the Auto Chip Erase command does nothing; the flash memory returns to Read mode in approximately 100 s after the completion of the sixth bus cycle of the command sequence. When the embedded Auto Chip Erase algorithm is complete, the flash memory returns to Read mode. If any failure occurs during the erase operation, the flash memory remains locked in Embedded Operation mode. The system can determine this status by using write status flags. To put the flash memory back in Read mode, use the Read/Reset command to reset the flash memory or a hardware reset to reset the whole chip. In case of an erase failure, it is recommended to replace the chip or discontinue the use of the failing flash block. The failing block can be identified by means of the Block Erase command. 3.4.1.9 Auto Block Erase and Auto Multi-Block Erase Commands The Auto Block Erase command requires six bus cycles. A time-out begins from the completion of the command sequence. After a time-out, the erase operation will commence. The embedded Auto Block Erase algorithm automatically preprograms the selected block for an all-0 data pattern, and then erases and verifies that block for an all-1 data pattern. During the time-out period, additional block addresses and Auto Block Erase commands may be written (see Section 3.4.1.16). Any command other than Auto Block Erase during the time-out period resets the flash memory to Read mode. The block erase time-out period is 50 s. The system may read DQ3 to determine whether the time-out period has expired. The block erase timer begins counting upon completion of the sixth bus cycle of the Auto Block Erase command sequence. The system can determine the status of the erase operation by using write status flags (see Table 3.4.6). Any commands written during the block erase operation are ignored. A hardware reset immediately terminates the block erase operation. The block erase operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. The block protection feature disables erase operations in any block. The Auto Block Erase algorithm erases the unprotected blocks and ignores the protected blocks. If all the TMP1942FD-61 TMP1942FD selected blocks are protected, the Auto Block Erase algorithm does nothing; the flash memory returns to Read mode in approximately 100 s after the final bus cycle of the command sequence. When the embedded Auto Block Erase algorithm is complete, the flash memory returns to Read mode. If any failure occurs during the erase operation, the flash memory remains locked in Embedded Operation mode. The system can determine this status by using write status flags. To put the flash memory back in Read mode, use the Read/Reset command to reset the flash memory or a hardware reset to reset the whole chip. In case of an erase failure, it is recommended to replace the chip or discontinue the use of the failing flash block. If any failure occurred during the multi-block erase operation, the failing block can be identified by running Auto Block Erase on each of the blocks selected for multi-block erasure. 3.4.1.10 Block Protect Command The block protection feature disables both program and erase operations in any block. The effects of the program and erase commands on the protected blocks are summarized below. Table 3.4.2 Effects of the Program and Erase Commands on the Protected Blocks Command Operation No programming operation is performed, and the flash memory automatically returns to Read mode. No erase operation is performed, and the flash memory automatically returns to Read mode. No erase operation is performed, and the flash memory automatically returns to Read mode. Only the unprotected blocks are erased. Upon completion, the flash memory automatically returns to Read mode. Only the unprotected blocks are erased. Upon completion, the flash memory automatically returns to Read mode. Program command on a protected block Block Erase command on a protected block Chip Erase command when all the blocks are protected Chip Erase command when any blocks are protected Multi-Block Erase command when any blocks are protected The Block Protect command requires 10 bus cycles. The address of the block to be protected is internally latched in the seventh cycle. Then, allow an interval of 4 s to elapse before providing data for the eighth cycle, which enables writing to the protection control circuitry. Next, allow an interval of at least 100 s to elapse before providing data for the ninth cycle. This terminates writing to the protection control circuitry. Finally, allow an interval of 8 s to elapse and provide data for the tenth cycle to complete the command. Note that the block protect operation is not verified automatically. The Verify Block Protect command must be written to verify the protect status after executing Block Protect. If the desired block is not in the protected state, the Block Protect command sequence must be re-initiated. Figure 3.4.8 illustrates the algorithm for the Block Protect command. Any commands written during the Block Protect algorithm are ignored. A hardware reset immediately terminates the block protect operation. The Block Protect command that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence. 3.4.1.11 Block Unprotect Command The Block Unprotect command unprotects all blocks simultaneously. All blocks must be protected before executing the Block Unprotect command. The Block Unprotect command requires 10 bus cycles. After the seventh bus write cycle is completed (where the address is don't care), allow an interval of 4 s to elapse before TMP1942FD-62 TMP1942FD providing data for the eighth cycle, which enables the block unprotect operation. Next, allow an interval of at least 10 s to elapse before providing data for the ninth cycle. This terminates the block unprotect operation. Finally, allow an interval of 8 s to elapse and provide data for the tenth cycle to complete the command. Note that the block unprotect operation is not verified automatically. The Verify Block Protect command must be written to verify the protect status after executing Block Unprotect. If the desired block is not unprotected, the Block Unprotect command sequence must be re-initiated. Any commands written during the block unprotect operation are ignored. The hardware reset immediately terminates the block unprotect operation. The Block Protect command that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence. Use the Verify Block Protect command to verify the protect status of a block. 3.4.1.12 Verify Block Protect Command The Verify Block Protect command is used to verify the protect status of a block. Verify Block Protect is a four-bus-cycle operation. The address of the block to be verified is given in the fourth cycle. Any address within the block range will suffice, provided A0 = A1 = A2 = A3 = 0, A4 = 1 and A6 = 0. To get correct data, a 32-bit read must be performed. Use the last read as valid data. If the selected block is protected, a value of 0x0000_0001 is returned. If the selected block is not protected, a value of 0x0000_0000 is returned. Additional blocks may be verified by repeating the fourth bus read cycle. The Verify Block Protect command does not return the flash memory to Read mode. Either the Read/Reset command or a hardware reset is required to reset the flash memory to Read mode or to write the next command. 