 |
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
|
| If you can't view the Datasheet, Please click here to try to view without PDF Reader . |
|
|
| Datasheet File OCR Text: |
| AN1361 APPLICATION NOTE Tuning Block Protection on the M58BW016B Flash Memory CONTENTS s s s INTRODUCTION The role of a standalone Flash Memory in a standard application is to collect code commands and functional parameters used by microprocessors to control the system. The final user of the application only stores data on well defined areas of the Flash address map. During application production steps, modification of some blocks of the Flash Memory must be prevented. For example generic boot code must be not modified during a calibration setup. It is also important to prevent the final user from modifying the application's functional code. For example, this could be something minor like the melody of a mobile phone, or something more serious like the control system of a vehicle's engine . To prevent such modifications, Flash memories are equipped with a range of block protection functions. To allow even more flexibility, the M58BW016B Flash Memory is equipped with a new concept of block protection: the Tuning Block Protection, where the application manufacturer can choose a 64 bit password to protect against program and erase operations. Standard protection features are also available on the device. A version also exists with the Tuning Block Protection disabled, M58BW016D. INTRODUCTION ORGANIZATION BLOCK PROTECTION OPTIONS TUNING BLOCK PROTECTION DESCRIPTION TUNING PROTECTION UNLOCK PROGRAM AND ERASE A TUNING PROTECTED BLOCK BLOCK PROTECTION COMBINATIONS CONCLUSIONS s s s s s June 2001 Rev. 01A 1/11 AN1361 - APPLICATION NOTE ORGANIZATION The M58BW016B is a 16Mbit non-volatile burst Flash memory that can be erased electrically at the block level and programmed in-system using a 2.7V to 3.6V V DD core power supply and a VDDQ supply down to 2.4V for the Input and Output buffers. An optional 12V VPP supply can be used to provide fast program and erase for a limited time and number of program/erase cycles. The device has a boot block architecture with a x32 bus. The 16 Mbit address space is divided in 8 Parameter Blocks of 64 Kbit each, and 31 Main Blocks of 512 Kbit each. The device is available with Top or Bottom Boot block's. In the "Top" version the Parameter Blocks are located starting from the higher address (0xFFFFF). In the "Bottom" version they are from the first part of the memory (0x00000). In most applications the parameter blocks are used to store the boot code, and so usually require protection from accidental program or erase operations. BLOCK PROTECTION OPTIONS The M58BW016B features four different levels of block protection. s VPP - The device features an optional 12V VPP voltage supply. Program or erase operation are also possible with Vpp at VIH (3V). When VPP is low at VSS level (VIL) all blocks are protected. WP - The two upper (Top ) or lower (Bottom ) Parameter Blocks and all the Main Blocks can be protected using the Write Protect Pin. When WP is low, VIL, all the lockable parameter blocks and all the main blocks are protected. When WP is high (VIH) all the lockable parameter blocks and all the main blocks are unprotected. RP - If the device is held in reset mode (RP at VIL), no program or erase operations can be performed on any block. Tuning block protection: M58BW016B features a 64 bit password protection for program and erase operations for a fixed number of blocks (see Figure 1)(a version with no password protection is also available). After power-up or reset the device is tuning protected, any attempt to program or erase the locked blocks will fail, the data in the block will not be changed and the Status Register will output the error (see data sheet for further detail on Status Register bits). A temporary Unlock command is provided to allow program or erase operations in all the blocks. s s s After a device reset the first three kinds of block protection (VPP, WP, RP) can be combined to give a flexible block protection. They do not affect the Tuning Block Protection. When all three protections are disabled, VPP, WP and RP at VIH, the blocks locked by the Tuning Block Protection cannot be modified. All blocks are protected during power-up. 2/11 AN1361 - APPLICATION NOTE TUNING BLOCK PROTECTION DESCRIPTION The Tuning Block Protection is a software feature to protect certain blocks from program or erase operations. The blocks are password protected. Program or erase operations are permitted only after the user has provided the correct 64 bit password, called the Tuning Protection Code. Not all blocks are tuning protected. The tuning protected blocks are the two parameter blocks closest to the boot address (Top or Bottom Boot) and the 24 main blocks located at the opposite boundary of the address space. 