ANALOG DEVICES ADuC7036 Service Manual
Integrated Precision Battery Sensor
www.BDTIC.com/ADI
FEATURES
High precision ADCs
Dual channel, simultaneous sampling, 16-bit, Σ-Δ ADCs
Programmable ADC throughput from 1 Hz to 8 kHz
On-chip 5 ppm/°C voltage reference
Current channel
Fully differential, buffered input
Programmable gain from 1 to 512
ADC input range: −200 mV to +300 mV
Digital comparators, with current accumulator feature
Voltage channel
Buffered, on-chip attenuator for 12 V battery inputs
Temperature channel
External and on-chip temperature sensor options
Microcontroller
ARM7TDMI core, 16-/32-bit RISC architecture
20.48 MHz PLL with programmable divider
PLL input source
On-chip precision oscillator
On-chip low power oscillator
External (32.768 kHz) watch crystal
JTAG port supports code download and debug
for Automotive
ADuC7036
Memory
96 kB Flash/EE memory, 6 kB SRAM
10,000-cycle Flash/EE endurance, 20-year Flash/EE
retention
In-circuit download via JTAG and LIN
On-chip peripherals
LIN 2.0-compatible (slave) support via UART with
hardware synchronization
Flexible wake-up I/O pin, master/slave SPI serial I/O
9-pin GPIO port, 3× general-purpose timers
Wake-up and watchdog timers
Power supply monitor and on-chip power-on reset
Power
Operates directly from 12 V battery supply
Current consumption
Normal mode 10 mA at 10 MHz
Low power monitor mode
Package and temperature range
48-lead, 7 mm × 7 mm LFCSP
Fully specified for −40°C to +115°C operation
APPLICATIONS
Battery sensing/management for automotive systems
Rev. 0
Information furnished by Analog Dev
responsibility is assumed by Analog Dev
rights of third parties that may result fro
license is granted by implication or othe
Trademarks and registered trademarks
FUNCTIONAL BLOCK DIAGRAM
PRECISION ANALO G ACQUISITION
IIN+
IIN–
VBAT
ACCUMULATOR
VTEMP
TEMPERATURE
VREF
GND_SW
VDD
REG_AVDD
ices is believed to be accurate and reliable. However, no
ices for its use, nor for any infringements of patents or other
m its use. Specifications subject to change without notice. No
rwise under any patent or patent rights of Analog Devices.
are the property of their respective owners.
BUF
RESULT
MUX BUF
SENSOR
REG_DVDD
AGND
PGA
DGND
DIGITAL
COMPARATOR
PRECISION
REFERENCE
VSS
IO_VSS
TCK
16-BIT
Σ-Δ ADC
16-BIT
Σ-Δ ADC
Figure 1.
NTRST
TDO
TDI
TMS
ADuC7036
GPIO_4
GPIO_5
MEMORY
98kB FLASH
6kB RAM
PRECISION
OSC
LOW POWER
OSC
ON-CHIP PLL
GPIO PORT
UART PORT
SPI PORT
LIN
GPIO_6
GPIO_7
GPIO_8
2.6V LDO
PSM
POR
ARM7TDMI
MCU
20MHz
3× TIMERS
WDT
WU TIMER
GPIO_2
GPIO_3
GPIO_1
GPIO_0
One Technology Way, P.O. Box 9106, Norw
Tel: 781.329.4700
Fax: 781.461.3113 ©2008 Analog De
RESET
XTAL1
XTAL2
WU
STI
LIN/ BSD
07474-001
ood, MA 02062-9106, U.S.A.
www.analog.com
vices, Inc. All rights reserved.
ADuC7036
www.BDTIC.com/ADI
TABLE OF CONTENTS
Features .............................................................................................. 1
Applications ....................................................................................... 1
Functional Block Diagram .............................................................. 1
Table of Contents .............................................................................. 2
Revision History ............................................................................... 3
Specifications ..................................................................................... 4
Electrical Specifications ............................................................... 4
Timing Specifications ................................................................ 10
Absolute Maximum Ratings .......................................................... 15
ESD Caution ................................................................................ 15
Pin Configuration and Function Descriptions ........................... 16
Typical Performance Characteristics ........................................... 18
Terminology .................................................................................... 19
Theory of Operation ...................................................................... 20
Overview of the ARM7TDMI Core ......................................... 20
Memory Organization ............................................................... 22
Reset ............................................................................................. 24
Flash/EE Memory ........................................................................... 25
Programming Flash/EE Memory In-Circuit .......................... 25
Flash/EE Control Interface ........................................................ 25
Flash/EE Memory Security ....................................................... 29
Flash/EE Memory Reliability .................................................... 31
Code Execution Time from SRAM and Flash/EE ..................... 31
On-Chip Kernel .......................................................................... 32
Memory Mapped Registers ....................................................... 34
Complete MMR Listing ............................................................. 35
16-Bit, Σ- Analog-to-Digital Converters .................................. 41
Current Channel ADC (I-ADC) .............................................. 41
ADC Ground Switch .................................................................. 44
ADC Noise Performance Tables ............................................... 44
ADC MMR Interface ................................................................. 45
ADC Power Modes of Operation ............................................. 54
ADC Comparator and Accumulator ....................................... 55
ADC Sinc3 Digital Filter Response .......................................... 55
ADC Calibration ........................................................................ 58
ADC Diagnostics ........................................................................ 59
Power Supply Support Circuits ..................................................... 60
System Clocks ................................................................................. 61
System Clock Registers .............................................................. 62
Low Power Clock Calibration ................................................... 65
Processor Reference Peripherals ................................................... 67
Interrupt System ......................................................................... 67
Timers .............................................................................................. 70
Timer0—Lifetime Timer ........................................................... 71
Timer1.......................................................................................... 73
Timer2—Wake-Up Timer ......................................................... 75
Timer3—Watchdog Timer ........................................................ 77
Timer4—STI Timer ................................................................... 79
General-Purpose I/O ..................................................................... 81
High Voltage Peripheral Control Interface ................................. 92
Wake-UP (WU) Pin ................................................................... 99
Handling Interrupts from the High Voltage Peripheral
Control Interface ...................................................................... 100
Low Voltage Flag (LVF) ........................................................... 100
High Voltage Diagnostics ........................................................ 100
UART Serial Interface .................................................................. 101
Baud Rate Generation .............................................................. 101
UART Register Definitions ..................................................... 102
Serial Peripheral Interface ........................................................... 107
MISO Pin ................................................................................... 107
MOSI Pin ................................................................................... 107
SCLK Pin ................................................................................... 107
SS
Pin ......................................................................................... 107
SPI Register Definitions .......................................................... 107
Serial Test Interface ...................................................................... 110
LIN (Local Interconnect Network) Interface............................ 113
LIN MMR Description ............................................................ 113
LIN Hardware Interface .......................................................... 117
Bit Serial Device (BSD) Interface ............................................... 121
BSD Communication Hardware Interface ............................ 121
BSD Related MMRs ................................................................. 122
BSD Communication Frame .................................................. 123
BSD Data Reception................................................................. 124
BSD Data Transmission ........................................................... 124
Wake-Up from BSD Interface ................................................. 124
Part Identification ......................................................................... 125
Schematic ....................................................................................... 128
Outline Dimensions ..................................................................... 129
Ordering Guide ........................................................................ 129
Rev. 0 | Page 2 of 132
ADuC7036
www.BDTIC.com/ADI
REVISION HISTORY
10/08—Revision 0: Initial Version
Rev. 0 | Page 3 of 132
ADuC7036
www.BDTIC.com/ADI
SPECIFICATIONS
ELECTRICAL SPECIFICATIONS
VDD = 3.5 V to 18 V, VREF = 1.2 V internal reference, f
precision oscillator, all specifications T
= −40°C to +115°C, unless otherwise noted.
A
Table 1.
