Short descriptionProduct version(s)Detailed description
0A, 1B
version (T1.1.5) will have runBootloader API function.
Section 5 “Errata notes
detail”
NXP Semiconductors
3. Functional problems detail
3.1 ROM.1: For PRINCE encrypted region, partial erase cannot be
performed
Introduction
The LPC55S6x devices supports real-time encryption and decryption for on-chip flash
using the PRINCE encryption algorithm. The PRINCE module supports three flash
memory regions for real-time encryption and decryption, referred to as crypto regions.
Each crypto region resides at a 256 kB address boundary within the flash and are divided
into 8 kB sub-regions which can be individually enabled.
Problem
For the LPC55S6x, when an erase operation is performed with a size less then 8 kB for a
PRINCE encrypted region, a return error is returned and subsequent ISP commands do
not respond.
Work-around
LPC55S6x
Errata sheet LPC55S6x
When a region is marked as a PRINCE encrypted region, a full erase of the PRINCE
encrypted region must be performed.
This issue is fixed on device revision 1B.
3.2 ROM.2: For PUF based key provisioning, a reset must be
performed
Introduction
On the LPC55S6x, the Key Management module supports storing three 128-bit PRINCE
Keys (KEY1, KEY2, and KEY3) used for the decryption process.
Problem
After PUF based key provisioning, the PRINCE module cannot perform the decryption
process without performing a reset.
Work-around
Perform a reset via the external reset pin or power cycle the device for a successful
decryption process when using a PUF key.
This issue is fixed on device revision 1B.
3.3 ROM.3: Unprotected sub regions in PRINCE defined
regions cannot be used.
Introduction
The LPC55S6x devices support real-time encryption and decryption for on-chip flash
using the PRINCE encryption algorithm. The PRINCE module supports three flash
memory regions for real-time encryption and decryption, referred to as crypto regions.
Each crypto region resides at a 256 kB address boundary within the flash and is divided
into 8 kB sub-regions which can be individually enabled.
Unprotected (non PRINCE encrypted) sub flash in PRINCE defined regions cannot be
written after an erase operation. Any non PRINCE encrypted sub regions in the PRINCE
defined regions cannot be used.
Work-around
There is no work-around.
This issue is fixed on device revision 1B.
3.4 ROM.4: Last page of image is erased when simultaneously
programming the signed image and CFPA region
Introduction
On the LPC55S6x, the protected flash region (PFR) supports a Customer Field
Programmable Area (CFPA) which can be used for Monotonic counters, Key revocation,
and PRINCE IV codes. Also, the ROM supports secure boot using a signed image.
Problem
LPC55S6x
Errata sheet LPC55S6x
When simultaneously programming the signed image and the CFPA via the Secure Binary
(SB2 file) image format, the last page of the image is erased.
Work-around
The signed image and the CFPA need to be programmed one a time to prevent the last
page of the image from being erased.
This issue is fixed on device revision 1B.
3.5 ROM.5: ROM fails to enter ISP mode when image is corrupted with
flash pages in an erased or unprogrammed state
Introduction
On the LPC55S6x, if the image is corrupted with flash pages in an erased or
unprogrammed state, the ROM may fail to automatically enter ISP mode.
Problem
When secure boot is enabled in CMPA and the flash memory contains an erased or
unprogrammed memory page inside the memory region specified by the image size field
in the image header, the device does not automatically enter into ISP mode using the
fallback mechanism, as in the case of a failed boot for an invalid image. This problem
occurs when the application image is only partially written or erased but a valid image
header is still present in memory.
Work-around
Perform a mass-erase to remove the incomplete and corrupted image using one of the
following methods:
• Execute the erase command using Debug Mailbox. The device will enter directly into
• Enter into ISP mode using the Debug Mailbox command and use the flash-erase
• Reset the device and enter into ISP mode using the ISP pin. Use the flash-erase
This issue occurs on device revisions 0A and 1B.
3.6 ROM.6: ROM fails to respond to debug session request on version 0A
parts
Introduction
Debugging is supported through Arm's Serial wire Debug (SWD) interface, enabling
debug with a range of debug probes and tools from NXP and other ecosystem partners.
Debug access by a remote host is controlled by the LPC55S6x ROM and is only enabled
when permitted through the device configuration and when the correct protocol is followed
to initiate a debug session.The Boot ROM implements a debug mailbox protocol to
interact with host debug systems over the SWD interface. For LPC55S6x, if the device
has been configured for debug authentication, then a debug session must be initiated
following the correct authentication sequence.