6 parameter blocks and 7 main blocks are not protected by the tuning algorithm. Refer to Figure 1, Tuning Block Protection Address Map. The tuning blocks are "locked" if the tuning protection code has not been provided, and "unlocked" once the correct code has been provided. The tuning blocks are locked after reset or power-up. The Tuning Protection status can be monitored in Status Register. Bit0 in the Status Register indicates the tuning protection status. Bit0 = `0' : tuning blocks are locked, Bit0 = `1' : tuning blocks are unlocked. Bit1 indicates the block protection status. If it is set to `1' a program or erase operation has been attempted on a protected block. The program erase controller status bit7 can be used to monitor when a program or erase operation has terminated. Table 1, describes the commands needed to unlock and modify the tuning protected blocks. Figure 1. Tuning Block Protection Address Map Top Boot Address Configuration 0xFFFFFh Parameter Block 38 Parameter Block 37 Parameter Block 36 Parameter Block 34 Bottom Boot Address Configuration Parameter Block 0 Parameter Block 1 Parameter Block 2 Parameter Block 3 0x00000h Parameter Block 31 Main Block 30 Tuning Protected Sectors Parameter Block 7 Main Block 8 Main Block 24 Main Block 14 Main Block 23 Main Block 15 Main Block 1 Main Block 37 Main Block 0 0x00000h Main Block 38 0xFFFFFh AI04500 3/11 AN1361 - APPLICATION NOTE Table 1. Tuning Block Protection Commands Cycles Bus Operations 1st Cycle Op. Write Write Write Addr. X X X X X X Data 48h 78h 70h FFh 20h 40h 10h Op. Write Write Read Read Write Write 2nd Cycle Addr. TPAh TPAh X RA BAh PA Data 3rd Cycle Op. Addr. Data Op. X X 4th Cycle Addr. Data Command Tuning Protection(2) Program Tuning Protection Unlock(2) Read Status Register Read Memory Array Block Erase Program 4 4 2 TPCh Write TPCh Write SRDh RD D0h PD 48h Write TPAh TPCh 78h Write TPAh TPCh 2 Write 2 2 Write Write Note: 1. X Don't Care; TPA = Tuning Protection Address, TPC = Tuning Protection Code, SRD Status Register Data, RA Read Address, RD Read Data, PA Program Address; PD Program Data, BA Any address in the Block. 2. Cycles 1 and 2 input the first 32 bits of the code, cycles 3 and 4 the second 32 bits of the code. 3. Refer to the M58BW016B datasheet for a full description of commands. 4/11 AN1361 - APPLICATION NOTE TUNING PROTECTION UNLOCK After a reset or power-up, the device must be unlocked to program or erase a tuning protected block. When the device is unlocked the user can protect all the blocks with VPP at VIL, or the first two parameters and all the main blocks with WP at VIL. The tuning protection unlock procedure is commonly used to temporary unprotect all the tuning protected blocks. It also unprotects the Tuning Protection Register where the tuning protection code is stored. Refer to Figure 2 for the operation flowchart. The Tuning Protection Code is composed of 64 bits, but the data bus is 32 bits wide so four (2 x 2) write cycles are required to unlock the device. s s The first write cycle issues the Tuning Protection Unlock Setup command (0x78). The second write cycle inputs the first 32 bits of the tuning protection code on the data bus, at address 0x00000. Bit 7 of the Status Register should now be checked to verify that the device has successfully stored the first part of the code in the internal register. If b7 = `1', the device is ready to accept the second part of the code. This does not mean that the first 32 bits match the tuning protection code, simply that it was correctly stored for the comparing. If b7 = `0', the user must wait for this bit setting (refer to write cycle AC timings). s s The third write cycle re-issues the Tuning Protection Unlock Setup command (0x78). The fourth write cycle inputs the second 32 bits of the code at address 0x00001. Bit 7 of the Status Register should again be checked to verify that the device has successfully stored the second part of the code. When the device is ready (b7 = `1'), the tuning protection status can monitored on Status Register bit0. If b0 = `0' the device is locked; b0 = `1' the device is unlocked. If the device is still locked, a Read Memory Array command must be issued before any new attempt to unlock the device. Device locked means that the 64 bit password is wrong. If the application user doesn't know the correct password, he can try again. The unlock sequence takes about 2 microseconds, therefore trying all possible combinations will take around 1,17 million years (Calculation: 264 * 2*10-6 / (3600*24*365) = 1,1698*106 years)! Once the device is successfully unlocked, a Read Memory Array command must be issued to return the memory to read mode before any other command can be issued. The user can then program or erase all blocks, depending on WP status and VPP level. At this point, it is also possible to configure a new protection code. To write a new protection code into the device tuning register, the user must perform the Tuning Protection Program sequence. 