Infineon TLE986x User Manual

TLE986x BF-Step

BootROM User Manual

Rev. 1.5, 2020-09-25

TLE986x BF BootROM

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.1 Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

1.3 Abbreviations and special terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.1 Firmware architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.2 Program structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

3 Startup procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.1 Program structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.1.1 Test and initialization of RAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.1.2 NVM initialisation routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.1.3 NVM MapRAM initialisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.1.3.1 NVM MapRAM initialization at high prio reset . . . . . . . . . . . . . . . . . . 11

3.1.3.2 NVM MapRAM initialization at low prio reset . . . . . . . . . . . . . . . . . . . 12

3.1.4 Oscillator trimming and system clock selection . . . . . . . . . . . . . . . . . . 12

3.1.5 Analog module trimming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.1.6 User configuration data initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.1.7 Debug support mode entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.1.8 User mode and BSL mode entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.1.8.1 NAC definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.1.9 Node Address for Diagnostic (NAD) . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4 FastLIN and UART BSL Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.1 FastLIN and UART BSL protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.2 Phase I for UART BSL: Automatic serial synchronization to the host . . . . 20

4.2.1 General description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2.2 Calculation of BR_VALUE and PRE values . . . . . . . . . . . . . . . . . . . . . 22

4.3 Phase I for FastLIN BSL: FastLIN BSL entry sequence . . . . . . . . . . . . . . 23

4.4 Phase II: Serial communication protocol and the working modes . . . . . . . 23

4.4.1 Serial communication protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

4.4.1.1 Transfer block structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.4.1.2 Transfer block type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.4.1.3 Response codes to the host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.4.1.4 Block response delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

4.4.2 UART BSL Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

4.4.2.1 Header Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

4.4.2.2 Mode 0 - Code/Data download to RAM/100TP . . . . . . . . . . . . . . . . . 30

4.4.2.3 Mode 1 - Code Execution inside RAM . . . . . . . . . . . . . . . . . . . . . . . . 33

4.4.2.4 Mode 2 - Code/Data download to NVM . . . . . . . . . . . . . . . . . . . . . . . 33

4.4.2.5 Mode 3 - Code Execution inside NVM . . . . . . . . . . . . . . . . . . . . . . . . 38

4.4.2.6 Mode 4 - NVM Erase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

4.4.2.7 Mode 6 - NVM Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

User Manual 2 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

4.4.2.8 Mode A - NVM Readout, Chip ID, Checksum, FastLIN BSL entry command 41

4.4.3 16 bits inverted XOR checksum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

4.5 WDT1 refreshing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

5NVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

5.1 NVM overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

5.1.1 NVM organisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

5.2 NVM configuration sectors organisation . . . . . . . . . . . . . . . . . . . . . . . . . . 51

5.2.1 Chip ID definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

5.2.2 100 Time Programmable data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

5.3 NVM user routines organisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

5.3.1 Opening assembly buffer routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.3.2 NVM programming routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

5.3.3 Page Verify Routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

5.3.4 NVM page erasing routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

5.3.5 Erase Page Verify Routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

5.3.6 Sector Erasing Routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

5.3.7 Erase Sector Verify Routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

5.3.8 Abort NVM programming routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5.3.9 MapRAM initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

5.3.10 Read NVM status routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

5.3.11 Read 100 Time Programmable parameter data routine . . . . . . . . . . . . 80

5.3.12 Program 100 Time Programmable routine . . . . . . . . . . . . . . . . . . . . . . 81

5.3.13 NVM ECC check routines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

5.3.14 Read NVM ECC2 address routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

5.3.15 RAM MBIST starting routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

5.3.16 NVM protection status change routines . . . . . . . . . . . . . . . . . . . . . . . . . 86

5.3.17 Read NVM config status routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

5.3.18 Read user calibration data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

5.3.19 NVMCLKFAC setting routine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

5.4 NVM user applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

5.4.1 NVM Data sector handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

5.4.2 Supporting Background NVM Operation . . . . . . . . . . . . . . . . . . . . . . . 101

5.4.3 Emergency operation handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

5.4.3.1 Emergency operation handling - Type 1 routines . . . . . . . . . . . . . . 104

5.4.3.2 Emergency operation handling - Type 2 routines . . . . . . . . . . . . . . 105

5.4.3.3 Emergency operation handling timing . . . . . . . . . .

5.4.4 NVM user routines operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

5.4.4.1 NVM user programming operation . . . . . . . . . . . . . . . . . . . . . . . . . . 107

5.4.4.2 Tearing-safe Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

5.4.4.3 NVM user erase operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

5.4.4.4 NVM user programming abort operation . . . . . . . . . . . . . . . . . . . . . 111

. . . . . . . . . . . . . 105

User Manual 3 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

5.4.5 NVM protection mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

6 Revision History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

User Manual 4 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Introduction

1 Introduction

This document specifies the BootROM firmware behavior for the TLE986x family. The specification contains the following major sections:

• BootROM Overview

• Startup Procedure

• BSL features

• NVM structure and user routines description.

1.1 Purpose

The document describes the functionality of the BootROM firmware.

