AN1070/0102 1/10 AN1070 application note st7 checksum selfchecking capability by microcontroller division applications introduction the goal of this application note is to present a software technique for determining if data and program in flash have been corrupted and if so not to run the user program. the program described in this application note has been written for the st72f26x family (st72260g1, st72262g1, st72262g2, st72264g1, st72264g2) but can be extended to all other st7 mcus. you have to choose your device at the beginning of the program (several #include and #de- fine statements are provided for this purpose). in this application, we chose to use a st72264g2. 1
2/10 st7 checksum selfchecking capability 1 checksum calculation the checksum is calculated by a simple addition of the content of the flash. the result is in 3 bytes. for the st72f264g2, the checksum is obtained by adding up all the bytes from e003h (be- ginning of the program stored in flash) up to ffffh. the result is stored in 3 byte variables (cs0, cs1 and cs2) located at the beginning of the flash memory area (from e000 to e003): a special segment (checksum segment) has been created at this location (see st72264.asm mapping file). its very important to check the interrupt vectors because to perform the checksum, the reset vector has to point to the safe routine and not to the main routine (if flash is not checked ok by the safe routine, then the user program wont be run). the routine which calculates the checksum is 27 bytes long. the table below shows the cal- culation times. the time depends on the chosen device (4k or 8k in this case) and on the value chosen to fill the unused memory area (if the chosen value is $ff for example, there will be more carry to take into account). the above results have been obtained in the worst case (unused memory part filled with $ff) with fcpu=8mhz. table 1. checksum calculation times 4k 8k device used st72264g1 st72264g2 time (ms) 13.7 27.5 cs0 cs1 cs2 e000 ffe0 fff0 interrupt vectors segment checksum flash (program) 2
3/10 st7 checksum selfchecking capability note : there are some unused opcodes in the st7 instruction set opcode map which can be used to make the application more secure. if an unused opcode is put into the unused part of memory, wrong code wont be executed if a problem occurs ($af for instance). you can also fill the unused memory with 0, the opcode of the nop instruction or whatever you want. but what st advises and what we do in our application, is to fill the unused part of memory with the opcode corresponding to the trap execution ( $83 ) allowing recovery through the trap interrupt routine (which can contain a software reset caused by writing the appropriate value in the watchdog register for instance). see also an1015: software techniques for improving mi- crocontroller emc performance.
4/10 st7 checksum selfchecking capability 2 using the same routine wiht a users application 2.1 flash to use the safe routine, do the following: n add the safe routine to the application. n select the define statement corresponding to the mcu device used in the application. n change the vectit segment depending on the device chosen. n modify the reset vector to point to the safe routine and not to the main one. n include the right .inc mapping file at the beginning of the application. n update the .bat file for the compilation. n generate the .s19 file. n use the emulator or the development kit with stvd7: first fill the emulator memory with $83 (for example): before opening the application workspace, go into debug mode (without any opened workspace), right-click on the memory window and select fill memory: fill the memory with 0x83 in 2 steps (because there are 2 sectors): first from 0xe000 to 0xefff, then from 0xf000 to 0xffff. you then just have to open your workspace and your program will be written into the flash area that has bee initialized with $83. to calculate your application checksum: n run the program the first time with the emulator in order to get the checksum: put a breakpoint on the line after the end1 label (see safe.asm in the zip file with this application note). n fill the cs0, cs1, cs2 variables (in constant.asm) with the obtained checksum value stored in ch_sum (ch_sum, {ch_sum+1}, {ch_sum+2}).
5/10 st7 checksum selfchecking capability n generate the new .s19 file. n program the flash using the epb programming board and fill the unused memory with the same opcode as before ($83 in our example) using the edit, fill area menu in stvisual programmer software (stvp7). 2.2 rom for the rom, the principle is the same, but you have to specify the content of the unused bytes in the program memory. in order that the stored checksum matches the calculated one, the unused bytes have to be the same. using the windows programmer (stvp7), fill the unused bytes with a particular op- code (the trap code for instance: 83h), and then save this new complete .s19 file, replacing the previous one. otherwise fill the unused bytes directly in the code with using assembly lan- guage repeat...until directives. refer to the st7 assembler-linker user manual for more information on st7 assembly directives.
6/10 st7 checksum selfchecking capability 3 description of safe routine operation at each reset, the safe routine calculates the checksum from e003h to ffffh and compares it to cs0, cs1 and cs2. if the comparison is ok, the user application (the main routine) will be run and in our example, the pbdr register is set to ffh (all leds set). if the comparison isnt ok, the microcontroller is halted (only a reset can make it exit from this state and this means the user application wont be run). the halt state (please refer to an980 for more details) puts the mcu in its lowest power consumption mode. the internal oscillator is turned off, causing all internal processing to be stopped, including the operation of the on-chip peripherals. note : during the execution of the safe routine, the i/o lines will be in their reset state (gener- ally floating input) because they wont have been modified. if the checksum comparison is not ok, the i/o lines remain unchanged in their reset state. the main program in our application just switches all leds on and then waits in an infinite loop. you can replace this by your own application. 4 flowcharts figure 1. safe routine (for st72264g2) with: n cs means checksum stored in cso, cs1 and cs2. n ch_sum is the three byte variable created to store the checksum calculated by the safe routine. main calculate the checksum from e003 to ffff stored into ch_sum ch_sum=cs? no halt yes (in our application pbdr=ff and a delay loop)
7/10 st7 checksum selfchecking capability figure 2. calculation of the checksum (for st72264g2) start_page = e000 a = start_page+x ch_sum=cs? halt no yes yes call add_byte checksum calculated till ffff? no (cs+=current byte) main
8/10 st7 checksum selfchecking capability figure 3. add_byte routine inc x x = 0? no a+=start_page+x c = 1? no ret yes {ch_sum+1}+=1 c = 1? no ret yes ch_sum+=1 ret yes start_page+=100 ret
9/10 st7 checksum selfchecking capability 5 software all the source files in assembly code are given in the zip file with this application note. the source files are for guidance only. stmicroelectronics shall not be held liable for any di- rect, indirect or consequential damages with respect to any claims arising from use of this soft- ware.
10/10 st7 checksum selfchecking capability the present note which is for guidance only aims at providing customers with information regarding their products in order for them to save time. as a result, stmicroelectronics shall not be held liable for any direct, indirect or consequential damages with respect to any claims arising from the content of such a note and/or the use made by customers of the information contained herein in connection with their products. information furnished is believed to be accurate and reliable. however, stmicroelectronics assumes no responsibility for the co nsequences of use of such information nor for any infringement of patents or other rights of third parties which may result from its use. no license is granted by implication or otherwise under any patent or patent rights of stmicroelectronics. specifications mentioned in this publicati on are subject to change without notice. this publication supersedes and replaces all information previously supplied. stmicroelectronics prod ucts are not authorized for use as critical components in life support devices or systems without the express written approval of stmicroele ctronics. the st logo is a registered trademark of stmicroelectronics ? 2002 stmicroelectronics - all rights reserved. purchase of i 2 c components by stmicroelectronics conveys a license under the philips i 2 c patent. rights to use these components in an i 2 c system is granted provided that the system conforms to the i 2 c standard specification as defined by philips. stmicroelectronics group of companies australia - brazil - canada - china - finland - france - germany - hong kong - india - israel - italy - japan malaysia - malta - morocco - singapore - spain - sweden - switzerland - united kingdom - u.s.a. http://www.st.com
|