Parameter Test Conditions/Comments Min Typ Max Unit
ADC SPECIFICATIONS
Conversion Rate
1
Chop on, ADC normal operating mode 4 2600 Hz
Chop on, ADC low power mode 1 650 Hz
Current Channel
No Missing Codes
Integral Nonlinearity
Offset Error
Offset Error
Offset Error
Offset Error
Offset Error Drift
Offset Error Drift
Offset Error Drift
Total Gain Error
Total Gain Error
Total Gain Error
1
1, 2
2, 3 , 4, 5
1, 3, 6
1, 3
Chop on, low power or low power plus mode,
1, 3
Chop on, normal mode, CD = 1 +0.5 −1.25 −3 V
6
Chop off, valid for ADC gains of 4 to 64, normal mode 0.03 LSB/°C
6
Chop off, valid for ADC gains of 128 to 512,
6
Chop on 10 nV/°C
1, 3, 7 , 8 , 9, 10
1, 3, 7, 9
1, 3, 7, 9, 11
Gain Drift
PGA Gain Mismatch Error
Output Noise
1, 12
Chop off, ADC normal operating mode 4 8000 Hz
Valid for all ADC update rates and ADC modes 16 Bits
±10 ±60 ppm of FSR
Chop off, 1 LSB = (36.6/gain) V −10 ±3 +10 LSB
Chop on −2 ±0.5 +2 V
MCU powered down
normal mode
Normal mode −0.5 ±0.1 +0.5
Low power mode, using ADCREF MMR −4 ±0.2 +4
Low power plus mode, using precision VREF −1 ±0.2 +1
4 Hz update rate, gain = 512, ADCFLT = 0xBF1D 60 90 nV rms
4 Hz update rate, gain = 512, ADCFLT = 0x3F1D 75 115 nV rms
10 Hz update rate, gain = 512, ADCFLT = 0x961F 100 150 nV rms
10 Hz update rate, gain = 512, ADCFLT = 0x161F 120 180 nV rms
1 kHz update rate, gain ≥ 64, ADCFLT = 0x8101 0.8 1.2 µV rms
1 kHz update rate, gain ≥ 64, ADCFLT = 0x0101 1 1.5 µV rms
1 kHz update rate, gain = 512, ADCFLT = 0x0007 0.6 0.9 µV rms
1 kHz update rate, gain = 32, ADCFLT = 0x0007 0.8 1.2 µV rms
1 kHz update rate, gain = 8, ADCFLT = 0x8101 2.1 4.1 µV rms
1 kHz update rate, gain = 8, ADCFLT = 0x0007 1.6 2.4 µV rms
1 kHz update rate, gain = 8, ADCFLT = 0x0101 2.6 3.9 µV rms
1 kHz update rate, gain = 4, ADCFLT = 0x0007 2.0 2.8 µV rms
8 kHz update rate, gain = 32, ADCFLT = 0x0000 2.5 3.5 µV rms
8 kHz update rate, gain = 4, ADCFLT = 0x0000 14 21 µV rms
ADC low power mode, f
ADC low power mode, f
ADC low power plus mode, f
ADC low power plus mode, f
gain = 512
= 10.24 MHz driven from external 32.768 kHz watch crystal or on-chip
CORE
100 −50 −300 nV
30 nV/°C
3
±0.1
= 10 Hz, gain = 128 1.25 1.9 µV rms
ADC
= 1 Hz, gain = 128 0.35 0.5 µV rms
ADC
= 1 Hz, gain = 512 0.1 0.15 µV rms
ADC
= 250 Hz,
ADC
0.6 0.9 µV rms
%
%
%
%
ppm/°C
Rev. 0 | Page 4 of 132
ADuC7036
www.BDTIC.com/ADI
Parameter Test Conditions/Comments Min Typ Max Unit
Voltage Channel
No Missing Codes
Integral Nonlinearity
Offset Error
Offset Error
Offset Error Drift Chop off 0.03 LSB/°C
Total Gain Error
Total Gain Error
Gain Drift Includes resistor mismatch drift 3 ppm/°C
Output Noise
Temperature Channel
No Missing Codes
Integral Nonlinearity
Offset Error
Offset Error
Offset Error Drift Chop off
Total Gain Error
Gain Drift
Output Noise
ADC SPECIFICATIONS ANALOG INPUT Internal VREF = 1.2 V
Current Channel
Absolute Input Voltage Range Applies to both IIN+ and IIN− −200 +300 mV
Input Voltage Range
Gain = 2
Gain = 4
Gain = 8 ±150 mV
Gain = 16 ±75 mV
Gain = 32 ±37.5 mV
Gain = 64 ±18.75 mV
Gain = 128 ±9.375 mV
Gain = 256 ±4.68 mV
Gain = 512 ±2.3 mV
Input Leakage Current
Input Offset Current
Voltage Channel
Absolute Input Voltage Range 4 18 V
Input Voltage Range 0 to 28.8 V
VBAT Input Current VBAT = 18 V 3 5.5 8 µA
Temperature Channel VREF = (REG_AVDD, GND_SW)/2
Absolute Input Voltage Range 100 1300 mV
Input Voltage Range 0 to
VTEMP Input Current
13
3, 5
1, 3
1, 12, 15
3, 4, 5, 16
1, 3
1, 3, 14
1
1
1
1, 3, 7, 10, 14
1, 3, 7, 10, 14
1
1
17, 18
1, 20
1
Valid at all ADC update rates 16 Bits
±10 ±60 ppm of FSR
Chop off, 1 LSB = 439.5 µV −10 ±1 +10 LSB
Chop on 0.3 1 LSB
Includes resistor mismatch −0.25 ±0.06 +0.25 %
Temperature range = −25°C to +65°C −0.15 ±0.03 +0.15 %
4 Hz update rate, ADCFLT = 0xBF1D 60 90 µV rms
10 Hz update rate, ADCFLT = 0x961F 60 90 µV rms
1 kHz update rate, ADCFLT = 0x0007 180 270 µV rms
1 kHz update rate, ADCFLT = 0x8101 240 307 µV rms
1 kHz update rate, ADCFLT = 0x0101 270 405 µV rms
8 kHz update rate, ADCFLT = 0x0000 1600 2400 µV rms
Valid at all ADC update rates 16
Chop off, 1 LSB = 19.84 V in unipolar mode,
tested at gain of 4
Chop on −5
Using REG_AVDD as the reference −0.2
1 kHz update rate
Gain = 1
1
−3 +3 nA
0.5 1.5 nA
2.5 100 nA
±10 ±60
−10
±3 +10
+1 +5
0.03
±0.06 +0.2
3
7.5 11.25
19
±1.2 V
19
±600 mV
19
±300 mV
Bits
ppm of FSR
LSB
LSB
LSB/°C
%
ppm/°C
µV rms
V
VREF
Rev. 0 | Page 5 of 132
ADuC7036
www.BDTIC.com/ADI
Parameter Test Conditions/Comments Min Typ Max Unit
VOLTAGE REFERENCE
ADC Precision Reference
Internal VREF 1.2 V
Power-Up Time
Initial Accuracy
Temperature Coefficient
Reference Long-Term Stability
External Reference Input Range
VREF Divide-by-2 Initial Error
ADC Low Power Reference
Internal VREF 1.2 V
Initial Accuracy Measured at TA = 25°C −5 +5 %
Initial Accuracy
Temperature Coefficient
ADC DIAGNOSTICS
VREF/136
Voltage Attenuator Current
Source
RESISTIVE ATTENUATOR
Divider Ratio 24
Resistor Mismatch Drift 3 ppm/°C
ADC GROUND SWITCH
Resistance Direct path to ground 10 Ω
Resistance
Input Current Allowed contunious current through the switch
TEMPERATURE SENSOR
Accuracy MCU in power-down or standby mode ±3 °C
MCU in power-down or standby mode,
POWER-ON RESET (POR)
POR Trip Level Refers to voltage at VDD pin 2.85 3.0 3.15 V
POR Hysteresis 300 mV
Reset Timeout from POR 20 ms
LOW VOLTAGE FLAG (LVF)
LVF Level Refers to voltage at VDD pin 1.9 2.1 2.3 V
POWER SUPPLY MONITOR (PSM)
PSM Trip Level Refers to voltage at VDD pin 6.0 V
WATCHDOG TIMER (WDT)
Timeout Period
Timeout Step Size 7.8 ms
FLASH/EE MEMORY
Endurance
Data Retention
DIGITAL INPUTS All digital inputs except NTRST
Input Leakage Current Input high = REG_DVDD ±1 ±10 µA
Input Pull-up Current Input low = 0 V −80 −20 −10 µA
Input Capacitance 10 pF
Input Leakage Current NTRST only: input low = 0 V ±1 ±10 µA
Input Pull-Down Current NTRST only: input high = REG_DVDD 30 55 100 µA
1
1
1
1
1
1, 21
23
1
1, 21
0.5 ms
Measured at TA = 25°C −0.15 +0.15 %
−20 ±5 +20 ppm/°C
22
100 ppm/1000 hr
0.1 1.3 V
0.1 0.3 %
Using ADCREF, measured at TA = 25°C 0.1 %
−300 ±150 +300 ppm/°C
At any gain settings 8.5 9.4 mV
Differential voltage increase on the attenuator
3.1 3.8 V
when the current source is on, temperature range =
−40°C to +85°C
1
20 kΩ resistor selected 10 20 30 kΩ
6 mA
with direct path to ground
24
After user calibration
±2 °C
temperature range = −25°C to +65°C
1
1
25
26
32.768 kHz clock, 256 prescale 0.008 512 sec
10,000 Cycles
20 Years
Rev. 0 | Page 6 of 132
ADuC7036
www.BDTIC.com/ADI
Parameter Test Conditions/Comments Min Typ Max Unit
LOGIC INPUTS
V
INL
V
INH
CRYSTAL OSCILLATOR
Logic Inputs, XTAL1 Only
V
V
XTAL1 Capacitance 12 pF
XTAL2 Capacitance 12 pF
ON-CHIP OSCILLATORS
Low Power Oscillator 131.072 kHz
Accuracy
Precision Oscillator 131.072 kHz
Accuracy Includes drift data from 1000 hour life test −1 +1 %
MCU CLOCK RATE Eight programmable core clock selections within
MCU START-UP TIME
At Power-On Includes kernel power-on execution time 25 ms
After Reset Event Includes kernel power-on execution time 5 ms
From MCU Power-Down
Oscillator Running
Crystal Powered Down
Internal PLL Lock Time 1 ms
LIN INPUT/OUTPUT GENERAL
Baud Rate 1000 20,000 Bits/sec
VDD Supply voltage range at which the LIN interface is
Input Capacitance 5.5 pF
Input Leakage Current Input (low) = IO_VSS −800 −400 µA
LIN Comparator Response Time
I
LIN_DOM_MAX
I
LIN_PAS_REC
1
I
LIN
I
LIN_PAS_DOM
I
LIN_NO_GND
V
LIN_DOM
V
LIN_REC
V
LIN_CNT
V
HYS
V
LIN_DOM_DRV_LOSUP
R
R
V
LIN_DOM_DRV_HISUP
R
R
V
LIN_RECESSIVE
VBAT Shift
GND Shift
1
All logic inputs
, Input Low Voltage 0.4 V
, Input High Voltage 2.0 V
1
, Input Low Voltage 0.8 V
INL
, Input High Voltage 1.7 V
INH
27
Includes drift data from 1000 hour life test −3 +3 %
0.160 10.24 20.48 MHz
this range (binary divisions 1, 2, 4, 8, . . . 64, 128)
Wake Up from Interrupt 2 ms
Wake Up from LIN 2 ms
Wake Up from Interrupt 500 ms
7 18 V
functional
1
Using 22 Ω resistor 38 90 µs
Current limit for driver when LIN bus is in
40 200 mA
dominant state, VBAT = VBAT (max)
Driver off, 7.0 V < V
1
28
VBAT disconnected, VDD = 0 V, 0 < V
Input leakage V
Control unit disconnected from ground,
GND = VDD, 0 V < V
1
1
1
1
LOAD
LOAD
LOAD
LOAD
1
LIN dominant output voltage, VDD = 7 V
= 500 Ω 1.2 V
= 1000 Ω 0.6 V
1
= 500 Ω 2 V
= 1000 Ω 0.8 V
LIN receiver dominant state, VDD > 7.0 V 0.4 VDD V