LPC55S6x
Errata sheet LPC55S6x
command.
command to erase the corrupted (incomplete) image.
Problem
For the LPC55S6x, a new method of initiating a debug session was introduced, as
documented in the current user manual. However, when used on 0A parts, a debug
system attempting to connect could become stuck in an endless loop because the ROM in
that silicon revision fails to issue a corresponding response to the new debug session
request.
Work-around
It is possible to determine whether the cause of the hang during a debug session request
is related to the part revision by detecting whether an overrun condition is reported via the
debug mailbox, which is only generated by the newer parts and not by the older 0A
version. The pseudo code below is a modified version to replace that shown in Chapter
51.6.1 of the user manual, implementing a check for silicon revision when connecting to
LPC55S6x parts:
// Read AP ID register to identify DM AP at index 2
WriteDP 2 0x020000F0
// The returned AP ID should be 0x002A0000
value = ReadAP 3
print "AP ID: ", value
// Select DM AP index 2
// Select CSW register [BJS]
WriteDP 2 0x02000000
// Write DM RESYNC_REQ + CHIP_RESET_REQ
WriteAP 0 0x21
// Poll CSW register (0) a offset 0x00 for zero return, indicating success
value = -1
while value != 0 {
value = ReadAP 0
}
print "RESYNC_REQUEST + CHIP_RESET_REQUEST: ", value
// detecting 0A vs 1B silicon.
// Write START_DM-AP command (CMD_1) the response of this command is 0x0
// returned through RETURN register 2
WriteAP 1 1
// Write DM START_DBG_SESSION (CMD_7) to REQUEST register (1) at offset 0x04.
// If the command is successful the return value is 0x80000000.
// However, 0A version silicon doesn't return a success code.
WriteAP 1 7
wait(10ms)
// Check CSW register (0) at offset 0x0 for any errors
// Since we have issued two command in sequence without reading
// the RETURN register in between, on 1B silicon an overrun condition would // occur.
value = ReadAP 0
LPC55S6x
Errata sheet LPC55S6x
// If the value return is 0x00000008 (AHB or ERR) then it is 1B silicon,
// else it is 0A silicon.
// For 1B silicon, reset the chip by writing 0x21 to register 0 to
// clear the error before continuing
If (value == 0x00000008) {
// Repeat connection sequence to clear overrun
WriteAP 0 0x21
value = -1
while value != 0 {
value = ReadAP 0
}
// Write DM START_DBG_SESSION to REQUEST register (1)
WriteAP 1 7
value = ReadAP 2
}
As a simpler fix, a delay can be introduced (around 100ms is suggested) to allow the ROM
code to reach its idle loop after preparing for the debug session; to do this, insert the
100ms delay just before the “detecting 0A vs 1B silicon” comment and omit the rest of the
steps.
3.7 VDD.1: The minimum operating voltage is 1.85 V
Introduction
The LPC55S6x operating voltage range specification is from 1.80 V to 3.6 V.
Problem
On the LPC55S6x rev 0A, the minimum operating range is 1.85 V.
3.8 CMP.1: The hysteresis on the comparator cannot be enabled
Introduction
On the LPC55S6x, the analog comparator control register (COMP) provides an option to
enable and disable the hysteresis.
Problem
On the LPC55S6x, the hysteresis feature of the comparator cannot be enabled.
Work-around
There is no work-around.
This issue will be fixed in the next silicon revision 1B.
3.9 USB.1: HS host fails when connecting with the LS device (mouse)
Introduction
LPC55S6x
Errata sheet LPC55S6x
The USB1 high-speed controller is available on select LPC55S6x devices and provides a
plug-and-play connection of peripheral devices to a host with three different data speeds:
• high-speed with a data rate of 480Mbps.
• full-speed with a data rate of 12 Mbps.
• low-speed with a data rate of 1.5 Mbps.
Many portable devices can benefit from the ability to communicate with each other over
the USB interface without intervention of a host PC.
Problem
USB HS host fails when connecting with an LS device (mouse).
Work-around
To support Full-Speed and Low-Speed applications, it is recommended to use the USB0
Full-Speed port and the USB1 High-speed port for Device or Host. In addition, should an
application require support of Low-Speed USB devices with a USB High-Speed Host, this
can be accomplished by inserting a USB Hub between the USB1 High-speed port and
external USB devices.
3.10 USB.2: PHY does not auto-power down in suspend mode
Introduction
The USB1 High-Speed Physical Layer (PHY) is available on LPC55S6x devices that
include USB high-speed controllers.