1.2 Scope

The BootROM firmware for the TLE986x family provides the following features:

• Startup procedure for stable operation of TLE986x chip

• Debugger connection for proper code debug

• BSL mode for users to download and run code from NVM and RAM

• NVM operation handling, e.g. program and erase

1.3 Abbreviations and special terms

Table 1-1 Abbreviations and Terms

BSL BootStrap Loader

CS Configuration Sector

EOT End of Transmission

EVR Embedded Voltage Regulator

NAC No Activity Count

NAD Node address for diagnostic

NEA NVM End Address

NLS NVM Linear Size

NSA NVM Starting Address

NVM Non Volatile Memory

OCDS On-Chip Debug Support

OSC Oscillator

PEM Program Execution Mode

User Manual 5 Rev. 1.5, 2020-09-25

Table 1-1 Abbreviations and Terms (cont’d)

PLL Phase-Locked Loop

SA Service Algorithm

SCU System Control Unit

SWD Serial Wire Debug

VTOR Vector Table Offset Register

WDT WatchDog Timer

TLE986x BF BootROM

Introduction

User Manual 6 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Overview

2Overview

This specification describes all firmware features including the operations and tasks defined to support the general startup behaviour and various boot options.

2.1 Firmware architecture

TLE986x on-chip BootROM consists of:

• startup procedure, see Chapter 3

• bootstrap loader via UART, see Chapter 4

• NVM user routines and NVM integrity handling routines, see Chapter 5

The BootROM in TLE986x is located at 00000000H and so represents the standard reset handler routine.

The startup procedure includes:

• EVR calibration

• MapRAM initialisation

• on-chip oscillator configurations

• NVM protection enabling

• branching to different modes

The latched values of TMS, P0.0 and P0.2 at the rising edge of RESET determine the mode of operation to be entered.

BootROM operation modes:

• User / BSL mode

• Debug Support mode

In user mode BootROM performs the following steps: execute the startup procedure, set the vector table position at the beginning of the NVM in user accessible space (by proper setting of the VTOR register) and jump to the user defined reset handler routine (jump to the location pointed by the address 11000004 program.

Note: The firmware will only set the VTOR to point at the beginning of the user

accessible NVM region but will not write any vector table. This is the responsibility of the user to download a correct vector table.

Table 2-1 lists the boot options available in the TLE986x.

-11000007H) to execute the user

User Manual 7 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Overview

Table 2-1 TLE986x Boot options

TMS/DAP1 P0.0

P0.2 Mode / Comment

/DAP0

0 X X User mode / BSL mode

1)2)

1 0 X Device test mode3)

1 1 0 Debug Support mode with SWD port

1 1 1 Device test mode

On-chip OSC is selected as PLL input. System is running on LP_CLK until firmware switches to PLL output before jumping to user code. Exception is with hardware reset where user settings are retained.

Boot in user mode or BSL mode depends on the NAC word in user memory (NVM).

Power up with special internal settings. At completion, device runs in endless loop. No NVM code execution is performed.

The device test mode is not intended to be selected by the user. The user shall ensure by external configuration of the pins (TMS, P0.0 and P0.2) that no device test mode is entered.

2.2 Program structure

The different sections of the BootROM provide the following basic functionality.

Startup procedure

The startup procedure is the main control program in the BootROM. It is the f ir st softw ar e controlled operation that is executed after any reset.

The startup procedure will perform configuration sector verification, EVR calibration, onchip oscillator trimming, MapRAM initialisation, BootROM protection, NVM protection and decode the pin-latched values of the TMS, P0.0 and P0.2 to determine which mode it will jump to.

User mode

User mode supports user code execution in the NVM address space. However, if NVM is not protected and the Bytes at address 11000004 device enters sleep mode. If a valid user reset vector is found at 11000004

-11000007H are erased (FFH), then

(values at

11000004H - 11000007H not equal to FFFFFFFFH) and a proper NAC value is found then the BootROM proceeds into user mode. In case an invalid NAC value is found, the device waits forever for a FastLIN BSL communication.

User Manual 8 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Overview

FastLIN and UART BSL mode

It is used to support BSL via UART protocol. Downloading of code/data to RAM and NVM related programming is supported in this mode.

User Manual 9 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Startup procedure

3 Startup procedure

This chapter describes the BootROM startup procedure in TLE986x.

The startup procedure is the first software-controlled operation in the BootROM that is automatically started after every reset. Certain operations are skipped depending on the type of reset. Refer to next section for further details.

3.1 Program structure

The first task executed by the startup firmware is the check of the reset source.

For power on, brown-out reset or wake-up from sleep mode reset, RAM test and initialization are executed according to user settings, while they are skipped for other reset types.

Firmware code uses part of the RAM for variable storage, literal pools and stack pointer. The startup code only uses a specific RAM region (the first 1 kB mapped from address

18000000H to 180003FFH), subset of the total available RAM address range. In the

remaining region, which is not used by the firmware, the user can store values to be valid across reset for all reset sources different from power on reset, brown out reset and wakeup reset. For these three reset sources, either a RAM test or a RAM clear might be executed thus destroying the previously stored values.

After that, depending on the reset source, the firmware will do NVM protection, NVM MapRAM initialisation, on-chip oscillator trimming, PLL setting and analog module trimming. It will decode the pin-latched values of the TMS, P0.0 and P0.2 to determine which mode it will jump to.

If bootup mode is Debug Support mode, the WDT1 is disabled. For entry to user mode, the WDT1 remains active. Next, the firmware will wait for NVM module to be ready.