LIN receiver recessive state, VDD > 7.0 V 0.6 VDD V
LIN receiver center voltage, VDD > 7.0 V 0.475 VDD 0.5 VDD 0.525 VDD V
LIN receiver hysteresis voltage 0.175 VDD V
LIN dominant output voltage, VDD = 18 V
< 18 V, VDD = V
LIN
= 0 V −1 mA
LIN
− 0.7 V −20 +20 µA
LIN
< 18 V 10 µA
LIN
−1 +1 mA
< 18 V, VBAT = 12 V
LIN
LIN recessive output voltage 0.8 VDD V
28
28
0 0.1 VDD V
0 0.1 VDD V
Rev. 0 | Page 7 of 132
ADuC7036
www.BDTIC.com/ADI
Parameter Test Conditions/Comments Min Typ Max Unit
R
Slave termination resistance 20 30 47 kΩ
SLAVE
V
Symmetry of Transmit Propagation
Receive Propagation Delay
Symmetry of Receive Propagation
LIN VERSION 2.0 SPECIFICATION
D1
D2
BSD INPUT/OUTPUT
Baud Rate 1164 1200 1236 Bits/sec
Input leakage current Input high = VDD, or input low = IO_VSS −50 +50 µA
VOL, Output Low Voltage 1.2 V
VOH, Output High Voltage 0.8 VDD V
I
o(sc)
V
V
WAKE UP R
VDD
Input Leakage Current Input high = VDD 0.4 2.1 mA
Input low = IO_VSS −50 +50 µA
V
V
VIH Input high level 4.6 V
VIL Input low level 1.2 V
Monoflop Timeout Timeout period 0.6 1.3 2 sec
I
o(sc)
SERIAL TEST INTERFACE R
Baud Rate 40 kbps
Input Leakage Current Input high = VDD or Input low = IO_VSS −50 +70 µA
VDD Supply voltage range for which STI is functional 7 18 V
VOH Output high level 0.6 VDD V
VOL Output low level 0.4 VDD V
VIH Input high level 0.6 VDD V
VIL Input low level 0.4 VDD V
PACKAGE THERMAL SPECIFICATIONS
Thermal Shutdown
Thermal Impedance (θJA)
28
SERIAL DIODE
Delay
Delay
Voltage drop at the serial diode, D
1
1
1
VDD (min) = 7 V −4 +4 µs
VDD (min) = 7 V 6 µs
VDD (min) = 7 V −2 +2 µs
Bus load conditions (CBUS||RBUS): 1 nF||1 kΩ;
0.4 0.7 1 V
Ser_Int
6.8 nF||660 Ω; 10 nF||500 Ω
Duty Cycle 1,
TH
TH
V
D1 = t
= 0.744 × VBAT,
REC(MAX)
= 0.581 × VBAT,
DOM(MAX)
= 7.0 V . . . 18 V; t
SUP
BUS_REC(MIN)
/(2 × t
= 50 µs,
BIT
)
BIT
Duty Cycle 2,
TH
TH
V
D2 = t
29
Short-Circuit Output Current V
, Input Low Voltage 1.8 V
INL
, Input High Voltage 0.7 VDD V
INH
1
Supply voltage range at which the WU pin is
= 0.284 × VBAT,
REC(MIN)
= 0.422 × VBAT,
DOM(MIN)
= 7.0 V . . . 18 V; t
SUP
BUS_REC(MAX)
= VDD = 12 V 50 80 120 mA
BSD
= 300 Ω, C
LOAD
/(2 × t
= 91 nF, R
BUS
= 50 µs,
BIT
)
BIT
= 39 Ω
LIMIT
0.396
7 18 V
0.581
functional
30
OH
30
Output low level 2 V
OL
Output high level 5 V
Short-Circuit Output Current 100 140 mA
1, 31
= 500 Ω, C
LOAD
32
140 150 160 °C
48-lead LFCSP, stacked die 45 °C/W
= 2.4 nF, R
BUS
= 39 Ω
LIMIT
Rev. 0 | Page 8 of 132
ADuC7036
www.BDTIC.com/ADI
Parameter Test Conditions/Comments Min Typ Max Unit
POWER REQUIREMENTS
Power Supply Voltages
VDD (Battery Supply) 3.5 18 V
REG_DVDD, REG_AVDD
Power Consumption
IDD (MCU Normal Mode)
MCU clock rate = 20.48 MHz, ADC off 20 mA
IDD (MCU Powered Down)
ADC low power mode, measured over the range
ADC low power plus mode, measured over the
IDD (MCU Powered Down) Average current, measured with wake-up and
IDD (Current ADC) 1.7 mA
IDD (Voltage/Temperature ADC) 0.5 mA
IDD (Precision Oscillator) 400 µA
1
These numbers are not production tested, but are guaranteed by design and/or characterization data at production release.
2
Valid for current ADC gain setting of PGA = 4 to 64.
3
These numbers include temperature drift.
4
Tested at gain range = 4; self-offset calibration removes this error.
5
Measured with an internal short after an initial offset calibration.
6
Measured with an internal short.
7
These numbers include internal reference temperature drift.
8
Factory-calibrated at gain = 1.
9
System calibration at a specific gain range (and temperature) removes the error at this gain range (and temperature).
10
Includes an initial system calibration.
11
Using ADC normal mode voltage reference.
12
Typical noise in low power modes is measured with chop enabled.
13
Voltage channel specifications include resistive attenuator input stage.
14
System calibration removes this error at the specified temperature.
15
RMS noise is referred to voltage attenuator input (for example, at f
to yield these input referred noise figures.
16
Valid after an initial self-calibration.
17
In ADC low power mode, the input range is fixed at ±9.375 mV. In ADC low power plus mode, the input range is fixed at ±2.34375 mV.
18
It is possible to extend the ADC input range by up to 10% by modifying the factory set value of the gain calibration register or using system calibration. This approach
can also be used to reduce the ADC input range (LSB size).
19
Limited by minimum/maximum absolute input voltage range.
20
Valid for a differential input less than 10 mV.
21
Measured using box method.
22
The long-term stability specification is noncumulative. The drift in subsequent 1000 hour periods is significantly lower than in the first 1000 hour period.
23
References of up to REG_AVDD can be accommodated by enabling an internal divide-by-2.
24
Die temperature.
25
Endurance is qualified to 10,000 cycles as per JEDEC Std. 22 Method A117 and measured at −40°C, +25°C, and +125°C. Typical endurance at 25°C is 170,000 cycles.
26
Retention lifetime equivalent at junction temperature (TJ) of 85°C as per JEDEC Std. 22 Method A117. Retention lifetime derates with junction temperature.
27
Low power oscillator can be calibrated against either the precision oscillator or the external 32.768 kHz crystal in user code.
28
These numbers are not production tested, but are supported by LIN compliance testing.
29
BSD electrical specifications, except high and low voltage levels, are per LIN 2.0 with pull-up resistor disabled and C
= 10 nF maximum.
30
Specified after R
31
The MCU core is not shutdown but interrupted, and high voltage I/O pins are disabled in response to a thermal shutdown event.
32
Thermal impedance can be used to calculate the thermal gradient from ambient to die temperature.
33
Internal regulated supply available at REG_DVDD (I
34
The specification listed is typical; additional supply current consumed during Flash/EE memory program and erase cycles is 7 mA and 5 mA, respectively.
LIMIT
of 39 Ω.
33
34
1
2.5 2.6 2.7 V
MCU clock rate = 10.24 MHz, ADC off 10 20 mA
ADC low power mode, measured over the range
= −10°C to +40°C, continuous ADC conversion
of T
A
300 400 µA
300 500 µA
= −40°C to +85°C, continuous ADC conversion
of T
A
520 700 µA
range of T
= −10°C to +40°C, continuous ADC
A
conversion
Average current, measured with wake-up and
120 300 µA
watchdog timer clocked from the low power
oscillator, T
= −40°C to +85°C
A
120 175 µA
watchdog timer clocked from low power oscillator
over a range of T
SOURCE
= −10°C to +40°C
A
= 1 kHz, typical rms noise at the ADC input is 7.5 V) and scaled by the attenuator (divide-by-24)
ADC
= 5 mA), and REG_AVDD (I
SOURCE
L
= 1 mA).
Rev. 0 | Page 9 of 132
ADuC7036
www.BDTIC.com/ADI
TIMING SPECIFICATIONS
SPI Timing Specifications
Table 2. SPI Master Mode Timing—PHASE Mode = 1
Parameter Description Min Typ Max Unit
tSL SCLK low pulse width
tSH SCLK high pulse width
t
Data output valid after SCLK edge
DAV
t
Data input setup time before SCLK edge 0 ns
DSU
t
Data input hold time after SCLK edge
DHD
tDF Data output fall time 3.5 ns
tDR Data output rise time 3.5 ns
tSR SCLK rise time 3.5 ns
tSF SCLK fall time 3.5 ns
1
t
depends on the clock divider (CD) bits in POWCON MMR. t
HCLK
2
t
= 48.8 ns. It corresponds to the 20.48 MHz internal clock from the PLL before the clock divider.
UCLK
SCLK
(POLARIT Y = 0)
SCLK
(POLARIT Y = 1)
1
1
(SPIDIV + 1) × t
t
DAV
2
2
= t
HCLK
UCLK
t
SH
(SPIDIV + 1) × t
(2 × t
3 × t
ns
UCLK
/2CD.
t
SL
t
DF
t
DR
ns
HCLK
ns
HCLK
) + (2 × t
UCLK
t
SR
t
SF
) ns
HCLK
MOSI
MISO
MSB IN BITS[6:1] LSB IN
t
DSUtDHD
Figure 2. SPI Master Mode Timing—PHASE Mode = 1
LSBBITS[6:1]MSB
07474-002
Rev. 0 | Page 10 of 132
ADuC7036
www.BDTIC.com/ADI
Table 3. SPI Master Mode—PHASE Mode = 0
Parameter Description Min Typ Max Unit
tSL SCLK low pulse width
tSH SCLK high pulse width
t
Data output valid after SCLK edge
DAV
t
Data output setup before SCLK edge ½ tSL ns
DOSU
t
Data input setup time before SCLK edge 0 ns
DSU
t
Data input hold time after SCLK edge
DHD
tDF Data output fall time 3.5 ns
tDR Data output rise time 3.5 ns
tSR SCLK rise time 3.5 ns
tSF SCLK fall time 3.5 ns
1
t
depends on the clock divider (CD) bits in POWCON MMR. t
HCLK
2
t
= 48.8 ns. It corresponds to the 20.48 MHz internal clock from the PLL before the clock divider.