A device will go into the L2 suspend state if there is no activity on the USB bus for more
than three ms.
The USB protocol requires power management by the USB device.
The device does not auto-power down properly in suspend states, which impacts power
consumption in the PHY.
Work-around
This issue is fixed on device revision 1B.
3.11 USB.3: Automatic USB rate adjustment is not functional when using
multiple hubs
Introduction:
Full-speed and low-speed signaling uses bit stuffing throughout the packet without
exception. If the receiver sees seven consecutive ones anywhere in the packet, then a bit
stuffing error has occurred, and the packet should be ignored.
The time interval just before an End of Packet (EOP) is a special case. The last data bit
before the EOP can become stretched by hub switching skews. This is known as dribble
and can lead to a situation where dribble introduces a sixth bit that does not require a bit
stuff. Therefore, the receiver must accept a packet where there are up to six full bit times
at the port with no transitions prior to the EOP.
LPC55S6x
Errata sheet LPC55S6x
Problem:
The LPC55S6x device use the start of an EOP for frequency measurements. This is not
functional when going through multiple hubs that introduce a dribble bit because of hub
switching skews. For this reason, the start of the EOP cannot be used for frequency
measurements for automatic USB rate adjustment (by setting USBCLKADJ in the
FRO192M_CTRL register). The problem does not occur when a single hub is used.
Work-around:
Use the FRO calibration library provided in technical note TN00063. This library allows the
application to have a crystal-less USB device operation in full-speed mode.
3.12 USB.4: For the USB high-speed device controller, the detection
handshaking fails when certain full-speed hubs are connected
Introduction
See the USB2.0 specification for details regarding the USB High-speed Detection
Handshake protocol.
Problem
As a high-speed device, when certain full-speed hubs are connected, the USB device
does not detect the HOST KJ sequence correctly and, as a result, does not recognize the
speed of the connected host. In this case, the USB device can act erratically due to the
wrong speed detection.
1. The software work-around below can be implemented in usb_dev_hid_mouse where
2. The software workaround below is available in tech note (TN00071) In event handler
LPC55S6x
Errata sheet LPC55S6x
API is called "USB_DeviceHsPhyChirpIssueWorkaround()". In event handler in
USB_DeviceCallback(),
– On "kUSB_DeviceEventBusReset" event,
USB_DeviceHsPhyChirpIssueWorkaround() should be called to identify the speed
of the host connected to. If full-speed host is connected or
"isConnectedToFsHostFlag" is set , FORCE_FS (bit 21) of DEVCMDSTAT register
should be set to force the device operating in full-speed mode.
– On "kUSB_DeviceEventDetach" event, FORCE_FS (bit 21) of DEVCMDSTAT
register should be cleared.
in USB_DeviceCallback(),
– On "kUSB_DeviceEventAttach" event, set PHY_RX register trip-level voltage to
the highest. USBPHY->RX &= ~(USBPHY_RX_ENVADJ_MASK);USBPHY->RX |=
2;.
– On "kUSB_DeviceEventBusReset" event, check the DEVCMDSTAT[SPEED] to
determine the connected bus speed. (SPEED are bits 22 and 23). If
DEVCMDSTAT[SPEED]=FS, FORCE_FS (bit 21) of DEVCMDSTAT should be set
to force the device operating in full-speed mode.
– On "kUSB_DeviceEventGetDeviceDescriptor" event, or first SETUP packet has
arrived, Set the USBPHY_RX[ENVADJ] field back to default 0. Otherwise,
USBPHY_RX[ENVADJ] field will remains as 2 unless a disconnect event occurs.
– On "kUSB_DeviceEventDetach" event, Clear FORCE_FS (bit 21) of
DEVCMDSTAT register to zero. Reset USBPHY_RX[ENVADJ] field back to default
0.
3.13 ADC.1: Async interrupts with resume not supported
Introduction
The ADC controller is available on all LPC55S6x devices. Trigger detect with up to 16
trigger sources is supported with priority level configuration. A software or hardware
trigger option is provided for each.
Problem
The following problems are all related to the restart after interrupt feature:
• Low priority trigger executes twice when resumed.
• Trigger can't restart when it is configured to do so.
• Incorrect trigger resumed after exception.
Work-around
There is no work-around.
The async interrupts with resume is not supported on device revisions 0A and 1B.