For software, or internal watchdog reset ( triggered by the WDT in the SCU), the following steps are skipped:

• RAM test and initialisation

• NVM MapRAM initialisation and service algorithm

• Setting of oscillator and PLL and switching system clock input to PLL output

• Loading of analog modules trimming parameters from first 100TP page

• Loading of user configuration data from 100TP page into the RAM

• Clearing of NMI status before exit to user mode or Debug support mode

3.1.1 Test and initialization of RAM

A functional test sequence is executed on the entire RAM after power on reset and brown out reset and can be executed optionally after a wakeup reset. The test consists of a linear write/read algorithm using alternating data. Once it is started, the firmware

User Manual 10 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

waits until the test is completed, before checking the result and continuing accordingly the start up sequence.

The execution of the RAM test after a wake up reset is controlled by the MBIST_EN bit in the PMU->SystemStartConfig register. The user can freely set the v alue of this bit and its value is kept over wake up reset. If the bit is set to 0, the RAM test is not performed on wake up. If the bit is set to 1 then the RAM test is performed even for wake up resets.

If an error is detected the device is set to loop endlessly with WDT1 enabled.

In case of power-on reset, brown-out reset or wake-up reset from sleep mode the start up procedure will continue with a complete RAM initialization by writing all the RAM to zero with proper ECC status.This is needed to prevent an ECC error during user code execution due to a write operation to an un-initialised location (with invalid ECC code). Afterwards the Firmware proceeds checking the NVM status.

Note: Via MBIST EN bit user can only disable the RAM test sequence while the RAM

initialization to 00H is still executed.

Note: The test sequence on the entire RAM takes 500 μs while the initialization of the

complete RAM takes 150 μs.

Startup procedure

3.1.2 NVM initialisation routine

This routine will set the NVM protection according to the password in the configuration sector (refer to Section 5.4.5 for further details on NVM protection and protection password).

3.1.3 NVM MapRAM initialisation

The MapRAM is being used for the EEPROM emulation which is described in

Chapter 5.4.1. After every reset the system performs the MapRAM initialisation. This

operation is triggered to restore the MapRAM content.

The operation is executed with different flows depending on the type of reset. These two flows are described in the following chapters.

3.1.3.1 NVM MapRAM initialization at high prio reset

During power on reset, brown out reset, pin reset or wakeup reset, the MapRAM content is cleared. For this reason, during the following startup sequence the system performs a complete MapRAM initialization. In case during the initialisation at least one error is detected, the service algorithm routine is called to do the repair.

In case of mapping errors, the repair mechanism consists of erasing the wrong pages (either faulty or double mapped pages). The repair step then requires the right of

User Manual 11 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

modifying the NVM Data sector content, which can be in contrast to the NVM protection settings user has provided. To avoid any risk of data loss, the user can control via dedicated 100TP page parameter whether the SA is allowed to proceed to the repair step in case NVM password protection for NVM Data sector is installed.

Detailed description of the MapRAM initialization and repair step can be found at

Section 5.4.1

Startup procedure

3.1.3.2 NVM MapRAM initialization at low prio reset

During low prio reset (soft reset, internal WDT reset and lockup reset) the content of the MapRAM is not cleared and so a MapRAM initialization is not mandatory. Any of these reset types might occur during an NVM operation on a non-linearly mapped data sector and might result in an inconsistent state of the MapRAM. In order to check MapRAM for consistency, MapRAM initialization is performed for these reset types too. In case of mapping errors no repair step is triggered, so that worst case startup time is not increased.

The result of the NVM Data sector initialization executed during the startup flow is reported to the user via the bit 1 of the SYS_STRTUP_STS register (MRMINITSTS). If this bit is set to 1 then the last initialization failed and the mapping info might be corrupted. In this case, a reset (power on reset, brown out reset, pin reset, WDT1 reset or wakeup reset) can be issued in order to start the Service Algorithm to try to fix the integrity issue inside the Data NVM. If the MRAMINITSTS is still flagged afterwards, the Data NVM sector has to be re-initialized by performing a sector erase.

3.1.4 Oscillator trimming and system clock selection

After every power on reset, brown out reset, pin reset or wakeup from sleep reset the system runs with an internal low precision clock (nominally 18 MHz). During the start up procedure, the internal oscillator is trimmed and the PLL is programmed to f the device. In order to reduce the boot time, the start up procedure continues to run with the low precision clock while the PLL is locking. System clock will be switched to PLL output before jumping to user or BSL mode in case of successful lock. In case the PLL does not lock the startup sequence proceeds further using the low precision clock as system clock.

Once user mode is entered, user is allowed to set the final desired frequency by proper register setting.

Note: After every power on reset, brown out reset, pin reset or wakeup reset the

user shall check whether the system is running on the low precision clock or on the PLL output reading the SYSCON0 register.

User Manual 12 Rev. 1.5, 2020-09-25

SYS

max. for

TLE986x BF BootROM

Startup procedure

3.1.5 Analog module trimming

In this routine, the trimming values of voltage regulators, LIN module, temperature sensor, bridge driver and other analog modules are read from the configuration sector and written into the respective SFR. For user mode or Debug Support mode, checksum on 100TP page is evaluated. In case of error, default values are used. Refer to Table 5-

11 for a list of user parameters in 100TP page.

3.1.6 User configuration data initialization

The firmware provides a routine to download data stored in user accessible configuration sector pages (100TP) during the startup flow. In particular, the routine copies a specified number of Bytes from a selected 100TP page (starting always from first Byte in the page) into the RAM (starting at a given address). The routine is by default disabled and can be enabled and controlled by proper programming of the Bytes stored in first 100TP page as described in the Table 5-11. This routine is not performed after a software or watchdog reset.