UCLK
SCLK
(POLARITY = 0)
SCLK
(POLARITY = 1)
1
1
(SPIDIV + 1) × t
t
DOSU
2
2
3 × t
HCLK
t
SH
t
t
DF
= t
DAV
UCLK
(SPIDIV + 1) × t
(2 × t
ns
UCLK
/2CD.
t
SL
t
DR
ns
HCLK
ns
HCLK
) + (2 × t
UCLK
t
SR
t
SF
) ns
HCLK
MOSI
MISO
MSB IN BITS[6:1] L SB IN
t
DSUtDHD
Figure 3. SPI Master Mode Timing—PHASE Mode = 0
LSBBITS[6:1]MSB
7474-003
Rev. 0 | Page 11 of 132
ADuC7036
www.BDTIC.com/ADI
Table 4. SPI Slave Mode Timing—PHASE Mode = 1
Parameter Description Min Typ Max Unit
to SCLK edge
tSS
tSL SCLK low pulse width
tSH SCLK high pulse width
t
Data output valid after SCLK edge
DAV
t
Data input setup time before SCLK edge 0 ns
DSU
t
Data input hold time after SCLK edge
DHD
SS
1
1
(SPIDIV + 1) × t
2
2
½ t
(SPIDIV + 1) × t
(3 × t
4 × t
ns
UCLK
tDF Data output fall time 3.5 ns
tDR Data output rise time 3.5 ns
tSR SCLK rise time 3.5 ns
tSF SCLK fall time 3.5 ns
t
SFS
1
t
depends on the clock divider (CD) bits in POWCON MMR. t
HCLK
2
t
= 48.8 ns. It corresponds to the 20.48 MHz internal clock from the PLL before the clock divider.
UCLK
high after SCLK edge
SS
HCLK
= t
UCLK
½ t
/2CD.
SS
ns
SL
ns
HCLK
ns
HCLK
) + (2 × t
UCLK
ns
SL
) ns
HCLK
SCLK
(POLARIT Y = 0)
SCLK
(POLARIT Y = 1)
MISO
MOSI
t
SS
t
SH
t
DAV
t
DSUtDHD
t
SL
t
DF
MSB IN BITS[6:1] LSB IN
t
DR
t
SR
t
SFS
t
SF
LSBBITS[ 6:1]MSB
07474-004
Figure 4. SPI Slave Mode Timing—PHASE Mode = 1
Rev. 0 | Page 12 of 132
ADuC7036
www.BDTIC.com/ADI
Table 5. SPI Slave Mode Timing (PHASE Mode = 0)
Parameter Description Min Typ Max Unit
to SCLK edge
tSS
tSL SCLK low pulse width
tSH SCLK high pulse width
t
Data output valid after SCLK edge
DAV
t
Data input setup time before SCLK edge 0 ns
DSU
t
Data input hold time after SCLK edge
DHD
SS
1
1
(SPIDIV + 1) × t
2
2
½ t
(SPIDIV + 1) × t
(3 × t
4 × t
ns
UCLK
tDF Data output fall time 3.5 ns
tDR Data output rise time 3.5 ns
tSR SCLK rise time 3.5 ns
tSF SCLK fall time 3.5 ns
t
DOCS
t
SFS
1
t
depends on the clock divider (CD) bits in POWCON MMR. t
HCLK
2
t
= 48.8 ns. It corresponds to the 20.48 MHz internal clock from the PLL before the clock divider.
UCLK
Data output valid after SS
high after SCLK edge
SS
edge
2
(3 × t
½ t
= t
UCLK
/2CD.
HCLK
SS
t
t
DOCS
SS
t
SH
t
DF
t
DAV
t
SL
t
DR
SCLK
(POLARITY = 0)
SCLK
(POLARITY = 1)
ns
SL
ns
HCLK
ns
HCLK
) + (2 × t
UCLK
) + (2 × t
UCLK
ns
SL
t
SFS
t
SR
t
SF
) ns
HCLK
) ns
HCLK
MISO
MOSI
MSB IN BITS[6:1] L SB IN
t
DSUtDHD
Figure 5. SPI Slave Mode Timing—PHASE Mode = 0
Rev. 0 | Page 13 of 132
LSBBITS[6:1]MSB
07474-005
ADuC7036
www.BDTIC.com/ADI
LIN Timing Specifications
TRANSMIT
INPUT TO
TRANSMITTING
NODE
V
(TRANSCEIVER SUPPLY
OF TRANSMIT TING NODE)
SUP
RxD
(OUTP UT OF RE CEIVI NG NODE 1)
RECESSIVE
DOMINANT
TH
REC (MAX)
TH
DOM (MAX)
TH
REC (MIN)
TH
DOM (MI N)
t
BIT
t
LIN_DO M (MAX)
t
LIN_DO M (MI N)
t
RX_PDF
t
BIT
t
LIN_REC ( MIN)
t
LIN_REC ( MAX)
t
RX_PDR
t
BIT
THRESHOLDS OF
RECEIVING NO DE 1
THRESHOLDS OF
RECEIVING NO DE 2
LIN
BUS
(OUTPUT O F RECEIVI NG NODE 2)
RxD
t
RX_PDR
Figure 6. LIN 2.0 Timing Specification
t
RX_PDF
07474-006
Rev. 0 | Page 14 of 132
ADuC7036
www.BDTIC.com/ADI
ABSOLUTE MAXIMUM RATINGS
TA = −40°C to +115°C, unless otherwise noted.
Table 6. Stresses above those listed under Absolute Maximum Ratings
Parameter Rating
AGND to DGND to VSS to IO_VSS −0.3 V to +0.3 V
VBAT to AGND −22 V to +40 V
VDD to VSS −0.3 V to +33 V
VDD to VSS for 1 sec −0.3 V to +40 V
LIN to IO_VSS −16 V to +40 V
STI and WU to IO_VSS −3 V to +33 V
Wake-up Continuous Current 50 mA
High Voltage I/O Pins Short-Circuit
Current
Digital I/O Voltage to DGND −0.3 V to REG_DVDD + 0.3 V
VREF to AGND −0.3 V to REG_AVDD + 0.3 V
ADC Inputs to AGND −0.3 V to REG_AVDD + 0.3 V
ESD Rating
IEC 1000-4-2 for all Pins 1 kV
IEC 61000-4-2 for LIN and
VBAT pins
Storage Temperature 125°C
Junction Temperature
Transient 150°C
Continuous 130°C
Lead Temperature
Soldering Reflow (15 sec) 260°C
100 mA
±5 kV
may cause permanent damage to the device. This is a stress
rating only; functional operation of the device at these or any
other conditions above those indicated in the operational
section of this specification is not implied. Exposure to absolute
maximum rating conditions for extended periods may affect
device reliability.
ESD CAUTION
Rev. 0 | Page 15 of 132
ADuC7036
D
www.BDTIC.com/ADI
PIN CONFIGURATION AND FUNCTION DESCRIPTIONS
LIN/BS
IO_VSS
STINCVSSNCVDDWUNCNCNC
4847464544434241403938
XTAL2
37
RESET
TCK
TDI
DGND
NC
TDO
NTRST
TMS
1
2
3
4
5
6
7
8
9
10
11
12
GPIO_5/IRQ1/RxD
GPIO_6/ TxD
GPIO_7/IRQ4
GPIO_8/IRQ5
NOTES
1. NC = NO CONNECT.
2. THE EXPOSED PAD SHOULD BE CONNECTED TO DGND.
PIN 1
INDICATOR
ADuC7036
TOP VIEW
(Not to Scale)
13141516171819
NC
VBAT
NC
VREF
VTEMP
GND_SW
2021222324
IIN–
IIN+
AGND
NC
AGND
REG_AVDD
Figure 7. Pin Configuration
Table 7. Pin Function Descriptions
Pin No. Mnemonic Type1Description
1
RESET
I
Reset Input Pin. Active low. This pin has an internal, weak pull-up resistor to REG_DVDD and
should be left unconnected when not in use. For added security and robustness, it is
recommended that this pin be strapped via a resistor to REG_DVDD.
2 GPIO_5/IRQ1/RxD I/O
General-Purpose Digital IO 5/External Interrupt Request 1/Receive Data for UART Serial Port. By
default and after a power-on reset, this pin configures as an input. The pin has an internal, weak
pull-up resistor and should be left unconnected when not in use.
3 GPIO_6/TxD I/O
General-Purpose Digital IO 6/Transmit Data for UART Serial Port. By default and after a power-on
reset, this pin configures as an input. The pin has an internal, weak pull-up resistor and should
be left unconnected when not in use.
4 GPIO_7/IRQ4 I/O
General-Purpose Digital IO 7/External Interrupt Request 4. By default and after a power-on reset,
this pin configures as an input. The pin has an internal, weak pull-up resistor and should be left
unconnected when not in use.
5 GPIO_8/IRQ5 I/O
General-Purpose Digital IO 8/External Interrupt Request 5. By default and after a power-on reset,
this pin configures as an input. The pin has an internal, weak pull-up resistor and should be left
unconnected when not in use.
6 TCK I
JTAG Test Clock. This clock input pin is one of the standard 5-pin JTAG debug ports on the part.
TCK is an input pin only and has an internal, weak pull-up resistor. This pin is left unconnected
when not in use.
7 TDI I
JTAG Test Data Input. This data input pin is one of the standard 5-pin JTAG debug ports on the
part. TDI is an input pin only and has an internal, weak pull-up resistor. This pin can be left
unconnected when not in use.
8, 34, 35 DGND S Ground Reference for On-Chip Digital Circuits.
9, 16, 23,
32, 38 to
NC
No Connect. These pins are not internally connected and are reserved for possible future use.
Therefore, do not externally connect these pins. These pins can be grounded, if required.
40, 43, 45
17, 25, 26 NC
No Connect. These pins are internally connected and are reserved for possible future use.
Therefore, do not externally connect these pins. These pins can be grounded, if required.
10 TDO O
JTAG Test Data Output. This data output pin is one of the standard 5-pin JTAG debug ports on
the part. TDO is an output pin only. At power-on, this output is disabled and pulled high via an
internal, weak pull-up resistor. This pin is left unconnected when not in use.
XTAL136
35
DGND
34
DGND
33
REG_DVDD
32
NC
31
GPIO_4/ ECLK
30
GPIO_3/ MOSI
29
GPIO_2/ MISO
28
GPIO_1/ SCLK
27
GPIO_0/IRQ0/SS
26
NC
25
NC
07474-007
Rev. 0 | Page 16 of 132
ADuC7036
www.BDTIC.com/ADI
Pin No. Mnemonic Type1Description
11 NTRST I
12 TMS I
13 VBAT I Battery Voltage Input to Resistor Divider.
14 VREF I
15 GND_SW I
18 VTEMP I External Pin for NTC/PTC Temperature Measurement.
19 IIN+ I Positive Differential Input for Current Channel.
20 IIN− I Negative Differential Input for Current Channel.
21, 22 AGND S Ground Reference for On-Chip Precision Analog Circuits.