5/11 AN1361 - APPLICATION NOTE TUNING PROTECTION PROGRAM The tuning protection code can be configured by the designer of the application. To configure the code, the user must specify the current protection code (when shipped all bits of the code are `1' ), see the previous section Tuning Protection Unlock. The tuning protection register is a non-erasable 64 Flash Memory cell array. When shipped all the bits in the register are set to `1' (that is all cells are erased). The user can program a `0' in any of the 64 positions. Once programmed it is not possible to reset a bit to `1' as the cells cannot be erased. The tuning protection register can be programmed at any moment (after providing the current code), however once all bits are set to `0' the tuning protection code can no longer be altered. Refer to Figure 2 for the operation flowchart. The Tuning Protection Code is composed of 64 bits, but the data bus is 32 bits wide so four (2 x 2) write cycles are required to program the code. s The first write cycle issues the Tuning Protection Program Setup command (0x48). s The second write cycle inputs the first 32 bits of the new tuning protection code on the data bus, at address 0x00000. Bit 7 of the Status Register should now be checked to verify that the device has successfully stored the first part of the code in the internal register. If b7 = `1', the device is ready to accept the second part of the code. If b7 = `0', the user must wait for this bit setting (refer to write cycle AC timings). s The third write cycle re-issues the Tuning Protection Program Setup command (0x48). s The fourth write cycle inputs the second 32 bits of the new code at address 0x00001. Bit 7 of the Status Register should again be checked to verify that the device has successfully stored the second part of the code. When the device is ready (b7 = `1'). After completion Status Register bit 4 is set to '1' if there has been a program failure. Programming aborts if VPP drops out of the allowed range or RP goes to VIL. A Read Memory Array command must be issued to return the memory to read mode before issuing any other commands. Once the code has been changed a device reset or power-down will make the protection active with the new code. Warning: If a Tuning Protection Program is aborted, it is not possible to re-program the device because the tuning protection register cannot be erased. The new protection code has not been correctly written and an algorithm to detect the partially written protection code is necessary. Example, a. Remember the positions with a logic `1', which were not to be programmed. b. All the positions already changed to `0' in previous successful code changes cannot be modified, so they are still set to "0". c. The positions that should have been changed from `1' to `0' can be now either `1' (program failed) or `0' (program terminated before abort event). So the user can try to guess these locations content making several unlock sequence trials. d. If there are N undetermined bit locations, then there are 2 N possible combinations. If the user thinks that the abort occurred close to the beginning of programming, the trials should begin from the old tuning code. If the abort occurred close to the end of programming, the trials should begin from the new code. e. After the detection of the correct code, the user must re-program the desired code. Example: Old Tuning code: 0x F0FF FF1F New Tuning code: 0x F0FF 1F1F If a VPP drop or a undesired reset occurs during the New Tuning Code Programming, the user can't be sure to have modified the code to 0x F0FF 1F1F. Looking at the new and old codes, the only positions that are undefined are the last three of the first 32 bits part (Hexadecimal digit F=11112 changed in 1=00012). 6/11 AN1361 - APPLICATION NOTE Figure 2. Unlock Device and Change Tuning Protection Code Flowchart Reset Add: don't care Data: 0xFFh TUNING PROTECTION UNLOCK SEQUENCE Issue Read command 5th: Write Cycle Device locked by tuning code Add: don't care Data: 0x78h 1st: Write Cycle Add: don't care Data: 0x48h 6th: Write Cycle Add: 0x00000h Data: First 32 bit 2nd: Write Cycle (old code, factory setup = 0xFFFFh) Add: 0x00000h Data: First 32 bit 7th: Write Cycle (new code) Add: don't care Data: 0xFFh Issue Read command b7 = 1 YES Add: don't care Data: 0x78h 3rd: Write Cycle b7 = 1 YES Add: don't care Data: 0x48h 8th: Write Cycle Add: 0x00001h Data: Second 32 bit 4th: Write Cycle (old code, factory setup = 0xFFFFh) Add: 0x00001h Data: Second 32 bit 9th: Write Cycle (new code) b7 = 1 YES Read Status Register b7 = 1 YES Reset NO DEVICE LOCKED b0 = 1 YES DEVICE UNLOCKED Device locked by new code AI04501 7/11 AN1361 - APPLICATION NOTE PROGRAM AND ERASE A TUNING PROTECTED BLOCK The tuning protection unlock sequence is mandatory to modify a tuning protected block. After the b0 TPS bit check, the user issues the standard Erase or Program command. Any number of erase or program operations are allowed. The device is re-locked only after a reset or a power-down. VPP or WP can be used to prevent the modification of all blocks, however VPP and WP transitions don't affect the status of temporary tuning unprotection. During the normal erase or program operations, other Status Register bits inform the user about the internal status (VPP low, block protected, program/erase status fail). Figure 3 shows an unlock sequence to initialize a program