Relevant routine control parameters stored in the first 100TP page are:

• CS_USER_CAL_STARTUP_EN (offset=79H): When set to C3H it enables the user

data download from a 100TP page into the RAM during startup flow. All other values will be ignored and the routine will not be executed at startup.

• CS_USER_CAL_XADDH: (offset=7A

address where to copy data downloaded from 100TP page. This Byte is ignored if the routine is not enabled.

• CS_USER_CAL_XADDL: (offset=7B

address where to copy data downloaded from 100TP page. This Byte is ignored if the routine is not enabled.

• CS_USER_CAL_100TP_PAGE: (offset=7C

has to be downloaded from (refer to Figure 5-8). This Byte is ignored if the routine is not enabled.

• CS_USER_CAL_NUM: (offset=7D

downloaded starting from the first Byte of the selected 100TP page. This Byte is ignored if the routine is not enabled.

The RAM address where the user configuration data has to be copied to is stored as a 16-bit offset to the RAM start address (18000000 CS_USER_CAL_XADDL and CS_USER_CAL_XADDH parameters.

The routine has been developed to support downloading of the Customer_ID and the ADC calibration parameters stored at the beginning of the first 100TP page (see

Table 5-11) into the RAM for an easy access but can be more generally used for all other

CS user parameters. If the routine is enabled, firmware will copy the data from the

): It defines the high Byte of the RAM starting

): It defines the low Byte of the RAM starting

): It defines the 100TP page where data

): It defines the number of Bytes to be

). This offset is defined by the

User Manual 13 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Startup procedure

selected 100TP page into the RAM. Moreover, independent of startup setting, a similar routine is provided as NVM user routine (refer to Section 5.3.18).

3.1.7 Debug support mode entry

Entry to Debug support mode is determined by pin setting at power up (see Table 2-1).

In case NVM address 11000004

-11000007H is not FFFFFFFFH, the firmware code

clears the RAM, waits for debugger to be connected, moves the VTOR to 11000000 and jumps to user code.

3.1.8 User mode and BSL mode entry

Entry to user mode is determined by the No Activity Count (NAC) value which is defined in the user code (refer to Section 3.1.8.1). After waiting the time defined by the current NAC value, the startup procedure sets the VTOR register to point to the beginning of the NVM (11000000

If NVM double Bit error occurs when reading the NAC value, the system goes into endless loop.

Before entering user mode, the system clock frequency is switched to PLL output previously set to the max. f CPU clock source LP_CLK (low precision clock running nominally at 18 MHz) will be used.

Note: User mode is entered jumping to the reset handler. This can happen directly from

startup routine, after a waiting time for possible BSL communication, or as a result of BSL commands. In all these cases, jump to user mode will only occur either (1) when NVM is not protected and NVM content at 11000004 FFFFFFFFH or (2) when NVM is protected. In all other cases, firmware will put the device in sleep mode.

) and jumps to the reset handler.

of the device. In case PLL has not locked within 1 ms, the

SYS

-11000007H is not

3.1.8.1 NAC definition

The NAC value defines the time window after reset release in which the firmware is able to receive BSL connection messages. The bits 5 to 0 define the duration of the time window while bit 7 of the NAC defines, which BSL interface is selected. Bit 6 is reserved and not used. If no BSL messages are received on the selected BSL interface during the NAC window and NAC time has expired, the firmware code proceeds to user mode.

There are 2 different BSL interfaces supported, FastLIN and UART.

The FastLIN BSL is an enhanced feature in TLE986x device, supporting a fixed baud rate of 115.2 kBaud. To support this faster baudrate the protocol used will be the same as UART BSL but on the integrated LIN transceiver (Refer to Chapter 4 for protocol description).

User Manual 14 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Startup procedure

After ending the start up procedure, the program will detect any activities on the LIN/ UART for a period of time, determined by (((NAC & 3FH) -1H) * 5) ms reduced by the time already spent to perform the start up procedure. When nothing is detected on the LIN/ UART and (((NAC & 3F

) -1H) * 5) ms is passed from reset going high, the

microcontroller will jump to user mode. If NAC(5:0) is 1H, the BSL window is closed, no BSL connection is possible and user mode is entered without delay.

The maximum NAC value is restricted to CH as the first open WDT1 window is worst case 65 ms. In case a valid BSL command is detected during the BSL window the firmware suspends the counting of the WDT1 in order to avoid that requested BSL communication is broken by a WDT1 reset. The firmware will then re-enable the WDT1 before jumping to user code. If NAC is not valid, BootROM code will switch off the WDT1 and wait for a FastLIN entry sequence infinitely.

Table 3-1 gives an overview of the action of the microcontroller with respect to No

Activity Count (NAC) values and the Table 3-2 shows the selection of the BSL interface depending on the NAC bit 7.

User Manual 15 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Startup procedure

Table 3-1 Type of action w.r.t. No Activity Count (NAC) values

NAC Value (5:0) Action

0 ms delay. Jump to user mode immediately

5 ms delay before jumping to user mode

10 ms delay before jumping to user mode

15 ms delay before jumping to user mode

20 ms delay before jumping to user mode

25 ms delay before jumping to user mode

30 ms delay before jumping to user mode

35 ms delay before jumping to user mode

40 ms delay before jumping to user mode

45 ms delay before jumping to user mode

50 ms delay before jumping to user mode

55 ms delay before jumping to user mode

0DH - 3FH, 00H, Invalid Wait forever for the first frame

If a FastLIN frame/UART frame is received within the delay period, the following actions occur; (1) the remaining delay is ignored, (2) it will not enter user mode anymore (3) it will process the FastLIN / UART frame accordingly

User Manual 16 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Startup procedure

Table 3-2 BSL Interface selection via NAC

NAC(7) Action

0 FastLIN BSL

1 UART BSL

For each derivative, the NAC value is stored, together with the NAD value, in the last 4 Bytes of the linearly mapped NVM region. To ensure the parameter validity, the 2 parameters’ actual values and their inverted values are checked. In case the stored value and inverted value are not consistent (value + inverted value + 1 not equal to 0) the parameter is considered to be invalid and the default value is used: The BSL window will be open indefinitely and FastLIN is selected as BSL interface.