24 REG_AVDD S Nominal 2.6 V Output from On-Chip Regulator.
27
28 GPIO_1/SCLK I/O
29 GPIO_2/MISO I/O
30 GPIO_3/MOSI I/O
31 GPIO_4/ECLK I/O
33 REG_DVDD S Nominal 2.6 V Output from the On-Chip Regulator.
36 XTAL1 O Crystal Oscillator Output. If an external crystal is not used, this pin is left unconnected.
37 XTAL2 I
41 WU I/O
42 VDD S Battery Power Supply to On-Chip Regulator.
44 VSS S Ground Reference. This is the ground reference for the internal voltage regulators.
46 STI I/O
47 IO_VSS S Ground Reference for High Voltage I/O Pins.
48 LIN/BSD I/O Local Interconnect Network IO/Bit Serial Device IO. This is a high voltage pin.
EPAD Exposed pad The exposed pad should be connected to DGND.
1
I = input, O = output, S = supply.
GPIO_0/IRQ0/SS
I/O
JTAG Test Reset. This reset input pin is one of the standard 5-pin JTAG debug ports on the part.
NTRST is an input pin only and has an internal, weak pull-down resistor. This pin remains
unconnected when not in use. NTRST is also monitored by the on-chip kernel to enable LIN
boot load mode.
JTAG Test Mode Select. This mode select input pin is one of the standard 5-pin JTAG debug ports
on the part. TMS is an input pin only and has an internal, weak pull-up resistor. This pin is left
unconnected when not in use.
External Reference Input Terminal. When this input is not used, connect it directly to the AGND
system ground. It can also be left unconnected.
Switch to Internal Analog Ground Reference. This pin is the negative input for the external
temperature channel and external reference. When this input is not used, connect it directly to
the AGND system ground.
General-Purpose Digital IO 0/External Interrupt Request 0/ slave select input for SPI Interface. By
default and after power-on reset, this pin is configured as an input. The pin has an internal, weak
pull-up resistor and should be left unconnected when not in use.
General-Purpose Digital IO 1/Serial Clock Input for SPI Interface. By default and after a power-on
reset, this pin is configured as an input. The pin has an internal, weak pull-up resistor and should
be left unconnected when not in use.
General-Purpose Digital IO 2/Master Input, Slave Output for SPI Interface. By default and after a
power-on reset, this pin is configured as an input. The pin has an internal, weak pull-up resistor
and should be left unconnected when not in use.
General-Purpose Digital IO 3/Master Output, Slave Input for SPI Interface. By default and after a
power-on reset, this pin is configured as an input. The pin has an internal, weak pull-up resistor
and should be left unconnected when not in use.
General-Purpose Digital IO 4/2.56 MHz clock Output. By default and after a power-on reset, this
pin is configured as an input. The pin has an internal, weak pull-up resistor and should be left
unconnected when not in use.
Crystal Oscillator Input. If an external crystal is not used, connect this pin to the DGND system
ground.
High Voltage Wake-Up Pin. This high voltage I/O pin has an internal, 10 kΩ pull-down resistor
and a high-side driver to VDD. If this pin is not being used, it should not be connected externally.
High Voltage Serial Test Interface Output Pin. If this pin is not used, externally connect it to the
IO_VSS ground reference.
Rev. 0 | Page 17 of 132
ADuC7036
www.BDTIC.com/ADI
TYPICAL PERFORMANCE CHARACTERISTICS
0
–0.5
VDD = 4V
–1.0
0
–0.5
–1.0
CORE OF F
–1.5
–2.0
OFFSET (µV)
–2.5
–3.0
–3.5
–50 0 50 100
VDD = 18V
TEMPERATURE (°C)
Figure 8. ADC Current Channel Offset vs. Temperature, 10 MHz MCU
0
–0.5
–1.0
–1.5
–2.0
OFFSET (µV)
–2.5
–3.0
–3.5
0510 2015
–40°C
+25°C
+115°C
VDD (V)
Figure 9. ADC Current Channel Offset vs. VDD, 10 MHz MCU
–1.5
–2.0
OFFSET (µV)
–2.5
–3.0
–3.5
3 4 5 6 7 8 9 10111213141516171819
07474-008
VDD (V)
CD = 1
CD = 0
07474-010
Figure 10. ADC Current Channel Offset vs. Supply @ 25°C
07474-009
Rev. 0 | Page 18 of 132
ADuC7036
www.BDTIC.com/ADI
TERMINOLOGY
Conversion Rate
The conversion rate specifies the rate at which an output result
is available from the ADC after the ADC has settled.
The Σ- conversion techniques used on this part mean that
while the ADC front-end signal is oversampled at a relatively
high sample rate, a subsequent digital filter is used to decimate
the output, providing a valid 16-bit data conversion result for
output rates from 1 Hz to 8 kHz.
Note that when software switches from one input to another on
the same ADC, the digital filter must first be cleared and then
allowed to average a new result. Depending on the configuration
of the ADC and the type of filter, this may require multiple
conversion cycles.
Integral Nonlinearity (INL)
INL is the maximum deviation of any code from a straight line
passing through the endpoints of the transfer function. The endpoints of the transfer function are zero scale, a point ½ LSB
below the first code transition, and full scale, a point ½ LSB
above the last code transition (111 ... 110 to 111 ... 111).
The error is expressed as a percentage of full scale.
No Missing Codes
No missing codes is a measure of the differential nonlinearity
of the ADC. The error is expressed in bits (as 2
no missing codes) and specifies the number of codes (ADC
results) that are guaranteed to occur through the full ADC
input range.
Offset Error
Offset error is the deviation of the first code transition ADC
input voltage from the ideal first code transition.
N
bits, where N is
Offset Error Drift
Offset error drift is the variation in absolute offset error with
respect to temperature. This error is expressed as LSBs per
degrees Celsius.
Gain Error
Gain error is a measure of the span error of the ADC. It is a
measure of the difference between the measured and the ideal
span between any two points in the transfer function.
Output Noise
The output noise is specified as the standard deviation (that is,
1 × Σ) of the distribution of ADC output codes that are collected
when the ADC input voltage is at a dc voltage. It is expressed
as µV rms. The output, or rms noise, can be used to calculate
the effective resolution of the ADC as defined by the following
equation:
Effective Resolution = log
where Effective Resolution is expressed in bits.
The peak-to-peak noise is defined as the deviation of codes that
fall within 6.6 × Σ of the distribution of ADC output codes that
are collected when the ADC input voltage is at dc. The peak-topeak noise is therefore calculated as 6.6 times the rms noise.
The peak-to-peak noise can be used to calculate the ADC
(noise-free code) resolution for which there is no code flicker
within a 6.6 × Σ limit as defined by the following equation:
Noise-Free Code Resolution = log
Peak Noise)
where Noise-Free Code Resolution is expressed in bits.
(Full-Scale Range/RMS Noise)
2
(Full-Scale Range/Peak-to-
2
Rev. 0 | Page 19 of 132
ADuC7036
www.BDTIC.com/ADI
THEORY OF OPERATION
The ADuC7036 is a complete system solution for battery monitoring in 12 V automotive applications. These devices integrate
all of the required features to precisely and intelligently monitor,
process, and diagnose 12 V battery parameters, including battery
current, voltage, and temperature, over a wide range of operating
conditions.
Minimizing external system components, the device is powered
directly from the 12 V battery. An on-chip, low dropout regulator generates the supply voltage for three integrated, 16-bit, Σ-
ADCs. The ADCs precisely measure battery current, voltage,
and temperature to characterize the state of health and charge
of the car battery.
A Flash/EE memory-based ARM7™ microcontroller (MCU) is
also integrated on chip. It is used to both preprocess the acquired
battery variables and to manage communications from the
ADuC7036 to the main electronic control unit (ECU) via a local
interconnect network (LIN) interface that is integrated on chip.
Both the MCU and the ADC subsystem can be individually
configured to operate in normal or flexible power saving modes
of operation.
In its normal operating mode, the MCU is clocked indirectly
from an on-chip oscillator via the phase-locked loop (PLL) at
a maximum clock rate of 20.48 MHz. In its power saving operating modes, the MCU can be totally powered down, waking
up only in response to an ADC conversion result ready event, a
digital comparator event, a wake-up timer event, a POR event,
or an external serial communication event.
The ADC can be configured to operate in a normal (full power)
mode of operation, interrupting the MCU after various sample
conversion events. The current channel features two low power
modes—low power and low power plus—generating conversion
results to a lower performance specification.
On-chip factory firmware supports in-circuit Flash/EE reprogramming via the LIN or JTAG serial interface ports, and
nonintrusive emulation is also supported via the JTAG interface.
These features are incorporated into a low cost QuickStart™
development system supporting the ADuC7036.
The ADuC7036 operates directly from the 12 V battery supply
and is fully specified over a temperature range of −40°C to
+115°C. The ADuC7036 is functional, but with degraded
performance, at temperatures from 115°C to 125°C.
OVERVIEW OF THE ARM7TDMI CORE
The ARM7 core is a 32-bit, reduced instruction set computer
(RISC), developed by ARM Ltd. The ARM7TDMI® is a
von Neumann-based architecture, meaning that it uses a single
32-bit bus for instruction and data. The length of the data can be 8,
16, or 32 bits, and the length of the instruction word is either 16 bits
or 32 bits, depending on the mode in which the core is operating.
The ARM7TDMI is an ARM7 core with four additional features,
as listed in Tabl e 8.
Table 8. ARM7TDMI
Feature Description
T Support for the Thumb® (16-bit) instruction set
D Support for debug
M Enhanced multiplier
I
Includes the EmbeddedICE™ module to support
embedded system debugging
Thumb Mode (T)
An ARM instruction is 32 bits long. The ARM7TDMI
processor supports a second instruction set compressed into
16 bits, the Thumb instruction set. Faster code execution from
16-bit memory and greater code density can be achieved by
using the Thumb instruction set, making the ARM7TDMI core
particularly well-suited for embedded applications.
However, the Thumb mode has three limitations.
• Relative to ARM, the Thumb code usually requires more
instructions to perform a task. Therefore, ARM code is
best for maximizing the performance of time-critical code
in most applications.
• The Thumb instruction set does not include some
instructions that are needed for exception handling, so
ARM code may be required for exception handling.
• When an interrupt occurs, the core vectors to the interrupt
location in memory and executes the code present at that
address. The first command is required to be in ARM code.
Multiplier (M)
The ARM7TDMI instruction set includes an enhanced
multiplier with four extra instructions to perform 32-bit by
32-bit multiplication with a 64-bit result, or 32-bit by 32-bit
multiplication-accumulation (MAC) with a 64-bit result.