3.4.1.13 Write Operation Status As shown in Table 3.4.6 , the flash memory provides several flag bits to determine the status of an embedded operation: DQ7, DQ5 and DQ3. These status bits can be read during an embedded operation using the same timing as for Read mode. The flash memory automatically returns to Read mode when an embedded operation completes. During the embedded program operation, the system must provide the program address (with A0 = 0 and A1 = 0) to read valid status information. During the embedded erase operation, the system must provide an address (with A0 =0 and A1 = 0) within any of the blocks selected for erasure to read valid status information. * DQ7 (Data Polling) The Data Polling bit, DQ7, indicates to the host system the status of the embedded operation. Data Polling is valid after the final bus write cycle of an embedded command sequence. When the embedded Program algorithm is in progress, an attempt to read the flash memory will produce the complement of the data last written to DQ7. Upon completion of the embedded Program algorithm, an attempt to read the flash memory will produce the true data last written to DQ7. Therefore, the system can use DQ7 to determine whether the embedded Program algorithm is in progress or complete. When the embedded Erase algorithm is in progress, an attempt to read the flash memory will produce a 0 at the DQ7 output. Upon completion of the embedded Erase algorithm, the flash memory will produce a 1 at the DQ7 output. If there is a failure during an embedded operation, DQ7 continues to output the TMP1942FD-63 TMP1942FD same value. Thus, DQ7 must always be polled in conjunction with the Exceeded Timing Limits (DQ5) flag. Figure 3.4.6 shows the DQ7 polling algorithm. The flash memory disables address latching when an embedded operation is complete. Data polling must be performed with a valid programmed address or an address within any of the non-protected blocks selected for erasure. * DQ5 (Exceeded Timing Limits) DQ5 produces a 0 while the program or erase operation is in progress normally. DQ5 produces a 1 to indicate that the program or erase time has exceeded the specified internal limit. This is a failure condition that indicates the program or erase cycle was not successfully completed. The DQ5 failure condition also appears if the system tries to program a 1 to a location that was previously programmed to a 0. Only an erase operation can change a 1 back to a 0. In this case, the embedded Program algorithm halts the operation. Once the operation has exceeded the timing limits, DQ5 will indicate a 1. Note that this is not a device failure condition since the flash memory was used incorrectly. Under both these conditions, the flash memory remains locked in Embedded Operation mode. The system must issue the Read/Reset command to return the flash memory to Read mode. DQ3 (Block Erase Timer) After the completion of the sixth bus cycle of the Auto Block Erase command sequence, the block erase time-out window of 50 s begins. The erase operation will begin after the time-out has expired. When the time-out is complete and the erase operation has begun, DQ3 switches from 0 to 1. If DQ3 is 0, the flash memory will accept additional Auto Block Erase commands. Each time an Auto Block Erase command is written, the time-out window is reset. To ensure that the command has been accepted, the system should check DQ3 prior to and following each Auto Block Erase command. If DQ3 is 1 on the second status check, the command might not have been accepted. * 3.4.1.14 Flash Control/Status Register This is an 8-bit register that indicates the Ready/Busy status of an embedded algorithm and controls the security feature. 7 6 5 4 3 R/W 0 2 RDY/BSY R 1 1 R/W 0 0 FSE R/W 0 FLCS Bit Symbol Reset Value Function (0xFFFF_E520) Read/Write Must be Ready/Busy written as 0: Embedded algorithm is in "0". progress. 1: Embedded algorithm is complete Must be Security control written as 0: Access flash memory array "0". 1: Access security logic Bit 2: Ready/Busy Flag Bit In Programmer mode, the ALE pin functions as the RDY/BSY pin. The host system can monitor the state of this pin to determine whether an embedded algorithm is in progress or complete. The CPU can poll the RDY/BSY bit in the FLCS register for the same purpose. The RDY/BSY bit is cleared to 0 when the flash memory is TMP1942FD-64 TMP1942FD actively erasing or programming. The RDY/BSY bit is set to 1 when an embedded operation has completed and the flash memory is ready to accept the next command. If any failure occurs during the program or erase operation, this bit remains cleared. A hardeare reset sets this bit. The RDY/BSY bit is cleared upon completion of the final bus write cycle of an embedded operation command, with one exception. In the case of the Auto Block Erase command, this bit is cleared after the time-out has expired. Any command is ignored while the RDY/BSY bit is cleared. Bit 0: Flash Security Enable (FSE) The FSE bit is used to enable and disable the security feature. After a reset, this bit is cleared. Under this condition, the program and erase commands access the memory array. To turn on the security feature, set the FSE bit and write the Auto Security On command. Thereafter, the FSE bit must be cleared to enable access to the memory array. To turn off the security feature, set the FSE bit and write the Auto Security Off command. Note: The Flash Control/Status register must be accessed as a 32-bit quantity. Figure 3.4.3 Flash Control/Status Register 3.4.1.15 Flash Security The TMP1942FD flash memory supports not only on-board programming but also programming using a general-purpose programmer. Therefore, the TMP1942FD flash memory provides a security feature to prevent intrusive access to the flash memory while in Programmer mode. The TMP1942FD has a security bit apart from the flash array. Programming this security bit disables access to the flash array. The paragraphs that follow describe the methods to secure and unsecure the flash memory. As in the case with a flash programming routine, the security control routine must also be placed and executed outside of the flash memory--either the on-chip RAM or an external memory device. * Securing the flash memory (Disabling read accesses) Securing the flash memory disables a general-purpose programmer to read its contents. To turn on the security feature, once programming is complete, set the FSE bit in the FLCS register and write the Auto Security On command. After the completion of the fourth bus cycle of that command sequence, the embedded Security On algorithm automatically programs and verifies the security bit. Any commands written during the embedded operation are ignored. A hardware reset immediately terminates the embedded operation. The FSE bit must not be altered throughout the embedded operation. When the embedded algorithm completes, the flash memory automatically returns to Read mode. In on-board operating modes, the CPU can read the flash memory even if the security is on; clear the FSE bit to 0 to enable access to the flash array. If any failure occurs during the embedded operation, the flash memory remains locked in Embedded Operation mode and does not return to Read mode. The system can determine the status of the embedded operation by using write status flags. Note that this is a security bit failure. If the flash memory needs to be secured, the chip should be replaced. When the security is on, any reads by programming equipment will always returns a value of 0x0098. Unsecuring the flash memory (Enabling read accesses) The security feature is designed to disable reads of the flash memory by programming equipment. While the TMP1942FD is soldered on a board, the CPU can always read the flash memory regardless of whether or not the security is on. * TMP1942FD-65 TMP1942FD Since the flash memory is placed under control of a user's application program in on-board operating modes, it is not easy for third parties to perform intrusive access to the flash memory. Therefore, within the confines of a board, the flash memory does not need to be secured. To turn off the security feature, set the FSE bit in the FLCS register to 1 and write the Auto Security Off command. After the completion of the sixth bus cycle of that command sequence, the embedded Security Off algorithm automatically erases and verifies the entire flash array, and then erases and verifies the security bit. Any commands written during the embedded operation are ignored. A hardware reset immediately terminates the embedded operation. In this case, if any erase operation is in progress, data may be corrupted. The FSE bit must not be altered throughout the embedded operation. When the embedded algorithm completes, the flash memory automatically returns to Read mode. If any on-board operation is subsequently required, clear the FSE bit to 0 to enable access to the flash array. If any failure occurs during the embedded operation, the flash memory remains locked in Embedded Operation mode and does not return to Read mode. The system can determine the status of the embedded operation by using write status flags. If a failure occurs in the memory array, the security bit is not erased. In this case, the security is left on. The chip should be replaced if a memory array or security bit failure occurs. The Auto Security Off command erases the flash array prior to turning off the security feature. Even if a given block is protected, it is unconditionally erased, but the protect status of that block remains unchanged. The Auto Security Off and Auto Chip Erase command sequences are the same. The only difference is that the Auto Security Off command requires the FSE bit to be set to 1 before the command is written. The Auto Block Erase command cannot turn off the security feature even when the FSE bit is set. If the Auto Block Erase command is written when the security is on, no block will be erased and the operation is immediately terminated. 