The Table 3-3 shows the addresses for all the available family devices. In the table NSA stands for NVM Starting Address whose value is 11000000

for all derivatives and NLS

stands for NVM Linear Size, in Bytes, whose value is derivative dependent.

Table 3-3 NAC and NAD parameters details

Address User Defined

Criteria / Range Default

Value

NSA+(NLS-4)

NAC 01H - 0CH for FastLIN BSL

81H - 8CH for UART BSL

NSA+(NLS-3)HNAC 1’s complement -

NSA+(NLS-2)

NAD (for FastLIN

01H - FFH (00H is reserved) 7F

BSL only)

NSA+(NLS-1)HNAD (for FastLIN

1’s complement -

BSL only)

For NSA and NLS values refer to Table 5-2.

3.1.9 Node Address for Diagnostic (NAD)

The NAD value is stored similar to the NAC value in NVM. This field specifies the address of the active slave node. Only slave nodes have an address. The NAD address range supported in TLE986x is listed in Table 3-4.

Table 3-4 NAD address range

NAD Value Description

to FEHValid Slave Address

User Manual 17 Rev. 1.5, 2020-09-25

Invalid Slave Address

TLE986x BF BootROM

Startup procedure

Table 3-4 NAD address range (cont’d)

NAD Value Description

Default Address (NAD value is invalid or it is not programmed in NVM linear area)

Broadcast Address (The actual NAD value stored in the NVM is not checked. Communication is granted)

If the NAD value is not programmed in the NVM linear region or in case its value is invalid (value and inverted value not consistent), the NAD is assumed to be 7FH.

User Manual 18 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

FastLIN and UART BSL Mode

4 FastLIN and UART BSL Mode

This chapter describes the protocol used for the FastLIN and UART BSL.

Both FastLIN and UART BSL share the same protocol. FastLIN BSL communication is performed via the integrated LIN transceiver while UART BSL is performed via the full duplex UART interface (UART1, UART send P0.1, UART receive P1.4).

Note: UART BSL expects a full duplex communication. A connection of an

external LIN transceiver to P0.1/P1.4 is not supported by UART BSL.

Although FastLIN BSL uses the same protocol as UART BSL, the connection sequence is different. To pro tect the FastLIN BSL from unwanted entries, a special entry sequence must be executed before FastLIN BSL is fully enabled. In addition, the FastLIN BSL is always executed at a fixed baud rate of 115.2 kBaud.

All information regarding connection and protocol for both UART and FastLIN are reported following.

The protocol is based on the phases described following.

4.1 FastLIN and UART BSL protocol

The FastLIN and UART BSL protocol is based on the following two phases:

• Phase I: Establish a serial connection

• For FastLIN BSL the device automatically sets a baud rate of 115.2 kBaud and waits for a specific command entry sequence before enabling all FastLIN BSL supported features (refer to Chapter 4.3).

• For UART BSL the device automatically synchronizes transfer speed (baud rate) with the serial communication partner (host) for UART. (refer to

Chapter 4.2)

• Phase II: Perform the serial communication with the host. The host controls

communication by sending header information which selects one of the working modes (refer to Chapter 4.4) These modes are: – Mode 0 (00H): Transfer a user program from the host to RAM or write 100TP

pages – Mode 1 (01H): Execute a user program in the RAM – Mode 2 (02H): Transfer a user program from the host to NVM – Mode 3 (03H): Execute a user program in the NVM – Mode 4 (04H): Erase NVM

– Mode 6 (06H): NVM protection mode enabling/disabling Scheme

1) The microcontroller returns to the beginning of phase II and waits for the next command from the host

2) UART BSL and serial communication are terminated.

User Manual 19 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

– Mode A (0AH): Get Info (based on Option Byte)

FastLIN and UART BSL Mode

Except mode 1, mode 3 and mode 6, the microcontroller returns to the beginning of Phase II and waits for the next command from the host after executing all other modes.

All serial communication is performed via the integrated LIN transceiver for FastLIN and via the full duplex serial interface (UART1) of the TLE986x for UART BSL.

The serial transfer works in asynchronous mode with the serial parameters 8N1 (eight data Bits, no parity and one stop Bit).

The following section provides detailed information on these two phases.