3.14 ADC.2: Request for offset calibration function bit (CALOFS) is not
cleared after completion of offset calibration function
Introduction
The ADC controller is available on all LPC55S6x devices and supports a calibration step
where the ADC is configured to perform a calibration operation to determine the value
needed in the OFSTRIM register. The CALOFS bit is set to determine the value for the
OFSTRIM register which automatically begins a sequence that calculates the value. Once
the sequence has completed, the OFSTRIM register is updated with a signed value
between -16 and 15. This value is used to minimize offset during normal operation
Problem
The CALOFS bit is written a 1 by software with a bus access to initiate the calibration
offset function implemented in hardware. The CALOFS control bit is supposed to be
cleared by hardware upon completion of the offset calibration function, but the clock used
for the CALOFS bit is only active when the ADC registers are being accessed by software
and the hardware clearing mechanism does not work except when an ADC bus access is
in progress on the exact cycle that hardware is trying to clear the CALOFS bit. In the
failing case where CALOFS does not clear after the offset calibration function, the ADC
logic begins the calibration offset function again. This results in an indefinite loop that can
only be terminated by a system reset or some form of polling of the ADC registers that
coincides with the successful clearance of the CALOFS bit.
Work-around
LPC55S6x
Errata sheet LPC55S6x
To clear the OFSTRIM-request, read the register STATUS (poll for the CAL_RDY bit in
the STATUS register). The polling for the bit is enough to ensure that the request is
cleared.
This issue is fixed on device revision 1B.
3.15 ADC.3: Sign-extend calibration results for averaging is not supported
Introduction
The ADC controller is available on all LPC55S6x devices.
The ADC module includes offset and linearity calibration logic. A request for calibration
should be made any time upon reset or power up. Each SAR conversion will utilize
calibration data calculated during the auto-calibration routine.
Problem
Sign-extend calibration values for averaging is not supported (averaging of negative
numbers in the offset calibration).
Work-around
Software-based averaging can be used as a work-around.
3.16 GPIO.1: During power-up, an unexpected glitch (low pulse) could
occur on port pins (PIO0_28, PIO1_1, PIO1_18, PIO1_30).
Introduction
To wake up from reduced power modes, the wake-up source must be properly configured.
Each reduced power mode supports its own wake-up sources and needs to be configured
accordingly.
Problem
An unexpected glitch (low pulse for around 200 us) could occur on port pins (PIO0_28,
PIO1_1, PIO1_18, PIO1_30) as the VDD supply ramps up. This glitch does not occur
when device wakes up from sleep, deep-sleep, power-down, and deep power-down
modes.
Work-around
There is no work-around.
This issue is fixed in the silicon revision 1B.
LPC55S6x
Errata sheet LPC55S6x
3.17 I2S.1: I2S signal sharing is not functional
Introduction
Signal sharing allows more than one on-chip I2S interface to be connected to a clock, WS,
and input data on the same pins without the need for any external board wiring. I2S signal
sharing allows the use of multiple I2S that function together in a single TDM stream thus
reducing the number of pins that are required for a particular application.
Problem
The I2S signal sharing feature is not functional.
Work-around
There is no work-around.
This issue is fixed in device revision 1B.
3.18 AES.1: Keys are not available when Cortex-M33 is running a security
level less than 3
Introduction
The security system on LPC55S6x has a set of hardware blocks and ROM code to
implement the security features provided by the device. The hardware consists of an AES,
SHA, and PRINCE engine, a random number generator, and a key storage block that can
wrap user provided keys and derive device unique keys from an SRAM based PUF
(Physically Unclonable Function). The wrapped keys and derived keys are exported by
PUF to firmware in key codes (encrypted data) through the SET_KEY and GEN_KEY
commands.
During key code generation, the KEY_INDEX parameter can be specified, which
determines the output path of the unwrapped plain key values. Keys wrapped with
KEY_INDEX set to 0 are only provided to hardware engines (AES & PRINCE) through a
secret bus; these keys are also referred to as secret keys. All other keys with KEY_INDEX
set from 1 to 15 are provided through the registers interface. Also, when you choose not to
use the TrustZone mechanism, you cannot use the secret keys (KEY_INDEX = 0) with the
AES engine. Instead, you have to use the software supplied key.
Problem
Hardware logic makes all secret keys passed from PUF to the AES engine unusable
unless firmware running on the Cortex-M33 accesses the HashCrypt engine at
secure-privilege level 3. Thus, firmware should be written to make sure the Cortex-M33
uses the appropriate secure-privilege mode before configuring the AES engine to use
secret keys. In addition, the TrustZone mechanism must be enabled to use secret keys
(KEY_INDEX = 0) with the AES engine.
Work-around
To use secret keys with the AES engine, firmware should make sure that the Cortex-M33
is at secure-privilege level 3 before configuring the AES engine registers.