3.4.1.16 Command Definitions Table 3.4.3 On-Board Programming Mode Command Definitions Bus Cycles Command Sequence Read/Reset Read/Reset Auto Program Auto Chip Erase Auto Block Erase Block Protect Verify Block Protect Auto Security On (Note 1) Cycles Required 1 3 4 6 6 10 4 4 1st Cycle (Write) Addr. Data 0xXXX0 0xAAA8 0xAAA8 0xAAA8 0xAAA8 0xAAA8 0xAAA8 0xAAA8 F0H AAH AAH AAH AAH AAH AAH AAH 2nd Cycle (Write) Addr. Data 0x5554 0x5554 0x5554 0x5554 0x5554 0x5554 0x5554 55H 55H 55H 55H 55H 55H 55H 3rd Cycle (Write) Addr. Data 0xAAA8 0xAAA8 0xAAA8 0xAAA8 0xAAA8 0xAAA8 0xAAA8 F0H A0H 80H 80H 9AH 90H A0H 4th Cycle (Read/Write) Addr. Data RA PA 0xAAA8 0xAAA8 0xAAA8 BPA 0x0000 RD PD AAH AAH AAH BD 98H 5th Cycle (Write) Addr. Data 0x5554 0x5554 0x5554 55H 55H 55H TMP1942FD-66 TMP1942FD (Continued from above) Bus Cycles Command Sequence Read/Reset Read/Reset Auto Program Auto Chip Erase Auto Block Erase Block Protect Verify Block Protect Auto Security On (Note 1) Cycles Required 1 3 4 6 6 10 4 4 6th Cycle (Write) Addr. Data 7th Cycle (Write) Addr. Data 8th Cycle (Write) Addr. Data 9th Cycle (Write) Addr. Data 10th Cycle (Write) Addr. Data 0xAAA8 BA 0xAAA8 10H 30H 9AH BA 00H 0xXXX0 00H 0xXXX0 00H 0xXXX0 00H Note 1: Note 2: Before executing the command sequence, set the FSE bit in the Flash Control/Status (FLCS) register to enable access to the security bit. There must be an interval of at least two instructions between writing one command sequence and another. The addresses to be provided by the CPU are shown below. Table 3.4.4 Addresses Provided by the CPU Command Address Addr. 0xXXX0 0x0000 0xAAA8 0x5554 A23A16 Flash memory block A15 X 0 1 0 A14 X 0 0 1 A13 X 0 1 0 A12 X 0 0 1 CPU Addresses: A23-A0 A11 X 0 1 0 A10 X 0 0 1 A9 X 0 1 0 A8 X 0 0 1 A7 X 0 1 0 A6 X 0 0 1 A5 X 0 1 0 A4 X 0 0 1 A3 0 0 1 0 A2 0 0 0 1 A1 0 0 0 0 A0 0 0 0 0 * F0H, AAH, 55H, A0H, 80H, 10H, 30H: Command data. Write command data as a byte quantity. * RA: RD: Read Address Read Data * PA: Program Address PD: Program Data The address must be a multiple of four. Write data on a word-by-word basis. * BA: Block Address (BA0-BA6) Refer to Table 3.4.5. * BPA: Verify Block Protect Address BD: Block Protect Data The address of the block to be verified can be any of the addresses within the block, with A6=0, A4=1, A3=0, A1=0 and A0=0. If a block is protected, a value of 0x0000_0001 will be returned. If a block is not protected, a value of 0x0000_0000 will be returned. TMP1942FD-67 TMP1942FD Table 3.4.5 Block Erase Addresses Block BA0 BA1 BA2 BA3 BA4 BA5 BA6 BA7 BA8 BA9 BA10 BA11 BA12 BA13 BA14 BA15 Address Range User Boot Mode 0x1FC0_0000-0x1FC0_7FFF (or x4000_0000-0x4000_7FFF) 0x1FC0_8000-0x1FC0_FFFF (or 0x4000_8000-0x4000_FFFF) 0x1FC1_0000-0x1FC1_7FFF (or 0x4001_0000-0x4001_7FFF) 0x1FC1_8000-0x1FC1_FFFF (or 0x4001_8000-0x4001_FFFF) 0x1FC2_0000-0x1FC2_7FFF (or 0x4002_0000-0x4002_7FFF) 0x1FC2_8000-0x1FC2_FFFF (or 0x4002_8000-0x4002_FFFF) 0x1FC3_0000-0x1FC3_7FFF (or 0x4003_00000x4003_7FFF) 0x1FC3_8000-0x1FC3_FFFF (or0x4003_80000x4003_FFFF) 0x1FC4_0000-0x1FC4_7FFF (or 0x4004_0000-0x4004_7FFF) 0x1FC4_8000-0x1FC4_FFFF (or0x4004_8000-0x4004_FFFF) 0x1FC5_0000-0x1FC5_7FFF (or0x4005_0000-0x4005_7FFF) 0x1FC5_8000-0x1FC5_FFFF (or 0x4005_8000-0x4005_FFFF) 0x1FC6_0000-0x1FC6_7FFF (or 0x4006_00000x4006_7FFF) 0x1FC6_8000-0x1FC6_FFFF (or 0x4006_8000-0x4006_FFFF) 0x1FC7_0000-0x1FC7_7FFF (or 0x4007_00000x4007_7FFF) 0x1FC7_8000-0x1FC7_FFFF (or 0x4007_8000-0x4007_FFFF) Boot Mode 0x1FC0_0000-0x1FC0_7FFF 0x1FC0_8000-0x1FC0_FFFF 0x1FC1_0000-0x1FC1_7FFF 0x1FC1_8000-0x1FC1_FFFF 0x1FC2_0000-0x1FC2_7FFF 0x1FC2_8000-0x1FC2_FFFF 0x1FC3_0000-0x1FC3_7FFF 0x1FC3_8000-0x1FC3_FFFF 0x1FC4_0000-0x1FC4_7FFF 0x1FC4_8000-0x1FC4_FFFF 0x1FC5_0000-0x1FC5_7FFF 0x1FC5_8000-0x1FC5_FFFF 0x1FC6_0000-0x1FC6_7FFF 0x1FC6_8000-0x1FC6_FFFF 0x1FC7_0000-0x1FC7_7FFF 0x1FC7_8000-0x1FC7_FFFF Size 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes 32 Kbytes The address of the block to be erased can be any of the addresses within that block with A0=0 and A1=0. For example, to select BA0 in User Boot mode, provide any address in the range of 0x1FC0_0000 to 0x1FC0_7FFF. Table 3.4.6 Write Status Flags Status Auto Program Embedded operation in progress Time-out in embedded operation Auto Erase (during the time-out window) Auto Erase Auto Program Auto Erase D7 (DQ7) D5 (DQ5) D3 (DQ3) DQ7 0 0 DQ7 0 0 0 0 1 1 0 0 1 1 1 Note: D31 to D8, D4 and D2 to D0 are don't cares. TMP1942FD-68 TMP1942FD 3.4.1.17 Embedded Algorithms Start Auto Program Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a longword quantity) Address = Address + 4 (longword-by-longword) No Last Address? Yes Auto Program Done Auto Program Command Sequence (Address/Data) 0xAAA8 / AAH 0x5554 / 55H 0xAAA8 / A0H Program Address (A1= A0 = 0) / Program Data (longword-by-longword) Figure 3.4.4 Auto Program Operation TMP1942FD-69 TMP1942FD Start Auto Erase Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a longword quantity) Auto Erase Done Auto Chip Erase Command Sequence (Address/Data) 0xAAA8 / AAH Auto Block/Multi-Block Erase Command Sequence (Address/Data) 0xAAA8 / AAH 0x5554 / 55H 0x5554 / 55H 0xAAA8 / 80H 0xAAA8 / 80H 0xAAA8 / AAH 0xAAA8 / AAH 0x5554 / 55H 0x5554 / 55H 0xAAA8 / 10H Block Address / 30H Block Address / 30H Additional addresses for Auto Multi-Block Erase (each within 50 s) Block Address / 30H Figure 3.4.5 Auto Erase Operation TMP1942FD-70 TMP1942FD Start Read a longword Addr. = VA DQ7 = Data ? No No DQ5 = 1 ? Yes Read a longword Addr. = VA Yes DQ7 = Data ? No Fail Yes Pass Figure 3.4.6 Data Polling (DQ7) Algorithm Start Read a longword Addr. = VA DQ6 = Toggled? Yes No DQ5 = 1? YES Read a longword Addr. = VA No DQ6 = Toggled? Yes Fail VA: Address being programmed in Auto Program Any address in the flash memory in Auto Chip Erase Any address in the selected block in Auto Block Erase No Pass Figure 3.4.7 Toggle Bit (DQ6) Algorithm TMP1942FD-71 TMP1942FD Start PLSCNT = 1 Block Protect Command 1st to 6th Bus Write Cycles (Address/Data) 7th Bus Write Cycle BA / 0x00 BA: Block Address Wait for 4 s (Address/Data) 8th Bus Write Cycle 0xXXX0 / 0x00 Wait for 100 s (Address/Data) 9th Bus Write Cycle 0xXXX0/0x00 Wait for 8 s (Address/Data) 10th Bus Write Cycle 0xXXX0 / 0x00 PLCNT = PLCNT + 1 Write the Verify Block Protect Command Write the Reset Command Read the Block Address BPA / BD No Data = 0x00? Yes Write the Reset Command No PLSCNT = 25? Yes Device Failure Yes Other block(s) to be protected? No Block Protect Done Figure 3.4.8 Block Protect Operation TMP1942FD-72 TMP1942FD Start Auto Program Operation FSE = 1 Auto Security Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a longword quantity) Auto Security On Done FSE = 0 Auto Security On Command Sequence (Address/Data) 0xAAA8/0xAA 0x5554/0x55 0xAAA8/0xA0 0x0000/0x98 Figure 3.4.9 Auto Security On Operation TMP1942FD-73 TMP1942FD Start FSE = 1 Auto Security Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a longword quantity) Flash array erased Security array erased Auto Security Off Done FSE = 0 Unprotect Flash Blocks Auto Security Off Command Sequence (Address/Data) 0xAAA8/0xAA 0x5554/0x55 0xAAA8/0x80 0xAAA8/0xAA 0x5554/0x55 0xAAA8/0x10 Figure 3.4.10 Auto Security Off Operation TMP1942FD-74 TMP1942FD 3.4.2 3.4.2.1 Writer Mode Pin Settings The TMP1942FD is placed in Writer mode by holding the RESET , BW0, P41, P42 and P43 pins at logic 0 and the BW1 and P40 pins at logic 1. In Writer mode, the flash memory can be read, erased and programmed using a general-purpose EPROM programmer. For instructions about the settings of the remaining pis, see section 3.4.2.3, Pin Functions and Settings. Figure 3.4.11 below shows the pin settings for Writer mode. 3V A17 PD2 (A18) PD1 (A17) PD0 (A16) PE7 (A15) DVCC AVCC VREFH FVCC CVCC PE0 (A8) P37 (A7) BW1 NMI P40 A0 P31 (A1) P30 (A0) PD3 