EmbeddedICE (I)
The EmbeddedICE module provides integrated on-chip debug
support for the ARM7TDMI. The EmbeddedICE module
contains the breakpoint and watchpoint registers that allow
nonintrusive user code debugging. These registers are controlled through the JTAG test port. When a breakpoint or
watchpoint is encountered, the processor halts and enters the
debug state. Once in a debug state, the processor registers can
be interrogated, as can the Flash/EE, SRAM, and memory
mapped registers.
Rev. 0 | Page 20 of 132
ADuC7036
www.BDTIC.com/ADI
ARM7 Exceptions
The ARM7 supports five types of exceptions, with a privileged
processing mode associated with each type. The five types of
exceptions are as follows:
• Normal interrupt or IRQ. This is provided to service
general-purpose interrupt handling of internal and
external events.
• Fast interrupt or FIQ. This is provided to service data
transfer or a communication channel with low latency.
FIQ has priority over IRQ.
• Memory abort (prefetch and data).
• Attempted execution of an undefined instruction.
• Software interrupt (SWI) instruction that can be used to
make a call to an operating system.
Typically, the programmer defines interrupts as IRQ, but for
higher priority interrupts, the programmer can define interrupts
as the FIQ type.
The priority of these exceptions and vector address are listed in
Tabl e 9.
Table 9. Exception Priorities and Vector Addresses
Priority Exception Address
1 Hardware reset 0x00
2 Memory abort (data) 0x10
3 FIQ 0x1C
4 IRQ 0x18
5 Memory abort (prefetch) 0x0C
6 Software interrupt1 0x08
6 Undefined instruction1 0x04
1
A software interrupt and an undefined instruction exception have the same
priority and are mutually exclusive.
The list of exceptions in Tab le 9 are located from 0x00 to 0x1C,
with a reserved location at 0x14. This location is required to be
written with either 0x27011970 or the checksum of Page 0,
excluding Location 0x14. If this is not done, user code does not
execute and LIN download mode is entered.
ARM Registers
The ARM7TDMI has 16 standard registers. R0 to R12 are used
for data manipulation, R13 is the stack pointer, R14 is the link
register, and R15 is the program counter that indicates the
instruction currently being executed. The link register contains
the address from which the user has branched (if the branch
and link command was used) or the command during which an
exception occurred.
The stack pointer contains the current location of the stack. As
a general rule, on an ARM7TDMI, the stack starts at the top of
the available RAM area and descends using the area as required.
A separate stack is defined for each of the exceptions. The size of
each stack is user configurable and is dependent on the target
application. On the ADuC7036, the stack begins at 0x00040FFC
and descends. When programming using high level languages,
such as C, it is necessary to ensure that the stack does not overflow.
This is dependent on the performance of the compiler that is used.
When an exception occurs, some of the standard registers are
replaced with registers specific to the exception mode. All
exception modes have replacement banked registers for the
stack pointer (R13) and the link register (R14) as represented
in Figure 11. The FIQ mode has more registers (R8 to R12)
supporting faster interrupt processing. With the increased
number of noncritical registers, the interrupt can be processed
without the need to save or restore these registers, thereby
reducing the response time of the interrupt handling process.
More information relative to the programmer’s model and the
ARM7TDMI core architecture can be found in ARM7TDMI
technical and ARM architecture manuals available directly from
ARM Ltd.
R0 USABLE IN USER MODE
R10
R11
R12
R13
R14
R15 (PC)
CPSR
USER MODE
R1
R2
R3
R4
R5
R6
R7
R8
R9
R8_FIQ
R9_FIQ
R10_FIQ
R11_FIQ
R12_FIQ
R13_FIQ
R14_FIQ
SPSR_FIQ
Figure 11. Register Organization
FIQ
MODE
R13_SVC
R14_SVC
SPSR_SVC
SVC
MODE
SPSR_ABT
R13_ABT
R14_ABT
ABORT
MODE
SYSTEM MODES ONLY
IRQ
R13_UND
R14_UND
SPSR_UND
UNDEFINED
MODE
R13_IRQ
R14_IRQ
SPSR_IRQ
MODE
Interrupt Latency
The worst-case latency for an FIQ consists of the longest possible
time for the request to pass through the synchronizer, for the
longest instruction to complete (the longest instruction is an LDM)
and load all the registers including the PC, and for the data abort
entry and the FIQ entry to complete. At the end of this time, the
ARM7TDMI executes the instruction at Address 0x1C (the FIQ
interrupt vector address). The maximum FIQ latency is 50 processor cycles, or just over 2.44 s in a system using a continuous
20.48 MHz processor clock.
The maximum IRQ latency calculation is similar but must allow
for the fact that FIQ has higher priority and may delay entry into
the IRQ handling routine for an arbitrary length of time. This
time can be reduced to 42 cycles if the LDM command is not
used; some compilers have an option to compile without using
this command. Another option is to run the part in Thumb
mode, which reduces the time to 22 cycles.
07474-011
Rev. 0 | Page 21 of 132
ADuC7036
www.BDTIC.com/ADI
The minimum latency for FIQ or IRQ interrupts is five cycles.
This consists of the shortest time the request can take through
the synchronizer plus the time to enter the exception mode.
Note that the ARM7TDMI initially (first instruction) runs in
ARM (32-bit) mode when an exception occurs. The user can
immediately switch from ARM mode to Thumb mode if
required, for example, when executing interrupt service routines.
MEMORY ORGANIZATION
The ARM7 MCU core, which has a von Neumann-based
architecture, sees memory as a linear array of 2
As shown in Figure 13, the ADuC7036 maps this into four
distinct user areas, namely, a memory area that can be remapped,
an SRAM area, a Flash/EE area, and a memory mapped register
(MMR) area.
• The first 94 kB of this memory space is used as an area into
which the on-chip Flash/EE or SRAM can be remapped.
• The ADuC7036 features a second 4 kB area at the top of
the memory map used to locate the MMRs, through which
all on-chip peripherals are configured and monitored.
• The ADuC7036 features an SRAM size of 6 kB.
• The ADuC7036 features 96 kB of on-chip Flash/EE memory,
94 kB of which are available to the user and 2 kB of which
are reserved for the on-chip kernel.
Any access, either a read or a write, to an area not defined in the
memory map results in a data abort exception.
Memory Format
The ADuC7036 memory organization is configured in little
endian format: the least significant byte is located in the lowest
byte address; the most significant byte, in the highest byte address.
BYTE 0
.
.
.
8
4
0
BIT 0
BIT 31
BYTE 3
.
.
.
B
7
3
BYTE 1
BYTE 2
Figure 12. Little Endian Format
.
.
.
A
6
2
32 BITS
.
.
.
9
5
1
32
byte locations.
0xFFFFFFFF
0x00000004
0x00000000
7474-012
0xFFFF0000
0x00080000
0x00040000
0x00000000
SRAM
The ADuC7036 features 6 kB of SRAM, organized as
1536 × 32 bits, that is, 1536 words located at 0x00040000.
The RAM space can be used as data memory and also as a volatile
program space.
ARM code can run directly from SRAM at full clock speed
because the SRAM array is configured as a 32-bit-wide memory
array. SRAM is readable/writeable in 8-, 16-, and 32-bit segments.
Remap
The ARM exception vectors are situated at the bottom of the
memory array, from Address 0x00000000 to Address 0x00000020.
By default, after a reset, the Flash/EE memory is logically
mapped to Address 0x00000000.
It is possible to logically remap the SRAM to Address 0x00000000.
This is accomplished by setting Bit 0 of the SYSMAP0 MMR
located at 0xFFFF0220. To revert Flash/EE to 0x00000000, Bit 0
of SYSMAP0 is cleared.
It is sometimes desirable to remap RAM to 0x00000000 to optimize
the interrupt latency of the ADuC7036 because code can run in full
32-bit ARM mode and at maximum core speed. It should be noted
that when an exception occurs, the core defaults to ARM mode.
0xFFFF0FFF
0x00097FFF
RESERVED
MMRs
RESERVED
FLASH/EE
RESERVED
0x00417FF
0x0017FFF
SRAM
RESERVED
REMAPPABLE MEMORY SPACE
(FLASH/EE OR SRAM)
Figure 13. Memory Map
7474-013
Rev. 0 | Page 22 of 132
ADuC7036
www.BDTIC.com/ADI
Remap Operation
When a reset occurs on the ADuC7036, execution starts
automatically in the factory-programmed internal configuration
code. This so-called kernel is hidden and cannot be accessed by
user code. If the ADuC7036 is in normal mode, it executes the
power-on configuration routine of the kernel and then jumps to
the reset vector, Address 0x00000000, to execute the user’s reset
exception routine. Because the Flash/EE is mirrored at the bottom
of the memory array at reset, the reset routine must always be
written in Flash/EE.
The remap command must be executed from the absolute
Flash/EE address and not from the mirrored, remapped
segment of memory, which may be replaced by SRAM. If a
remap operation is executed while operating code from the
mirrored location, prefetch/data aborts may occur or the user
may observe abnormal program operation.
Any kind of reset remaps the Flash/EE memory to the bottom
of the memory array.
SYSMAP0 Register
Name: SYSMAP0
Address: 0xFFFF0220
Default Value: Updated by the kernel
Access: Read/write access
Function: This 8-bit register allows user code to remap either
RAM or Flash/EE space into the bottom of the ARM memory
space, starting at Address 0x00000000.
Table 10. SYSMAP0 MMR Bit Designations
Bit Description
7 to 1
0 Remap bit.
Set by the user to remap the SRAM to 0x00000000.
Reserved. These bits are reserved and should be written
as 0 by user code.
Cleared automatically after a reset to remap the
Flash/EE memory to 0x00000000.
Rev. 0 | Page 23 of 132
ADuC7036
www.BDTIC.com/ADI
RESET
There are four kinds of resets: external reset, power-on reset,
watchdog reset, and software reset. The RSTSTA register indicates
the source of the last reset and can be written to by user code to
initiate a software reset event. The bits in this register can be
cleared to 0 by writing to the RSTCLR MMR at 0xFFFF0234.
The bit designations in RSTCLR mirror those of RSTSTA.
These registers can be used during a reset exception service
routine to identify the source of the reset. The implications of
all four kinds of reset events are shown in Tabl e 12 .
RSTSTA Register
Name: RSTSTA
Address: 0xFFFF0230
Default Value: Varies according to type of reset (see Table 1 1)
Access: Read/write access
Function: This 8-bit register indicates the source of the last reset
event and can be written to by user code to initiate a software reset.