4.2 Phase I for UART BSL: Automatic serial synchronization to the host

Upon entering UART BSL mode, a serial connection is established and the transfer speed (baud rate) of the serial communication partner (host) is automatically synchronized in the following steps, a simplified entry flow is depicted in Figure 4-1:

• STEP 1: Initialize serial interface for reception and timer for baud rate measurement

• STEP 2: Wait for test Byte (80H) from host

• STEP 3: Synchronize the baud rate to the host

• STEP 4: Send Acknowledge Byte (55

) to the host

• STEP 5: Enter Phase II

4.2.1 General description

The microcontroller will set the serial port of the UART1 to mode 1 (8-bit UART, variable baud rate) for communication. Timer 2 will be set in auto-reload mode (16-bit timer) for baud rate measurement. In the process of waiting for the test Byte (80 will start the timer on reception of the start Bit (0) and stop it on reception of the last Bit of the test Byte (1). Then the UART BSL routine calculates the actual baud rate, sets the PRE and BR_VALUE values and activates baud rate generator. When the synchronization is done, the microcontroller sends back the Acknowledge Byte (55 the host. If the synchronization fails, the baud rates for the microcontroller and the host are different, and the Acknowledge code from the microcontroller cannot be received properly by the host. In this case, on the host side, the host software may give a message to the user, e.g. asking the user to repeat the synchronization procedure. On the microcontroller side, the UART BSL routine cannot judge whether the synchronization is correct or not. It always enters phase II after sending the Acknowledge Byte. Therefore, if synchronization fails, a reset of the microcontroller has to be invoked, to restart it for a new synchronization attempt.

), microcontroller

) to

User Manual 20 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

BootROM

BSL Mode Start

is NAC > 0x01

(0ms) or invalid?

Start NAC timer

(Timer21)

Timer21

elapsed?*

is RxD line low

state?

Stop NAC timer

(Timer21)**

disable WDT1**

yes

Start Baudrate

detection

(Timer2)

is RxD line high

state?

Stop Baudrate

detection

(Timer2)

yes

Calculate baudrate

Program BaudRate

for UART1

Return

Acknowledge (0x55)

is BSL command

received?

Execute BSL

command

enable WDT1

Mode 3

Exit to User Mode

BSL Mode?

Program BaudRate

for UART1

to 115.2kBaud

is BSL command

received?

Get ChipID Cmd.

Received?

yes

NAD match?

yes

FastLIN

Timer21

elapsed?*

yes

UART BSL

Stop NAC timer

(Timer21)**

disable WDT1**

0ms

5..55ms

disable WDT1

disable Timer21

(disable NAC timer)

invalid

Setup

Hardware

(UART, LIN)

Setup

Hardware

(Timer2, UART)

Setup Timer21

(NAC timer)

*) if NAC Timer is disabled (NAC = invalid)

Timer21 will never elaps,

it always branches to ‚no‘

**) if NAC Timer is disabled (NAC = invalid)

Stop NAC timer and disable WDT1 is

skipped

FastLIN and UART BSL Mode

Figure 4-1 BSL Entry flow (simplified)

User Manual 21 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

baud

PCLK

16 PRE× BR_VALUE

FDSEL

-------------------

èø

æö

------------------------------------------------------------------------------------------------

baud

T2Nb

--------------------

PCLK

16 PRE× BR_VALUE

FDSEL

-------------------

èø

æö

------------------------------------------------------------------------------------------------

PCLK

---------------

8×

------------------------

PRE BR_VALUE

FDSEL

-------------------

èø

æö

-------

FastLIN and UART BSL Mode

4.2.2 Calculation of BR_VALUE and PRE values

For the baud rate synchronization of the microcontroller to the fixed baud rate of the host, the UART BSL routine waits for a test Byte (80 polling the receive port of the serial interface (P1_DATA.4/RxD Pin), the Timer 2 is started on the reception of the start Bit (0) and stopped on the reception of the last Bit of the test Byte (1). Hence the time recorded is the receiving time of 8 Bits (1 start Bit plus 7 least significant Bits of the test Byte). The resulting timer val ue is 16-bi t (T2). This v alue is used to calculate the 11-bit auto-reload value (BR_VALUE stored in the BGH and BGL SFRs), the fractional divider FDSEL and PRE, with T2PRE predefined as 011. This calculation needs two formulas.

First, the correlation between the baud rate (baud) and the reload value (BG) depends on the internal peripheral frequency (

PCLK

Second, the relation between the baud rate (baud) and the recording value of Timer 2 (T2) depends on the T2 peripheral frequency (fT2) and the number of received Bits (f

)

T2Nb

), which has to be sent by the host. By

)

[4.1]

[4.2]

Combining Equation [4.1] and Equation [4.2] with N

Simplifying Equation [4.3], we get

After setting BR_VALUE, FDSEL and PRE, the baud rate generator will then be enabled, and the UART BSL routine sends an Acknowledge Byte (55 received correctly, it will be guaranteed that both serial interfaces are working with the same baud rate.

User Manual 22 Rev. 1.5, 2020-09-25

=8, fT2=f

/ 8 (T2PRE=011),

PCLK

[4.3]

[4.4]

) to the host. If this Byte is

TLE986x BF BootROM

FastLIN and UART BSL Mode

4.3 Phase I for FastLIN BSL: FastLIN BSL entry sequence

Upon entering FastLIN BSL mode, there is no automatic synchronization to the host transfer speed. The device sets the baud rate to 115.2 kBaud. Please also refer to the simplified entry flow in Figure 4-1.

In addition, the FastLIN mode is protected against unwanted entries, i.e. because of noise on the communication line. In order to establish a FastLIN connection, the following sequence must be sent to the device during the active BSL connection window (NAC).

• STEP 1: Host to send the “Get Chip ID for FastLIN BSL entry” command

• STEP 2: Device to answer with Acknowledge (55

• STEP 3: Device to answer with the Chip ID

Get Chip ID for FastLIN BSL entry is described in Chapter 4.4.2.8.

If the sequence has been passed to the device during the BSL active window and the device has acknowledged the commands and answered with the Chip ID then the FastLIN BSL connection is established, the NAC and the WDT1 will be disabled and the device will wait for further FastLIN BSL commands.