PD4 DQ15 P7 (D15) X1 P10 (D8) PB7 (D7) DQ0 PB0(D0) X2 P44 PF6 DVSS AVSS VREFL FVSS CVSS RESET BW0 P41 P42 P43 RESET RDY/BSY CE OE WE FSE PD5 (FRESET) ALE (RDY/BSY) P27 (CE) P25 (OE) P26 (WE) P24 (FSE) Figure 3.4.11 Pin Settings for Programmer Mode TMP1942FD-75 TMP1942FD 3.4.2.2 Memory Maps Figure 3.4.12 shows a comparison of memory maps in Single-Chip (Normal) mode and Writer mode. In Writer mode, the on-chip flash memory is mapped to physical addresses 0x0000_0000 through 0x0007_FFFF. In Writer mode, all reads and writes use 16-bit accesses aligned on an even-byte boundary. Normal Mode On-Chip Peripherals Programmer Mode 0xFFFF_FFFF 0xFFFF_E000 Inaccessible 0xFFFF_FFFF (Reserved) On-Chip RAM (16 KB) 0xFFFF_BFFF 0xFFFF_8000 0xFF3F_FFFF 0xFF20_0000 (Reserved) Used for debugging (Reserved) (Reserved) 0xFF00_0000 0xC000_0000 0xBF00_0000 0x4007_FFFF 0x4000_0000 Inaccessible 0x2000_0000 (512 MB) Inaccessible Inaccessible 0xC000_0000 (Reserved) On-Chip ROM Shadow Inaccessible (512 MB) 0x4000_0000 0x2000_0000 User Program Area ROM Maskable Interrupt Area Exception Vector Area 0x1FC7_FFFF 0x1FC0_0400 0x0007_FFFF 0x1FC0_0000 0x0000_0000 On-Chip Flash ROM 0x0000_0000 Figure 3.4.12 Memory Maps in Normal and Programmer Modes TMP1942FD-76 TMP1942FD 3.4.2.3 Pin Functions and Settings Table 3.4.7 EPROM Programmer Connections Programmer TMP1942 GND A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16 A17 RESET Function Programmer DQ0 DQ1 DQ2 DQ3 DQ4 DQ5 DQ6 DQ7 DQ8 TMP1942 PB0 PB1 PB2 PB3 PB4 PB5 PB6 PB7 P10 P11 P12 P13 P14 P15 P16 P17 P27 P26 P25 P24 FVCC (3 V) Function P30 P31 P32 P33 P34 P35 P36 P37 PE0 PE1 PE2 PE3 PE4 PE5 PE6 PE7 PD0 PD1 PD2 PD5 ALE FVSS Hardware reset input Ready/Busy output Ground Address bus (input) Data bus (input/output) DQ9 DQ10 DQ11 DQ12 DQ13 DQ14 DQ15 CE WE Chip Enable input Write Enable input Output Enable input Flash Security Enable input Power supply (+3 V) OE FSE VCC (3 V) RDY/BSY GND TMP1942FD-77 TMP1942FD Table 3.4.8 Settings of the Other Pins Pin Name RESET # of Pins 1 1 1 1 3 1 1 1 1 8 4 8 8 8 2 8 1 1 6 5 1 1 2 2 1 1 Type Input Input Input Input Input Input Input Output Input Input Input Input Input Input Input Input Input Input Input Input Input Input Input Input Input Input Input Input Tie to logic 0 (0 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 1 (3 V). Tie to logic 0 (0 V). Tie to logic 0 (0 V). Tie to logic 0 (0 V). Tie to logic 1 (3 V). 0V Tie to logic 1 (3 V). 0V Tie to logic 1 (3 V). 0V Tie to logic 1 (3V). 0V Setting Tie to logic 0 (0V). (Programmer mode setting) Tie to logic 0 (0 V). (Programmer mode setting) Tie to logic 1 (3 V). (Programmer mode setting) Tie to logic 1 (3 V). (Programmer mode setting) Tie to logic 0 (0 V). (Programmer mode setting) Tie to logic 1 (3 V). Connect a 20-MHz crystal for self-oscillation. BW0 BW1 P40 P41, P42, P43 NMI X1 X2 P44 P00-P07 P20-P23 P50- P57 P60- P67 P90-P97 PA0-PA7 PC0-PC7 PD3, PD4 PF0- PF7 PLLOFF TEST DVCC3, DVCC51, 52 DVSS CVCC CVSS AVCC, DAVCC AVSS, DAVSS VREFH VREFL 3.4.2.4 Key Features The TMP1942FD flash memory commands are in principle compatible with the standard JEDEC commands. After a command sequence is written, the flash memory does not require the system to provide further controls or timings. The flash memory initiates the embedded program or erase algorithm automatically. The entire flash memory or one or more flash blocks can be erased at a time. Table 3.4.9 Flash Memory Features Feature Auto Program Auto Chip Erase Auto Block Erase Auto Multi-Block Erase Write operation status Description Programs and verifies the desired addresses word by word automatically. Erases and verifies the entire memory array automatically. Erases and verifies all memory locations in the selected block automatically. Erases and verifies all memory locations in multiple selected blocks automatically. Provides several status bits such as the Data Polling bit and Toggle bit, which can be used to determine whether a program or erase operation is complete or in progress. Prevents intrusive access to the flash memory while in Programmer mode. When the security feature is turned off, the entire memory array is erased and verified automatically, regardless of whether a given block is protected or not. Disables both program and erase operations in any block. Security feature Block protection All accesses to the flash memory are performed word by word (16 bits), including the writing of commands. Unless otherwise noted, the subsections that follow indicate addresses as seen from the programmer. The program/erase operations of on-board programming modes are very similar to those TMP1942FD-78 TMP1942FD of Programmer mode, with a few exceptions such as the data bus width. For details, refer to the descriptions of the program and erase operations in on-board programming modes earlier in this section. 3.4.2.5 Block Architecture Address range as seen from the programmer (words) 000000H 004000H 008000H 00C000H 010000H 014000H 018000H 01C000H 020000H 024000H 028000H 02C000H 030000H 034000H 038000H 03C000H 03FFFFH Address range as seen from the TMP1942FD (bytes) 000000H 008000H 010000H 018000H 020000H 028000H 030000H 038000H 040000H 048000H 050000H 058000H 060000H 068000H 070000H 078000H 07FFFFH 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) 32 Kbytes (16 Kwords) Block-0 Block-1 Block-2 Block-3 Block-4 Block-5 Block-6 Block-7 Block-8 Block-9 Block-10 Block-11 Block-12 Block-13 Block-14 Block-15 Figure 3.4.13 Flash Memory Block Architecture and Address Ranges in Writer Mode TMP1942FD-79 TMP1942FD 3.4.2.6 Read Mode and Embedded Operation Mode The TMP1942FD flash memory has the following two modes of operation: * * Read mode in which array data is read Embedded Operation mode in which the flash array is programmed or erased The flash memory enters Embedded Operation mode when a valid command is executed in Read mode. In Embedded Operation mode, array data cannot be read. In Writer mode, all bus cycles such as the writing of commands and the reading of data are performed as a 16-bit quantity. The flash memory has a security bit apart from the flash array. The reading of the flash array can be disabled in Writer mode by programming this bit. In Writer mode, the FSE pin is used for this purpose. In Normal operation mode, the FSE pin must be held at the VIL level to access the flash array. During any operation, the FSE pin must remain stable. 3.4.2.7 Reading Array Data The flash memory is automatically set to Read mode upon CPU reset after device power-up and after an embedded operation is successfully completed. If an embedded operation terminated abnormally or the flash memory is required to return to Read mode, the Read/Reset command (software reset) or hardware reset is used. 3.4.2.8 Writing Commands The operations of the flash memory are selected by commands or command sequences written into the internal command register. This uses the same mechanism as for JEDEC-standard EEPROMs. Commands are made up of data sequences written at specific addresses via the command register. (See Table 3.4.12 and Table 3.4.13.) The command sequence being written can be canceled by issuing the Read/Reset command between sequence cycles. The Read/Reset command clears the command register and resets the flash memory to Read mode. Invalid command sequences also cause the flash memory to clear the command register and return to Read mode. 3.4.2.9 Reset * Read/Reset command (software reset) The flash memory does not return to Read mode if an embedded operation terminated abnormally. In this case, the Read/Reset command must be issued to put the flash memory back in Read mode. The Read/Reset command may also be written between sequence cycles of the command being written to clear the command register. Hardware reset The RESET pin provides a hardware method of terminating an embedded operation or clearing the internal command register being written. A reset is performed when the RESET pin is set to VIL and kept low at least 500 ns. It takes 20 s for a reset to complete and put the flash memory in Read mode. An embedded operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. After a reset, the flash memory is set to Read mode if RESET is at the VIH level * TMP1942FD-80 TMP1942FD and to Standby mode if RESET is at the VIL level. While RESET is at the VIL level, D0 to D15 are held at the high-impedance state. Any