operation. Figure 4 the same for erase. Figure 3. Unlock Device and Program a Tuning Protected Block Flowchart Reset Add: don't care Data: 0xFFh TUNING PROTECTION UNLOCK SEQUENCE Issue Read command 5th: Write Cycle Device locked by tuning code Add: don't care Data: 0x78h 1st: Write Cycle Add: don't care Data: 0x40h 6th: Write Cycle Add: 0x00000h Data: First 32 bit 2nd: Write Cycle (First part of the tuning code) Add: location to prog. 7th: Write Cycle Data: data to prog. Add: don't care Data: 0xFFh Issue Read command b7 = 1 YES Add: don't care Data: 0x78h 3rd: Write Cycle b7 = 1 YES Status Register check Add: 0x00001h Data: Second 32 bit 4th: Write Cycle (Second part of the tuning code) Location programmed b7 = 1 YES Read Status Register NO DEVICE LOCKED b0 = 1 YES DEVICE UNLOCKED AI04502 8/11 AN1361 - APPLICATION NOTE Figure 4. Unlock Device and Erase a Tuning Protected Block Flowchart Reset Add: don't care Data: 0xFFh TUNING PROTECTION UNLOCK SEQUENCE Issue Read command 5th: Write Cycle Device locked by tuning code Add: don't care Data: 0x78h 1st: Write Cycle Add: don't care Data: 0x20h 6th: Write Cycle Add: 0x00000h Data: First 32 bit 2nd: Write Cycle (First part of the tuning code) Add: block to erase Data: 0xD0h 7th: Write Cycle Add: don't care Data: 0xFFh Issue Read command b7 = 1 YES Add: don't care Data: 0x78h 3rd: Write Cycle b7 = 1 YES Status Register check Add: 0x00001h Data: Second 32 bit 4th: Write Cycle (Second part of the tuning code) Block Erased b7 = 1 YES Read Status Register NO DEVICE LOCKED b0 = 1 YES DEVICE UNLOCKED AI04502 9/11 AN1361 - APPLICATION NOTE BLOCK PROTECTION COMBINATIONS The flexible block protection of the M58BW016B allows protection for all phases of application production and usage. Table 2, shows all the possible combinations of block protection for the M58BW016B. As previously mentioned, when the device is held in reset mode (RP at VIL) no program or erase operation can be performed. With VPP at VSS the results are the same, but in this case the device is operational and the modify commands are recognized, but not executed (fail bits will be set in the Status Register). The 6 intermediate parameters blocks are always unprotected when VPP and RP are high. For this reason this area of the device is the most suitable to make EEPROM emulation and to store final user data. Table 2. Block Protection Combinations Protection Options RP VIL VIH VIH VIH VIH VPP X VIL VIH to 12V VIH to 12V VIH to 12V WP X X VIL VIH VIH Tuning Protection X X X On Off 2 Parameters Blocks Locked Locked Locked Locked Unlocked Blocks 6 Parameters Blocks Locked Locked Unlocked Unlocked Unlocked 7 Main Blocks Locked Locked Locked Unlocked Unlocked 24 Main Blocks Locked Locked Locked Locked Unlocked Note: X = Don't Care. CONCLUSIONS The M58BW016B is a Flash memory with flexible block protection to allow data control at any time in the application lifetime. It features Tuning Block Protection, where certain blocks can be protected from program and erase operations with a 64 bit password. All the operations and algorithms related to non-volatile data protection in the final application can be derived from the protection features available in this device. The Flash Memory can be removed from the application, but no accidental or voluntary modifications can be performed on the crucial code, if it is stored in tuning protected blocks. REVISION HISTORY Date 05-Jun- 2001 Version -01 First Issue Revision Details 10/11 AN1361 - APPLICATION NOTE If you have any questions or suggestion concerning the matters raised in this document please send them to the following electronic mail address: ask.memory@st.com (for general enquiries) Please remember to include your name, company, location, telephone number and fax number. Information furnished is believed to be accurate and reliable. However, STMicroelectronics assumes no responsibility for the consequences of use of such information nor for any infringement of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of STMicroelectronics. Specifications mentioned in this publication are subject to change without notice. This publication supersedes and replaces all information previously supplied. STMicroelectronics products are not authorized for use as critical components in life support devices or systems without express written approval of STMicroelectronics. The ST logo is registered trademark of STMicroelectronics All other names are the property of their respective owners. (c) 2001 STMicroelectronics - All Rights Reserved STMicroelectronics GROUP OF COMPANIES Australia - Brazil - China - Finland - France - Germany - Hong Kong - India - Italy - Japan - Malaysia - Malta - Morocco Singapore - Spain - Sweden - Switzerland - United Kingdom - U.S.A. www.st.com 11/11 |
Price & Availability of AN1361
 |
|
|
|
|
All Rights Reserved © IC-ON-LINE 2003 - 2022 |
| [Add Bookmark] [Contact Us] [Link exchange] [Privacy policy] |
|
Mirror Sites : [www.datasheet.hk]
[www.maxim4u.com] [www.ic-on-line.cn]
[www.ic-on-line.com] [www.ic-on-line.net]
[www.alldatasheet.com.cn]
[www.gdcy.com]
[www.gdcy.net] |