User applications which disable the TrustZone mechanism cannot use secret keys.
There is no workaround.
LPC55S6x
Errata sheet LPC55S6x
This issue is fixed in device revision 1B.
3.19 Powerquad.1: Format issue in matrix scale function
Introduction
A PowerQuad DSP Coprocessor and Accelerator are available on all LPC55S6x devices.
A matrix operation (Add, Sub, Dot, Prod, Mult, Inverse, Transpose, and Scale) is provided
for the DSP.
Problem
When using the matrix scale operation, in floating number to fixed one conversion, every
8th number is wrong.
Work-around
Do not mix fixed and float operands. As long as all operands and results are either fixed or
float, then there is no issue.
This issue is fixed in device revision 1B.
3.20 Powerquad.2: Floating point to integer converter scaling issue
Introduction
A PowerQuad DSP Coprocessor and Accelerator is available on all LPC55S6x devices.
For each co-processor output, and for AHB data converter for streaming operations write
back, a floating point to fixed point conversion can be performed, while allowing the user
to adjust the floating point's numbers exponent value before the conversion. As a result, a
scaling by 2^^N of the floating-point value can occur when it gets converted. In the case of
co-processor opcodes, this feature is useful in order to 'upscale' by taking numbers which
have a fractional component and multiplying them by a power of two to increase the
resolution in the resulting integer. In the case of AHB data writeback, it is possible to
'upscale' or 'downscale' the floating-point number.
Problem
When performing a downscale, the result for a floating-point value of 0 is an overflow of
the exponent field, resulting in saturation.
whether down-scaled or up-scaled, should result in 0.
When performing an upscale, results are correct, except in the case where a very large
number's exponent combined with the up-scaling exceeds 2^^127. In this case, the
overflow detection may not work, and saturation may not be correctly engaged due to the
overflow in the exponent field. A negative prescaler (2^x prescaler where x is negative)
cannot be used.
Work-around
Use floating numbers if fractional numbers are needed.
On the LPC55S6x, a wake-up I/O cause register is available to identify the wake-up I/O
(WAKEUP pins) source from deep power-down mode.
Problem
Before entering DEEP-POWER-DOWN, the following configuration is set for the wake-up
sources:
• Wake-up I/O 0 as falling edge.
• Wake up I/O 1 as rising edge.
• Wake up I/O 2 is disabled.
• Wake up I/O 3 as falling edge.
1st case: The first wake up event is a rising edge on wake up I/O 1.
PMC->WAKEIOCAUSE will indicate Wake-up I/O 0 trigger (wrong), Wake up I/O 1 trigger
(correct) and Wake up I/O 3 trigger (wrong) as wake up I/O cause.
2nd case: The first wake up event is a falling edge on wake up I/O 3.
PMC->WAKEIOCAUSE will indicate Wake-up I/O 0 trigger (wrong) and Wake up I/O 3
trigger (correct) as wake up I/O cause.
3rd case: The first wake up event is an RTC. PMC->WAKEIOCAUSE will indicate
Wake-up I/O 0 trigger (wrong) and Wake up I/O 3 trigger (wrong) as wake up I/O cause.
Work-around
None. This issue does not occur when the wake I/O is not configured as falling edge.
3.22 USB.5: In USB high-speed device mode, device writes extra byte(s) to
the buffer if the NBytes is not multiple of 8 for OUT transfer
Introduction
The LPC55S6x device family include a USB high-speed interface (USB1) that can operate
in device mode at high-speed. The NBytes value represents the number of bytes that can
be received in the buffer.
Problem
The LPC55S6x USB device controller writes extra bytes to the receive data buffer if the
size of the transfer is not a multiple of 8 bytes since the USB device controller always
writes 8 bytes. For example, if the transfer length is 1 bytes, 7 extra bytes will be written to
the receive data buffer. If the transfer length is 7 bytes, 1 extra bytes will be written to the
receive data buffer.
Work-around
Reserve an additional, intermediary buffer along with the buffer used by the application for
USB data. After the USB data transfer into the intermediary buffer has been completed,
use memcpy to move the data from the intermediary buffer into the application buffer,
skipping the extraneous extra byte. This software work-around is implemented on the
SDK software platform.
5.1 ROM bootloader updated to provide API functionality for entry to ISP
mode
ISP.1: Devices with date code 2113 (yyww) and ROM patch version (T1.1.5), the ROM
bootloader will be updated to provide an API (runBootloader API) for the user application
to enter the ISP mode based on the designated ISP interface mode.