command sequence must be written after the flash memory is put back in Read mode. 3.4.2.10 Auto Program Command In Writer mode, the programming of the flash array is performed on a word-by -word (16-bit) basis. In the fourth bus cycle of the Auto Program command sequence, the program address is latched on the falling edge of WE , and data is latched on the rising edge of WE . The latching of the program data initiates the embedded Auto Program algorithm. The Auto Program command executes a sequence of internally timed events to program the desired bits of the addressed memory location and verify that the desired bits are sufficiently programmed. The system can determine the status of the programming operation by using write status flags (see Table 3.4.15). Any commands written during the programming operation are ignored. A hardware reset immediately terminates the programming operation. The programming operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. The block protection feature disables programming operations in any block. If an attempt is made to program a protected block, the Auto Program command does nothing; the flash memory returns to Read mode in approximately 3 s after the rising edge of WE in the fourth bus cycle of the command sequence. A bit must be programmed to change its state from a 1 to a 0. A bit cannot be programmed from a 0 back to a 1. Only an erase operation can change a 0 back to a 1. A programming failure condition is indicated if the system tries to program a 1 to a location that was previously programmed to a 0. Note that this is not a device failure condition since the flash memory was used incorrectly. When the embedded Auto Program algorithm is complete, the flash memory returns to Read mode. If any failure occurs during the programming operation, the flash memory remains locked in Embedded Operation mode. The system can determine this status by using write status flags. To put the flash memory back in Read mode, use the Read/Reset command to reset the flash memory or a hardware reset to reset the whole chip. In case of a programming failure, it is recommended to replace the chip or discontinue the use of the failing flash block. 3.4.2.11 Auto Chip Erase Command The embedded Auto Chip Erase algorithm is initiated on the rising edge of WE in the sixth bus cycle of the command sequence. The embedded Auto Chip Erase algorithm automatically preprograms the entire memory for an all-0 data pattern prior to the erase; then it automatically erases and verifies the entire memory for an all-1 data pattern. The system can determine the status of the chip erase operation by using write status flags (see Table 3.4.15). Any commands written during the chip erase operation are ignored. A hardware reset immediately terminates the chip erase operation. The chip erase operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. The block protection feature disables erase operations in any block. If all the blocks are protected, the Auto Chip Erase command does nothing; the flash memory returns to Read mode in approximately 100 s after the rising edge of WE in the sixth bus write cycle of TMP1942FD-81 TMP1942FD the command sequence. When the embedded Auto Chip Erase algorithm is complete, the flash memory returns to Read mode. If any failure occurs during the erase operation, the flash memory remains locked in Embedded Operation mode. The system can determine this state by using write status flags. To put the flash memory back in Read mode, use the Read/Reset command to reset the flash memory or a hardware reset to reset the whole chip. In case of an erase failure, it is recommended to replace the chip or discontinue the use of the failing flash block. The failing block can be identified by means of the Block Erase command. 3.4.2.12 Auto Block Erase and Auto Multi-Block Erase Commands The address of the block to be erased is latched on the falling edge of WE in the sixth bus write cycle of the command sequence. A time-out begins at the rising edge of that WE pulse. After a time-out, the erase operation will commence. The embedded Auto Block Erase algorithm automatically preprograms the selected block for an all-0 data pattern, and then erases and verifies that block for an all-1 data pattern. During the time-out period, additional block addresses and Auto Block Erase commands may be written (see Table 3.4.14). Any command other than Auto Block Erase during the time-out period resets the flash memory to Read mode. The block erase time-out period is 50 s. The time-out window is reset on each rising edge of WE . The system may determine the status of the erase operation by using write status flags (see Table 3.4.15). Any commands written during the block erase operation are ignored. A hardware reset immediately terminates the block erase operation. The block erase operation that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence because data may be corrupted. The block protection feature disables erase operations in any block. If all the selected blocks are protected, the Auto Block Erase algorithm does nothing; the flash memory returns to Read mode in approximately 100 s after the rising edge of WE in the final bus cycle of the command sequence. If any failure occurs during the erase operation, the flash memory remains locked in Embedded Operation mode. The system can determine this status by using write status flags. To put the flash memory back in Read mode, use the Read/Reset command to reset the flash memory or a hardware reset to reset the whole chip. In case of an erase failure, it is recommended to replace the chip or discontinue the use of the failing flash block. If any failure occurred during the multi-block erase operation, the failing block can be identified by running Auto Block Erase on each of the blocks selected for multi-block erasure. 3.4.2.13 Block Protect Command The block protection feature disables both program and erase operations in any block. The effects of the program and erase commands on the protected blocks are summarized below. TMP1942FD-82 TMP1942FD Table 3.4.10 Effects of the Program and Erase Commands on the Protected Blocks Command Program command on a protected block Block Erase command on a protected block Chip Erase command when all the blocks are protected Operation No programming operation is performed, and the flash memory automatically returns to Read mode. No erase operation is performed, and the flash memory automatically returns to Read mode. No erase operation is performed, and the flash memory automatically returns to Read mode. Only the unprotected blocks are erased. Upon completion, the flash memory automatically returns to Read mode. Only the unprotected blocks are erased. Upon completion, the flash memory automatically returns to Read mode. Chip Erase command when any blocks are protected Multi-Block Erase command when any blocks are protected After the command sequence is complete, writing to the protect control logic is performed by pulsing WE for tPPLH while CE is set to VIL and the block address is placed on P70 (A16) to P54 (A12). Any commands written during the Block Protect algorithm are ignored. A hardware reset immediately terminates the block protect operation. The Block Protect command that was interrupted should be re-initiated once the flash memory is ready to accept another command sequence. Note that the block protect operation is not verified automatically. The Verify Block Protect command must be written to verify the protect status after executing Bock Protect. If the selected block is not in the protected state, the Block Protect command sequence must be re-initiated (see Figure 3.4.18). 3.4.2.14 Block Unprotect Command The Block Unprotect command unprotects all blocks simultaneously. All blocks must be protected before executing the Block Unprotect command. After the Block Unprotect command sequence is complete, block unprotection is performed by pulsing WE for tPULH with CE set to VIL . Any commands written during the Block Unprotect algorithm are ignored. A hardware reset immediately terminates the block unprotect operation. The Block Unprotect command that was interrupted should be re-initiated from protecting all blocks. The Verify Block Protect command must be written to verify the protect status after executing Block Unprotect. 