RSTCLR Register
Name: RSTCLR
Address: 0xFFFF0234
Access: Write only
Function: This 8-bit, write only register clears the corresponding
bit in RSTSTA.
Table 11. RSTSTA/RSTCLR MMR Bit Designations
Bit Description
7 to 4 Not used. These bits are not used and always read as 0.
3 External reset.
Set automatically to 1 when an external reset occurs.
Cleared by setting the corresponding bit in RSTCLR.
2 Software reset.
Set to 1 by user code to generate a sofware reset.
Cleared by setting the corresponding bit in RSTCLR.1
1 Watchdog timeout.
Set automatically to 1 when a watchdog timeout occurs.
Cleared by setting the corresponding bit in RSTCLR.
0 Power-on reset.
Set automatically when a power-on reset occurs.
Cleared by setting the corresponding bit in RSTCLR.
1
If the software reset bit in RSTSTA is set, any write to RSTCLR that does not
clear this bit generates a software reset.
Table 12. Device Reset Implications
Impact
Reset
External Pins
to Default
Reset
POR Ye s Ye s Yes Yes Ye s Yes Yes/No2RSTSTA[0] = 1
Watchdog Yes Yes Yes Yes Yes No Yes RSTSTA[1] = 1
Software Yes Yes Yes Yes Yes No Yes RSTSTA[2] = 1
External Pin Yes Yes Yes Yes Yes No Yes RSTSTA[3] = 1
1
RAM is not valid in the case of a reset following a LIN download.
2
The impact on RAM is dependent on the HVMON[3] contents if LVF is enabled. When LVF is enabled using HVCFG0[2], RAM has not been corrupted by the POR reset
mechanism if the LVF status bit, HVMON[3], is 1. See the Low Voltage Flag (LVF) section for more information.
State
Execute
Kernel
Reset All
External MMRs
(Excluding RSTSTA)
Reset All HV
Indirect
Registers
Reset
Peripherals
Reset
Watc hdog
Timer
Valid
RAM
RSTSTA Status
(After a Reset
1
Event)
Rev. 0 | Page 24 of 132
ADuC7036
www.BDTIC.com/ADI
FLASH/EE MEMORY
The ADuC7036 incorporates Flash/EE memory technology on
chip to provide the user with nonvolatile, in-circuit reprogrammable memory space.
Like EEPROM, flash memory can be programmed in-system
at a byte level, although it must first be erased, with the erasure
performed in page blocks. Therefore, flash memory is often and
more correctly referred to as Flash/EE memory.
Overall, Flash/EE memory represents a step closer to the ideal
memory device that includes nonvolatility, in-circuit programmability, high density, and low cost. Incorporated within the
ADuC7036, Flash/EE memory technology allows the user to
update program code space in-circuit, without the need to
replace one-time programmable (OTP) devices at remote
operating nodes.
The Flash/EE memory is located at Address 0x80000. Upon
a hard reset, the Flash/EE memory maps to Address 0x00000000.
The factory-set default contents of all Flash/EE memory locations
is 0xFF. Flash/EE can be read in 8-, 16-, and 32-bit segments
and written in 16-bit segments. The Flash/EE is rated for 10,000
endurance cycles. This rating is based on the number of times
that each byte is cycled, that is, erased and programmed. Implementing a redundancy scheme in the software ensures that none
of the flash locations reach 10,000 endurance cycles.
The user can also write data variables to the Flash/EE memory
during run-time code execution, for example, for storing
diagnostic battery parameter data.
The entire Flash/EE is available to the user as code and nonvolatile data memory. There is no distinction between data
and program space during ARM code processing. The real
width of the Flash/EE memory is 16 bits, meaning that in
ARM mode (32-bit instruction), two accesses to the Flash/EE
are necessary for each instruction fetch. When operating at
speeds of less than 20.48 MHz, the Flash/EE memory controller
can transparently fetch the second 16-bit halfword (part of the
32-bit ARM operation code) within a single core clock period.
Therefore, for speeds less than 20.48 MHz (that is, CD > 0), it is
recommended to use ARM mode. For 20.48 MHz operation
(that is, CD = 0), it is recommended to operate in Thumb mode.
The page size of this Flash/EE memory is 512 bytes. Typically,
it takes the Flash/EE controller 20 ms to erase a page, regardless
of CD. Writing a 16-bit word at CD = 0, 1, 2, or 3 requires 50 s;
at CD = 4 or 5, 70 s; at CD = 6, 80 s; and at CD = 7, 105 s.
It is possible to write to a single 16-bit location only twice
between erasures; that is, it is possible to walk bytes, not bits.
If a location is written to more than twice, the contents of the
Flash/EE page may become corrupt.
PROGRAMMING FLASH/EE MEMORY IN-CIRCUIT
The Flash/EE memory can be programmed in-circuit, using a
serial download mode via the LIN interface or the integrated
JTAG port.
Rev. 0 | Page 25 of 132
Serial Downloading (In-Circuit Programming)
The ADuC7036 facilitates code download via the LIN pin.
JTAG Access
The ADuC7036 features an on-chip JTAG debug port to
facilitate code downloading and debugging.
ADuC7036 Flash/EE Memory
The total 96 kB of Flash/EE is organized as 47,000 × 16 bits. Of
this total, 94 kB is designated as user space, and 2 kB is reserved
for boot loader/kernel space.
FLASH/EE CONTROL INTERFACE
The access to and control of the Flash/EE memory on the
ADuC7036 are managed by an on-chip memory controller. The
controller manages the Flash/EE memory as two separate blocks
(Block 0 and Block 1).
Block 0 consists of the 32 kB of Flash/EE memory that is mapped
from Address 0x00090000 to Address 0x00097FFF, including the
2 kB kernel space that is reserved at the top of this block.
Block 1 consists of the 64 kB of Flash/EE memory that is mapped
from Address 0x00080000 to Address 0x0008FFFF.
It should be noted that the MCU core can continue to execute code
from one memory block while an active erase or program cycle
is being carried out on the other block. If a command operates on
the same block as the code currently executing, the core is halted
until the command is complete. This also applies to code execution.
User code, LIN, and JTAG programming use the Flash/EE
control interface, consisting of the following MMRs:
• FEExSTA (x = 0 or 1): Read only register. Reflects the
status of the Flash/EE control interface.
• FEExMOD (x = 0 or 1): Sets the operating mode of the
Flash/EE control interface.
• FEExCON (x = 0 or 1): 8-bit command register. The
commands are interpreted as described in Tabl e 13.
• FEExDAT (x = 0 or 1): 16-bit data register.
• FEExADR (x = 0 or 1): 16-bit address register.
• FEExSIG (x = 0 or 1): Holds the 24-bit code signature as
a result of the signature command being initiated.
• FEExHID (x = 0 or 1): Protection MMR. Controls read and
write protection of the Flash/EE memory code space. If
previously configured via the FEExPRO register, FEExHID
may require a software key to enable access.
• FEExPRO (x= 0 or 1): A buffer of the FEExHID register.
Stores the FEExHID value and is automatically downloaded to the FEExHID registers on subsequent reset and
power-on events.
Note that user software must ensure that the Flash/EE controller
completes any erase or write cycle before the PLL is powered
down. If the PLL is powered down before an erase or write cycle
is completed, the Flash/EE page or byte may be corrupted.
ADuC7036
www.BDTIC.com/ADI
The FEE0CON and FEE1CON Registers section to the FEE0MOD and FEE1MOD Registers section provide detailed descriptions of the
bit designations for each of the Flash/EE control MMRs.
FEE0CON and FEE1CON Registers
Name: FEE0CON and FEE1CON
Address: 0xFFFF0E08 and 0xFFFF0E88
Default Value: 0x07
Access: Read/write access
Function: These 8-bit registers are written by user code to control the operating modes of the Flash/EE memory controllers for Block 0
(32 kB) and Block 1 (64 kB).
Table 13. Command Codes in FEE0CON and FEE1CON
Code Command Description
1
0x002Reserved Reserved. This command should not be written by user code.
2
0x01
Single read Load FEExDAT with the 16-bit data indexed by FEExADR.
2
0x02
Single write Write FEExDAT at the address pointed by FEExADR. This operation takes 50 µs.
2
0x03
Erase write Erase the page indexed by FEExADR and write FEExDAT at the location pointed by FEExADR. This operation takes 20 ms.
2
0x04
Single verify
Compare the contents of the location pointed by FEExADR to the data in FEExDAT. The result of the comparison is
returned in FEExSTA, Bit 1 or Bit 0.
2
0x05
Single erase Erase the page indexed by FEExADR.
2
0x06
Mass erase
Erase Block 0 (32 kB) or Block 1 (64 kB) of user space. The 2 kB kernel is protected. This operation takes 1.2 sec. To
prevent accidental execution, a command sequence is required to execute this instruction (see the Command
Sequence for Executing a Mass Erase section).
0x07 Default command.
0x08 Reserved Reserved. This command should not be written by user code.
0x09 Reserved Reserved. This command should not be written by user code.
0x0A Reserved Reserved. This command should not be written by user code.
0x0B Signature FEE0CON: This command results in the generation of a 24-bit LFSR-based signature that is loaded into FEE0SIG.
If FEE0ADR is less than 0x97800, this command results in a 24-bit LFSR-based signature of the user code space from
the page specified in FEE0ADR upwards, including the kernel, security bits, and Flash/EE key.
If FEE0ADR is greater than 0x97800, the kernel and manufacturing data are signed. This operation takes 120 µs.
FEE1CON: This command results in the generation of a 24-bit LFSR-based signature, beginning at FEE1ADR and
ending at the end of the 63,500 block, that is loaded into FEE1SIG. The last page of this block is not included in the
sign generation.
0x0C Protect
This command can be run only once. The value of FEExPRO is saved and can be removed only with a mass erase
(0x06) or with the software protection key.
0x0D Reserved Reserved. This command should not be written by user code.
0x0E Reserved Reserved. This command should not be written by user code.
0x0F Ping No operation, interrupt generated.
1
The x represents 0 or 1, designating Flash/EE Block 0 or Block 1.
2
The FEE0CON register reads 0x07 immediately after the execution of this command.
Rev. 0 | Page 26 of 132
ADuC7036
www.BDTIC.com/ADI
Command Sequence for Executing a Mass Erase
Given the significance of the mass erase command, the following
specific code sequence must be executed to initiate this
operation:
1. Set Bit 3 in FEExMOD.
2. Write 0xFFC3 in FEExADR
3. Write 0x3CFF in FEExDAT
4. Run the mass erase command (Code 0x06) in FEExCON.
This sequence is illustrated by the following example:
Int a = FEExSTA; // Ensure FEExSTA is
cleared
FEExMOD = 0x08
FEExADR = 0xFFC3
FEExDAT = 0x3CFF
FEExCON = 0x06; // Mass erase command
while (FEExSTA & 0x04){} //Wait for
command to finish
It should be noted that to run the mass erase command via
FEE0CON, the write protection on the lower 64 kB must be
disabled.That is, FEE1HID/FEE1PRO are set to 0xFFFFFFFF.
This setting can be accomplished by first removing the protection or by erasing the lower 64 kB.
FEE0STA and FEE1STA Registers
Name: FEE0STA and FEE1STA
Address: 0xFFFF0E00 and 0xFFFF0E80
Default Value: 0x20
Access: Read only
Function: These 8-bit, read only registers can be read by user
code, and they reflect the current status of the Flash/EE
memory controllers.
Table 14. FEE0STA and FEE1STA MMR Bit Designations
Bit Description1
7 to 4 Not used. These bits are not used and always read as 0.
3 Flash/EE interrupt status bit.
2 Flash/EE controller busy.
Set automatically when the Flash/EE controller is busy.
Cleared automatically when the controller is not busy.
1 Command fail.
0 Command successful.
1
The x represents 0 or 1, designating Flash/EE Block 0 or Block 1.
Set automatically when an interrupt occurs, that is,
when a command is complete and the Flash/EE
interrupt enable bit in the FEExMOD register is set.
Cleared automatically when the FEExSTA register is read
by user code.
Set automatically when a command written to FEExCON
completes unsuccessfully.
Cleared automatically when the FEExSTA register is read
by user code.
Set automatically by the MCU when a command is
completed successfully.
Cleared automatically when the FEE0STA register is read
by user code.
FEE0ADR and FEE1ADR Registers
Name: FEE0ADR and FEE1ADR
Address: 0xFFFF0E10 and 0xFFFF0E90
Default Value: 0x0000 (FEE1ADR). For FEE0ADR, see the
System Identification FEE0ADR section.
Access: Read/write access
Function: These 16-bit registers dictate the address acted upon
when a Flash/EE command is executed via FEExCON.
Rev. 0 | Page 27 of 132
ADuC7036
www.BDTIC.com/ADI
FEE0DAT and FEE1DAT Registers
Name: FEE0DAT and FEE1DAT
Address: 0xFFFF0E0C and 0xFFFF0E8C
Default Value: 0x0000
Access: Read/write access
Function: This 16-bit register contains the data either read from
or to be written to the Flash/EE memory.
FEE0MOD and FEE1MOD Registers
Name: FEE0MOD and FEE1MOD
Address: 0xFFFF0E04 and 0xFFFF0E84
Default Value: 0x00
Access: Read/Write access
Function: These registers are written by user code to configure
the mode of operation of the Flash/EE memory controllers.
Table 15. FEE0MOD and FEE1MOD MMR Bit Designations
Bit Description
15 to 7 Not used. These bits are reserved for future functionality and should be written as 0 by user code.
6, 5 Flash/EE security lock bits. These bits must be written as [6:5] = 1,0 to complete the Flash/EE security protect sequence.
4 Flash/EE controller command complete interrupt enable.
Set to 1 by user code to enable the Flash/EE controller to generate an interrupt upon completion of a Flash/EE command.
Cleared to disable the generation of a Flash/EE interrupt upon completion of a Flash/EE command.
3 Flash/EE erase/write enable.
Set by user code to enable the Flash/EE erase and write access via FEExCON.
Cleared by user code to disable the Flash/EE erase and write access via FEExCON.
2 Reserved. Should be written as 0.
1 Flash/EE controller abort enable.
Set to 1 by user code to enable the Flash/EE controller abort functionality.
0 Reserved. Should be written as 0.
1
The x represents 0 or 1, designating Flash/EE Block 0 or Flash/EE Block 1.
1
Rev. 0 | Page 28 of 132
ADuC7036
www.BDTIC.com/ADI
FLASH/EE MEMORY SECURITY
The 94 kB of Flash/EE memory available to the user can be read
and write protected using the FFE0HID and FEE1HID registers.
In Block 0, the FEE0HID MMR protects the 30 kB. Bits[0:28] of
this register protect Page 0 to Page 57 from writing. Each bit
protects two pages, that is, 1 kB. Bits[29:30] protect Page 58 and
Page 59, respectively; that is, each bit write protects a single page
of 512 bytes. The MSB of this register (Bit 31) protects Block 0
from being read via JTAG.
The FEE0PRO register mirrors the bit definitions of the FEE0HID
MMR. The FEE0PRO MMR allows user code to lock the protecttion or security configuration of the Flash/EE memory so that
the protection configuration is automatically loaded on
subsequent power-on or reset events. This flexibility allows the
user to set and test protection settings temporarily using the
FEE0HID MMR and, subsequently, lock the required protection
configuration (using FEE0PRO) when shipping protection systems
into the field.
In Block 1 (64 kB), the FEE1HID MMR protects the 64 kB.
Bits[0:29] of this register protect Page 0 to Page 119 from writing.
Each bit protects four pages, that is, 2 kB. Bit 30 protects Page 120
to Page 127; that is, Bit 30 write protects eight pages of 512 bytes.
The MSB of this register (Bit 31) protects Flash/EE Block 1 from
being read via JTAG.
As with Block 0, the FEE1PRO register mirrors the bit
definitions of the FEE1HID MMR. The FEE1PRO MMR allows
user code to lock the protection or security configuration of the
Flash/EE memory so that the protection configuration is
automatically loaded on subsequent power-on or reset events.
There are three levels of protection: temporary protection,
keyed permanent protection, and permanent protection.
Temporary Protection
Temporary protection can be set and removed by writing
directly into the FEExHID MMR. This register is volatile and,
therefore, protection is in place only while the part remains
powered on. This protection is not reloaded after a power cycle.
Keyed Permanent Protection
Keyed permanent protection can be set via FEExPRO, which is
used to lock the protection configuration. The software key
used at the start of the required FEExPRO write sequence is
saved once and must be used for any subsequent access of the
FEExHID or FEExPRO MMRs. A mass erase sets the key back
to 0xFFFF but also erases the entire user code space.
Permanent Protection
Permanent protection can be set via FEExPRO, in a manner
similar to the way keyed permanent protection is set, with the
only difference being that the software key used is 0xDEADDEAD.
When the FEExPRO write sequence is saved, only a mass erase
sets the key back to 0xFFFFFFFF. The mass erase also erases the
entire user code space.
Sequence to Write the Key and Set Permanent Protection
1. Write FEExPRO corresponding to the pages to be protected.
2. Write the new (user-defined) 32-bit key in FEExADR,
Bits[31:16] and FEExDAT, Bits[15:0].
3. Write 1,0 in FEExMOD, Bits[6:5], and set FEExMOD, Bit 3.
4. Run the write key command (Code 0x0C) in FEExCON.
To remove or modify the protection, the same sequence can be
used with a modified value of FEExPRO.
The previous sequence for writing the key and setting permanent
protection is illustrated in the following example sequence,
which protects writing Page 4 and Page 5 of the Flash/EE.
Int a = FEExSTA; //Ensure FEExSTA is
cleared
FEExPRO =0 xFFFFFFFB; //Protect Page 4
and Page 5
FEExADR = 0x66BB; //32-bit key value
(Bits[31:16])
FEExDAT = 0xAA55; //32-bit key value
(Bits[15:0])
FEExMOD = 0x0048 // Lock security
sequence
FEExCON = 0x0C; // Write key command
while (FEExSTA & 0x04){} //Wait for
command to finish
Rev. 0 | Page 29 of 132
ADuC7036
www.BDTIC.com/ADI
Block 0, Flash/EE Memory Protection Registers
Name: FEE0HID and FEE0PRO
Address: 0xFFFF0E20 (for FEE0HID) and 0xFFFF0E1C (for FEE0PRO)
Default Value: 0xFFFFFFFF (for FEE0HID) and 0x00000000 (for FEE0PRO)
Access: Read/write access
Function: These registers are written by user code to configure the protection of the Flash/EE memory.
Table 16. FEE0HID and FEE0PRO MMR Bit Designations
Bit Description
31 Read protection bit.
Set by user code to allow reading the 32 kB Flash/EE block code via JTAG read access.
Cleared by user code to protect the 32 kB Flash/EE block code via JTAG read access.
30 Write protection bit.
Set by user code to allow writes to Page 59.
Cleared by user code to write protect Page 59.
29 Write protection bit.
Set by user code to allow writes to Page 58.
Cleared by user code to write protect Page 58.
28 to 0 Write protection bits.
1
The x represents 0 or 1, designating Flash/EE Block 0 or Block 1.
Set by user code to allow writes to Page 0 to Page 57 of the 30 kB Flash/EE code memory. Each bit write protects two pages, and
each page consists of 512 bytes.
Cleared by user code to write protect Page 0 to Page 57 of the 30 kB Flash/EE code memory. Each bit write protects two pages, and
each page consists of 512 bytes.
1
Block1, Flash/EE Memory Protection Registers
Name: FEE1HID and FEE1PRO
Address: 0xFFFF0EA0 (for FEE1HID) and 0xFFFF0E9C
(for FEE1PRO)
Default Value: 0xFFFFFFFF (for FEE1HID) and 0x00000000 (for FEE1PRO)
Access: Read/Write access
Function: These registers are written by user code to configure the protection of the Flash/EE memory.
Table 17. FEE1HID and FEE1PRO MMR Bit Designations
Bit Description
31 Read protection bit.
Set by user code to allow reading of the 64 kB Flash/EE block code via JTAG read access.
Cleared by user code to read protect the 64 kB Flash/EE block code via JTAG read access.
30 Write protection bit. Write protects eight pages. Each page consists of 512 bytes.
Set by user code to allow writes to Page 120 to Page 127 of the 64 kB Flash/EE code memory.
Cleared by user code to write protect Page 120 to Page 127 of the 64 kB Flash/EE code memory.
29 to 0 Write protection bits.
Set by user code to allow writes to Pages 0 to Page 119 of the 64 kB Flash/EE code memory. Each bit write protects four pages, and
each page consists of 512 bytes.
Cleared by user code to write protect Pages 0 to Page 119 of the 64 kB Flash/EE code memory. Each bit write protects two pages,
and each page consists of 512 bytes.
Rev. 0 | Page 30 of 132
Loading...