)

4.4 Phase II: Serial communication protocol and the working modes

Once the BSL communication is established, the FastLIN or UART BSL enters Phase II, during which it communicates with the host to select the desired working modes. The detailed communication protocol is explained as follows: From now on, both FastLIN and UART BSL modes share the same UART BSL protocol.

4.4.1 Serial communication protocol

The communication between the host and the UART BSL routine is done by a simple transfer protocol. The information is sent from the host to the microcontroller in blocks. All the blocks follow the specified block structure. The host is sending several transfer blocks and the UART BSL routine is just confirming them by sending back single Acknowledge or error Bytes. The microcontroller itself does not send any transfer blocks.

However, the above rule does not apply to some modes where the microcontroller might need to send the required data to the host besides the Acknowledge or error Byte (e.g. mode A).

User Manual 23 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Block Type

(1 byte)

Checksum

(1 byte)

Data Area

(X bytes)

FastLIN and UART BSL Mode

4.4.1.1 Transfer block structure

A transfer block consists of three parts:

• Block Type: the type of block, which determines how the Bytes in the data area are

interpreted. Implemented block types are:

type “Header”

–00

–01H type “Data” –02H type “End of Transmission” (EOT)

• Data area: A list of Bytes, which represents the data of the block. The length of data

area cannot exceed 128 Bytes for mode 0 and 2. For mode 2, the length of data area must always be 128 Bytes. This is due to the fact that NVM is written page-wise.

• Checksum: the XOR checksum of the Block Type and data area.

The host will decide the number of transfer blocks and their respective lengths during one serial communication process. For safety purpose, the last Byte of each transfer block is a simple checksum of the Block Type and data area. The host generates the checksum by XOR-ing all the Bytes of the Block Type and data area. Every time the UART BSL routine receives a transfer block, it recalculates the checksum of the received Bytes (Block Type and data area) and compares it with the attached checksum.

Note: If there is less than one page to be programmed to NVM, the PC host will have to

fill up the vacancies with 00

, and transfer data in the length of 128 Bytes.

4.4.1.2 Transfer block type

There are three types of transfer blocks depending on the value of the Block Type.

Table 4-1 provides the general information on these block types. More details will be

described in the corresponding sections later.

User Manual 24 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

FastLIN and UART BSL Mode

Table 4-1 Type of transfer block

Block Name Block Type Description

Header block 00

This block has a fixed length of 8 Bytes. Special information is contained in the data area of the block, which is used to select different working modes.

Data block 01

This block length depends on the special information given in the previous header block. This block is used in working mode 0 and 2 to transfer a portion of program code. The program code is contained in the data area of the block.

EOT block 02

This block length depends on the special information given in the previous header block. This block is the last block in data transmission in working mode 0 and 2. The last program code to be transferred is in the data area of the block.

4.4.1.3 Response codes to the host

The microcontroller communicates to the host whether a block has been successfully received by sending out a response code. If a block is received correctly, an Acknowledge Code (55 two possible error codes, FFH or FEH, reflecting the two possible types of fail, Block Type or Checksum Error. A Block Type Error occurs when either a not implemented Block Type or transfer blocks in wrong sequence are received. For example, if in working mode 0 two consecutive header blocks are received a Block Type Error is detected and a Block Type Error (FF

) indication is returned. A Checksum Error occurs when the checksum

comparison on a received block fails. In such a case, the transfer is rejected and a Checksum Error (FEH) indication is returned. In both error cases the UART BSL routine awaits the actual block from the host again.

When program and erase operation of NVM is restricted due to enabled NVM protection, only modes 1, 3 and some options of mode A are allowed. All other modes are blocked and a Protection Error code (FD protected and no programming and erasing are allowed. In this error case, the UART BSL routine will wait for the next header block from the host again.

) is sent. In case of failure, an error code is returned. There are

) will be sent to host. This will indicate that NVM is

Table 4-2 gives a summary of the response codes to be sent back to the host by the

microcontroller after it receives a transfer block.

User Manual 25 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

FastLIN and UART BSL Mode

Table 4-2 Type of response codes

Communication status Response code to the host

Acknowledge (Success) 55

Block Type Error FF

Checksum Error FE

Protection Error FD

Combined Offset Error

0FBH only valid for Mode 0 option F0

(COMBOFFSETFAULT)

ID Offset Error

0FAH only valid for Mode 0 option F0

(IDOFFSETFAULT)

In Page Offset Error

0F9H only valid for Mode 0 option F0

(INPAGEOFFSETFAULT)

Table 4-3 shows a tabulated summary of the possible responses the device may

transmit following the reception of a header, data or EOT block.

Table 4-3 Possible responses for various block types

Mode Header block Data block EOT block

0 Acknowledge, Block Type

Error, Checksum Error, Protection Error

Acknowledge, Block Type Error, Checksum Error

Acknowledge, Block Type Error, Checksum Error, Combined/ID/InPage offset error

1 Acknowledge, Block Type

Error, Checksum Error

2 Acknowledge, Block Type

Error, Checksum Error, Protection Error

Acknowledge, Block Type Error, Checksum Error

3 Acknowledge, Block Type

Error, Checksum Error

4 Acknowledge, Block Type

Error, Checksum Error, Protection Error

User Manual 26 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

FastLIN and UART BSL Mode

Table 4-3 Possible responses for various block types (cont’d)

Mode Header block Data block EOT block

6 Acknowledge, Block Type

Error, Checksum Error, Protection Error

A Acknowledge, Block Type

Error, Checksum Error, Protection Error

The responses are defined in Table 4-4, which lists the possible reasons and/or implications for error and suggests the possible corrective actions that the host can take upon notification of the error.

Table 4-4 Definitions of responses

Response Value Description

Acknowledge

Block Type

Header1, 3 The requested operation will

BSL Mode

Reasons / Implications Corrective

Action

be performed once the response is sent.

A The requested operation has

been performed and was successful. Requested data transmission follows.

6 The requested operation has

EOT 0, 2, 4

All other

combinations

been performed and was successful.

Reception of the block was successful. Ready to receive the next block.

Block Type Error

Header2, 4, A Start Address in Mode Data is

not within NVM address

Retransmit a valid header block.

range or invalid 100TP Page.

All other

combinations

Either the Block Type is undefined or option is invalid

Retransmit a valid block

or the flow is invalid.

Checksum Error

All

combinations

There is a mismatch between the calculated and the

Retransmit a valid block

received Checksum.

User Manual 27 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

FastLIN and UART BSL Mode

Table 4-4 Definitions of responses (cont’d)

Response Value Description

Protection Error

Block Type

Header0, 2,

BSL Mode

4, 6, A

Reasons / Implications Corrective

Action

Protection against external

Disable protection access enabled, i.e. userpassword is valid.

Combined Offset Error Code

EOT 0 The operation is targeting

100-TP page 1 and there is at least 1 Byte with a not in page

Check the Byte

offset.

offset and 1 byte pointing to the Customer_ID reserved region.

ID Offset Error Code

EOT 0 The operation is targeting

100-TP page 1 and there is at

Check the Byte

offset. least 1 Byte pointing to the Customer_ID reserved region.

Combined Offset

EOT 0 There is at least 1 Byte with a

not in page offset.

Check the Byte

offset.

Error Code

4.4.1.4 Block response delay

As described in Section 4.4.1.3, after receiving any block the microcontroller communicates to the host whether the block was successfully received by sending out a response code. If a block is received correctly, an Acknowledge Code (55H) is sent. In case of failure, an error code is returned.

The response is transmitted with a delay that depends on the selected mode and on the type of the block received.

The following Table 4-5 reports the maximum response delay for each mode and block type.

User Manual 28 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

FastLIN and UART BSL Mode

Table 4-5 Maximum Response Delay

Max Response Delay Table

Block Type

Mode Option Description Header Data EoT

Mode 0 0x00 Download Code/

250 us 1 µs per Byte 1 µs per Byte

Data to RAM

0xF0 Download data to

250 µs 1 µs per Byte 10 ms

100TP pages

Mode 1 -- RAM code

250 µs -- --

execution

Mode 2 -- Download Code/

250 µs 10 ms

10 ms

Data to NVM

Mode 3 -- NVM code

250 µs -- --

execution

Mode 4 0x00 NVM page erase 4.5 ms -- --

0x40 NVM sector erase 4.5 ms -- --

0xC0 NVM mass erase 4.5 ms per

-- --

sector

Mode 6 -- NVM Protection set 10 ms

-- NVM Protection reset

4.5 ms + 4.5 ms per sector

-- --

Mode A 0x00 Get Chip ID 250 µs -- --

0x10 NVM Page

250 µs -- --

Checksum Check

0x18 NVM Mass

100 ms -- --

checksum check

0x50 100TP page

250 µs -- --

Checksum Check

0xC0 NVM Page 250 µs -- --

0xF0 100TP page 250 µs -- --

Time needed for data collection, OpenAB, erasing old data (if required) and programming the data given

User Manual 29 Rev. 1.5, 2020-09-25

TLE986x BF BootROM

Block Type

(Header Block)

Mode

(1 byte)

Mode Data

(5 bytes)

Checksum

(1 byte)

Data Area

FastLIN and UART BSL Mode

4.4.2 UART BSL Modes

When the UART BSL routine enters Phase II, it first waits for an 8-byte long header block from the host. The header block contains the information for the selection of the working modes. Depending on this information, the UART BSL routine selects and activates the desired working mode. If the microcontroller receives an incorrect header block, the UART BSL routine sends, instead of an Acknowledge code, a Checksum or Block Type Error code to the host and awaits the header block again. In this case the host may react by re-sending the header block or by releasing a message to the user.

4.4.2.1 Header Block

The header block is always the first transfer block to be sent by the host during one data communication process. It contains the working mode number and special information on the related mode (referred to as “Mode Data”). The general structure of a header block is shown below.

Description:

• Block Type 00H: The Block Type, which marks the block as a header block

• Mode: The mode to be selected. The implemented modes are covered in Section 4

• Mode Data: Five Bytes of special information, which are necessary to activate

corresponding working mode.

• Checksum: The checksum of the header block.

4.4.2.2 Mode 0 - Code/Data download to RAM/100TP

Mode 0 is used to transfer a user program or data from the host to the RAM of the microcontroller via serial interface. Selecting the proper mode option, this mode can be used to transfer data into the user configuration sector pages. In this case, user has to transfer data to the RAM in accordance with the format reported in the Table 5-12 and after EOT block has been received, data is automatically copied with proper offset in the target page. If NVM protection is installed, programming to RAM is not allowed.

Different options supported are:

• Option 00H: RAM download

•Option F0

The header block for this working mode has the following structure:

User Manual 30 Rev. 1.5, 2020-09-25

: RAM download and Configuration sector page programming

+ 84 hidden pages