3.4.2.15 Verify Block Protect Command The Verify Block Protect command is used to verify the protect status of a block. The address of the block to be verified is given in the fourth bus read cycle of the command sequence. Any address within the block range will suffice, provided A0 = 1 and A5 = 0. If the selected block is protected, a value of 0x0001 is returned. If the selected block is not protected, a value of 0x0000 is returned. Following the fourth bus cycle, an additional block address may be provided. The Verify Block Protect command does not return the flash memory to Read mode. Either the Read/Reset command or a hardware reset is required to reset the flash memory to Read mode or to write the next command. TMP1942FD-83 TMP1942FD 3.4.2.16 Write Operation Status As shown in Table 3.4.15, the flash memory provides several flag bits to determine the status of an embedded operation: DQ7, DQ5, DQ3 and RDY/BSY. These status bits can be read during an embedded operation using the same timing as for Read mode by setting CE and OE to VIL. The RDY/BSY status is valid after the rising edge of the final WE pulse in the command sequence, regardless of CE and OE . The flash memory automatically returns to Read mode when an embedded operation completes. * DQ7 (Data Polling) The Data Polling bit, DQ7, indicates to the host system the status of an embedded operation. Data Polling is valid after the rising edge of the final WE pulse in the command sequence. When the embedded Program algorithm is in progress, an attempt to read the flash memory will produce the complement of the data last written to DQ7. Upon completion of the embedded Program algorithm, an attempt to read the flash memory will produce the true data last written to DQ7. Therefore, the system can use DQ7 to determine whether the embedded Program algorithm is in progress or completed. When the embedded Erase algorithm is in progress, an attempt to read the flash memory will produce a 0 at the DQ7 output. Upon completion of the embedded Erase algorithm, the flash memory will produce a 1 at the DQ7 output. If there is a failure during an embedded operation, DQ7 continues to output the same value. Thus, DQ7 must always be polled in conjunction with the Exceeded Timing Limits (DQ5) flag. Figure 3.4.16 shows the DQ7 polling algorithm. The flash memory disables address latching when an embedded operation is complete. Data polling must be performed with a valid programmed address or an address within any of the non-protected blocks selected for erasure. DQ7 may change asynchronously while OE is asserted low. DQ5 (Exceeded Timing Limits) DQ5 produces a 0 while the program or erase operation is in progress normally. DQ5 produces a 1 to indicate that the program or erase time has exceeded the specified internal limit. This is a failure condition that indicates the program or erase cycle was not successfully completed. The DQ5 failure condition also appears if the system tries to program a 1 to a location that was previously programmed to a 0. In this case, the embedded Program algorithm halts the operation. Once the operation exceeded the timing limits, DQ5 will indicate a 1. Note that this is not a device failure condition since the flash memory was used incorrectly. Under both these conditions, the flash memory remains locked in Embedded Operation mode. The Read/Reset command must be issued to return the flash memory to Read mode. DQ3 (Block Erase Timer) The block erase time-out window of 50 s begins from the rising edge of WE in the sixth bus cycle of the command sequence. The erase operation will begin after the time-out has expired. When the time-out is complete and the erase operation has begun, DQ3 switches from 0 to 1. If DQ3 is 0, the flash memory will accept additional Auto Block Erase commands. Each time an Auto Block Erase command is written, the time-out window is reset. To ensure that the command has been accepted, the system should check DQ3 prior to and following each Auto Block Erase command. If DQ3 is 1 on the second status check, the command might not * * TMP1942FD-84 TMP1942FD have been accepted. * RDY/BSY (Ready/Busy) In Programmer mode, the ALE pin functions as the RDY/BSY pin. The programming equipment can monitor the state of this pin to determine whether an embedded algorithm is in progress or complete. RDY/BSY produces a 0 when the flash memory is actively erasing or programming. RDY/BSY produces a 1 when an embedded operation has completed and the flash memory is ready to accept the next command. If any failure occurs during the program or erase operation, this flag remains at the 0 logic state. RDY/BSY is not an open-drain output, but a normal CMOS output pin. 3.4.2.17 Flash Security The TMP1942FD flash memory has a security bit apart from the flash array. Programming this security bit disables access to the flash array. This prevents intrusive access to the flash memory by third parties while in Programmer mode. * Securing the flash memory (Disabling read accesses) Securing the flash memory disables a general-purpose programmer to read its contents. To turn on the security feature, once programming is complete, write the Auto Security On command, with the FSE pin set to VIL. In the fourth bus cycle of the command sequence, program 0x0098 at address 0x0000. After the rising edge of WE in the fourth bus cycle, the embedded Security On algorithm automatically programs and verifies the security bit. Any commands written during the embedded operation are ignored. A hardware reset immediately terminates the embedded operation. The FSE bit must be held stable throughout the embedded operation. When the embedded algorithm completes, the flash memory automatically returns to Read mode. If any failure occurs during the embedded operation, the flash memory remains locked in Embedded Operation mode. The system can determine this status by using write status flags. Note that this is a security bit failure. If the flash memory needs to be secured, the chip should be replaced. When the security is on, any reads by programming equipment always return a word-length value of 0x0098. Unsecuring the flash memory (Enabling read accesses) To turn off the security feature, with the Auto Security Off command, with the FSE pin set to VIH. After the rising edge of WE in the sixth bus cycle of the command sequence, the embedded Security Off algorithm automatically erases and verifies the entire flash array, and then erases and verifies the security bit. Any commands written during the embedded operation are ignored. A hardware reset immediately terminates the embedded operation. In this case, if any erase operation is in progress, data may be corrupted. The FSE pin must be held stable throughout the embedded operation. When the embedded algorithm completes, the flash memory automatically returns to Read mode. If any failure occurs during the embedded operation, the flash memory remains locked in Embedded Operation mode. The system can determine the status of the embedded operation by using write status flags. If a failure occurs in the memory array, the security bit is not erased. In this case, the security bit is left on. The chip should be replaced if a memory array or security bit failure occurs. The Auto Security Off command erases the flash array prior to turning off the security feature. Even if a given block is protected, it is unconditionally erased, but * TMP1942FD-85 TMP1942FD the protect status of that block remains unchanged. The Auto Security Off and Auto Chip Erase command sequences are the same. The only difference is that the Auto Security Off command requires the FSE pin to be set to the VIH level before the command is written. The Auto Block Erase command does not turn off the security feature even when the FSE pin is set to VIH. If the Auto Block Erase command is written with the FSE input pin set to VIH, no block will be erased and the operation is immediately terminated. Table 3.4.11 Basic Operation Modes (with addresses as seen from the programmer) Mode Read Standby Output Disable Write Hardware Reset/Standby CE 0 1 X 0 X OE 0 X 1 1 X WE 1 X 1 0 X A5 A5 X X A5 X A0 A0 X X A0 X RESET 1 1 X 1 0 DQ0-DQ15 Dout Hi-Z Hi-Z Din Hi-Z Table 3.4.12 Programmer Mode Command Definitions (with addresses as seen from the programmer) Command Sequence Read/Reset Read/Reset Auto Program Auto Chip Erase Auto Block Erase Block Protect Verify Block Protect Auto Security On (Note 1) Bus Cycles 2nd Cycle 3rd Cycle 4th Cycle 1st Cycle (Write) (Write) (Write) (Read/Write) Addr. Data Addr. Data Addr. Data Addr. Data 0x5555 0x5555 0x5555 0x5555 0x5555 0x5555 0x5555 AAH 0xAAAA AAH 0xAAAA AAH 0xAAAA AAH 0xAAAA AAH 0xAAAA AAH 0xAAAA AAH 0xAAAA 55H 55H 55H 55H 55H 55H 55H 0x5555 0x5555 0x5555 0x5555 0x5555 0x5555 0x5555 F0H A0H 80H 80H 9AH 90H A0H RA PA 0x5555 0x5555 0x5555 BPA 0x0000 RD PD AAH AAH AAH BD 98H Cycles Required 5th Cycle 6th Cycle (Write) (Write) Addr. Data Addr. Data 1 3 4 6 6 6 4 4 0xXXXX F0H 0xAAAA 0xAAAA 0xAAAA 55H 55H 55H 0x5555 BA 0x5555 10H 30H 9AH Note: Write the command sequence with the FSE input pin set to VIH. This enables access to the security bit. Write the other command sequences with the FSE input pin set to VIL. * * * F0H, AAH, 55H, A0H, 80H, 10H, 30H: Command data. Write command as a word quantity with the upper byte 00H. RA: Read Address RD: Read Data PA: Program Address PD: Program Data Write data as a word quantity. * * * BA: Block Address (BA0-BA6) Refer to Table 3.4.14. BPA: Verify Block Protect Address BD: Block Protect Data The address of the block to be verified can be any of the addresses within the block with A5 = 0 and A0 = 1. If a block is protected, a value of 0x0001 will be returned. If a block is not protected, a value of 0x0000 will be returned. TMP1942FD-86 TMP1942FD Table 3.4.13 shows the relationships between the addresses as seen from the programmer and the TMP1942FD. Table 3.4.13 Relationships between Addresses Command Address Programmer P73 P77 Address TMP1942 Address A17 P72 / A18 X 0 1 0 A16 P71 / A17 X 0 0 1 A15 P70 / A16 X 0 1 0 A14 P57 / A15 X 0 0 1 A13 P56 / A14 X 0 1 0 A12 P55 / A13 X 0 0 1 A11 P54 / A12 X 0 1 0 A10 P53 / A11 X 0 0 1 A9 P52 / A10 X 0 1 0 A8 P51 / A9 X 0 0 1 A7 P50 / A8 X 0 1 0 A6 P37 / A7 X 0 0 1 A5 P36 / A6 X 0 1 0 A4 P35 / A5 X 0 0 1 A3 P34 / A4 X 0 1 0 A2 P33 / A3 X 0 0 1 A1 P32 / A2 X 0 1 0 A0 P31 / A1 X 0 0 1 P30 / A0 0 0 0 0 0xXXXX 0x0000 0xAAAA 0x5555 0 Table 3.4.14 Block Erase Addresses in Writer Mode (as seen from the programmer) Block BA0 BA1 BA2 BA3 BA4 BA5 BA6 BA7 BA8 BA9 BA10 BA11 BA12 BA13 BA14 BA15 Address Range 0x0000-0x3FFF 0x4000-0x7FFF 0x8000-0xBFFF 0xC000-0xFFFF 0x1000-0x13FFF 0x14000-0x17FFF 0x18000-0x1BFFF Size 16 Kwords 16 Kwords 16 Kwords 16 Kwords 16 Kwords 16 Kwords 0x38000-0x3BFFF 0x3C000-0x3FFFF 16 Kwords 16 Kwords The address of the block to be erased can by any of the addresses within that block. For example, to select BA0, provide any address in the range between 0x0000 and 0x3FFF. Table 3.4.15 Write Status Flags Status Auto Program Embedded operation in progress Auto Erase (during the time-out window) Auto Erase Time-out in embedded operation Auto Program Auto Erase D7 D7 0 0 D7 0 D5 0 0 0 1 1 D3 0 0 1 1 1 Note: D4 and D2-D0 are don't cares. TMP1942FD-87 TMP1942FD 3.4.2.18 Embedded Algorithms Start Auto Program Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a word quantity) Address = Address + 4 (Word-by-word) No Last Address? Yes Auto Program Done Auto Program Command Sequence (Address/Data) 0x5555/0x00AA 0xAAAA/0x0055 0x5555/0x00A0 Program Address/Program Data (word-by-word) Figure 3.4.14 Auto Program Operation TMP1942FD-88 TMP1942FD Start Auto Erase Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a word quantity) Auto Erase Done Auto Chip Erase Command Sequence (Address/Data) 0x5555 / 0x00AA Auto Block/Multi-Block Erase Command Sequence (Address/Data) 0x5555 / 0x00AA 0xAAAA / 0x0055 0xAAAA / 0x0055 0x5555 / 0x0080 0x5555 / 0x0080 0x5555 / 0x00AA 0x5555 / 0x00AA 0xAAAA / 0x0055 0xAAAA / 0x0055 0x5555 / 0x0010 Block Address / 0x0030 Block Address / 0x0030 Additional addresses for Auto Multi-Block Erase (each within 50 s) Block Address / 0x0030 Figure 3.4.15 Auto Erase Operations TMP1942FD-89 TMP1942FD Start Read a word Addr. = VA DQ7 = Data ? No No DQ5 = 1 ? Yes Read a word Addr. = VA Yes DQ7 = Data ? No Fail Yes Pass Figure 3.4.16 Data Polling (DQ7) Algorithm Start Read a word Addr. = VA DQ6 = Toggled? Yes No DQ5 = 1? YES Read a word Addr. = VA No DQ6 = Toggled? Yes Fail VA: Address being programmed in Auto Program Any address in the flash memory in Auto Chip Erase Any address in the selected block in Auto Block Erase No Pass Figure 3.4.17 Toggle Bit (DQ6) Algorithm TMP1942FD-90 TMP1942FD Start PLSCNT = 1 Block Protect Command 1st to 6th Bus Write Cycles CE = VIH, OE = VIH, WE = VIH Set the Block Address Addr = BA CE = VIL, OE = VIH, WE = VIL Wait for 100s CE = VIH, OE = VIH, WE = VIH Wait for 4s PLCNT = PLCNT + 1 Write the Verify Block Protect command Write the Reset command Read the Block Address Addr = BA; A5 = 0, A0 = 1 No Data = 01H? Yes Write the Reset command No PLSCNT = 25 ? Yes Device failure Yes Other block(s) to be protected? No Block Protect Done Figure 3.4.18 Block Protect Operation TMP1942FD-91 TMP1942FD Start Auto Program Operation FSE = 1 Auto Security Command Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a word quantity) Auto Security On Done FSE = 0 Auto Security On Command Sequence (Address/Data) 0x5555/0x00AA 0xAAAA/0x0055 0x5555/0x00A0 0x0000/0x0098 Figure 3.4.19 Auto Security On Operation TMP1942FD-92 TMP1942FD Start FSE = 1 Auto Security Off Sequence (Shown below) Data Polling Bit, Toggle Bit (Read as a word quantity) Flash array erased Security array erased Auto Security Off Done FSE = 0 Unprotect Flash Blocks Auto Security Off Command Sequence (Address/Data) 0x5555 / 0x00AA 0xAAAA / 0x0055 0x5555 / 0x0080 0x5555 / 0x00AA 0xAAAA / 0x0055 0x5555 / 0x0010 Figure 3.4.20 Auto Security Off Operation TMP1942FD-93 TMP1942FD 4. Electrical Characteristics The letter x in equations presented in this chapter represents the cycle period of the fsys clock selected through the programming of the SYSCR1.SYSCK bit. The fsys clock may be derived from either the high-speed or low-speed crystal oscillator. The programming of the clock gear function also affects the fsys frequency. All relevant values in this chapter are calculated with the high-speed (fc) system clock (SYSCR1.SYSCK = 0) and a clock gear factor of 1/fc (SYSCR1.GEAR[1:0] = 00). 4.1 Absolute Maximum Ratings Parameter Symbol VCC3 VCC5 VIN3 VIN5(*) VAIN VAREFH DAREFH IOL IOL IOH IOH PD TSOLDER TSTG Rating Unit Supply voltage Input voltage Analog input voltage Analog reference input voltage Low-level output current High-level output current Per pin Total Per pin - 0.5~4.0 - 0.5~6.0 - 0.5~VCC3 + 0.5 - 0.5~ VCC5+ 0.5 - 0.5~ AVCC+ 0.5 - 0.5~ AVCC+ 0.5 - 0.5~ DAVCC+ 0.5 5 80 -5 -80 600 260 -65~150 -40~85 V V V V V V V mA Total Power dissipation (Ta = 85C) Soldering temperature (10 s) Storage temperature Except during flash write/erase During flash write/erase mW C C Operating temperature TOPR 0~70 NEW 100 C Write/erase cycles cycle VCC3 = DVCC3 = AVCC = DAVCC = CVCC, VCC5 = DVCC51 = DVCC52, VSS =DVSS = AVSS = DAVSS = CVSS (*) Applies only to Port C and Port F. Note: Absolute maximum ratings are limiting values of operating and environmental conditions which should not be exceeded under the worst possible conditions. The equipment manufacturer should design so that no Absolute Maximum Ratings value is exceeded with respect to current, voltage, power dissipation, temperature, etc. Exposure to conditions beyond those listed above may cause permanent damage to the device or affect device reliability, which could increase potential risks of personal injury due to IC blowup and/or burning. TMP1942FD-94 TMP1942FD 4.2 DC Electrical Characteristics (1/5) Ta = -40 to 85C Parameter Symbol Conditions fosc = 5 to 8 MHz fsys = 2.5 to 32 MHz PLLON (INTLV="H") fs = 30 to 34 kHz fosc = 5 to 7 MHz fsys = 5 to 28 MHz fs = 30 to 34 kHz (INTLV = "H") fosc = 10 to 20 MHz fsys = 1 to 20 MHz PLLOFF DVCC3 (Crystal) fs = 30 to 34 kHz (INTLV = "L") fosc = 10 to 16 MHz fsys = 1 to 16 MHz fs = 30 to 34 kHz fosc = 20 to 32 MHz fsys = 1.25 to 16 MHz PLLOFF (External clock) fs = 30 to 34 kHz Min. Typ. (Note 1) Max. Unit Supply voltage DAVCC=AVCC =CVCC=DVCC3 DAVSS=AVSS =CVSS= 0V Low-level input voltage PLLOFF , BW0, BW1, RSTPUP, RESET , NMI PC0 - PC7,PF0 - PF6 X1 VIL2 VIL3 VIL4 0.2 DVCC3 0.3 DVCC5 0.2 DVCC3 High-level input voltage P00 - P17 (AD0 - AD15) VIH VIH1 P20 - PB7,PD0 - PE7 PLLOFF , BW0, BW1, DVCC3 2.7 V DVCC5 4.5 V 2.0 0.7DVCC3 V DVCC3 + 0.3 RSTPUP, RESET , NMI VIH2 0.8DVCC3 DVCC5 + 0.3 DVCC3 + 0.3 0.45 2.4 2.4 4.2 V PC0 - PC7,PF0 - PF6 X1 VIH3 VIH4 VOL VOH1 IOL = 1.6 mA DVCC3 2.7 V DVCC5 4.5 V DVCC3 2.7 V IOH = - 400 A DVCC5 2.7 V DVCC5 4.5 V 0.7DVCC5 0.8DVCC3 Low-level output voltage High-level output voltage VOH2 (Note 3) Note 1: Note 2: Note 3: Ta = 25 C, DVCC3 = 3.3 V, DVCC5 = 5.0 V, unless otherwise noted. DVCC5*: DVCC51, DVCC52 DVCC5* can also be used as 2.7 V DVCC5* 3.6 V. Applies only to Port C and Port F. TMP1942FD-95 TMP1942FD 4.3 DC Electrical Characteristics (2/5) Ta = -40 to 85C Parameter Symbol ILI ILO VSTOP1 VSTOP2 RRST PKH1 PKH2 CIO Conditions 0.0 VIN DVCCn (n = 3, 5) 0.2 VIN DVCCn - 0.2 (n = 3, 5) VIL2 = 0.2DVCC3 VIH2 = 0.8DVCC3 VIL2 = 0.2DVCC5 VIH2 = 0.8DVCC5 VCC = 3.3 V 0.3 V DVCC3 = 3.3 V 0.3 V DVCC5 = 4.5 V to 5.25 V fc = 1 MHz Min. Typ. (Note) 0.02 0.05 Max. 5 10 Unit A Input leakage current Output leakage current Power-down voltage (STOP mode, RAM backup) Pull-up resistor at reset Programmable pull-up resistor P32-P37,P40-P43 KEY0-KEYD Pin capacitance (Except power supply pins) 2.2 VSTOP1 100 30 30 45 55 3.6 V 5.25 550 100 100 10 k k pF Note: Ta = 25 C, DVCC3 = 3.3 V, DVCC5 = 5.0 V, unless otherwise noted. TMP1942FD-96 TMP1942FD 4.4 DC Electrical Characteristics (3/5) DVCC3 = 3.3 V0.3 V, DVCC51 = DVCC52 = 3.3 V0.3 V, Ta = -40 to 85C Parameter Symbol Conditions fsys = 32 MHz (fOSC = 8 MHz, PLLON) INTLV = "H" fsys = 16 MHz (fOSC = 16 MHz, PLLOFF) INTLV = "L" fs = 32.768 kHz fs = 32.768 kHz DVCC3 = 2.7 to 3.6 V DVCC5 = 2.7 to 3.6 V Min. Typ. (Note 1) 110 35 30 70 17.5 15 210 10 1 Max. 135 50 44 85 32 28 280 60 50 Unit NORMAL (Note 2): Gear = 1/1 IDLE (Doze) IDLE (Halt) NORMAL (Note 2): Gear = 1/1 IDLE (Doze) IDLE (Halt) SLOW SLEEP STOP ICC mA mA A A A Note 1: Note 2: Ta = 25 C, DVCC3 = 3.3 V, DVCC5 = 3.3 V, unless otherwise noted. ICC NORMAL measurement conditions CPU: 8-bit timer: Dhrystone (Ver. 2.1) execution (including external memory access) 500 kHz/50% output x 3 channels, 50 kHz/50% output x 3 channels 2-ms interval timer x 6 channels, two-phase pulse input counter x 2 channel SIO: ADC: DAC: UART (11.5 kbps) transmission x 1 channel, clock synchronization (50 kHz) x 4 channels Channel-fixed continuous conversion mode Output (0x200) x 3 channels Same as for NORMAL mode 16-bit timer: 500 kHz/50% output x 3 channels, 50 kHz/50% output x 3 channels, Note 3: ICC SLOW and ICC SLEEP measurement conditions CPU: RTC timer, two-phase pulse input counter, dynamic pull-up logic operating (16-ms cycle, 250-s sampling) Note 4: Note 5: Note 6: ICC includes the supply current flowing through the DVCC3, DVCC5, CVCC, AVCC and DAVCC pins. ICC NORMAL includes the reference current for the A/D and D/A converters. ICC IDLE indicates the current values when on-chip peripherals are not operating. TMP1942FD-97 TMP1942FD 4.5 DC Electrical Characteristics (4/5) DVCC3 = 3.3 V0.3 V, DVCC51 = DVCC52 = 5.0 V0.25 V, Ta = -40 to 85C Parameter Symbol Conditions fsys = 32 MHz (fOSC = 8 MHz, PLLON) INTLV = "H" Min. Typ. (Note 1) 110 Max. 135 Unit mA NORMAL: Gear =1/1 ICC SLOW SLEEP STOP fsys = 16 MHz (fOSC = 16 MHz,PLLOFF) INTLV = "L" fs = 32.768 kHz fs = 32.768 kHz DVCC3 = 2.7 to 3.6 V DVCC5 = 4.75 to 5.25 V 70 210 10 1 85 280 60 50 mA A A Note 1: Note 2: Note 3: Ta = 25 C, DVCC3 = 3.3 V, DVCC5 = 5.0 V, unless otherwise noted. ICC measurement conditions See Note 2 and Note 3 in 4.4, DC Electrical Characteristics. ICC for DVCC3 includes the current consumed by CVCC, AVCC and DAVCC. TMP1942FD-98 TMP1942FD 4.6 DC Electrical Characteristics (5/5) Table 4.6.1 DC Electrical Characteristics in Modes Other Than Programmer Mode Ta = -40 to 85C (0 to70C during program and erase of the flash memory), DVCC = 2.7 to 3.6 V Symbol IDDO1 Parameter Active write current Condition fSYS = 32 MHz Min - Max 185 Unit mA Table 4.6.2 DC Electrical Characteristics In Programmer Mode Ta = 25 5C, DVCC = 2.7 to 3.6 V Symbol VIH VIL ILI ILO VOH VOL IDDO2 Parameter High-level input voltage Low-level input voltage Input leakage current Output leakage current High-level output voltage Low-level output voltage Active write current Condition 0 V VIN DVCC 0 V VOUT DVCC IOH = -0.1 mA IOH = -2.5 mA IOL = 4.0 mA tCYC = tRC (Min) Min 0.7 x DVCC -0.3 Max DVCC + 0.5 0.8 1 1 Unit V V A A DVCC - 0.4 0.85 x DVCC - 0.4 50 V V mA 4.6.1 Precautions for Programming and Erasing the Flash Memory * In on-board programming modes (Single Boot mode and User Boot mode), the flash program and erase operations must be given the highest priority. All interrupts including NMI must be disabled. An auto erase operation is required before performing an auto program operation on addresses that have already been programmed. To use Programmer mode to re-program the flash memory that has been programmed/erased in an on-board programming mode, it is recommended to perform an auto erase operation before executing an auto program operation. * * TMP1942FD-99 TMP1942FD Table 4.6.3 AC Electrical Characteristics in Programmer Mode Symbol tRC tACC tCE tOE tCEE tOEE tOEH tOH tDF1 tDF2 tCMD tAS tAH tDS tDH tWELH tWEHH tCES tCEH tOES tOEHP tOEHT tPPW tPCEW tPBEW tVDS tBUSY tRP tREADY tRB tRH tPPLH tPAS tPAH tCESP tCEHP Read cycle time Address access time CE access time Parameter Min 120 0 0 0 0 120 0 50 60 0 50 20 0 0 0 10 20 16 (Note 1) Max 120 120 50 30 30 20 - Unit ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns s OE access time CE to output low-Z OE to output low-Z OE hold time (read) Output data hold time CE to output high-Z OE to output high-Z Command cycle time Address setup time Address hold time Data setup time Data hold time WE pulse width WE pulse width high CE setup time CE hold time OE setup time OE hold time (data polling and toggle) OE high-level hold time (toggle) Auto Program time Auto Chip Erase time Auto Block Erase time DVCC (3V) setup RDY/BSY delay to program/erase valid RESET pulse width RESET low to Read mode RDY/BSY recovery time RESET recovery time 30 (Note 1) s s s 3 (Note 1) 500 20 6 0 500 100 0 0 4 8 ns s s ns ns s WE low-level hold time (Block Protect) Protect address setup time Protect address hold time CE setup time (Block Protect) CE hold time (Block Protect) ns ns s s Note 1: Typical values Note 2: AC test conditions: /Input pulse levels: 2.4 V/0.4 V /Input pulse rise/fall time (10% to 90%) : 5 ns /Input timing measurement reference levels: 1.5 V/1.5 V /Output timing measurement reference levels: 1.5 V/1.5 V /Output load capacitance (CL): 100 pF Note 3: Other AC characteristics are the same as for the TX1942CY/CZ. TMP1942FD-100 TMP1942FD 4.6.2 Timing Charts tRC Address tACC tCE tOH CE tOE tOEE tDF1 OE tCEE WE tDF2 tOEH High-Z High-Z Dout Output Valid Figure 4.6.1 Read/ID Read Operation Timings Address 5555h tCMD 2AAAh tAS tAH 5555h PA PA CE tCES tCEH OE tOES tWEL tWEHH tOEHP tPPW WE tDS tDH Din AAh 55h A0h PD Dout tVDS VDD DQ7 Dout PA: Program address PD: Program data Figure 4.6.2 Auto Program Operation Timings TMP1942FD-101 TMP1942FD Address 5555h tCMD 2AAAh tAS tAH 5555h 55555h 2AAAh 5555h/BA CE tCES tCEH OE tOES tWELH tWEHH WE tDS tDH Din tVDS VDD BA: Block address for Auto Block Erase AAh 55h 80h AAh 55h 10h/30 Figure 4.6.3 Auto Chip Erase /Auto Block Erase Operation Timings Address Last Command Address PA/BA tCMD CE tCES tCEH tDF1 tCE tOE tOEHP tDF2 OE WE tPPW/tPCEW/tPBEW tOH Din Last Command Dout7 PA: Program address BA: Block address DQ7 Valid Data Figure 4.6.4 Data Polling Timings During Embedded Algorithms TMP1942FD-102 TMP1942FD Address Last command address PA/BA tCMD CE tCES tCEH tOEHT OE tOEHP WE tOE Din Last command Dout7 Toggle Toggle Stop * Valid * The output on the toggle bit stops when an embedded algorithm completes. PA: Program address BA: Block address Figure 4.6.5 Toggle Bit Operation Timings During Embedded Algorithms CE Command Sequence WE Embedded operation in progress RDY/ BSY tBUSY Figure 4.6.6 RDY/ BSY Status Timings During Embedded Operations WE tRB RESET tRP tREADY RDY/ BSY Figure 4.6.7 Hardware Reset Timings TMP1942FD-103 TMP1942FD tRC Address tRH RESET tACC tOH High-Z Dout Valid Data Figure 4.6.8 Read Timings After RESET Block Protect Setup Block Protect Verify Block Protect Address 5555h 6th Bus Write Cycle BA tPAS 5555h tPAH 2AAAh 5555h BA tACC tCE CE tCESP tCEHP tPPLH tOE OE WE Din 9Ah AAh 55h 90h Dout BA: Block address 001h Indicates that the block is protected. Figure 4.6.9 Block Protect Operation TMP1942FD-104 TMP1942FD TMP1942FD-105 |
Price & Availability of TMP1942FDU
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |