ST ST10F296E User Manual

16-bit MCU with MAC unit, 832 Kbyte Flash memory

www.BDTIC.com/ST

Features

■ High performance 16-bit CPU with DSP

functions
– 31.25 ns instruction cycle time at 64 MHz

max CPU clock

– Multiply/accumulate unit (MAC) 16 x 16-bit

multiplication, 40-bit accumulator

– Enhanced boolean bit manipulation

facilities

– Single-cycle context switching support

■ Memory organization

– 512 Kbyte Flash memory (32-bit fetch)
– 320 Kbyte extension Flash memory

(16-bit fetch)
– 100 k erasing/programming cycles
– Up to 16 Mbyte linear address space for

code and data (5 Mbytes with CAN or I
– 2 Kbyte on-chip internal RAM (IRAM)
– 66 Kbyte on-chip extension RAM (XRAM)
– Programmable external bus characteristics

for different address ranges
– Five programmable chip-select signals
– Hold-acknowledge bus arbitration support

■ Interrupt

– 8-channel peripheral event controller for

single cycle interrupt driven data transfer
– 16-priority-level interrupt system with 56

sources, sampling rate down to 15.6 ns

■ Timers

– Two multi-functional general purpose timer

units with 5 timers

■ Two 16-channel capture/compare units

■ Analog-to-digital converter (ADC)

– 32-channel 10-bit
–3 µs minimum conversion time
– TImer for ADC channel injection

■ 4-channel PWM unit and 4-channel XPWM

ST10F296E

and 68 Kbyte RAM

PBGA 208

(23 x 23 x 1.96 mm)

■ Serial channels

– Two synchronous/asynch. serial channels
– Two high-speed synchronous channels

2

C standard interface

–I

■ Two CAN 2.0B interfaces operating on one or

two CAN busses (64 or 2 x 32 message
objects, C-CAN version)

2

C)

■ Fail-safe protection

– Programmable watchdog timer
– Oscillator watchdog

■ On-chip bootstrap loader

■ Clock generation

– On-chip PLL and 4-12 MHz oscillator
– Direct or prescaled clock input

■ Real-time clock

■ Up to 143 general purpose I/O lines

– Individually programmable as input, output

or special function

– Programmable threshold (hysteresis)

■ Idle, power-down and stand-by modes

■ single voltage supply: 5 V ±10% (embedded

regulator for 1.8 V core supply).

Table 1. Device summary

Order codes

ST10F296

ST10F296TR

Temp. range

(°C)

-40 to 125 1 to 64

CPU freq. range

(MHz)

October 2008 Rev 2 1/346

www.st.com

1

Contents ST10F296E

www.BDTIC.com/ST

Contents

1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

2 Ball data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3 Functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4 Memory organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4.1 IFlash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4.2 XFlash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

4.3 Internal RAM (IRAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

4.4 Extension RAM (XRAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

4.5 Special function register (SFR) areas . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

4.6 CAN1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

4.7 CAN2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4.8 Real-time clock (RTC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4.9 Pulse-width modulation 1 (PWM1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4.10 ASC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4.11 SSC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4.12 I

4.13 XTimer/XMiscellaneous . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

4.14 XPort 9/XPort 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

4.15 Visibility of XBus peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

4.16 XPeripheral configuration registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

2

C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

5 Internal Flash memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

5.1 Functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

5.1.1 Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

5.1.2 Module structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

5.1.3 Low power mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

2/346

5.2 Write operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

5.2.1 Power supply drop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

5.3 Internal Flash memory registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

ST10F296E Contents

www.BDTIC.com/ST

5.4 Protection strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

5.4.1 Protection registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

5.4.2 Access protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

5.4.3 Write protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.4.4 Temporary unprotection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.5 Write operation examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.5.1 Word program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.5.2 Double word program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.5.3 Sector erase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.5.4 Suspend and resume . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.5.5 Erase suspend, program and resume . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.5.6 Set protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

5.6 Write operation summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

6 The bootstrap loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

6.1 Selection among user-code, standard or alternate bootstrap . . . . . . . . . 66

6.2 Standard bootstrap loader (BSL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

6.2.1 Entering the standard bootstrap loader . . . . . . . . . . . . . . . . . . . . . . . . . 67

6.2.2 ST10 configuration in BSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

6.2.3 Booting steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

6.2.4 Hardware to activate BSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

6.2.5 Memory configuration in bootstrap loader mode . . . . . . . . . . . . . . . . . . 71

6.2.6 Loading the startup code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

6.2.7 Exiting bootstrap loader mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

6.2.8 Hardware requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

6.3 Standard bootstrap with UART (RS232 or K-line) . . . . . . . . . . . . . . . . . . 73

6.3.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

6.3.2 Entering bootstrap via UART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

6.3.3 ST10 configuration in UART BSL (RS232 or K-line) . . . . . . . . . . . . . . . 75

6.3.4 Loading the startup code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

6.3.5 Choosing the baud rate for the BSL via UART . . . . . . . . . . . . . . . . . . . 76

6.4 Standard bootstrap with CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

6.4.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

6.4.2 Entering the CAN bootstrap loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

6.4.3 ST10 configuration in CAN BSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

6.4.4 Loading the startup code via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

3/346

Contents ST10F296E

www.BDTIC.com/ST

6.4.5 Choosing the baud rate for the BSL via CAN . . . . . . . . . . . . . . . . . . . . 82

6.4.6 How to compute the baud rate error . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

6.4.7 Bootstrap via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

6.5 Comparing the old and the new bootstrap loader . . . . . . . . . . . . . . . . . . 85

6.5.1 Software aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

6.5.2 Hardware aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

6.6 Alternate boot mode (ABM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

6.6.1 Activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

6.6.2 Memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

6.6.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

6.6.4 ST10 configuration in alternate boot mode . . . . . . . . . . . . . . . . . . . . . . 87

6.6.5 Watchdog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

6.6.6 Exiting alternate boot mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

6.6.7 Alternate boot user software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

6.6.8 User/alternate boot mode signature check . . . . . . . . . . . . . . . . . . . . . . 88

6.6.9 Alternate boot user software aspects . . . . . . . . . . . . . . . . . . . . . . . . . . 89

6.6.10 Internal decoding of test modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

6.6.11 Example of alternate boot mode operation . . . . . . . . . . . . . . . . . . . . . . 89

6.7 Selective boot mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

7 Central processing unit (CPU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

7.1 Multiplier-accumulator unit (MAC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

7.2 Instruction set summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

7.3 MAC coprocessor specific instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

8 External bus controller (EBC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

8.1 Programmable chip select timing control . . . . . . . . . . . . . . . . . . . . . . . . . 98

8.2 READY

8.3 EA

programmable polarity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

9 Interrupt system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

9.1 XPeripheral interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

10 Capture/compare (CAPCOM) units . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

4/346

9.2 Exception and error traps list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

ST10F296E Contents

www.BDTIC.com/ST

11 General purpose timer unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

11.1 GPT1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

11.2 GPT2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

12 Pulse-width modulation (PWM) modules . . . . . . . . . . . . . . . . . . . . . . 114

12.1 XPWM output signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

12.2 XPWM registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

12.2.1 Software control of the XPWM outputs . . . . . . . . . . . . . . . . . . . . . . . . 116

13 Parallel ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

13.1 I/O special features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

13.1.1 Open-drain mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

13.1.2 Input threshold control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

13.1.3 I/0 port registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

13.1.4 Alternate port functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

13.2 Port 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

13.2.1 Port 0 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

13.2.2 Alternate functions of Port 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

13.3 Port 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

13.3.1 Port 1 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

13.3.2 Alternate functions of Port 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

13.4 Port 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

13.4.1 Port 2 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

13.4.2 Alternate functions of Port 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

13.4.3 Port 2 and external interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

13.5 Port 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

13.5.1 Port 3 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

13.5.2 Alternate functions of Port 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

13.6 Port 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

13.6.1 Port 4 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

13.6.2 Alternate functions of Port 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

13.7 Port 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

13.7.1 Port 5 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

13.7.2 Alternate functions of port 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

13.7.3 Port 5 analog inputs disturb protection . . . . . . . . . . . . . . . . . . . . . . . . 152

13.8 Port 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

5/346

Contents ST10F296E

www.BDTIC.com/ST

13.8.1 Port 6 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

13.8.2 Alternate functions of Port 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

13.9 Port 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

13.9.1 Port 7 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

13.9.2 Alternate functions of Port 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

13.10 Port 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

13.10.1 Port 8 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

13.10.2 Alternate functions of Port 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

13.11 XPort 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

13.11.1 XPort 9 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

13.12 XPort 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

13.12.1 XPort 10 registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

13.12.2 Alternate functions of XPort 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

13.12.3 XPort 10 analog inputs disturb protection . . . . . . . . . . . . . . . . . . . . . . 174

14 Analog-to-digital converter (ADC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

14.1 Mode selection and operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

14.2 Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

14.3 XTimer module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

14.3.1 Main features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

15 Serial channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

15.1 Asynchronous/synchronous serial interface (ASC0) . . . . . . . . . . . . . . . 183

15.1.1 ASC0 in asynchronous mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

15.1.2 Asynchronous mode baud rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

15.1.3 ASC0 in synchronous mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

15.1.4 Synchronous mode baud rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

15.2 Asynchronous/synchronous serial interface (ASC1) . . . . . . . . . . . . . . . 188

15.3 High speed synchronous serial interface (SSC0) . . . . . . . . . . . . . . . . . . 188

15.3.1 Baud rate generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

15.4 High speed synchronous serial interface (SSC1) . . . . . . . . . . . . . . . . . . 190

16 I2C interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

17 CAN modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

6/346

16.1 I2C bus speed selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

ST10F296E Contents

www.BDTIC.com/ST

17.1 CAN module memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

17.1.1 CAN1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

17.1.2 CAN2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

17.2 Configuration support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

17.3 Clock prescaling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

17.4 CAN bus configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

17.4.1 Single CAN bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

17.4.2 Multiple CAN bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

17.4.3 Parallel mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

17.5 System clock tolerance range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

17.6 Configuration of the CAN controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

17.7 Calculation of the bit timing parameters . . . . . . . . . . . . . . . . . . . . . . . . . 200

17.7.1 Example of bit timing at high baud rate . . . . . . . . . . . . . . . . . . . . . . . . 201

17.7.2 Example of bit timing at low baud rate . . . . . . . . . . . . . . . . . . . . . . . . . 202

18 Real-time clock (RTC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

18.1 RTC registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

18.2 Programming the RTC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

19 Watchdog timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

20 System reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

20.1 Input filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

20.2 Asynchronous reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

20.2.1 Power-on reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

20.2.2 Hardware reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

20.2.3 Exit from asynchronous reset state . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

20.3 Synchronous reset (warm reset) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

20.3.1 Short and long synchronous reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

20.3.2 Exit from synchronous reset state . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

20.3.3 Synchronous reset and the RPD pin . . . . . . . . . . . . . . . . . . . . . . . . . . 222

20.4 Software reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

20.5 Watchdog timer reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

20.6 Bidirectional reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

20.6.1 WDTCON flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

20.7 Reset circuitry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

7/346

Contents ST10F296E

www.BDTIC.com/ST

20.8 Reset application examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235

20.9 Reset summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

21 Power reduction modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

21.1 Idle mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

21.2 Power-down mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

21.2.1 Protected power-down mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

21.2.2 Interruptible power-down mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

21.3 Standby mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

21.3.1 Entering standby mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

21.3.2 Exiting standby mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

21.4 Power reduction modes summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

22 Programmable output clock divider . . . . . . . . . . . . . . . . . . . . . . . . . . 247

23 Register set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

23.1 Register description format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

23.2 General purpose registers (GPRs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

23.3 SFRs ordered by name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

23.4 SFRs ordered by address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

23.5 X registers ordered by name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

23.6 X registers ordered by address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

23.7 Flash registers ordered by name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

23.8 Flash registers ordered by address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

23.9 Identification registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

23.10 System configuration registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

23.10.1 XPEREMU register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

23.11 Emulation dedicated registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

24 Electrical characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

24.1 Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

8/346

24.2 Recommended operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

24.3 Power considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

24.4 Parameter interpretation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

24.5 DC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

ST10F296E Contents

www.BDTIC.com/ST

24.6 Flash characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

24.7 ADC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302

24.7.1 Conversion timing control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303

24.7.2 ADC conversion accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

24.7.3 Analog reference pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

24.7.4 Analog input pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

24.7.5 Example of external network sizing . . . . . . . . . . . . . . . . . . . . . . . . . . . 310

24.8 AC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

24.8.1 Test waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

24.8.2 Definition of internal timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

24.8.3 Clock generation modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313

24.8.4 Prescaler operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

24.8.5 Direct drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

24.8.6 Oscillator watchdog (OWD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

24.8.7 Phase-locked loop (PLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

24.8.8 Voltage controlled oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

24.8.9 PLL jitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

24.8.10 Jitter in the input clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

24.8.11 Noise in the PLL loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

24.8.12 PLL lock/unlock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

24.8.13 Main oscillator specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

24.8.14 External clock drive XTAL1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

24.8.15 Memory cycle variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

24.8.16 External memory bus timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

24.8.17 READY

24.8.18 External bus arbitration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

24.8.19 High-speed synchronous serial interface (SSC) timing modes . . . . . . 338

and CLKOUT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

25 Package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

26 Ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

27 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345

9/346

List of tables ST10F296E

www.BDTIC.com/ST

List of tables

Table 1. Device summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Table 2. Ball description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Table 3. Address ranges for IFlash. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Table 4. Address ranges for IFlash. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Table 5. XPERCON register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Table 6. Segment 8 address range mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Table 7. Flash module absolute mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Table 8. Sectorization of the Flash modules (read operations) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Table 9. Sectorization of the Flash modules (write operations or with ROMS1 = 1) . . . . . . . . . . . . 44

Table 10. Control register interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Table 11. FCR0L register decription. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Table 12. FCR0H register decription . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Table 13. FCR1L register description (SMOD = 0, XFlash selected) . . . . . . . . . . . . . . . . . . . . . . . . . 50

Table 14. FCR1L register description (SMOD = 1, IFlash selected). . . . . . . . . . . . . . . . . . . . . . . . . . 50

Table 15. FCR1H register description (SMOD = 0, XFlash selected). . . . . . . . . . . . . . . . . . . . . . . . . 51

Table 16. FCR1H register description (SMOD = 1, IFlash selected) . . . . . . . . . . . . . . . . . . . . . . . . . 52

Table 17. Banks (BxS) and sectors (BxFy) status bits meaning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Table 18. FDR0L register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Table 19. FDR0H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Table 20. FDR1L register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Table 21. FDR1H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Table 22. FARL register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Table 23. FARH register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Table 24. FER register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Table 25. XFICR register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Table 26. FNVWPXRL register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Table 27. FNVWPXRH register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Table 28. FNVWPIRL register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Table 29. FNVWPIRH register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Table 30. FNVAPR0 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Table 31. FNVAPR1L register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Table 32. FNVAPR1H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Table 33. Summary of access protection levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Table 34. Flash write operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Table 35. ST10F296E boot mode selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Table 36. ST10 configuration in BSL mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Table 37. ST10 configuration in UART BSL mode (RS232 or K-line). . . . . . . . . . . . . . . . . . . . . . . . . 75

Table 38. ST10 configuration in CAN BSL mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Table 39. Timer content ranges of BRP value in Equation 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Table 40. Software topics summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Table 41. Hardware topics summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Table 42. ST10 configuration in alternate boot mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Table 43. EMUCON register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Table 44. Selective boot mode configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Table 45. Instruction set summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Table 46. MAC instruction set summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Table 47. Interrupt sources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Table 48. XInterrupt detailed mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

10/346

ST10F296E List of tables

www.BDTIC.com/ST

Table 49. Trap priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Table 50. Compare modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Table 51. CAPCOM timer input frequencies, resolution, and periods at 40 MHz . . . . . . . . . . . . . . . 109

Table 52. CAPCOM timer input frequencies, resolution, and periods at 64 MHz . . . . . . . . . . . . . . . 109

Table 53. GPT1 timer input frequencies, resolution, and periods at 40 MHz . . . . . . . . . . . . . . . . . . 111

Table 54. GPT1 timer input frequencies, resolution, and periods at 64 MHz . . . . . . . . . . . . . . . . . . 111

Table 55. GPT2 timer input frequencies, resolution, and period at 40 MHz . . . . . . . . . . . . . . . . . . . 112

Table 56. GPT2 timer input frequencies, resolution, and period at 64 MHz . . . . . . . . . . . . . . . . . . . 112

Table 57. PWM unit frequencies and resolution at 40 MHz CPU clock . . . . . . . . . . . . . . . . . . . . . . 114

Table 58. PWM unit frequencies and resolution at 64 MHz CPU clock . . . . . . . . . . . . . . . . . . . . . . 115

Table 59. XPOLAR register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Table 60. XPWMPORT register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Table 61. PICON register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Table 62. XPICON register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

Table 63. XPICON9 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Table 64. XPICON9SET register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Table 65. XPICON9CLR register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Table 66. XPICON10 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Table 67. P0L and P0H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

Table 68. DP0L and DP0H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Table 69. P1L and P1H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

Table 70. DP1L and DP1H register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Table 71. P2 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Table 72. DP2 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Table 73. ODP2 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Table 74. Alternate functions of Port 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Table 75. EXISEL register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Table 76. External interrupt selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Table 77. P3 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Table 78. DP3 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Table 79. ODP3 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Table 80. Port 3 alternative functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Table 81. P4 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Table 82. DP4 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Table 83. ODP4 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Table 84. Port 4 alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Table 85. P5 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Table 86. Port 5 alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Table 87. P5DIDIS register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Table 88. P6 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Table 89. DP6 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Table 90. ODP6 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Table 91. ODP6 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Table 92. Port 6 alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Table 93. P7 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Table 94. DP7 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Table 95. ODP7 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Table 96. Port 7 alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Table 97. P8 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Table 98. DP8 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Table 99. ODP8 register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

Table 100. XS1PORT register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

11/346

List of tables ST10F296E

www.BDTIC.com/ST

Table 101. Port 8 alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Table 102. XP9 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Table 103. XP9SET register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Table 104. XP9CLR register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Table 105. XDP9 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Table 106. XDP9SET register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Table 107. XDP9CLR register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Table 108. XODP9 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Table 109. XODP9SET register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Table 110. XODP9CLR register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

Table 111. XP10 register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

Table 112. XPort 10 alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Table 113. XP10DIDIS register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Table 114. XP10DIDISSET register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

Table 115. XP10DIDISCLR register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

Table 116. ADC programming at f

= 64 MHz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

CPU

Table 117. Different counting modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Table 118. Commonly used baud rates by reload value and deviation error

= 40 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

(f

CPU

Table 119. Commonly used baud rates by reload value and deviation error

= 64 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

(f

CPU

Table 120. Commonly used baud rates by reload value and deviation error

= 40 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

(f

CPU

Table 121. Commonly used baud rates by reload value and deviation errors

= 64 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

(f

Table 122. Synchronous baud rate and reload values (f

CPU

Table 123. Synchronous baud rate and reload values (f

= 40 MHz) . . . . . . . . . . . . . . . . . . . . . . 189

CPU

= 64 MHz) . . . . . . . . . . . . . . . . . . . . . . 190

CPU

Table 124. RTCCON register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Table 125. EXISEL register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Table 126. Interrupt sources associated with the RTC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Table 127. WDTCON register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Table 128. WDTCON bit values on different resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Table 129. WDTREL reload value (f
Table 130. WDTREL reload value (f

= 40 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

CPU

= 64 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

CPU

Table 131. Reset event definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Table 132. Reset events summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Table 133. Latched configurations of Port 0 for the different reset events . . . . . . . . . . . . . . . . . . . . . 238

Table 134. EXICON register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Table 135. Power reduction modes summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Table 136. XCLKOUTDIV register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Table 137. Word register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

Table 138. General purpose registers (GPRs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Table 139. General purpose registers (GPRs) bit wise addressing . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Table 140. SFRs ordered by name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

Table 141. SFRs ordered by address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Table 142. X registers ordered by name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

Table 143. X registers ordered by address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Table 144. Flash registers ordered by name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Table 145. Flash registers ordered by address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Table 146. IDMANUF register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Table 147. IDCHIP register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Table 148. IDMEM register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

12/346

ST10F296E List of tables

www.BDTIC.com/ST

Table 149. IDPROG register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Table 150. SYSCON register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Table 151. BUSCONx register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Table 152. RP0H register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Table 153. EXICON register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

Table 154. EXISEL register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

Table 155. External interrupt selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

Table 156. xxIC register description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

Table 157. XPERCON register description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

Table 158. Segment 8 address range mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Table 159. Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Table 160. Recommended operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

Table 161. Thermal characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Table 162. Package characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Table 163. DC characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Table 164. Flash characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

Table 165. Data retention characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301

Table 166. ADC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302

Table 167. ADC programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Table 168. On-chip clock generator selections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313

Table 169. Internal PLL divider mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

Table 170. PLL lock/unlock timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Table 171. Main oscillator specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Table 172. Negative resistance (absolute min value @125 °C/V

Table 173. External clock drive timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Table 174. Memory cycle variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Table 175. Multiplexed bus timings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

Table 176. Demultiplexed bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

Table 177. READY

Table 178. External bus arbitration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

Table 179. Master mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

Table 180. Slave mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340

Table 181. PBGA 208 (23 x 23 x 1.96 mm) mechanical data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343

Table 182. Order codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

Table 183. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345

and CLKOUT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

= 4.5 V) . . . . . . . . . . . . . . . . . . . 320

DD

13/346

List of figures ST10F296E

www.BDTIC.com/ST

List of figures

Figure 1. Logic diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Figure 2. Pin configuration (bottom view) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Figure 3. Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Figure 4. ST10F296E on-chip memory mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Figure 5. Flash modules structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Figure 6. ST10F296E new standard bootstrap loader program flow . . . . . . . . . . . . . . . . . . . . . . . . . 69

Figure 7. Booting steps for the ST10F296E. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Figure 8. Hardware provisions to activate the BSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Figure 9. Memory configuration after reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Figure 10. UART bootstrap loader sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Figure 11. Baud rate deviation between the host and ST10F296E . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Figure 12. CAN bootstrap loader sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Figure 13. Bit rate measurement over a predefined zero-frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Figure 14. Reference signature computation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Figure 15. Reset boot sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Figure 16. CPU block diagram (MAC unit not included) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Figure 17. MAC unit architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Figure 18. Chip select delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

Figure 19. EA

Figure 20. XInterrupt basic structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Figure 21. CAPCOM unit block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Figure 22. Block diagram of CAPCOM timers T0 and T7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Figure 23. Block diagram of CAPCOM timers T1 and T8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Figure 24. Block diagram of GPT1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Figure 25. Block diagram of GPT2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Figure 26. Block diagram of PWM module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Figure 27. XPWM output signal generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Figure 28. SFRs and pins associated with the parallel ports (A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Figure 29. SFRs and pins associated with the parallel ports (B) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Figure 30. Output drivers in push-pull mode and in open-drain mode . . . . . . . . . . . . . . . . . . . . . . . . 124

Figure 31. Hysteresis concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Figure 32. Port 0 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Figure 33. Block diagram of a Port 0 pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Figure 34. Port 1 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Figure 35. Block diagram of a Port 1 pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Figure 36. Port 2 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Figure 37. Block diagram of a Port 2 pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Figure 38. Port 3 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

Figure 39. Block diagram of a Port 3 pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Figure 40. Block diagram of pins P3.15 (CLKOUT) and P3.12 (BHE

Figure 41. Port 4 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Figure 42. Block diagram of Port 4 pins 3 to 0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Figure 43. Block diagram of pin P4.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

Figure 44. Block diagram of pin P4.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Figure 45. Block diagram of pin P4.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Figure 46. Block diagram of pin P4.7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Figure 47. Port 5 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Figure 48. Block diagram of a Port 5 pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

/V

external circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

STBY

/WRH) . . . . . . . . . . . . . . . . . . . 142

14/346

ST10F296E List of figures

www.BDTIC.com/ST

Figure 49. Port 6 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Figure 50. Block diagram of Port 6 pins 7, 6, 1, 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

Figure 51. Block diagram of pin P6.5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Figure 52. Block diagram of pins P6.2, P6.3, and P6.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Figure 53. Port 7 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Figure 54. Block diagram of Port 7 pins 3 to 0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Figure 55. Block diagram of Port 7 pins 7 to 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Figure 56. Port 8 I/O and alternate functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Figure 57. Block diagram of P8 pins 5 to 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Figure 58. Block diagram of pin P8.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Figure 59. Block diagram of pin P8.7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

Figure 60. XPort 10 I/O and alternate functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Figure 61. Block diagram of an XPort 10 pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Figure 62. ADC block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Figure 63. XTimer block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Figure 64. Asynchronous mode of serial channel ASC0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Figure 65. Synchronous mode of serial channel ASC0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Figure 66. Synchronous serial channel SSC0 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Figure 67. Connection to a single CAN bus via separate CAN transceivers . . . . . . . . . . . . . . . . . . . 194

Figure 68. Connection to a single CAN bus via common CAN transceivers . . . . . . . . . . . . . . . . . . . 194

Figure 69. Connection to two different CAN buses (example for gateway application) . . . . . . . . . . . 195

Figure 70. Connection to one CAN bus with internal parallel mode enabled. . . . . . . . . . . . . . . . . . . 195

Figure 71. ESFRs and port pins associated with the RTC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Figure 72. RTC block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Figure 73. Prescaler registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Figure 74. Divider counter registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Figure 75. Asynchronous power-on reset (EA
Figure 76. Asynchronous power-on reset (EA
Figure 77. Asynchronous hardware reset (EA
Figure 78. Asynchronous hardware reset (EA
Figure 79. Synchronous short/long hardware reset (EA
Figure 80. Synchronous short/long hardware reset (EA
Figure 81. Synchronous long hardware reset (EA
Figure 82. Synchronous long hardware reset (EA
Figure 83. Software/watchdog timer unidirectional reset (EA
Figure 84. Software/watchdog timer unidirectional reset (EA
Figure 85. Software/watchdog timer bidirectional reset (EA
Figure 86. Software/watchdog timer bidirectional reset (EA
Figure 87. Software/watchdog timer bidirectional reset (EA

Figure 88. Minimum external reset circuitry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Figure 89. System reset circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Figure 90. Example of software or watchdog bidirectional reset (EA
Figure 91. Example of software or watchdog bidirectional reset (EA

Figure 92. Port 0 bits latched into the different registers after reset . . . . . . . . . . . . . . . . . . . . . . . . . 239

Figure 93. External RC circuit on the RPD

Figure 94. Simplified power-down exit circuitry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Figure 95. Power-down exit sequence when using an external interrupt (PLL x 2). . . . . . . . . . . . . . 243

Figure 96. Port 2 test mode structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

Figure 97. Supply current versus the operating frequency (run and idle modes) . . . . . . . . . . . . . . . 299

Figure 98. AD conversion characteristic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

Figure 99. ADC input pins scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

Figure 100. Charge sharing timing diagram during sampling phase . . . . . . . . . . . . . . . . . . . . . . . . . . 307

= 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

= 0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

= 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

= 0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

= 1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

= 0). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

= 1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

= 0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

= 1). . . . . . . . . . . . . . . . . . . . . . . . . . . 227

= 0). . . . . . . . . . . . . . . . . . . . . . . . . . . 228

= 1). . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

= 0). . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

= 0) followed by a hardware reset . . . . 232

= 1) . . . . . . . . . . . . . . . . . . . . . 235

= 0) . . . . . . . . . . . . . . . . . . . . . 236

pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

15/346

List of figures ST10F296E

www.BDTIC.com/ST

Figure 101. Anti-aliasing filter and conversion rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

Figure 102. Input/output waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Figure 103. Float waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

Figure 104. Generation mechanisms for the CPU clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313

Figure 105. ST10F296E PLL jitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318

Figure 106. ST10F296ECrystal oscillator and resonator connection diagram. . . . . . . . . . . . . . . . . . . 320

Figure 107. External clock drive XTAL1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Figure 108. Multiplexed bus with/without R/W delay and normal ALE. . . . . . . . . . . . . . . . . . . . . . . . . 324

Figure 109. Multiplexed bus with/without R/W delay and extended ALE . . . . . . . . . . . . . . . . . . . . . . 325

Figure 110. Multiplexed bus with/without R/W delay, normal ALE, R/W CS
Figure 111. Multiplexed bus with/without R/ W delay, extended ALE, R/W CS

Figure 112. Demultiplexed bus with/without read/write delay and normal ALE . . . . . . . . . . . . . . . . . . 330

Figure 113. Demultiplexed bus with/without R/W delay and extended ALE . . . . . . . . . . . . . . . . . . . . 331

Figure 114. Demultiplexed bus with ALE and R/W CS
Figure 115. Demultiplexed bus no R/W delay, extended ALE, R/W CS
Figure 116. READY

Figure 117. External bus arbitration (releasing the bus) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

Figure 118. External bus arbitration (regaining the bus) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

Figure 119. SSC master timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339

Figure 120. SSC slave timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341

Figure 121. PBGA 208 (23 x 23 x 1.96 mm) outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

and CLKOUT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

. . . . . . . . . . . . . . . . . . . . 326

. . . . . . . . . . . . . . . . . 327

. . . . . . . . . . . . . . . . . . . . . . . 333

16/346

ST10F296E Description

www.BDTIC.com/ST

1 Description

The ST10F296E is a derivative of the STMicroelectronics ST10 family of 16-bit single-chip
CMOS microcontrollers. It combines high CPU performance (up to 32 million instructions
per second) with high peripheral functionality and enhanced I/O-capabilities. It also provides
on-chip high-speed single voltage Flash memory, on-chip high-speed RAM, and clock
generation via the phase-locked loop (PLL).

ST10F296E is processed in 0.18 µm CMOS technology. The MCU core and the logic is
supplied with a 5 V to 1.8 V on-chip voltage regulator. The part is supplied with a single 5 V
supply and I/Os work at 5 V.

The device is upwardly compatible with the ST10F280 device, with the following differences:

● The Flash control interface is now based on STMicroelectronics third generation of

standalone Flash memories (M29F400 series), with an embedded program/erase
controller. This completely frees up the CPU during programming or erasing of the
Flash.

● Pins DC1 and DC2 of ST10F280, are renamed as V

5.0 V external supply. Instead, these pin should be connected to a decoupling capacitor
(ceramic type, typical value 10 nF, maximum value 100 nF).

● The AC and DC parameters are modified due to a difference in the maximum CPU

frequency.

● The EA pin has assumed a new, alternate functionality: It is also used to provide a

dedicated power supply (see V

) to maintain a portion of the XRAM (16 Kbytes)

STBY

biased when the main power supply of the device (V
generated V

) is turned off for low power mode, thereby allowing data retention. V

18

voltage is in the range 4.5-5.5 V, and a dedicated embedded low power voltage
regulator provides the 1.8 V for the RAM. The upper limit of up to 6 V may be exceeded
for a very short period of time during the global life of the device. The lower limit of 4 V
may also be exceeded.

● A second SSC, mapped on the XBus, has been added (SSC of ST10F280 becomes

SSC0, while the new SSC is referred to as XSSC or SSC1). There are some
restrictions and functional differences due to peculiarities present in the XBus between
the classic SSC and the new XSSC.

● A second ASC, mapped on the XBus, has been added (ASC0 of ST10F280 remains

ASC0, while the new one is referred to as XASC or ASC1). Some restrictions and
functional differences due to peculiarities present in the XBus between the classic
ASC, and the new XASC.

● The second PWM (XPWM), mapped on the XBus, has been improved adding set/clear

command for safe management of the control register. Memory mapping is thus slightly
different.

● An I

● The CLKOUT function can output either the CPU clock (as in ST10F280) or a software

2

C interface on the XBus has been added (see X-I2C or simply I2C interface).

programmable prescaled value of the CPU clock.

● the embedded memory size has been significantly increased (both Flash and RAM).

● PLL multiplication factors have been adapted to new frequency range.

. Do not connect these pins to

18

and consequently the internally

DD

STBY

17/346

Description ST10F296E

www.BDTIC.com/ST

● The ADC is not fully compatible with the ST10F280 (timing and programming model).

The formula for the convertion time is still valid, while the sampling phase programming
model is different.

● The external memory bus potential limitations on maximum speed and maximum

capacitance load are under evaluation and may be introduced: ST10F296E will
probably not be able to address an external memory at 64 MHz with 0 wait states.

● The XPERCON register bit mapping has been modified according to new peripheral

implementation (which is not fully compatible with ST10F280).

● The bondout chip for emulation (ST10R201) cannot achieve more than 50 MHz at room

temperature (so, no real-time emulation is possible at maximum speed).

● Input section characteristics are different. The threshold programmability is extended to

all port pins (additional XPICON register); it is possible to select standard TTL (with up
to 400 mV of hysteresis) and standard CMOS (with up to 750 mV of hysteresis).

● Output transition is not programmable.

● An RTC module has been added.

● The CAN module has been enhanced: ST10F296E implements two C-CAN modules,

so the programming model is slightly different. The possibility to map both CAN
modules simultaneously has been added (on P4.5/P4.6).

● The on-chip main oscillator input frequency range has been reshaped, reducing it from

1-25 MHz to 4-12 MHz. This is a high performance oscillator amplifier, that provides a
very high negative resistance and wide oscillation amplitude. When this on-chip
amplifier is used as a reference for the RTC module, the power-down consumption is
dominated by the consumption of the oscillator amplifier itself. A metal option is added
to offer a low power oscillator amplifier working in the range 4-8 MHz which allows a
power consumption reduction when the RTC is running in power-down mode using the
on-chip main oscillator clock as a reference.

● The possibility to reprogram the internal XBus chip select window characteristics

(XRAM2 and XFlash address window) has been added.

18/346

ST10F296E Description

www.BDTIC.com/ST

Figure 1. Logic diagram

V

V

DDVSS

18

XTAL1
XTAL2

RSTIN

RSTOUT

V

AREF

V

AGND

NMI

EA/V

STBY

READY

ALE

RD

WR/WRL

Port 5

16-bit

XPort 10

16-bit

XADCINJ

RPD

ST10F296E

Port 0
16-bit

Port 1
16-bit

Port 2
16-bit

Port 3
15-bit

Port 4
8-bit

Port 6
8-bit

Port 7
8-bit

Port 8
8-bit

XPort 9
16-bit

XPOUT
3-bit

19/346

Ball data ST10F296E

www.BDTIC.com/ST

2 Ball data

The ST10F296E package is a PBGA measuring 23 x 23 x 1.96 mm. Ball pitch is 1.27 mm.
Pin configuration is shown in Figure 2 while the signal assignment of the balls is given in

Ta bl e 2 . This package has 25 additional thermal balls.

Figure 2. Pin configuration (bottom view)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

U1

U

XP10.15U2V

T1

T

XP10.14T2P5.0T3P5.2T4P5.4T5P5.8T6P5.12T7P2.0T8P2.3T9P2.4

R1

R

XP10.13R2XP10.12R3P5.1R4P5.3R5P5.7R6P5.11R7P5.15R8P2.2R9P2.6

P1

P

XP10.11P2XP10.10P3XP10.9P4XP10.8P5P5.6P6P5.10P7P5.14P8P2.1P9P2.5

N1

N

XP10.7N2XP10.6N3XP10.5N4XP10.4

M1

M

XP10.3M2XP10.2M3XP10.1M4XP10.0

L1

L

V

SS

K1

K

V

DD

J1

J

P7.3J2P7.2J3P7.1J4P7.0

H1

H

V

SS

G1

G

V

18

F1

F

V

SS

E1

E

V

DD

D1

D

P6.7D2P6.4D3P6.1D4XPOUT0D5V

C1

C

P6.3C2XPOUT3C3XPOUT1C4NMIC5P1H.6C6P1H.7C7P1H.4C8P1H.0C9P1L.7

B1

B

P6.2B2XPOUT2B3V

A1

A

V

SS

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

U3

V

AREF

L2

P7.7L3XADCINJL4V

K2

P7.4K3P7.5K4P7.6

H2

P8.7H3P8.6H4P8.5

G2

P8.4G3P8.3G4V

F2

P8.2F3P8.1F4P6.6

E2

P8.0E3P6.5E4P6.0

A2

V

RSTINA4V

DD

U4

P5.5U5P5.9U6P5.13U7V

AGND

B4

RSTOUTB5V

SS

A3

SS

SS

D6

V

SS

B6

V

SS

A5

XTAL1A6XTAL2A7P1H.2A8V

SS

SS

L7

V

SS

K7

V

SS

J7

V

SS

H7

V

SS

G7

V

SS

D7

P1H.5D8P1H.1D9P1L.6

SS

B7

P1H.3B8V

SS

U8

U9

U10

U11

U12

U13

U14

U15

U16

U17

V

P2.7

V

V

P2.13

V

V

V

DD

L8

V

SS

K8

V

SS

J8

V

SS

H8

V

SS

G8

V

SS

SS

SS

SS

18

T10

T11

P2.8

P2.11

R10

R11

P2.9

P2.12

P10

P11

P2.10

P2.14

L9

L10
V

SS

K10
V

SS

J10
V

SS

H10
V

SS

G10
V

SS

D10

P1L.2

C10

P1L.3

B10

P1L.4

A10

P1L.5

L11
V

SS

K11
V

SS

J11
V

SS

H11
V

SS

G11
V

SS

D11

XP9.14

C11

P1L.0

B11

P1L.1

A11
V

SS

XP9.11

XP9.13

XP9.15

V

SS

K9

V

SS

J9

V

SS

H9

V

SS

G9

V

SS

B9

V

SS

A9

V

DD

T12

P2.15

R12
P3.0

P12
P3.2

D12

C12

B12

A12
V

DD

SS

T13
P3.1

R13
P3.3

P13
P3.5

D13

XP9.5

C13

XP9.10

B13

XP9.12

A13
V

SS

SS

T14
P3.4

R14
P3.6

P14
P3.7

N14

P3.10

M14

P3.13

L14
P4.2

K14
P4.6

J14RDJ15WRJ16

H14

P0L.2

G14

P0L.5

F14

P0H.2

E14

P0H.7

D14

XP9.2

C14

XP9.6

B14

XP9.9

A14
V

DD

DD

T15
V

SS

R15

P3.8

P15

P3.11

N15
V

SS

M15
P4.1

L15

P4.4

K15

P4.7

H15

P0L.1

G15

P0L.4

F15

P0H.0

E15

P0H.4

D15

XP9.0

C15

XP9.3

B15

XP9.7

A15

XP9.8

V

SS

T16
V

SS

R16
P3.9

P16

P3.12

N16
P4.0

M16
P4.3

L16
P4.5

K16
V

SS

READY17ALE

H16

P0L.0

G16

P0L.3

F16

P0L.6

E16

P0H.1

D16

P0H.5

C16

XP9.1

B16

XP9.4

A16
V

SS

V

SS

T17

P3.15

R17
V

SS

P17
V

DD

N17
V

SS

M17

RPD

L17
V

DD

K17
V

SS

H17

EA

G17

V

DD

F17
V

SS

E17

P0L.7

D17

P0H.3

C17

P0H.6

B17
V

SS

A17
V

SS

U

T

R

P

N

M

L

K

J

H

G

F

E

D

C

B

A

20/346

ST10F296E Ball data

www.BDTIC.com/ST

Table 2. Ball description

Symbol

P6.0 to P6.7

Ball

Type Function (including port, pin and alternate function where applicable)

no.

E4 O

D3 O P6.1 CS1

O

B1

I/O SCLK1

8-bit bidirectional I/O port,
bit-wise programmable for

O

input or output via direction

C1

D2

E3 I P6.5 HOLD

F4 O P6.6 HLDA

bit. Programming an I/O pin
as input forces the

I/O MTSR1

corresponding output driver
to high impedance state.
Port 6 outputs can be

O

configured as push-pull or
open-drain drivers. The

I/O MRST1

input threshold of Port 6 is
selectable (TTL or CMOS).

P6.0 CS0

CS2

P6.2

CS3 Chip select 3 output

P6.3

CS4 Chip select 4 output

P6.4

Chip select 0 output

Chip select 1 output

Chip select 2 output

SSC1: Master clock
output/slave clock input

SSC1: Master­transmitter/slave-receiver
O/I

SSC1: Master­receiver/slave-transmitter
I/O

External master hold
request input

Hold acknowledge output

P8.0 to P8.7

D1 O P6.7 BREQ

E2 I/O

F3 I/O P8.1 CC17IO

F2 I/O P8.2 CC18IO

8-bit bidirectional I/O port,

G3 I/O P8.3 CC19IO

G2 I/O P8.4 CC20IO

H4 I/O P8.5 CC21IO

H3 I/O P8.6

H2

bit-wise programmable for
input or output via direction
bit. Programming an I/O pin
as input forces the
corresponding output driver
to high impedance state.
Port 8 outputs can be
configured as push-pull or
open-drain drivers. The
input threshold of Port 8 is
selectable (TTL or CMOS).

I/O

O TxD1

P8.0 CC16IO

CC22IO

RxD1

CC23IO

P8.7

Bus request output

CAPCOM2: CC16 capture
input/compare output

CAPCOM2: CC17 capture
input/compare output

CAPCOM2: CC18 capture
input/compare output

CAPCOM2: CC19 capture
input/compare output

CAPCOM2: CC20 capture
input/compare output

CAPCOM2: CC21 capture
input/compare output

CAPCOM2: CC22 capture
input/compare output

ASC1: Data input
(asynchronous) or I/O
(synchronous)

CAPCOM2: CC23 capture
input/compare output

ASC1: Clock/data output
(asynchronous/synchronous)

21/346

Ball data ST10F296E

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

P7.0 to P7.7

XP10.0 to

XP10.15

Ball

Type Function (including port, pin and alternate function where applicable)

no.

J4 O

J3 O P7.1 POUT1 PWM0: Channel 1 output

J2 O P7.2 POUT2 PWM0: Channel 2 output

J1 O P7.3 POUT3 PWM0: Channel 3 output

K2 I/O P7.4 CC28IO

K3 I/O P7.5 CC29IO

K4 I/O P7.6 CC30IO

L2 I/O P7.7 CC31IO

M4 I

M3 I XP10.1

M2 I XP10.2

M1 I XP10.3

N4 I XP10.4

N3 I XP10.5

N2 I XP10.6

N1 I XP10.7

P4 I XP10.8

P3 I XP10.9

P2 I XP10.10

P1 I XP10.11

R2 XP10.12

R1 XP10.13

8-bit bidirectional I/O port,
bit-wise programmable for
input or output via direction
bit. Programming an I/O pin
as input forces the
corresponding output driver
to high impedance state.
Port 7 outputs can be
configured as push-pull or
open-drain drivers. The
input threshold of Port 7 is
selectable (TTL or CMOS).

16-bit input-only port with
Schmitt-Trigger
characteristics. The pins of
XPort 10 can be the analog
input channels (up to 16) for
the ADC, where XP10.x
equals ANy (analog input
channel y, where y = x +

16). The input threshold of
XPort 10 is selectable (TTL
or CMOS).

P7.0 POUT0 PWM0: Channel 0 output

CAPCOM2: CC28 capture
input/compare output

CAPCOM2: CC29 capture
input/compare output

CAPCOM2: CC30 capture
input/compare output

CAPCOM2: CC31 capture
input/compare output

XP10.0

22/346

T1 XP10.14

U1 XP10.15

ST10F296E Ball data

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

P5.0 to

P5.15

Ball

Type Function (including port, pin and alternate function where applicable)

no.

T2 I

R3 I P5.1

T3 I P5.2

R4 I P5.3

T4 I P5.4

U4 I P5.5

P5 I P5.6

R5 I P5.7

T5 I P5.8

U5 I P5.9

P6 I P5.10 T6EUD

R6 I P5.11 T5EUD

T6 I P5.12 T6IN GPT2: Timer T6 count input

U6 I P5.13 T5IN GPT2: Timer T5 count input

P7 I P5.14 T4EUD

R7 I P5.15 T2EUD

16-bit input-only port with
Schmitt-Trigger
characteristics. The pins of
Port 5 can be the analog
input channels (up to 16) for
the ADC, where P5.x equals
ANx (analog input channel
x), or they are timer inputs.
The input threshold of Port 5
is selectable (TTL or
CMOS).

P5.0

GPT2: Timer T6 external
up/down control input

GPT2: Timer T5 external
up/down control input

GPT1: Timer T4 external
up/down control input

GPT1: Timer T2 external
up/down control input

P2.0 to

P2.15

T7 I/O

P8 I/O P2.1 CC1IO

R8 I/O P2.2 CC2IO

T8 I/O P2.3 CC3IO

T9 I/O P2.4 CC4IO

P9 I/O P2.5 CC5IO

R9 I/O P2.6 CC6IO

U9 I/O P2.7 CC7IO

16-bit bidirectional I/O port,
bit-wise programmable for
input or output via direction
bit. Programming an I/O pin
as input forces the
corresponding output driver
to high impedance state.
Port 2 outputs can be
configured as push-pull or
open-drain drivers. The
input threshold of Port 2 is
selectable (TTL or CMOS).

P2.0 CC0IO

23/346

CAPCOM1: CC0 capture
input/compare output

CAPCOM1: CC1 capture
input/compare output

CAPCOM1: CC2 capture
input/compare output

CAPCOM1: CC3 capture
input/compare output

CAPCOM1: CC4 capture
input/compare output

CAPCOM1: CC5 capture
input/compare output

CAPCOM1: CC6 capture
input/compare output

CAPCOM1: CC7 capture
input/compare output

Ball data ST10F296E

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

P2.0 to

P2.15 cont’d

Ball

Type Function (including port, pin and alternate function where applicable)

no.

CAPCOM1: CC8 capture
input/compare output

Fast external interrupt 0
input

CAPCOM1: CC9 capture
input/compare output

Fast external interrupt 1
input

CAPCOM1: CC10 capture
input/compare output

Fast external interrupt 2
input

CAPCOM1: CC11 capture
input/compare output

Fast external interrupt 3
input

CAPCOM1: CC12 capture
input/compare output

Fast external interrupt 4
input

CAPCOM1: CC13 capture
input/compare output

Fast external interrupt 5
input

CAPCOM1: CC14 capture
input/compare output

Fast external interrupt 6
input

CAPCOM1: CC15 capture
input/compare output

Fast external interrupt 7
input

T10

R10

P10

T11

R11

U12

P11

T12

I/O

P2.8

I EX0IN

I/O

P2.9

I EX1IN

I/O

P2.10

I EX2IN

16-bit bidirectional I/O port,

I/O

bit-wise programmable for
input or output via direction

I

bit. Programming an I/O pin
as input forces the
corresponding output driver

I/O

to high impedance state.
Port 2 outputs can be
configured as push-pull or

I EX4IN

open-drain drivers. The
input threshold of Port 2 is

I/O

selectable (TTL or CMOS).

I EX5IN

I/O

I EX6IN

I/O

I EX7IN

P2.11

P2.12

P2.13

P2.14

P2.15

CC8IO

CC9IO

CC10IO

CC11IO

EX3IN

CC12IO

CC13IO

CC14IO

CC15IO

24/346

IT7IN

CAPCOM2: Timer T7 count
input

ST10F296E Ball data

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

P3.0 to

P3.13, P3.15

Ball

Type Function (including port, pin and alternate function where applicable)

no.

R12 I

T13 O P3.1 T6OUT

P12 I P3.2 CAPIN

R13 O P3.3 T3OUT

T14 I P3.4 T3EUD

P13 I P3.5 T4IN

15-bit (P3.14 is missing)

R14 I P3.6 T3IN

P14 I P3.7 T2IN

R15 I/O P3.8 MRST0

R16 I/O P3.9 MTSR0

N14 I/O P3.10 TxD0

P15 O P3.11 RxD0

P16 O P3.12

bidirectional I/O port, bit­wise programmable for input
or output via direction bit.
Programming an I/O pin as
input forces the
corresponding output driver
to high impedance state.
Port 3 outputs can be
configured as push-pull or
open-drain drivers. The
input threshold of Port 3 is
selectable (TTL or CMOS).

P3.0 T0IN

BHE

WRH

CAPCOM1: Timer T0 count
input

GPT2: Timer T6 toggle latch
output

GPT2: Register caprel
capture input

GPT1: Timer T3 toggle latch
output

GPT1: Timer T3 external
up/down control input

GPT1: Timer T4 input for
count/gate/reload/capture

GPT1: Timer T3 count/gate
input

GPT1: Timer T2 input for
count/gate/reload/capture

SSC0: Master receive/slave
transmit I/O

SSC0: Master
transmit/slave receive O/I

ASC0: Clock/data output
(asynchronous/synchronous)

ASC0: Data input
(asynchronous) or I/O
(synchronous)

External memory high byte
enable signal

External memory high byte
write strobe

M14 I/O P3.13 SCLK0

T17 O P3.15 CLKOUT

25/346

SSC0: Master clock
output/slave clock input

Clock output
(programmable divider on
CPU clock)

Ball data ST10F296E

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

P4.0 to P4.7

RD J14 O

Ball

Type Function (including port, pin and alternate function where applicable)

no.

N16 O

P4.0 A16

Least significant segment
address line

M15 O P4.1 A17 Segment address line

L14 O P4.2 A18 Segment address line

M16 O P4.3 A19 Segment address line

L15

L16

K14

K15

8-bit bidirectional I/O port. It
is bit-wise programmable for
input or output via direction

O

bit. Programming an I/O pin

I CAN2_RxD CAN2: Receive data input

as input forces the
corresponding output driver

I/O

to high impedance state.

O

The input threshold is
selectable (TTL or CMOS).

I CAN1_RxD CAN1: Receive data input

Port 4.4, 4.5, 4.6 and 4.7

I CAN2_RxD CAN2: Receive Data Input

outputs can be configured
as push-pull or open-drain

O

drivers. In case of an

O

external bus configuration,
Port 4 can be used to output

O

the segment address lines.

P4.4

P4.5

P4.6

O

O CAN2_TxD CAN2: Transmit data output

P4.7

I/O SDA I

External memory read strobe: RD

is activated for every external instruction or data

A20 Segment address line

SCL I2C interface: Serial clock

A21 Segment address line

A22 Segment address line

CAN1_TxD CAN1: Transmit data output

CAN2_TxD CAN2: Transmit data output

A23

Most significant segment
address line

2

C interface: Serial data

read access.

External memory write strobe: In WR

WR

and

WRL

J15 O

write access. In WRL mode this pin is activated for low byte data write access on a 16­bit bus, and, for every data write access on an 8-bit bus. See WRCFG in register
SYSCON for mode selection.

Ready input: The active level is programmable. When the Ready function is enabled,

READY and

READY

J16 I

the selected inactive level at this pin during an external memory access forces the
insertion of memory cycle time waitstates until the pin returns to the selected active
level.

ALE J17 O

Address latch enable output: Can be used for latching the address into external
memory or an address latch in the multiplexed bus modes.

External access enable pin: A low level applied to this pin during and after reset forces
the ST10F296E to start the program from the external memory space. A high level
forces ST10F296E to start in the internal memory space. This pin is also used (when
standby mode is entered: ST10F296E under reset and main V

EA

V

and

STBY

H17 I

a reference voltage for the low-power embedded voltage regulator which generates
the internal 1.8 V supply to retain data inside the standby portion of the XRAM (16
Kbyte).

It can range from 4.5 to 5.5 V (6 V for a reduced amount of time during the device life).
In running mode, this pin can be tied low during reset without affecting XRAM
activities, since the presence of a stable V
module.

26/346

mode this pin is activated for every external data

turned off) to provide

DD

guarantees the proper biasing of this

DD

ST10F296E Ball data

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

POL.0 to

POL.7 and

POH.0 to

POH.7

Ball

Type Function (including port, pin and alternate function where applicable)

no.

H16 I/O Two 8-bit bidirectional I/O

H15 I/O P0L.1

H14 I/O P0L.2

G16 I/O P0L.3

G15 I/O P0L.4

G14 I/O P0L.5

F16 I/O P0L.6

E17 I/O P0L.7

F15 I/O P0H.0

E16 I/O P0H.1

F14 I/O P0H.2

D17 I/O P0H.3

E15 I/O P0H.4

D16 I/O P0H.5

C17 I/O P0H.6

E14 I/O P0H.7

ports P0L and P0H, bit-wise
programmable for input or
output via direction bit.
Programming an I/O pin as
input forces the
corresponding output driver
to high impedance state.
The input threshold of Port 0
is selectable (TTL or
CMOS).

In case of an external bus
configuration, Port 0 serves
as the address (A) and as
the address/data (AD) bus
in multiplexed bus modes
and as the data (D) bus in
demultiplexed bus modes.

Demultiplexed bus modes

P0L.0-P0L.7: D0-D7 (8-bit),
D0-D7 (16-bit).
P0H.0-P0H.7: I/O (8-bit),
D8-D15 (16-bit).

Multiplexed bus modes

P0L.0-P0L.7: AD0-AD7 (8­bit), AD0-AD7 (16-bit).
P0H.0-P0H.7: A8-A15 (8­bit), AD8-AD15 (16-bit).

P0L.0

27/346

Ball data ST10F296E

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

P1L.0 to

P1L.7 and

P1H.0 to

P1H.7

Ball

Type Function (including port, pin and alternate function where applicable)

no.

C11 I/O

B11 I/O P1L.1

D10 I/O P1L.2

C10 I/O P1L.3

B10 I/O P1L.4

A10 I/O P1L.5

D9 I/O P1L.6

C9 I/O P1L.7

C8 I/O P1H.0

D8 I/O P1H.1

A7 I/O P1H.2

B7 I/O P1H.3

C7 I P1H.4 CC24I

D7 I P1H.5 CC25I

C5 I P1H.6 CC26I

C6 I P1H.7 CC27I

Port 1 output pins: Two 8-bit
bidirectional I/O ports P1L
and P1H, bit-wise
programmable for input or
output via direction bit.
Programming an I/O pin as
input forces the
corresponding output driver
to high impedance state.
Port 1 is used as the 16-bit
address bus (A) in
demultiplexed bus modes: if
at least BUSCONx is
configured so that the
demultiplexed mode is
selected, the pis of Port 1
are not available for general
purpose I/O function. The
input threshold of Port 1 is
selectable (TTL or CMOS).

P1L.0

CAPCOM2: CC24 capture
input

CAPCOM2: CC25 capture
input

CAPCOM2: CC26 capture
input

CAPCOM2: CC27 capture
input

28/346

ST10F296E Ball data

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

XPORT9.0

to

XPORT9.15

XTAL1 A5 I XTAL1: Input to the oscillator amplifier and/or external clock input.

Ball

Type Function (including port, pin and alternate function where applicable)

no.

D15 I/O

C16 I/O XPORT9.1

D14 I/O XPORT9.2

C15 I/O XPORT9.3

B16 I/O XPORT9.4

D13 I/O XPORT9.5

C14 I/O XPORT9.6

B15 I/O XPORT9.7

A15 I/O XPORT9.8

B14 I/O XPORT9.9

C13 I/O XPORT9.10

D12 I/O XPORT9.11

B13 I/O XPORT9.12

C12 I/O XPORT9.13

D11 I/O XPORT9.14

B12 I/O XPORT9.15

16-bit bidirectional I/O port.
It is bit-wise programmable
for input or output via
direction bits. For a pin
configured as input, the
output driver is put into high­impedance state. XPort 9
outputs can be configured
as push-pull or open-drain
drivers.The input threshold
of XPort 9 is selectable (TTL
or CMOS).

XPORT9.0

XTAL2: Output of the oscillator amplifier circuit. To clock the device from an external

XTAL2 A6 O

RSTIN

RSTOUT

NMI

XPOUT.0 D4 O XPWM: Channel 0 output

XPOUT.1 C3 O XPWM: Channel 1 output

XPOUT.2 B2 O XPWM: Channel 2 output

XPOUT.3 C2 O XPWM: Channel 3 output

XADCINJ L3 O Output trigger for ADC channel injection

A3 I

B4 O

C4 I

source, drive XTAL1 while leaving XTAL2 unconnected. Minimum and maximum
high/low and rise/fall times specified in the AC characteristics must be observed

Reset input with CMOS Schmitt-Trigger characteristics: A low level at this pin for a
specified duration while the oscillator is running resets ST10F296E. An internal pull-up
resistor permits power-on reset using only a capacitor connected to VSS. In
bidirectional reset mode (enabled by setting bit BDRSTEN in SYSCON register), the

line is pulled low for the duration of the internal reset sequence.

RSTIN

Internal reset indication output: This pin is driven to a low level during hardware,
software or watchdog timer reset.
initialization) instruction is executed.

Non maskable interrupt input: A high to low transition at this pin causes the CPU to
vector to the NMI trap routine. If bit PWDCFG = 0 in the SYSCON register, when the
PWRDN (power-down) instruction is executed, the NMI
force the ST10F296E to go into power-down mode. If NMI is high and PWDCFG = 0,
when PWRDN is executed, the part will continue to run in normal mode.
If not being used, pin NMI

should be pulled high externally.

RSTOUT

remains low until the EINIT (end of

pin must be low in order to

29/346

Ball data ST10F296E

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

V

AREF

V

AGND

RPD M17 I/O

V

18

V

DD

Ball

Type Function (including port, pin and alternate function where applicable)

no.

U2 - ADC reference voltage and analog supply

U3 - ADC reference and analog ground

G1,

U11

A2

A9
A12
A14

E1

K1

U8
U15
P17

L17

G17

O

Timing pin for the return from power-down circuit and synchronous/
asynchronous reset selection.

1.8 V decoupling pin: A decoupling capacitor (typical value of 10 nF, max 100 nF) must
be connected between this pin and nearest VSS pin.

Digital supply voltage: 5 V during normal operation, idle and power-down modes. It

­can be turned off when standby RAM mode is selected.

30/346

ST10F296E Ball data

www.BDTIC.com/ST

Table 2. Ball description (continued)

Symbol

V

SS

Ball

Type Function (including port, pin and alternate function where applicable)

no.

A1,

A4

A8,
A11,
A13,
A16
A17,

B3,

B5

B6,

B8

B9,
B17,

D5,

D6

F1,
F17,

G4,

H1
K16,
K17,

L1,

L4
N15,
N17,
R17,
T15,
T16,

U7,
U10,
U13,
U14,
U16,

U17

- Digital ground

31/346

Functional description ST10F296E

www.BDTIC.com/ST

3 Functional description

The architecture of the ST10F296E combines advantages of both RISC and CISC
processors and an advanced peripheral subsystem. The block diagram of Figure 3 gives an
overview of the different on-chip components and the high bandwidth internal bus structure
of the ST10F296E.

Figure 3. Block diagram

16

XFlash

320K

16

16

16

16

16

XCAN1

16 16

XCAN2

16 16

16 16

XTimer

16

16

controller

External bus

Port 6

8161588

4

16

16

16

16

8

XRAM

48K

XRAM

16K

(STBY)

XRAM

2K

(PEC)

XPWM

XPort 9

XPort 10

Port 0Port 1Por t 4

IFlash

512K

XRTC

XI2C

XASC

XSSC

Por t 5

32

16

16

10-bit ADC

GPT1/GPT2

CPU-Core and MAC unit

PEC

Interrupt controller

SSC0

PWM

ASC0

BRG BRG

Port 3 Port 7 Port 8

16

16

CAPCOM2

IRAM

2K

Watchdog

Oscillator

PLL

5V-1.8V

voltage

regulator

CAPCOM1

16

Port 2

32/346

ST10F296E Memory organization

www.BDTIC.com/ST

4 Memory organization

The memory space of the ST10F296E is configured in a unified memory architecture. Code
memory, data memory, registers and I/O ports are organized within the same linear address
space of 16 Mbytes. The entire memory space can be accessed byte wise or word wise.
Particular portions of the on-chip memory have additionally been made directly bit
addressable.

The organization of the ST10F296E memory is described in the sections below and shown
in Figure 4: ST10F296E on-chip memory mapping on page 38.

4.1 IFlash

IFlash comprises 512 Kbytes of on-chip Flash memory. It is divided into 10 blocks
(B0F0...B0F9) of Bank 0, and two blocks of Bank 1 (B1F0, B1F1). Read-while-write
operations inside the same bank are not allowed. When bootstrap mode is selected, the
Test-Flash Block B0TF (8 Kbyte) appears at address 00’0000h. Refer to Section 5: Internal

Flash memory on page 42 for more details on memory mapping in boot mode. The

summary of address ranges for IFlash is given in Tab le 3 .

Table 3. Address ranges for IFlash

Blocks User mode Size (Kbytes)

B0TF Not visible 8

B0F0 00’0000h - 00’1FFFh 8

B0F1 00’2000h - 00’3FFFh 8

B0F2 00’4000h - 00’5FFFh 8

B0F3 00’6000h - 00’7FFFh 8

B0F4 01’8000h - 01’FFFFh 32

B0F5 02’0000h - 02’FFFFh 64

B0F6 03’0000h - 03’FFFFh 64

B0F7 04’0000h - 04’FFFFh 64

B0F8 05’0000h - 05’FFFFh 64

B0F9 06’0000h - 06’FFFFh 64

B1F0 07’0000h - 07’FFFFh 64

B1F1 08’0000h - 08’FFFFh 64

33/346

Memory organization ST10F296E

www.BDTIC.com/ST

4.2 XFlash

XFlash comprises 320 Kbytes of on-chip extension Flash memory. The XFLASH address
range is 09’0000h - 0E’FFFFh if enabled (if the XPEN bit, bit 2, of the SYSCON register and
the XFLASHEN bit, bit 5, of the XPERCON register are set ). If the XPEN bit is cleared, any
access in the address range 09’0000h - 0E’FFFFh is directed to the external memory
interface, using the BUSCONx register corresponding to an address matching the
ADDRSELx register. When the XPEN bit is set, but the XFLASHEN and XRAM2EN bits are
cleared.

Note: When the Flash control registers are not accessible, no program/erase operations are

possible.

XFlash is divided into 3 blocks (B2F0...B0F2) of Bank 2, and two blocks of Bank 3 (B3F0,
B3F1). Read-while-write operations inside the same bank are not allowed. Flash control
registers are mapped in the range 0E’0000h - 0E’FFFFh. The summary of address range for
XFLASH is given in Ta bl e 4 .

Table 4. Address ranges for IFlash

Blocks User Mode Size (Kbytes)

B2F0 09’0000h - 09’FFFFh 64

B2F1 0A’0000h - 0A’FFFFh 64

B2F2 0B’0000h - 0B’FFFFh 64

B3F0 0C’0000h - 0C’FFFFh 64

B3F1 0D’0000h - 0D’FFFFh 64

CTRL Registers 0E’0000h - 0E’FFFFh 64

The XFlash is accessed like an external memory in 16-bit demultiplexed bus-mode without
read/write delay. The user must set the proper number of waitstates according to the system
frequency (1 waitstate for f

higher than 40 MHz, 0 waitstates otherwise). Refer to the

CPU

XFICR register described in Section 5: Internal Flash memory on page 42). Byte and word
access is allowed.

Note: When the ROMEN and XPEN bits in the SYSCON register are set, together with at least

one of the XFLASHEN or XRAM2EN bits in the XPERCON register, the address 08’0000h ­08’FFFFh must be reserved (no external memory access is enabled).

4.3 Internal RAM (IRAM)

2 Kbytes of on-chip IRAM (dual-port) is provided as a storage for data, system stack,
general purpose register bank and code. A register bank includes 16 wordwide (R0 to R15)
and/or bytewide (RL0, RH0, …, RL7, RH7) general purpose registers.

34/346

ST10F296E Memory organization

www.BDTIC.com/ST

4.4 Extension RAM (XRAM)

64 Kbyte and 2 Kbytes of on-chip XRAM (single port XRAM) is provided as a storage for
data, user stack and code.

The XRAM is divided into 2 areas, the first 2 kbytes and second 64 Kbytes, called XRAM1
and XRAM2 respectively, are connected to the internal XBus and are accessed like an
external memory in 16-bit demultiplexed bus-mode without wait state or read/write delay
(31.25 ns access at 64 MHz CPU clock). Byte and word access is allowed.

The XRAM1 address range is 00’E000h - 00’E7FFh if the XPEN bit (bit 2 of the SYSCON
register) and XRAM1EN bit (bit 2 of the XPERCON register) are set. If the XRAM1EN or
XPEN bits are cleared, any access in the address range 00’E000h - 00’E7FFh is directed to
external memory interface, using the BUSCONx register corresponding to an address
matching the ADDRSELx register.

The XRAM2 address range is 0F’0000h - 0F’FFFFh if the XPEN bit and XRAM2EN bit (bit 3
of the XPERCON register) are set. If the XRAM2EN or XPEN bits are cleared, any access in
the address range 00’C000h - 00’DFFFh is directed to the external memory interface, using
the BUSCONx register corresponding to an address matching the ADDRSELx register. The
same thing happens when the XPEN bit is set, but both the XRAM2EN and XFLASHEN bits
are cleared.

The lower 16 Kbyte portion of XRAM2 (address range 0F’0000h-0F’3FFFh) represents the
standby RAM which can be maintained biased through EA
supply V

As the XRAM appears as external memory, it cannot be used as a system stack or as a
register bank. The XRAM is not provided for single bit storage and therefore is not bit
addressable.

is turned off.

DD

/ V

pin when the main

STBY

Note: When the ROMEN bit in the SYSCON register is low, and the XPEN bit is set, and at least

one of the two bits XFLASHEN or XRAM2EN in the XPERCON register are also set, the
address 08’0000h - 08’FFFFh must be reserved (no external memory access is enabled).

4.5 Special function register (SFR) areas

An area of 1024 bytes (2 x 512 bytes) of address space is reserved for special function
registers (SFR) and extended special function registers (ESFR). SFRs are wordwide
registers which are used to control and to monitor the function of the different on-chip units.

4.6 CAN1

Address range 00’EF00h - 00’EFFFh is reserved for the CAN1 module access. CAN1 is
enabled by setting the XPEN bit (bit 2 of the SYSCON register) and the CAN1EN bit (bit 0 of
the XPERCON register). Access to the CAN module use demultiplexed addresses and a 16­bit data bus (only word access is possible). Two wait states give an access time of 62.5 ns at
64 MHz CPU clock. No tristate wait states are used.

35/346

Memory organization ST10F296E

www.BDTIC.com/ST

4.7 CAN2

Address range 00’EE00h - 00’EEFFh is reserved for the CAN2 module access. CAN2 is
enabled by setting the XPEN bit (bit 2 of the SYSCON register) and the CAN2EN bit (bit 1 of
the new XPERCON register). Access to the CAN module use demultiplexed addresses and
a 16-bit data bus (only word access is possible). Two wait states give an access time of 62.5
ns at 64 MHz CPU clock. No tristate wait states are used.

Note: If one or both CAN modules are used, Port 4 cannot be programmed to output all eight

segment address lines. Thus, only four segment address lines can be used, reducing the
external memory space to 5 Mbytes (1 Mbyte per CS

line).

4.8 Real-time clock (RTC)

Address range 00’ED00h - 00’EDFFh is reserved for the RTC module access. The RTC is
enabled by setting the XPEN bit (bit 2 of the SYSCON register) and bit 4 of the XPERCON
register. Access to the RTC module use demultiplexed addresses and a 16-bit data bus
(only word access is possible). Two waitstates give an access time of 62.5 ns at 64 MHz
CPU clock. No tristate waitstate is used.

4.9 Pulse-width modulation 1 (PWM1)

Address range 00’EC00h - 00’ECFFh is reserved for the PWM1 module access. The PWM1
is enabled by setting the XPEN bit (bit 2 of the SYSCON register) and bit 6 of the
XPERCON register. Access to the PWM1 module use demultiplexed addresses and a 16-bit
data bus (only word access is possible). Two waitstates give an access time of 62.5 ns at 64
MHz CPU clock. No tristate waitstate is used. Only word access is allowed.

4.10 ASC1

Address range 00’E900h - 00’E9FFh is reserved for the ASC1 module access. The ASC1 is
enabled by setting the XPEN bit (bit 2 of the SYSCON register) and bit 7 of the XPERCON
register. Access to the ASC1 module use demultiplexed addresses and a 16-bit data bus
(only word access is possible). Two waitstates give an access time of 62.5 ns at 64 MHz
CPU clock. No tristate waitstate is used.

4.11 SSC1

Address range 00’E800h - 00’E8FFh is reserved for the SSC1 module access. The SSC1 is
enabled by setting the XPEN bit (bit 2 of the SYSCON register) and bit 8 of the XPERCON
register. Access to the SSC1 module use demultiplexed addresses and a 16-bit data bus
(only word access is possible). Two waitstates give an access time of 62.5 ns at 64 MHz
CPU clock. No tristate waitstate is used.

36/346

ST10F296E Memory organization

www.BDTIC.com/ST

4.12 I2C

Address range 00’EA00h - 00’EAFFh is reserved for the I2C module access. The I2C is
enabled by setting the XPEN bit (bit 2 of the SYSCON register) and bit 9 of the XPERCON
register. Access to the I
word access is possible). Two waitstates give an access time of 62.5 ns at 64 MHz CPU
clock. No tristate waitstate is used.

2

C module use demultiplexed addresses and a 16-bit data bus (only

4.13 XTimer/XMiscellaneous

Address range 00’EB00h - 00’EB7Fh is reserved for the access to XTimer and to a set of
XBus additional features (XMiscellaneous). They are enabled by setting the XPEN bit (bit 2
of the SYSCON register) and bit 10 of the XPERCON register. Access to these additional
modules and features use demultiplexed addresses and a 16-bit data bus (only word access
is possible). Two waitstates give an access time of 62.5 ns at 64 MHz CPU clock. No tristate
waitstate is used. In addition to the XTimer module control registers, the following set of
features are provided:

● CLKOUT programmable divider

● XBus interrupt management registers

● ADC multiplexing on the P1L register

● Port 1L digital disable register for extra ADC channels

● CAN2 multiplexing on P4.5/P4.6

● CAN1-2 main clock prescaler

● Main voltage regulator disable for power-down mode

● TTL/CMOS threshold selection for Port 0, Port 1, Port 5, XPort 9 and XPort 10.

4.14 XPort 9/XPort 10

Address range 00’EB80h - 00’EBFFh is reserved for access to XPort 9 and XPort 10. They
are enabled by setting the XPEN bit (bit 2 of the SYSCON register) and bit 11 of the
XPERCON register. These additional modules are accessed by demultiplexed addresses
and a 16-bit data bus (only word access is possible). Two waitstates give an access time of

62.5 ns at 64 MHz CPU clock. No tristate waitstate is used.

4.15 Visibility of XBus peripherals

To retain compatibility between the ST10F296E and the ST10F280, the XBus peripherals
can be selected to be visible and/or accessible on the external address/data bus. Different
bits must be set in the XPERCON register to enable the XPeripherals. If these bits are
cleared before global enabling with the XPEN bit (in the SYSCON register), the
corresponding address space, port pins and interrupts are not occupied by the peripherals,
and the peripheral is not visible and not available. Refer to Section 23: Register set on

page 248.

37/346

Memory organization ST10F296E

www.BDTIC.com/ST

Figure 4. ST10F296E on-chip memory mapping

Code Data

segment

FF FFFF

255

0

00 0000

16 Mbyte

page

1023

0

Code

segment

11 FFFF

11 0000

10 FFFF

10 0000

0F FFFF

0F 0000

0E FFFF

0E 0000

0D FFFF

0D 0000

0C FFFF

0C 0000
0B FFFF

0B 0000

0A FFFF

0A 0000
09 FFFF

09 0000

08 FFFF

08 0000

07 FFFF

07 0000

06 FFFF

06 0000

05 FFFF

05 0000

04 FFFF

04 0000

03 FFFF

03 0000

02 FFFF

02 0000

01 FFFF

01 0000

00 FFFF

00 0000

Data
page

67
66

Ext.

17

16

15

14

FPEC RAM/ROM

13

12

11

10

9

8

7

6

5

4

3

2

1

0

Standby RAM

Flash registers

Ext. memory

Ext. memory

memory

Ext.

memory

XRAM2

+

B3F1

(XFlash)

B3F0

(XFlash)

B2F2

(XFlash)

B2F1

(XFlash)

B2F0

(XFlash)

B1F1

(IFlash)

B1F0

(IFlash)

B0F9

(IFlash)

B0F8

(IFlash)

B0F7

(IFlash)

B0F6

(IFlash)

B0F5

(IFlash)

B0F4

(IFlash)

B0F3
B0F2
B0F1
B0F0

65
64
67
66
65
64
63
62
61
60
59
58
57
56
55
54
53
52
51
50
49
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
32
31
30
29
28
27
26
25
24
23
22
21
20
19
18
17
16
15
14
13
12
11
10

9
8
7
6
5
4
3
2
1
0

Flash + XRAM - 1 Mbyte

64 Kbyte

00 FFFF
00 FE00

00 FDFF

00 F600
00 F5FF

00 F200
00 F1FF

00 F000

00 EFFF

00 E800

00 E7FF

00 E000

00 DFFF

IRAM

Reserved

ESFR
CAN1

CAN2

PWM1

Xmisc/XTimer/XPort

ASC1
SSC1

XRAM1

Ext. memory

SFR

RTC

I2C

512 byte

2 Kbytes

1 Kbyte

512 byte
256 byte

256 byte
256 byte
256 byte
128 + 128
256 byte
256 byte
256 byte

2 Kbytes

8 Kbytes

00 C000

Data page 3 (segment 0) - 16 Kbyte

XPeripherals (2 Kbytes)

00 F000

00 EFFF

00 EF00

00 EEFF

00 EE00

00 EDFF

00 ED00

00 ECFF

00 EC00
00 EBFF

XPort 9 + XPort 10

XMiscellaneous

00 EB00
00 EAFF

00 EA00
00 E9FF

00 E900

00 E8FF

00 E800

00 E7FF

CAN1

CAN2

RTC

PWM1

XTimer

I2C

ASC1

SSC1

256 byte

256 byte

256 byte

256 byte

128 byte
128 byte

256 byte

256 byte

256 byte

38/346

1. Blocks B0F0, B0F1, B0F2, B0F3 may be remapped from segment 0 to segment 1 by setting SYSCON­ROMS1 (before EINIT).

2. Data page number and absolute memory address are hexadecimal values.

ST10F296E Memory organization

www.BDTIC.com/ST

4.16 XPeripheral configuration registers

XPERCON register

XPERCON (F024h/12h) ESFR Reset value: 005h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

----

XPORTENXMISCENXI2CENXSSCENXASCENXPWMENXFLASHENXRTCENXRAM

2EN

XRAM

1EN

CAN
2EN

CAN

1EN

- - - - RW RW RW RW RW RW RW RW RW RW RW RW

Table 5. XPERCON register description

BIt Bit name Function

XPort 9 and XPort 10 enable bit

0: Access to the on-chip XPort 9 and XPort 10 modules is disabled.

11 XPORTEN

Address range 00’EB80h to 00’EBFFh is directed to the external
memory only if CAN1EN, CAN2EN, XRTCEN, XASCEN, XSSCEN,
XPWMEN, XI2CEN and XMISCEN are also 0.
1: The on-chip XPort 9 and XPort 10 are enabled and can be accessed.

XBus additional features and XTimer enable bit

0: Access to the additional miscellaneous features is disabled. Address
range 00’EB00h to 00’EB7Fh is directed to the external memory only if

10 XMISCEN

CAN1EN, CAN2EN, XRTCEN, XASCEN, XSSCEN, XPWMEN, XI2CEN
and XPORTEN are also 0.
1: The additional features and XTimer are enabled and can be
accessed.

2

C enable bit

I

0: Access to the on-chip I

9XI2CEN

Address range 00’EA00h to 00’EAFFh is directed to the external
memory only if CAN1EN, CAN2EN, XRTCEN, XASCEN, XSSCEN,
XPWMEN, XMISCEN and XPORTEN are also 0.
1: The on-chip I

2

C is enabled and can be accessed.

2

C is disabled, external access performed.

8 XSSCEN

7 XASCEN

6 XPWMEN

SSC1 enable bit

0: Access to the on-chip SSC1 is disabled, external access performed.
Address range 00’E800h to 00’E8FFh is directed to the external
memory only if CAN1EN, CAN2EN, XRTCEN, XASCEN, XI2CEN,
XPWMEN, XMISCEN and XPORTEN are also 0.
1: The on-chip SSC1 is enabled and can be accessed.

ASC1 enable bit

0: Access to the on-chip ASC1 is disabled, external access performed.
Address range 00’E900h to 00’E9FFh is directed to the external
memory only if CAN1EN, CAN2EN, XRTCEN, XASCEN, XI2CEN,
XPWMEN, XMISCEN and XPORTEN are also 0.
1: The on-chip ASC1 is enabled and can be accessed.

XPWM enable

0: Access to the on-chip PWM1 module is disabled, external access is
performed. Address range 00’EC00h to 00’ECFF is directed to the
external memory only if CAN1EN, CAN2EN, XASCEN, XSSCEN,
XI2CEN, XRTCEN, XMISCEN and XPORTEN are also 0.
1: The on-chip PWM1 module is enabled and can be accessed.

39/346

Memory organization ST10F296E

www.BDTIC.com/ST

Table 5. XPERCON register description

BIt Bit name Function

XFlash enable bit

0: Access to the on-chip XFlash is disabled, external access is

5 XFLASHEN

4XRTCEN

3XRAM2EN

2XRAM1EN

performed. Address range 09’0000h to 0E’FFFFh is directed to the
external memory only if XRAM2EN is also 0.
1: The on-chip XFlash is enabled and can be accessed.

RTC enable

0: Access to the on-chip RTC module is disabled, external access is
performed. Address range 00’ED00h to 00’EDFF is directed to the
external memory only if CAN1EN, CAN2EN, XASCEN, XSSCEN,
XI2CEN, XPWMEN, XMISCEN and XPORTEN are also 0.
1: The on-chip RTC module is enabled and can be accessed.

XRAM2 enable bit

0: Access to the on-chip 64 KByte XRAM is disabled, external access is
performed. Address range 0F’0000h to 0F’FFFFh is directed to the
external memory only if XFLASHEN is also 0.
1: The on-chip 64 Kbyte XRAM is enabled and can be accessed.

XRAM1 enable bit

0: Access to the on-chip 2 KByte XRAM is disabled. Address range
00’E000h to 00’E7FFh is directed to the external memory.
1: The on-chip 2 Kbyte XRAM is enabled and can be accessed.

CAN2 enable bit

0: Access to the on-chip CAN2 XPeripheral and its functions is disabled

1CAN2EN

0CAN1EN

(P4.4 and P4.7 pins can be used as general purpose IOs, but, address
range 00’EC00h to 00’EFFFh is directed to the external memory only if
CAN1EN, XRTCEN, XASCEN, XSSCEN, XI2CEN, XPWMEN,
XMISCEN and XPORTEN are also 0).
1: The on-chip CAN2 XPeripheral is enabled and can be accessed.

CAN1 enable bit

0: Access to the on-chip CAN1 XPeripheral and its functions is disabled
(P4.5 and P4.6 pins can be used as general purpose IOs, but, address
range 00’EC00h to 00’EFFFh is directed to the external memory only if
CAN2EN, XRTCEN, XASCEN, XSSCEN, XI2CEN, XPWMEN an
XMISCEN are also 0).
1: The on-chip CAN1 XPeripheral is enabled and can be accessed.

When CAN1, CAN2, RTC, ASC1, SSC1, I2C, PWM1, XBus additional features, XTimer and
XPort modules are disabled via XPERCON settings, any access in the address range
00’E800h to 00’EFFFh is directed to the external memory interface, using the BUSCONx
register associated with the ADDRSELx register matching the target address. All pins
involved with the XPeripherals can be used as general purpose IOs whenever the related
module is not enabled.

The default XPER selection after reset is identical to configuration of the XBus in the
ST10F280. CAN1 and XRAM1 are enabled, CAN2 and XRAM2 are disabled, all other
XPeripherals are disabled after reset.

40/346

the XPERCON register cannot be changed after globally enabling the XPeripherals (after
setting the XPEN bit in the SYSCON register).

ST10F296E Memory organization

www.BDTIC.com/ST

In emulation mode, all XPeripherals are enabled (all XPERCON bits are set). The access to
the external memory and/or the XBus is controlled by the bondout chip.

Reserved bits of the XPERCON register must always be written to 0.
When the RTC is disabled (RTCEN = 0) the main clock oscillator is switched off if the ST10

enters power-down mode. When the RTC is enabled, the RTCOFF bit of the RTCCON
register allows the power-down mode of the main clock oscillator to be chosen (eee

Section 18: Real-time clock (RTC) on page 203).
Table 6 summarizes the address range mapping on segment 8 for programming the

ROMEN and XPEN bits (of the SYSCON register) and the XRAM2EN and XFLASHEN bits
(of the XPERCON register).

Table 6. Segment 8 address range mapping

ROMEN XPEN XRAM2EN XFLASHEN Segment 8

00x

0100 External memory

011x

01x

1x

1. Don’t care

(1)

(1)

(1)

(1)

x

(1)

x

(1)

1 Reserved

(1)

x

External memory

Reserved

IFlash (B1F1)

XPEREMU register

The XPEREMU register is a write-only register that is mapped on the XBus memory space
at address EB7Eh. It contrasts with the XPERCON register, a read/write ESFR register,
which must be programmed to enable the single XBus modules separately.

Once the XPEN bit of the SYSCON register is set and at least one of the XPeripherals
(except the memories) is activated, the XPEREMU register must be written with the same
content as the XPERCON register. This is to allow a correct emulation of the new set of
features introduced on the XBus for the new ST10 generation. The following instructions
must be added inside the initialization routine:

if (SYSCON.XPEN && (XPERCON & 0x07D3))
then { XPEREMU = XPERCON }

XPEREMU must be programmed after both the XPERCON and SYSCON registers in such
a way that the final configuration for the XPeripherals is stored in the XPEREMU register
and used for the emulation hardware setup.

XPEREMU (EB7Eh) XBus Reset value: xxxxh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

----

---- W W W W W W W W W W WW

XPORTENXMISCENXI2CENXSSCENXASCENXPWMENXFLASHENXRTCENXRAM

2EN

XRAM

1EN

CAN

2EN

CAN

1EN

XPEREMU bit descriptition follows the XPERCON register (see Table 5: XPERCON register

description on page 39).

41/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

5 Internal Flash memory

The on-chip Flash is composed of two matrix modules each one containing one array
divided into two banks that can be read and modified independently of the other (i.e. one
bank can be read while the other is under modification).

Figure 5. Flash modules structure

IFLASH (Module I)

Bank 1: 128 Kbyte

Program Memory

Bank 0: 384 Kbyte

Program Memory

8 Kbyte Test-Flash

+

I-BUS Interface

The write operations of the four banks are managed by an embedded Flash program/erase
controller (FPEC). The high voltages needed for program/erase operations are internally
generated.

The data bus is 32 bits wide. Due to ST10 core architecture limitations, only the first 512
Kbytes are accessed at 32-bit (internal Flash bus, also known as IBus), while the remaining
320 Kbytes are accessed at 16-bit (also known as XBus).

5.1 Functional description

Control Section

HV and Ref.

Generator

Program/Erase

Controller

XFLASH (Module X)

Bank 3: 128 Kbyte

Program Memory

Bank 2: 192 Kbyte

Program Memory

X-BUS Interface

5.1.1 Structure

Table 7 shows the address space reserved for the Flash module.

.

Table 7. Flash module absolute mapping

Description Addresses Size (Kbytes)

IFlash sectors 0x00 0000 to 0x08 FFFF 512

XFlash sectors 0x09 0000 to 0x0D FFFF 320

Registers and Flash internal reserved area 0x0E 0000 to 0x0E FFFF 64

42/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

5.1.2 Module structure

The IFlash module is composed by two banks. Bank 0 contains 384 Kbytes of program
memory divided into 10 sectors. Bank 0 also contains a reserved sector named ‘Test-Flash’.
Bank 1 contains 128 Kbyte of program memory divided into two sectors (64 Kbytes each).

The XFlash module is also composed of two banks. Bank 2 contains 192 Kbytes of program
memory divided into 3 sectors. Bank 3 contains 128 Kbytes of program memory divided into
two sectors (64 Kbytes each).

Addresses from 0x0E 0000 to 0x0E FFFF are reserved for the control register interface and
other internal service memory space used by the Flash program/erase controller.

Ta bl e 8 shows the memory mapping of the Flash when it is accessed in read mode and
Ta bl e 9 when it is accessed in write or erase mode.

Note: With this second mapping, the first three banks are remapped into code segment 1 (same

result as setting ROMS1 bit in the SYSCON register).

.

Table 8. Sectorization of the Flash modules (read operations)

Bank Description Addresses

Bank 0 Flash 0 (B0F0) 0x0000 0000 - 0x0000 1FFF 8

Bank 0 Flash 1 (B0F1) 0x0000 2000 - 0x0000 3FFF 8

Bank 0 Flash 2 (B0F2) 0x0000 4000 - 0x0000 5FFF 8

Bank 0 Flash 3 (B0F3) 0x0000 6000 - 0x0000 7FFF 8

B0

B1

B2

B3

Bank 0 Flash 4 (B0F4) 0x0001 8000 - 0x0001 FFFF 32

Bank 0 Flash 5 (B0F5) 0x0002 0000 - 0x0002 FFFF 64

Bank 0 Flash 6 (B0F6) 0x0003 0000 - 0x0003 FFFF 64

Bank 0 Flash 7 (B0F7) 0x0004 0000 - 0x0004 FFFF 64

Bank 0 Flash 8 (B0F8) 0x0005 0000 - 0x0005 FFFF 64

Bank 0 Flash 9 (B0F9) 0x0006 0000 - 0x0006 FFFF 64

Bank 1 Flash 0 (B1F0) 0x0007 0000 - 0x0007 FFFF 64

Bank 1 Flash 1 (B1F1) 0x0008 0000 - 0x0008 FFFF 64

Bank 2 Flash 0 (B2F0) 0x0009 0000 - 0x0009 FFFF 64

Bank 2 Flash 1 (B2F1) 0x000A 0000 - 0x000A FFFF 64

Bank 2 Flash 2 (B2F2) 0x000B 0000 - 0x000B FFFF 64

Bank 3 Flash 0 (B3F0) 0x000C 0000 - 0x000C FFFF 64

Bank 3 Flash 1 (B3F1) 0x000D 0000 - 0x000D FFFF 64

Size

(Kbytes)

ST10 bus size

32-bit (IBus)

16-bit (X-BUS)

43/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Table 9. Sectorization of the Flash modules (write operations or with ROMS1 = 1)

Bank Description Addresses

Bank 0 Test-Flash (B0TF) 0x0000 0000 - 0x0000 1FFF 8

Bank 0 Flash 0 (B0F0) 0x0001 0000 - 0x0001 1FFF 8

Bank 0 Flash 1 (B0F1) 0x0001 2000 - 0x0001 3FFF 8

Bank 0 Flash 2 (B0F2) 0x0001 4000 - 0x0001 5FFF 8

Bank 0 Flash 3 (B0F3) 0x0001 6000 - 0x0001 7FFF 8

B0

B1

B2

B3

Bank 0 Flash 4 (B0F4) 0x0001 8000 - 0x0001 FFFF 32

Bank 0 Flash 5 (B0F5) 0x0002 0000 - 0x0002 FFFF 64

Bank 0 Flash 6 (B0F6) 0x0003 0000 - 0x0003 FFFF 64

Bank 0 Flash 7 (B0F7) 0x0004 0000 - 0x0004 FFFF 64

Bank 0 Flash 8 (B0F8) 0x0005 0000 - 0x0005 FFFF 64

Bank 0 Flash 9 (B0F9) 0x0006 0000 - 0x0006 FFFF 64

Bank 1 Flash 0 (B1F0) 0x0007 0000 - 0x0007 FFFF 64

Bank 1 Flash 1 (B1F1) 0x0008 0000 - 0x0008 FFFF 64

Bank 2 Flash 0 (B2F0) 0x0009 0000 - 0x0009 FFFF 64

Bank 2 Flash 1 (B2F1) 0x000A 0000 - 0x000A FFFF 64

Bank 2 Flash 2 (B2F2) 0x000B 0000 - 0x000B FFFF 64

Bank 3 Flash 0 (B3F0) 0x000C 0000 - 0x000C FFFF 64

Bank 3 Flash 1 (B3F1) 0x000D 0000 - 0x000D FFFF 64

Size

(Kbytes)

ST10 bus size

32-bit (IBus)

16-bit (XBus)

Ta bl e 9 refers to the configuration when bit ROMS1 of the SYSCON register is set. When

bootstrap mode is entered:

● Test-Flash is seen and is available for code fetches (address 00’0000h)

● User IFlash is only available for read and write access

● Write access must be made using addresses in segment 1 that start at 01'0000h,

irrespective of the ROMS1 bit value in the SYSCON register. Note that the user must
not rely on the ROMS1 bit because it is ‘don't care’ for write operations.

● Read access is made in segment 0 or in segment 1 depending on the ROMS1 value.

In bootstrap mode, ROMS1 = 0 by default, so the first 32 Kbytes of IFlash are mapped in
segment 0.

Example

To program address 0 using the default configuration, the user must put the value 01'0000h
in the FARL and FARH registers. However, to verify the content of address 0 a read to
00'0000h must be performed.

44/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Ta bl e 1 0 shows the composition of the control register interface. These registers can be

addressed by the CPU

.

Table 10. Control register interface

Name Description Addresses

FCR1-0 Flash control registers 1-0 0x000E 0000 - 0x000E 0007 8

FDR1-0 Flash data registers 1-0 0x000E 0008 - 0x000E 000F 8

FAR Flash address registers 0x000E 0010 - 0x000E 0013 4

FER Flash error register 0x000E 0014 - 0x000E 0015 2

FNVWPXR

FNVWPIR

FNVAPR0

FNVAPR1

XFICR XFlash interface control register 0x000E E000 - 0x000E E001 2

Flash non volatile protection X

register

Flash non volatile protection I

register

Flash non volatile access

protection register 0

Flash non volatile access

protection register 1

0x000E DFB0 - 0x000E DFB3 4

0x000E DFB4 - 0x000E DFB7 4

0x000E DFB8 - 0x000E DFB9 2

0x000E DFBC - 0x000E DFBF 4

Size

(byte)

bus size

16-bit

(XBus)

5.1.3 Low power mode

The Flash modules are automatically switched off when executing the PWRDN instruction.
Consumption is drastically reduced, but, exiting this state can take a long time (t

Note: Recovery time from power-down mode for the Flash modules is shorter than the main

oscillator start-up time. To avoid problems restarting to fetch code from the Flash, it is
important to properly size the external circuit on the RPD pin.

PD

).

ST10

Power-off Flash mode is entered only at the end of the Flash write operation.

5.2 Write operation

The Flash modules have a single register interface mapped in the memory space of the
XFlash module (0x0E 0000 to 0x0E 0013). All operations are enabled through four 16-bit
control registers: Flash control register 1-0 high/low (FCR1H/L-FCR0H/L). Eight other 16-bit
registers are used to store Flash addresses and data for program operations (FARH/L and
FDR1H/L-FDR0H/L) and write operation error flags (FERH/L). All registers are accessible
with 8 and 16-bit instructions (since they are mapped on the ST10 XBus).

Note: Before accessing the XFlash module (and consequently the Flash register to be used for

program/erasing operations), the XFLASHEN bit in the XPERCON register and the XPEN
bit in the SYSCON register must be set.

The four Flash module banks have their own dedicated sense amplifiers, so that any bank
can be read while any other bank is written. However simultaneous write operations (‘write’
meaning either program or erase) on different banks are forbidden. When a write operation
is occurring in the Flash, no other write operations can be performed.

45/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

During a Flash write operation any attempt to read the bank under modification outputs
invalid data (software trap 009Bh). This means that the Flash bank is not fetchable when a
write operation is active. The write operation commands must be executed from another
bank, from the other module or from another memory (internal RAM or external memory).

Note: During a write operation, when the LOCK bit of the FCR0 register is set, it is forbidden to

write into the Flash control registers.

5.2.1 Power supply drop

If, during a write operation, the internal low voltage supply drops below a certain internal
voltage threshold, any write operation that is running is suddenly interrupted and the
modules are reset to read mode. Following power-on, an interrupted Flash write operation
must be repeated.

5.3 Internal Flash memory registers

Flash control register 0 low (FCR0L)

The Flash control register 0 low (FCR0L) together with the Flash control register 0 high
(FCR0H) is used to enable and to monitor all the write operations for both Flash modules.
The user has no access in write mode to the Test-Flash (B0TF). The Test-Flash block is only
seen by the user in bootstrap mode.

FCR0L (0x0E 0000) FCR Reset value: 0000h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved BSY1 BSY0 LOCK Res. BSY3 BSY2 Res.

-RRRRR

Table 11. FCR0L register decription

BIt Bit name Function

15-7 - Reserved

Bank 1:0 busy (IFlash)

These bits indicate that a write operation is running in the
corresponding bank of IFlash. They are automatically set when the
WMS bit of the FCR0H register is set. When the BSY [1:0] bits are set

6-5 BSY[1:0]

every read access to the corresponding bank outputs invalid data
(software trap 009Bh), while every write access to the bank is ignored.
At the end of a write operation or during a program or erase suspend
these bits are automatically reset and the bank returns to read mode.
After a program or erase resume these bits are automatically reset.

46/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Table 11. FCR0L register decription (continued)

BIt Bit name Function

Flash registers access locked

When this bit is set, access to the Flash control registers
FCR0H/L-FCR1H/L, FDR0H/L-FDR1H/L, FARH/L and FER is locked by
the FPEC. Any read access to the registers outputs invalid data
(software trap 009Bh) and any write access is ineffective. The LOCK bit

4LOCK

3-Reserved

2-1 BSY[3:2]

0-Reserved

is automatically set when the Flash bit WMS of the FCR0H register is
set.
The LOCK bit is the only bit the user can always access to detect the
status of the Flash. If it is low, the remainder of the FCR0L and all other
Flash registers are accessible by the user.

Note: When the LOCK bit is low, the FER register content can be read,
but, its content is updated only when the BSY bits are reset.

Bank 3:2 busy (XFlash)

These bits indicate that a write operation is running on the
corresponding bank of XFlash. They are automatically set when bit
WMS in the FCR0H register is set. Setting the protection operation
automatically sets the BSY2 bit (since the protection registers are in
Block B2). When both busy (XFlash) bits are set, every read access to
the corresponding bank outputs invalid data (software trap 009Bh),
while every write access to the bank is ignored. At the end of a write
operation or during a program or erase suspend these bits are
automatically reset and the bank returns to read mode. After a program
or erase resume these bits are automatically reset.

47/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Flash control register 0 high (FCR0H)

The Flash control register 0 high (FCR0H) together with the Flash control register 0 low
(FCR0L) is used to enable and monitor write operations for both the Flash modules. The
user has no access in write mode to the Test-Flash (B0TF). The Test-Flash block is only
seen by the user in bootstrap mode.

FCR0H (0x0E 0002) FCR Reset value: 0000h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

WMS SUSP WPG DWPG SER Reserved SPR SMOD Reserved

RW RW RW RW RW

Table 12. FCR0H register decription

- RW RW -

Bit Bit name Function

Write mode start

This bit must be set to start every write operation in the Flash modules. At
the end of the write operation or during a suspend, this bit is automatically

15 WMS

reset. To resume a suspended operation, this bit must be set again. It is
forbidden to set this bit if the ERR bit of the FER register is high (the
operation is not accepted). It is also forbidden to start a new write (program
or erase) operation (by setting the WMS bit high) when the SUSP bit of the
FCR0 register is high. Resetting this bit by software has no effect.

Suspend

This bit must be set to suspend the current program (word or double word)
or sector erase operation to read data in one of the sectors of the bank
under modification or to program data in another bank. The suspend
operation resets the Flash bank to normal read mode (automatically
resetting bits BSYx). When in program suspend, the two Flash modules

14 SUSP

accept only read and program resume operations. When in erase suspend,
the modules accept only read, erase resume, and program (word or double
word) operations. Program operations cannot be suspended during erase
suspend. To resume the suspended operation, the WMS bit must be set
again, together with the selection bit corresponding to the operation to
resume (WPG, DWPG, SER).

Note: It is forbidden to start a new write operation with the SUSP bit already
set.

Word program

This bit must be set to select the word (32 bits) program operation in the
Flash modules. The word program operation allows 0s to be programmed

13 WPG

instead of 1s. The Flash address to be programmed must be written in the
FARH/L registers, while the Flash data to be programmed must be written
in the FDR0H/L registers before starting the execution by setting the WMS
bit. The WPG bit is automatically reset at the end of the word program
operation.

48/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Table 12. FCR0H register decription (continued)

Bit Bit name Function

Double word program

This bit must be set to select the double word (64 bits) program operation in
the Flash modules. The double word program operation allows 0s to be

12 DWPG

11 SER

10-9 - Reserved

8 SPR

7SMOD

programmed instead of 1s. The Flash address in which to program (aligned
with even words) must be written in the FARH/L registers, while the two
Flash data to be programmed must be written in the FDR0H/L registers
(even word) and FDR1H/L registers (odd word) before starting the
execution by setting the WMS bit. The DWPG bit is automatically reset at
the end of the double word program operation.

Sector erase

This bit must be set to select the sector erase operation in the Flash
modules. The sector erase operation allows all Flash locations to 0xFF to
be erased. 1 to all sectors of the same bank (excluding the Test-Flash for
Bank B0) can be erased through bits BxFy of the FCR1H/L registers before
starting the execution by setting the WMS bit. Preprogramming the sectors
to 0x00 is done automatically. The SER bit is automatically reset at the end
of the sector erase operation.

Set protection

This bit must be set to select the set protection operation. The set
protection operation allows 0s to be programmed instead of 1s in the Flash
non-volatile protection registers. The Flash address in which to program
must be written in the FARH/L registers, while the Flash data to be
programmed must be written in the FDR0H/L before starting the execution
by setting the WMS bit. A sequence error is flagged by the SEQER bit of
the FER register if the address written in FARH/L is not in the range
0x0EDFB0-0x0EDFBF. The SPR bit is automatically reset at the end of the
set protection operation.

Select module

If this bit is reset, a write operation is performed on the XFlash module. if
this bit is set, a write operation is performed on IFlash module. The SMOD
bit is automatically reset at the end of the write operation.

6-0 - Reserved

49/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Flash control register 1 low (FCR1L)

The Flash control register 1 low (FCR1L) and the Flash control register 1 high (FCR1H) are
used to select the sectors to erase or they are used, during any write operation, to monitor
the status of each sector of the module selected by the SMOD bit of the FCR0H register.
FCR1L is shown below when SMOD = 0 and when SMOD = 1.

FCR1L (0x0E 0004) SMOD = 0 FCR Reset value: 0000h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved B2F2 B2F1 B2F0

-RRR

Table 13. FCR1L register description (SMOD = 0, XFlash selected)

BIt Bit name Function

15-3 - Reserved

Bank 2 XFlash sector 2:0 status

These bits must be set during a sector erase operation to select the
sectors to be erased in Bank 2. During any erase operation, these bits

2-0 B2F[2:0]

FCR1L (0x0E 0004) SMOD = 1 FCR Reset value: 0000h

are automatically set and give the status of the three sectors of Bank 2
(B2F2-B2F0). The meaning of B2Fy bit for sector y of Bank 2 is given in

Ta bl e 17 . The BTF [2:0] bits are automatically reset at the end of a write

operation if no errors are detected.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved B0F9 B0F8 B0F7 B0F6 B0F5 B0F4 B0F3 B0F2 B0F1 B0F0

-

Table 14. FCR1L register description (SMOD = 1, IFlash selected)

RS RS RS RS RS RS RS RS RS RS

BIt Bit name Function

15-10 - Reserved

Bank 0 IFlash sector 9:0 status

These bits must be set during a sector erase operation to select the
sectors to be erased in Bank 0. During any erase operation, these bits

9-0 B0F[9:0]

are automatically set and give the status of the 10 sectors of Bank 0
(B0F9-B0F0). The meaning of B0Fy bit for sector y of Bank 0 is given in

Ta bl e 17 . The B0F [9:0] bits are automatically reset at the end of a write

operation if no errors are detected.

50/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Flash control register 1 high (FCR1H)

The Flash control register 1 high (FCR1H) and the Flash control register 1 low (FCR1L) are
used to select the sectors to erase, or they are used, during any write operation, to monitor
the status of each sector and each bank of the module selected by the SMOD bit of the
FCR0H register. FCR1H is shown below when SMOD = 0 and when SMOD = 1.

FCR1H (0x0E 0006) SMOD = 0 FCR Reset value: 0000h

15141312111098765432 1 0

Reserved B3S B2S Reserved B3F1 B3F0

-

Table 15. FCR1H register description (SMOD = 0, XFlash selected)

RS RS -RSRS

BIt Bit name Function

15-10 - Reserved

Bank 3-2 status (XFlash)

During any erase operation, these bits are automatically modified and

9-8 B[3:2]S

give the status of the two banks, B3-B2. The meaning of the BxS bit for
Bank x is given in Ta bl e 1 7 . Bits B[3:2]S are automatically reset at the
end of a erase operation if no errors are detected.

7-2 - Reserved

Bank 3 XFlash sector 1:0 status

During any erase operation, these bits are automatically set and give

1-0 B3F[1:0]

the status of the two sectors of Bank 3 (B3F1-B3F0). The meaning of
B3Fy bit for sector y of Bank 1 is given in Tab l e 1 7 . Bits B3F[1:0] are
automatically reset at the end of a erase operation if no errors are
detected.

51/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

FCR1H (0x0E 0006) SMOD = 1 FCR Reset value: 0000h

15141312111098765432 1 0

Reserved B1S B0S Reserved B1F1 B1F0

-

Table 16. FCR1H register description (SMOD = 1, IFlash selected)

RS RS -RSRS

BIt Bit name Function

15-10 - Reserved

Bank 1-0 status (IFlash)

During any erase operation, these bits are automatically modified and

9-8 B[1:0]S

give the status of the two banks, B1-B0. The meaning of BxS bit for
Bank x is given in Ta bl e 1 7 . Bits B[1:0]S are automatically reset at the
end of a erase operation if no errors are detected.

7-2 - Reserved

Bank 1 IFlash sector 1:0 status

During any erase operation, these bits are automatically set and give

1-0 B1F[1:0]

the status of the two sectors of Bank 1 (B1F1-B1F0). The meaning of
B1Fy bit for sector y of Bank 1 is given in Tab l e 1 7 . These bits are
automatically reset at the end of a erase operation if no errors are
detected.

Table 17. Banks (BxS) and sectors (BxFy) status bits meaning

ERR SUSP BxS = 1 meaning BxFy = 1 meaning

1 - Erase error in Bank x Erase error in sector y of Bank x

0 1 Erase suspended in Bank x Erase suspended in sector y of Bank x

0 0 Don’t care Don’t care

Flash data register 0 low (FDR0L)

The Flash address registers (FARH/L) and the Flash data registers (FDR1H/L-FDR0H/L)
are used during program operations to store Flash addresses and data to program.

FDR0L (0x0E 0008) FCR Reset value: FFFFh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

DIN15DIN14DIN13DIN12DIN11DIN10DIN9DIN8DIN7DIN6DIN5DIN4DIN3DIN2DIN1DIN

RW RW RW RW RW

Table 18. FDR0L register description

BIt Bit name Function

15-0 DIN[15:0]

52/346

RW RW RW RW RW RW RW RW RW RW RW

Data input 15:0

These bits must be written with the data to program the Flash with the
following operations: Word program (32-bit), double word program (64­bit) and set protection.

0

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Flash data register 0 high (FDR0H)

FDR0H (0x0E 000A) FCR Reset value: FFFFh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

DIN31DIN30DIN29DIN28DIN27DIN26DIN25DIN24DIN23DIN22DIN21DIN20DIN19DIN18DIN17DIN

16

RW RW RW RW RW

Table 19. FDR0H register description

RW RW RW RW RW RW RW RW RW RW RW

BIt Bit name Function

Data input 31:16

31-16 DIN[31:16]

These bits must be written with the data to program the Flash with the
following operations: Word program (32-bit), double word program (64-bit)
and set protection.

Flash data register 1 low (FDR1L)

FDR1L (0x0E 000C) FCR Reset value: FFFFh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

DIN15DIN14DIN13DIN12DIN11DIN10DIN9DIN8DIN7DIN6DIN5DIN4DIN3DIN2DIN1DIN

RW RW RW RW RW

Table 20. FDR1L register description

BIt Bit name Function

15-0 DIN[15:0]

RW RW RW RW RW RW RW RW RW RW RW

Data input 15:0

These bits must be written with the data to program the Flash with the
following operations: Word program (32-bit), double word program (64­bit) and set protection.

0

Flash data register 1 high (FDR1H)

FDR1H (0x0E 000E) FCR Reset value: FFFFh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

DIN31DIN30DIN29DIN28DIN27DIN26DIN25DIN24DIN23DIN22DIN21DIN20DIN19DIN18DIN17DIN

16

RW RW RW RW RW

Table 21. FDR1H register description

BIt Bit name Function

31-16 DIN[31:16]

RW RW RW RW RW RW RW RW RW RW RW

Data input 31:16
These bits must be written with the data to program the Flash with the

following operations: Word program (32-bit), double word program (64-bit)
and set protection.

53/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Flash address register low (FARL)

FARL (0x0E 0010) FCR Reset value: 0000h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

ADD15ADD14ADD13ADD12ADD11ADD10ADD9ADD8ADD7ADD6ADD5ADD4ADD3ADD

RW RW RW RW RW

Table 22. FARL register description

RW RW RW RW RW RW RW RW RW -

2

Reserved

BIt Bit name Function

Address 15:2
These bits must be written with the address of the Flash location to

15-2 ADD[15:2]

program in the following operations: Word program (32-bit) and double
word program (64-bit). In double word program the ADD2 bit must be
written to 0.

1-0 - Reserved

Flash address register high (FARH)

FARH (0x0E 0012) FCR Reset value: 0000h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved

- RWRWRWRWRW

Table 23. FARH register description

ADD20ADD19ADD18ADD17ADD

16

BIt Bit name Function

15-5 - Reserved

Address 20:16

4-0 ADD[20:16]

These bits must be written with the address of the Flash location to
program in the following operations: Word program and double word
program.

54/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Flash error register (FER)

The Flash error register (and all other Flash registers) can only be properly read once the
LOCK bit of the FCR0L register is low. Nevertheless, its content is updated when the BSY
bits are reset. For this reason, it is meaningful to read the FER register content only when
the LOCK bit and all BSY bits are cleared.

FER (0xE 0014) FCR Reset value: 0000h

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved WPF RESER SEQER Reserved 10ER PGER ERER ERR

-

Table 24. FER register description

RC RC RC - RC RC RC RC

Bit Bit name Function

15-9 - Reserved

Write protection flag

This bit is automatically set when trying to program or erase in a sector

8WPF

that is write protected. In the case of a multiple sector erase,
unprotected sectors are erased, protected sectors are not erased, and
the WPF bit is set. The WPF bit has to be reset by software.

Resume error

7 RESER

This bit is automatically set when a suspended program or erase
operation is not resumed correctly due to a protocol error. In this case
the suspended operation is aborted. This bit has to be reset by software.

Sequence error

This bit is automatically set when the control registers (FCR1H/L-

6 SEQER

FCR0H/L, FARH/L, FDR1H/L-FDR0H/L) are not correctly filled to
execute a valid write operation. In this case no write operation is
executed. This bit has to be reset by software.

5-4 - Reserved

1 over 0 error

This bit is automatically set when trying to program bits to 1 that have

310ER

previously been set to 0 (this does not happen when programming the
protection bits). This error is not due to a failure of the Flash cell. It flags
that the desired data has not been written. The 10ER bit has to be reset
by software.

Program error

This bit is automatically set when a program error occurs during a Flash

2PGER

write operation. This error is due to a failure of a Flash cell that can no
longer be programmed. The word where this error occurred must be
discarded. This bit has to be reset by software.

55/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Table 24. FER register description (continued)

Bit Bit name Function

Erase error

This bit is automatically set when an erase error occurs during a Flash

1ERER

write operation. This error is due to a failure of a Flash cell that can no
longer be erased. This kind of error is fatal and the sector where it
occurred must be discarded. This bit has to be reset by software.

Write error

This bit is automatically set when an error occurs during a Flash write

0ERR

operation or when a bad operation setup is written. Once the error has
been discovered and understood, the ERR bit must be reset by
software.

XFlash interface control register (XFICR)

This register is used to configure the XFlash interface behavior on the XBus. It allows the
number of wait states introduced on the XBus to be set before the internal READY
given to the ST10 bus master.

XFICR (0xE E000h) XBus Reset value: 000Fh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

signal is

Reserved WS3WS2WS1WS0

- RWRWRWRW

Table 25. XFICR register description

Bit Bit name Function

15-4 - Reserved

Wait state setting

These three bits are the binary coding of the wait state number
introduced by the XFlash interface through the internal READY

3-0 WS[3:0]

the XBus. The default value after reset is 1111, where up to 15 wait
states are set. Recommendations for the ST10F296E include:
For f
For f

> 40 MHz: 1 wait state WS[3:0] = 0001

CPU

≤ 40 MHz: 0 wait state WS[3:0] = 0000

CPU

signal of

56/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

5.4 Protection strategy

The protection bits are stored in non-volatile Flash cells inside the XFlash module. They are
read once at reset and stored in seven volatile registers. Before they are read from the non­volatile cells, all available protections are forced active during reset.

Protection can be programmed using the set protection operation (see the Flash control
registers of Section 5.3), that can be executed from all the internal or external memories
except from the Flash bank, B2.

Two kinds of protection are available:

● Write protections to avoid unwanted writings

● Access protections to avoid piracy

5.4.1 Protection registers

This section describes the seven non-volatile protection registers and their architectural
limitations. These registers are one time programmable.

Four registers (FNVWPXRL/H-FNVWPIRL/H) are used to store the write protection fuses
respectively for each sector of the XFlash module (see ‘X’ in the sections below) and IFlash
module (see ‘I’ in the sections below). The other three registers (FNVAPR0 and
FNVAPR1L/H) are used to store the access protection fuses (common to both Flash
modules, though, with some limitations).

Flash non-volatile write protection X register low (FNVWPXRL)

FNVWPXRL (0x0E DFB0) NVR Delivery value: FFFFh

15 14131211109876543 2 1 0

W2PPR Reserved W2P2 W2P1 W2P0

RW - RWRWRW

Table 26. FNVWPXRL register description

Bit Bit name Function

Write protection Bank 2 non-volatile cells

This bit, if programmed at 0, disables any write access to the non-

15 W2PPR

14-3 - Reserved

2-0 W2P[2:0]

volatile cells of Bank 2. Since these non-volatile cells are dedicated to
protection registers, once the W2PPR bit is set, the configuration of
protection setting is frozen, and can only be modified by executing a
temporary write unprotection operation.

Write protection Bank 2 sectors 2-0 (XFlash)

These bits, if programmed at 0, disable any write access to the sectors
of Bank 2 (XFlash).

57/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Flash non-volatile write protection X register high (FNVWPXRH)

FNVWPXRH (0x0E DFB2) NVR Delivery value: FFFFh

15141312111098765432 1 0

Reserved W3P1 W3P0

-RWRW

Table 27. FNVWPXRH register description

Bit Bit name Function

15-2 - Reserved

Write protection Bank 3/sectors 1-0 (XFlash)

1-0 W3P[1:0]

These bits, if programmed at 0, disable any write access to the sectors
of Bank 3 (XFlash).

Flash non-volatile write protection I register low (FNVWPIRL)

FNVWPIRL (0x0E DFB4) NVR Delivery value: FFFFh

1514131211109876543210

Reserved

W0P9W0P8W0P7W0P6W0P5W0P4W0P3W0P2W0P1W0P

- RW RW RW RW RW RW RW RW RW RW

Table 28. FNVWPIRL register description

Bit Bit name Function

15-10 - Reserved

Write protection Bank 0/sectors 9-0 (IFlash)

9-0 W0P[9:0]

These bits, if programmed at 0, disable any write access to the sectors of
Bank 0 (IFlash).

Flash non-volatile write protection I register high (FNVWPIRH)

FNVWPIRH (0x0E DFB6) NVR Delivery value: FFFFh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved W1P1 W1P0

-RWRW

Table 29. FNVWPIRH register description

Bit Bit name Function

0

58/346

15-2 - Reserved

Write protection Bank 1/sectors 1-0 (IFlash)

1-0 W1P[1:0]

These bits, if programmed at 0, disable any write access to the sectors
of Bank 1 (IFlash).

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Flash non-volatile access protection register 0 (FNVAPR0)

Because of the ST10 architecture, the XFlash is seen as external memory. For this reason,
it is impossible to access protect it from the real external memory or internal RAM.

FNVAPR0 (0x0E DFB8) NVR Delivery value: ACFFh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved DBGP ACCP

-RWRW

Table 30. FNVAPR0 register description

Bit Bit name Function

15-2 - Reserved

Debug protection

This bit, if erased at 1, allows all protections to be by-passed using the

1DBGP

0 ACCP

debug features through the test interface. If programmed at 0, all the
debug features and Flash test modes, and the test interface are
disabled. STMicroelectronics will be unable to access the device to run
any eventual failure analysis.

Access protection

This bit, if programmed at 0, disables any access (read/write) to data
mapped inside the IFlash module address space, unless the current
instruction is fetched from one of the two Flash modules.

Flash non-volatile access protection register 1 low (FNVAPR1L)

FNVAPR1L (0x0E DFBC) NVR Delivery value: FFFFh

1514131211109876543210

PDS15PDS14PDS13PDS12PDS11PDS10PDS9PDS8PDS7PDS6PDS5PDS4PDS3PDS2PDS1PDS

0

RW RW RW RW RW RW RW RW RW RW RW RW RW RW RW RW

Table 31. FNVAPR1L register description

Bit Bit name Function

Protections disable 15-0

If bit PDSx is programmed at 0 and bit PENx (of the FNVAPR1H

15-0 PDS[15:0]

register) is erased at 1, the ACCP bit action is disabled. Bit PDS0 can be
programmed at 0 only if bits DBGP and ACCP (of the FNVAPR0
register) have already been programmed at 0. Bit PDSx can be
programmed at 0 only if bit PENx-1 has already been programmed at 0.

59/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

Flash non-volatile access protection register 1 high (FNVAPR1H)

FNVAPR1H (0x0E DFBE) NVR Delivery value: FFFFh

1514131211109876543210

PEN15PEN14PEN13PEN12PEN11PEN10PEN9PEN8PEN7PEN6PEN5PEN4PEN3PEN2PEN1PEN

0

RW RW RW RW RW

Table 32. FNVAPR1H register description

Bit Bit name Function

15-0 PEN[15:0]

5.4.2 Access protection

The Flash modules have one level of access protection (access to data both when reading
and writing). If bit ACCP of the FNVAPR0 register is programmed at 0, the IFlash module
becomes access protected: Data in the IFlash module can be read/written only if the current
execution is from the IFlash module itself.

Protection can be permanently disabled by programming bit PDS0 of the FNVAPR1H
register to analyze rejects. Allowing PDS0 bit programming only when the ACCP bit is
programmed, guarantees that only an execution from the Flash itself can disable the
protections.

Protection can be permanently enabled again by programming bit PEN0 of the FNVAPR1L
register. Access protection can be permanantly disabled and enabled again up to 16 times.

Trying to write into the access protected Flash from internal RAM is unsuccessful. Trying to
read into the access protected Flash from internal RAM outputs dummy data.

RW RW RW RW RW RW RW RW RW RW RW

Protections enable 15-0

If bit PENx is programmed at 0 and bit PDSx+1 is erased at 1, bit ACCP
action is enabled again. Bit PENx can be programmed at 0 only if bit
PDSx has already been programmed at 0.

When the Flash module is access protected, data access through the program erase
controller (PEC) of a peripheral is forbidden. To read/write data in PEC mode from/to a
protected bank, the Flash module must be temporarily unprotected.

Due to the ST10 architecture, the XFlash is seen as external memory. For this reason, it is
impossible to access protect it from real external memory or internal RAM. Ta b le 3 3
summarizes the different access protection levels. In particular, it shows what is possible
(and not possible) if trying to enable all access protections when fetching from a memory
(see column 1).

60/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

Table 33. Summary of access protection levels

Fetching from IFlash Yes/Yes Yes/Yes Yes Yes

Fetching from XFlash No/Yes Yes/Yes Yes No

Fetching from IRAM No/Yes Yes/Yes Yes No

Fetching from XRAM No/Yes Yes/Yes Yes No

Fetching from external memory No/Yes Yes/Yes Yes No

5.4.3 Write protection

The Flash modules have one level of write protection. Each sector of each bank of each
Flash module can be software write protected by programming the related WyPx bit of the
FNVWPXRH/L-FNVWPIRH/L registers

5.4.4 Temporary unprotection

Bits WyPx of the FNVWPXRH/L-FNVWPIRH/L registers can be temporary unprotected by
executing the set protection operation and writing 1 into these bits.

Bit ACCP can be temporarily unprotected by executing the set protection operation and
writing 1 into these bits, bu,t only if these write instructions are executed from the Flash
modules.

Read IFlash/

jump to IFlash

at 0.

Read XFlash/

jump to XFlash

Read Flash

registers

Write Flash

registers

To restore the write and access protection bits or to execute a set protection operation and
write 0 into the desired bits, the microcontroller must be reset.

It is not necessary to temporarily unprotect an access protected Flash to update the code. it
is sufficient to execute the updating instructions from another Flash bank.

When a temporary unprotection operation is executed, the corresponding volatile register is
written to 1, while the non-volatile registers bits previously written to 0 (for a protection set
operation), continue to maintain the 0. For this reason, the user software must track the
current protection status (for example, by using a specific RAM area), as it is not possible to
deduce it by reading the non-volatile register content (a temporary unprotection cannot be
detected).

61/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

5.5 Write operation examples

Examples are presented below for each kind of Flash write operation.

5.5.1 Word program

Example: 32-bit word program of data 0xAAAAAAAA at address 0x0C5554 in XFlash
module.

FCR0H|= 0x2000; /*Set WPG in FCR0H */
FARL = 0x5554; /*Load Add in FARL*/
FARH = 0x000C; /*Load Add in FARH*/
FDR0L = 0xAAAA; /*Load Data in FDR0L*/
FDR0H = 0xAAAA; /*Load Data in FDR0H*/
FCR0H|= 0x8000; /*Operation start*/

5.5.2 Double word program

Example: Double word program (64-bit) of data 0x55AA55AA at address 0x095558 and
data 0xAA55AA55 at address 0x09555C in IFlash module.

FCR0H|= 0x1080; /*Set DWPG, SMOD*/
FARL = 0x5558; /*Load Add in FARL*/
FARH = 0x0009; /*Load Add in FARH*/
FDR0L = 0x55AA; /*Load Data in FDR0L*/
FDR0H = 0x55AA; /*Load Data in FDR0H*/
FDR1L = 0xAA55; /*Load Data in FDR1L*/
FDR1H = 0xAA55; /*Load Data in FDR1H*/
FCR0H|= 0x8000; /*Operation start*/

Double word program is always performed on the double word aligned on an even word. Bit
ADD2 of FARL is ignored.

5.5.3 Sector erase

Example: Sector erase of sectors B3F1 and B3F0 of Bank 3 in XFlash module.

FCR0H|= 0x0800; /*Set SER in FCR0H*/
FCR1H|= 0x0003; /*Set B3F1, B3F0*/
FCR0H|= 0x8000; /*Operation start*/

5.5.4 Suspend and resume

Example: Word program, double word program, and sector erase operations can be
suspended in the following way:

FCR0H|= 0x4000; /*Set SUSP in FCR0H*/

The operation can be resumed in the following way:

FCR0H|= 0x0800; /*Set SER in FCR0H*/
FCR0H|= 0x8000; /*Operation resume*/

Before resuming a suspended erase, FCR1H/FCR1L registers must be read to check if the
erase is already completed (FCR1H = FCR1L = 0x0000 if erase is complete). The original
setup of select operation bits in the FCR0H/L registers must be restored before the
operation resume, otherwise the operation is aborted and bit RESER of FER is set.

62/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

5.5.5 Erase suspend, program and resume

A sector erase operation can be suspended in order to program (word or double word)
another sector.

Example: Sector erase of sector B3F1 of Bank 3 in XFlash module.

FCR0H|= 0x0800; /*Set SER in FCR0H*/
FCR1H|= 0x0002; /*Set B3F1*/
FCR0H|= 0x8000; /*Operation start*/

Example: Sector erase suspend

FCR0H|= 0x4000; /*Set SUSP in FCR0H*/
do /* Loop to wait for LOCK=0 and BSY bit(s)=0 */
{tmp = FCR0L ;
} while( (tmp && 0x00E6) );

Example: Word program of data 0x5555AAAA at address 0x0C5554 in XFlash module.

FCR0H&= 0xBFFF; /*Rst SUSP in FCR0H*/
FCR0H|= 0x2000; /*Set WPG in FCR0H*/
FARL = 0x5554; /*Load Add in FARL*/
FARH = 0x000C; /*Load Add in FARH*/
FDR0L = 0xAAAA; /*Load Data in FDR0L*/
FDR0H = 0x5555; /*Load Data in FDR0H*/
FCR0H|= 0x8000; /*Operation start*/

Once the program operation is finished, the erase operation can be resumed in the following
way:

FCR0H|= 0x0800; /*Set SER in FCR0H*/
FCR0H|= 0x8000; /*Operation resume*/

During the program operation in erase suspend, bits SER and SUSP are low. A word or
double word program during erase suspend cannot be suspended.

To summarize:

● A sector erase can be suspended by setting SUSP bit

● To perform a word program operation during erase suspend, bits SUSP and SER must

first be reset, then bits WPG and WMS can be set.

● To resume the sector erase operation bit SER must be set again

● It is forbidden to start any write operation when the SUSP bit is set

63/346

Internal Flash memory ST10F296E

www.BDTIC.com/ST

5.5.6 Set protection

Example 1: Enable write protection of sectors B0F3-0 of Bank 0 in the IFlash module.

FCR0H|= 0x0100; /*Set SPR in FCR0H*/
FARL = 0xDFB4; /*Load Add of register FNVWPIRL in FARL*/
FARH = 0x000E; /*Load Add of register FNVWPIRL in FARH*/
FDR0L = 0xFFF0; /*Load Data in FDR0L*/
FDR0H = 0xFFFF; /*Load Data in FDR0H*/
FCR0H|= 0x8000; /*Operation start*/

Bit SMOD of FCR0H must not be set as the write protection bits of the IFlash module are
stored in the Test-Flash (XFlash module).

Example 2: Enable access and debug protection.

FCR0H|= 0x0100; /*Set SPR in FCR0H*/
FARL = 0xDFB8; /*Load Add of register FNVAPR0 in FARL*/
FARH = 0x000E; /*Load Add of register FNVAPR0 in FARH*/
FDR0L = 0xFFFC; /*Load Data in FDR0L*/
FCR0H|= 0x8000; /*Operation start*/

Example 3: Disable access and debug protection permanently.

FCR0H|= 0x0100; /*Set SPR in FCR0H*/
FARL = 0xDFBC; /*Load Add of register FNVAPR1L in FARL*/
FARH = 0x000E; /*Load Add of register FNVAPR1L in FARH*/
FDR0L = 0xFFFE; /*Load Data in FDR0L for clearing PDS0*/
FCR0H|= 0x8000; /*Operation start*/

Example 4: Re- enable access and debug protection permanently .

FCR0H|= 0x0100; /*Set SPR in FCR0H*/
FARL = 0xDFBC; /*Load Add register FNVAPR1H in FARL*/
FARH = 0x000E; /*Load Add register FNVAPR1H in FARH*/
FDR0H = 0xFFFE; /*Load Data in FDR0H for clearing PEN0*/
FCR0H|= 0x8000; /*Operation start*/

Disabling and re-enabling access and debug protection permanently way (as shown above)
can be done up to a maximum of 16 times.

64/346

ST10F296E Internal Flash memory

www.BDTIC.com/ST

5.6 Write operation summary

Write operations are generally started with the following three steps:

1. The first instruction is used to select the desired operation by setting its corresponding

selection bit in the Flash control register 0. This instruction is also used to select in
which Flash Module to apply the write operation (by setting/resetting the SMOD bit).

2. The second step is the definition of the address and data for programming or the

sectors or banks to erase.

3. The third instruction is used to start the write operation, by setting the start bit, WMS, in

the FCR0 register.

Once selected, but not yet started, one operation can be canceled by resetting the operation
selection bit.

A summary of the available Flash module write operations are shown in Tab le 3 4 .

Table 34. Flash write operations

Operation Select bit Address and data Start bit

Word program (32-bit) WPG

Double word program (64-bit) DWPG

Sector erase SER FCR1L/FCR1H WMS

Set protection SPR FDR0L/FDR0H WMS

Program/erase suspend SUSP None None

FARL/FARH

FDR0L/FDR0H

FARL/FARH
FDR0L/FDR0H
FDR1L/FDR1H

WMS

WMS

65/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6 The bootstrap loader

The ST10F296E implements innovative boot capabilities to:

● Support a user defined bootstrap (see ‘alternate bootstrap loader’);

● Support bootstrap via UART or bootstrap via CAN for the standard bootstrap.

6.1 Selection among user-code, standard or alternate bootstrap

The selection among user-code, standard bootstrap or alternate bootstrap is made by
special combinations on Port 0L[5...4] during the time the reset configuration is latched from
Port 0.

The alternate boot mode is triggered with a special combination set on Port 0L[5...4]. These
signals, as with other configuration signals are latched on the rising edge of the RSTIN

The alternate boot function is divided into two functional parts (which are independent from
each other):

Part 1

Selection of the reset sequence according to Port 0 configuration, user mode, and alternate
mode signatures:

● Decoding reset configuration P0L.5 = 1 and P0L.4 = 1 selects normal mode and

selects that user Flash is mapped from address 00’0000h.

● Decoding reset configuration P0L.5 = 1 and P0L.4 = 0 selects ST10 standard bootstrap

mode (Test-Flash is active and overlaps user Flash for code fetches from address
00'0000h; user Flash is active and available for read and program).

● Decoding reset configuration P0L.5 = 0 and P0L.4 = 1 activates new verifications to

select which bootstrap software to execute:
– If the user mode signature in the user Flash is programmed correctly, a software

reset sequence is selected and the user code is executed.

– if the user mode signature is not programmed correctly, but, the alternate mode

signature in the user Flash is programmed correctly, alternate boot mode is
selected.

– If both the user and alternate mode signatures are not programmed correctly in

the user Flash, the user key location is read again. Its value determines the
behavior of the selective bootstrap loader.

pin.

66/346

Part 2

Running of user selected reset sequences:

● Standard bootstrap loader: Jump to a predefined memory location in Test-Flash

(controlled by ST).

● Alternate boot mode: Jump to address 09’0000h.

● Selective bootstrap loader: Jump to a predefined location in Test-Flash (controlled by

ST) and check which communication channel is selected.

● User code: Make a software reset and jump to 00’0000h.

ST10F296E The bootstrap loader

www.BDTIC.com/ST

Table 35. ST10F296E boot mode selection

P0.5 P0.4 ST10 decoding

1 1 User mode: User Flash is mapped at 00’0000h

10

0 1 Alternate boot mode: Flash mapping depends on signature integrity check

00Reserved

Standard bootstrap loader: User Flash is mapped from 00’0000h, code
fetches redirected data to Test-Flash at 00’0000h

6.2 Standard bootstrap loader (BSL)

The built-in bootstrap loader of the ST10F296E provides a mechanism to load the startup
program, which is executed after reset, via the serial interface. In this case no external
(ROM) memory or internal ROM is required for the initialization code starting at location
00’0000
transfer data via the serial interface into an external RAM using a second level loader
routine. ROM memory (internal or external) is not necessary. However, it may be used to
provide lookup tables or may provide ‘core-code’, a set of general purpose subroutines, for
I/O operations, number crunching, system initialization, etc.

. The bootstrap loader moves code/data into the IRAM, but it is also possible to

H

The bootstrap loader may be used to load the complete application software into ROMless
systems. It may also load temporary software into complete systems for testing or
calibration. in addition, it may be used to load a programming routine for Flash devices.

The BSL mechanism may be used for standard system startup as well as for special
occasions such as system maintenance (firmware update), end-of-line programming, or
testing.

6.2.1 Entering the standard bootstrap loader

The ST10F296E enters BSL mode if pin P0L.4 is sampled low at the end of a hardware
reset. In this case the built-in bootstrap loader is activated independently of the selected bus
mode. The bootstrap loader code is stored in a special Test-Flash: No part of the standard
Flash memory area is required for this.

After entering BSL mode and completing the respective initialization steps, the ST10F296E
scans the RxD0 line and the CAN1_RxD line to receive either a valid dominant bit from the
CAN interface, or a start condition from the UART line.

Start condition on UART RxD: The ST10F296E starts the standard bootstrap loader. This
bootstrap loader is identical to other ST10 devices (for example, the ST10F280). See

Section 6.3: Standard bootstrap with UART (RS232 or K-line) on page 73 for details.

Valid dominant bit on CAN1 RxD: The ST10F296E starts bootstrapping via CAN1. This
bootstrapping method is new and is described in Section 6.4: Standard bootstrap with CAN

on page 78. Figure 6: ST10F296E new standard bootstrap loader program flow on page 69

shows the program flow of the new bootstrap loader. It illustrates how new functionalities are
implemented, which is as follows:

● UART: UART has priority over CAN after a falling edge on CAN1_RxD untill the first

valid rising edge on CAN1_RxD.

● CAN: Pulses on CAN1_RxD which are shorter than 20*CPU-cycles, are filtered.

67/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.2.2 ST10 configuration in BSL

When the ST10F296E has entered BSL mode, the configuration shown in Tab le 3 6 is
automatically set (values that deviate from the normal reset values, are highlighted in bold
italic).

.

Table 36. ST10 configuration in BSL mode

Watchdog timer Disabled

Register SYSCON

0404

Context pointer CP FA00

Register STKUN FC00

Stack pointer SP FA4 0

Register STKOV FA00

Register BUSCON0

Acc. to startup

config.

Register S0CON 8011

(1)

H

H

H

H

H

(2)

H

XPEN bit set for bootstrap via CAN or
alternate boot mode

Initialized only if bootstrap is run via UART

Register S0BG Acc. to ‘00’ byte Initialized only if bootstrap is run via UART

P3.10/TXD0 1 Initialized only if bootstrap is run via UART

DP3.10 1 Initialized only if bootstrap is run via UART

CAN1 status/control register 0000

H

Initialized only if bootstrap is run via CAN

CAN1 bit timing register Acc. to 0 frame Initialized only if bootstrap is run via CAN

XRAM1-2, XFlash, CAN1 and XMISC

XPERCON 042D

H

enabled. Initialized only if bootstrap is run via
CAN

P4.6/CAN1_TxD 1 Initialized only if bootstrap is run via CAN

DP4.6 1 Initialized only if bootstrap is run via CAN

1. In bootstrap modes (standard or alternate) the ROMEN bit, bit 10 of the SYSCON register, is always set
regardless of the EA
bus width selection via Port 0 configuration.

2. BUSCON0 is initialized with 0000h which disables the external bus if pin EA is high during reset. If pin EA
is low during reset, the BUSACT0 bit, bit 10, and the ALECTL0 bit, bit 9, are set, enabling the external bus
with a lengthened ALE signal. BTYP field, bit 7 and 6, is set according to Port 0 configuration.

pin level. The BYTDIS bit, bit 9 of the SYSCON register, is set according to the data

68/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

Figure 6. ST10F296E new standard bootstrap loader program flow

Start

Falling-edge on

UART0 RxD?

UART boot

Start timer T6

No

UART0 RxD = 1?

Stop timer T6

Initialize UART

Send acknowledge

Address = FA40h

No

No

Byte received?

[Address] = S0RBUF

Address = Address + 1

Address = FA60h?

No

Ye s

Falling-edge on

CAN1 RxD?

Start timer PT0

UART RxD = 0?

CAN1 RxD = 1?

PT0 > 20?

Count = 1

CAN RxD = 0?

CAN1 RxD = 1?

CAN BOOT

No

No

No

No

No

Glitch on CAN1 RxD

Stop timer PT0

Clear timer PT0

Message received?

No

UART boot

Count += 1

Count = 5?

Stop timer PT0

Initialize CAN

Address = FA40h

Jump to address FA40h

No

[Address] = MO15_data0

Address = Address + 1

Address = FAC0h?

CAN boot

No

The watchdog timer is disabled, except after a normal reset, so the bootstrap loading sequence is not
time limited. Depending on the selected serial link (UART0 or CAN1), pin TxD0 or CAN1_TxD is
configured as output, so the ST10F296E can return the acknowledge byte. Even if the internal IFlash is
enabled, no code can be executed out of it.

69/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.2.3 Booting steps

There are four steps to booting the ST10F296E with the boot loader code (see Figure 7):

1. The ST10F296E is reset with P0L.4 low

2. The internal new bootstrap code runs on the ST10 and a first level user code is

downloaded from the external device, via the selected serial link (UART0 or CAN1).
The bootstrap code is contained in the ST10F296E Test-Flash and is automatically run
when ST10F296E is reset with P0L.4 low. After loading a preselected number of bytes,
ST10F296E begins executing the downloaded program.

3. The first level user code is run on ST10F296E. Typically, this user code is another

loader that is used to download the application software into the ST10F296E.

4. The loaded application software is now running

Figure 7. Booting steps for the ST10F296E

Serial

Step1

Entering bootstrap

External device

Link

ST10F296

Loading 1st level user code

Step2

Step3

Loading the application

and exiting BSL

Step4

External device

External device

External device

Download

1st level user code

Download

Application

Serial

Link

Link

Link

ST10F296

Run Bootstrap Code

from Test-Flash

Serial

ST10F296

Run 1st level Code

from DPRAM @FA40h

Serial

ST10F296

Run Application Code

6.2.4 Hardware to activate BSL

The hardware that activates the BSL during every hardware reset may be a simple pull­down resistor on P0L.4. switchable solution (via jumper or an external signal) may be used
for systems that only temporarily use the BSL.

Note: The CAN alternate function on Port 4 lines is not activated if the user has selected eight

address segments (Port 4 pins have three functions: I/O port, address-segment, and CAN).
Bootstrapping via CAN requires that four address segments or less are selected.

70/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

Figure 8. Hardware provisions to activate the BSL

External
Signal

Normal Boot

P0L.4

R

P0L.4

8kΩ max.

Circuit 1

P0L.4

BSL

R

P0L.4

8kΩ max.

Circuit 2

6.2.5 Memory configuration in bootstrap loader mode

The configuration (i.e. the accessibility) of the ST10F296E’s memory areas after reset in
bootstrap loader mode differs from the standard case. Pin EA
is selected to enable the external bus or not:

● If EA = 1, the external bus is disabled (BUSACT0 = 0 in BUSCON0 register);

● If EA = 0, the external bus is enabled (BUSACT0 = 1 in BUSCON0 register).

is evaluated when BSL mode

Moreover, while in BSL mode, access to the internal IFlash area are partly redirected:

● Code access is made from the special Test-Flash seen in the range 00’0000h to

00’01FFFh.

● User IFlash is only available for read and write access (Test-Flash cannot be read nor

written).

● Write access must be made with addresses starting in segment 1 from 01'0000h,

whatever the value of the ROMS1 bit in the SYSCON register.

● Read access is made in segment 0 or in segment 1 depending on the ROMS1 bit

value.

● In BSL mode, by default, ROMS1= 0 so the first 32 Kbytes of IFlash are mapped in

segment 0.

Example

In default configuration, to program address 0, the user must put the value 01'0000h in the
FARL and FARH registers. However, to verify the content of the address 0 a read to
00'0000h must be performed.

Figure 9 shows the memory configuration after reset.

71/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

Figure 9. Memory configuration after reset

16 Mbytes 16 Mbytes 16 Mbytes

Int.
RAM

Test-Flash

BSL mode active

pin

EA

Data fetch from internal Flash
area

Code fetch from internal Flash
area

Yes ( P0 L .4 = 0

Test-Flash access

User IFlash access

1. As long as the ST10F296E is in BSL, user software should not try to execute code from the internal IFlash
as the fetches are redirected to the Test-Flash.

6.2.6 Loading the startup code

After the serial link initialization sequence (see Section 6.3 and Section 6.4), the BSL enters
a loop to receive 32 bytes (boot via UART) or 128 bytes (boot via CAN).

255

Access to
external
bus
disabled

1

0

User Flash

High

Access to
int. Flash
enabled

255

Access to
external
bus
enabled

1

Int.
RAM

0

Test-Flash

User Flash

Yes (P0L.4 = 0

Low

Test-Flash access

User IFlash access

Access to
int. Flash
enabled

255

Depends on
reset config.

, PO)

(EA

1

Int.
RAM

0

Depends on
reset config.

user FLASH

No (P0L.4 = 1

According to application

User IFlash access

User IFlash access

These bytes are stored sequentially into the ST10F296E dual-port RAM from location
00’FA40h.

To execute the loaded code, the BSL jumps to location 00’FA40h. The bootstrap sequence
running from the Test-Flash terminates. However, the microcontroller remains in BSL mode.

The initially loaded routine (the first level user code) most probably loads additional code
and data. This first level user code may use the pre-initialized interface (UART or CAN) to
receive data, a second level code, and store it to arbitrary user-defined locations.

This second level code may be the final application code. It may also be another, more
sophisticated, loader routine that adds a transmission protocol to enhance the integrity of
the loaded code or data. It may also contain a code sequence to change the system
configuration and enable the bus interface to store the received data into external memory.

In all cases, the ST10F296E runs in BSL mode, i.e. with the watchdog timer disabled and
with limited access to the internal IFlash area.

72/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.2.7 Exiting bootstrap loader mode

To execute a program in normal mode, the BSL mode must first be terminated. The
ST10F296E exits BSL mode upon a software reset (level on P0L.4 is ignored) or a hardware
reset (P0L.4 must be high in this case). After the reset, the ST10F296E starts executing
from location 00’0000
programmed via pin EA

of the internal Flash (user Flash) or the external memory, as

H

.

Note: If a bidirectional software reset is executed, and external memory boot is selected (EA

a degeneration of the software reset event into a hardware reset can occur. This implies that
P0L.4 becomes transparent, so to exit from bootstrap mode it is necessary to release pin
P0L.4 (it is no longer ignored).

6.2.8 Hardware requirements

Although the new bootstrap loader has been designed to be compatible with the old one,
there are a few hardware requirements related to the new one:

● External bus configuration: Four segment address lines or less (keep CAN I/O’s

available) are required.

● Use of CAN pins (P4.5 and P4.6): P4.5 (CAN1_RxD) can only be used as a port input.

Pin P4.6 (CAN1_TxD) can be used as input or output.

● Level on UART RxD and CAN1_RxD during the bootstrap phase (see step 2 of

Figure 7: Booting steps for the ST10F296E on page 70): Must be 1 (external pull-up’s

recommended).

6.3 Standard bootstrap with UART (RS232 or K-line)

6.3.1 Features

ST10F296E bootstrap via UART has the same overall behavior as the old ST10 bootstrap
via UART:

● Same bootstrapping steps

● Same bootstrap method: To analyze the timing of a predefined byte, send back an

acknowledge byte, load a fixed number of bytes and then run.

● Same functionalities: To boot with different crystals and PLL ratios.

= 0),

73/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

Figure 10. UART bootstrap loader sequence

RSTIN

P0L.4

RxD0

TxD0

CSP:IP

1. BSL initialization time > 1ms @ f

2. Zero byte (1 start bit, eight 0 data bits, 1 stop bit), sent by host.

3. Acknowledge byte, sent by ST10F296E.

4. 32 bytes of code / data, sent by host.

5. TxD0 is only driven a certain time after reception of the zero byte (1.3 ms @ f

6. Internal boot ROM / Test-Flash.

1)

2)

6)

Int. boot ROM/Test-Flash BSL-routine

= 40 MHz.

CPU

6.3.2 Entering bootstrap via UART

The ST10F296E enters BSL mode at the end of a hardware reset if pin P0L.4 is sampled
low. In this case, the built-in bootstrap loader is activated independent of the selected bus
mode. The bootstrap loader code is stored in a special Test-Flash, for which no part of the
standard mask ROM or Flash memory area is required.

4)

3)

5)

32 bytes

user software

= 40 MHz).

CPU

After entering BSL mode and the respective initialization, the ST10F296E scans the RxD0
line to receive a zero byte (one start bit, eight 0 data bits and one stop bit). From this zero
byte, it calculates the corresponding baud rate factor with respect to the current CPU clock,
initializes the serial interface ASC0 accordingly, and switches the TxD0 pin to output. Using
this baud rate, an acknowledge byte is returned to the host that provides the loaded data.

The acknowledge byte for the ST10F296E is D5h.

74/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.3.3 ST10 configuration in UART BSL (RS232 or K-line)

When the ST10F296E has entered BSL mode on the UART, the configuration shown in

Ta bl e 3 7 is automatically set (values that deviate from the normal reset values, are

highlighted in bold italic).

Table 37. ST10 configuration in UART BSL mode (RS232 or K-line)

Watchdog timer Disabled

Register SYSCON

Context pointer CP FA00

Register STKUN FA00

Stack pointer SP FA4 0

Register STKOV FC00

Register BUSCON0

Acc. to startup

Register S0CON 8011

Register S0BG Acc. to 00 byte

P3.10/TXD0 1

DP3.10 1

0400

config.

(1)

H

H

H

H

H

(2)

H

Initialized only if bootstrap is run via UART

Initialized only if Bootstrap is run via UART

Initialized only if Bootstrap is run via UART

Initialized only if Bootstrap is run via UART

1. In bootstrap modes (standard or alternate) the ROMEN bit, bit 10 of the SYSCON register, is always set
regardless of the EA pin level. The BYTDIS bit, bit 9 of the SYSCON register, is set according to the data
bus width selection via Port 0 configuration.

2. BUSCON0 is initialized with 0000h which disables the external bus if pin EA is high during reset. If pin EA
is low during reset, the BUSACT0 bit, bit 10, and the ALECTL0 bit, bit 9, are set, enabling the external bus
with a lengthened ALE signal. BTYP field, bit 7 and 6, is set according to Port 0 configuration.

The watchdog timer is disabled, except after a normal reset, so the bootstrap loading
sequence is not time limited. Pin TxD0 is configured as output, so the ST10F296E can
return the acknowledge byte. Even if the internal IFlash is enabled, no code can be
executed out of it.

6.3.4 Loading the startup code

After sending the acknowledge byte the BSL enters a loop to receive 32 bytes via ASC0.
These bytes are stored sequentially into locations 00’FA40
Up to 16 instructions may be placed into the RAM area. To execute the loaded code the BSL
jumps to location 00’FA40
then terminates, however, the ST10F296E remains in BSL mode. It is likely that the initially
loaded routine loads additional code or data, as an average application is likely to require
substantially more than 16 instructions. This second receive loop may directly use the pre­initialized interface ASC0 to receive data and store it to arbitrary user-defined locations.

This second level of loaded code may be the final application code. It may also be another,
more sophisticated, loader routine that adds a transmission protocol to enhance the integrity
of the loaded code or data. In addition, it may contain a code sequence to change the
system configuration and enable the bus interface to store the received data into the
external memory.

, i.e. the first loaded instruction. The bootstrap loading sequence

H

through 00’FA5FH of the IRAM.

H

75/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

This process may go through several iterations or may directly execute the final application.
In all cases, the ST10F296E runs in BSL mode, i.e. with the watchdog timer disabled and
limited access to the internal Flash area. All code fetches from the internal IFlash area
(01’0000

...08’FFFFH) are redirected to the special Test-Flash. Data read operations

H

access the internal Flash of the ST10F296E, if any is available, but return undefined data on
ROM-less devices.

6.3.5 Choosing the baud rate for the BSL via UART

The calculation of the serial baud rate for ASC0 from the length of the first zero byte that is
received, allows the bootstrap loader of the ST10F296E to operate with a wide range of
baud rates. However, upper and lower limits have to be respected to insure proper data
transfer.

Equation 1

Note: F

B

ST 10F296fCPU

32 SOBRL 1+()×⁄=

The ST10F296E uses Timer T6 to measure the length of the initial zero byte. The
quantization uncertainty of this measurement implies the first deviation from the real baud
rate. The next deviation is implied by the computation of the S0BRL reload value from the
timer contents. Equation 2 below shows the association:

Equation 2

SOBRL T6 36–()72⁄=

Where:

T6 9 4⁄ f

⁄×=

CPUBHost

For correct data transfer from the host to the ST10F296E, the maximum deviation between
the internal initialized baud rate for ASC0 and the real baud rate of the host should be below

2.5 %. The deviation (F

, in percent) between host baud rate and the ST10F296E baud rate

B

can be calculated via Equation 3:

Equation 3

B

F

B

–()B

ContrBHost

⁄ 100×=

Contr

where:
FB ≤ 2.5 %

does not consider the tolerances of oscillators and other devices supporting the serial

B

communication.

76/346

This baud rate deviation is a nonlinear function depending on the CPU clock and the baud
rate of the host. The maxima of F

increases with the host baud rate due to the smaller

B

baud rate pre-scaler factors and the implied higher quantization error (see Figure 11).

ST10F296E The bootstrap loader

www.BDTIC.com/ST

Figure 11. Baud rate deviation between the host and ST10F296E

F

B

2.5%

B

Low

The minimum baud rate (B
of Timer T6, when measuring the zero byte, i.e. it depends on the CPU clock. Using the
maximum T6 count as 2

B

High

in Figure 11) is determined by the maximum count capacity

Low

16

in the formula, the minimum baud rate can be calculated. The

lowest standard baud rate in this case is 1200 Baud. Baud rates below B

I

B

II

Low

HOST

cause T6 to

overflow. In this case ASC0 cannot be initialized properly.
The maximum baud rate (B

does not exceed the limit, i.e. all baud rates between B

in Figure 11) is the highest baud rate where the deviation

High

Low

and B

are below the deviation

High

limit. The maximum standard baud rate that fulfills this requirement is 19200 Baud.
Higher baud rates, however, may be used as long as the actual deviation does not exceed

the limit. The baud rate marked ‘I’ in Figure 11 may violate the deviation limit, while the
higher baud rate, marked ‘II’, in Figure 11 stays well below it. This depends on the host
interface.

77/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.4 Standard bootstrap with CAN

6.4.1 Features

The bootstrap via CAN has the same overall behavior as the bootstrap via UART:

● Same bootstrapping steps

● Same bootstrap method: To analyze the timing of a predefined frame, send back an

acknowledge frame (on request only), load a fixed number of bytes and then run.

● Same functionalities: To boot with different crystals and PLL ratios.

Figure 12. CAN bootstrap loader sequence

RSTIN

P0L.4

CAN1_RxD

CAN1_TxD

CSP:IP

1. BSL initialization time > 1ms @ f

2. Zero frame (CAN message: standard ID = 0, DLC = 0) sent by host

3. CAN message (standard ID = E6h, DLC = 3, Data0 = D5h, Data1-Data2 = IDCHIP_low-high) sent by
ST10F296E on request.

4. 128 bytes of code/data, sent by host

5. CAN1_TxD is only driven a certain time after reception of the zero byte (1.3 ms @ f

6. Internal boot ROM/Test-Flash

1)

2)

3)

5)

6)

Int. boot ROM / Test-Flash BSL-routine

= 40 MHz

CPU

4)

128 bytes

user software

= 40 MHz).

CPU

The bootstrap loader may be used to load the complete application software into ROM-less
systems. It may also load temporary software into complete systems for testing or
calibration. In addition, it may be used to load a programming routine for Flash devices.

The BSL mechanism may be used for standard system start-ups as well as for special
occasions like system maintenance (firmware update), end-of-line programming or testing.

78/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.4.2 Entering the CAN bootstrap loader

The ST10F296E enters BSL mode, if pin P0L.4 is sampled low at the end of a hardware
reset. In this case, the built-in bootstrap loader is activated independent of the selected bus
mode. The bootstrap loader code is stored in a special Test-Flash, no part of the standard
mask ROM or Flash memory area is required for this.

After entering BSL mode and the respective initialization the ST10F296E scans the
CAN1_TxD line to receive the following initialization frame:

● Standard identifier = 0h

● DLC = 0h

As all the bits to be transmitted are dominant bits, a succession of five dominant bits and
one stuff bit on the CAN network is used. From the duration of this frame it calculates the
corresponding baud rate factor with respect to the current CPU clock, initializes the CAN1
interface accordingly, switches pin CAN1_TxD to output and enables the CAN1 interface to
take part in the network communication. Using this baud rate, a message object is
configured to send an acknowledge frame. The ST10F296E does send this message object,
but, the host can request it by sending remote frame.

The acknowledge frame is the following for the ST10F296E:

● Standard identifier = E6h

● DLC = 3h

● Data0 = D5h (generic acknowledge of the ST10 devices)

● Data1 = IDCHIP least significant byte

● Data2 = IDCHIP most significant byte

For the ST10F296E, IDCHIP = 128Xh.

Note: Two behaviors can be distinguished regarding acknowledgement of the ST10 by the host. If

the host is behaving according to CAN protocol, as long as the ST10 CAN module is not
configured, the host is alone on the CAN network and does not receive acknowledgement. It
automatically resends the zero frame. As soon as the ST10 CAN is configured, the host
acknowledges the zero frame. The ‘acknowledge frame’, with identifier 0xE6, is configured,
but, the transmit request is not set. The host can request this frame to be sent, and therefore
get the IDCHIP, by sending a remote frame.

As the IDCHIP is sent in the acknowledge frame, Flash programming software now has the
possibility to know immediately the exact type of device to be programmed.

79/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.4.3 ST10 configuration in CAN BSL

When the ST10F296E has entered BSL mode via CAN, the configuration shown in Ta bl e 38
is automatically set (values that deviate from the normal reset values, are marked in bold
italic)

.

Table 38. ST10 configuration in CAN BSL mode

Watchdog timer Disabled

Register SYSCON

Context pointer CP FA00

Register STKUN FA00

Stack pointer SP FA40

Register STKOV FC00

Register BUSCON0

Acc. to startup

CAN1 status/control register 0000

0404

config.

(1)

H

H

H

H

H

(2)

H

XPEN bit set

Initialized only if bootstrap is run via UART

CAN1 bit timing register Acc. to 0 frame Initialized only if bootstrap is run via CAN

XPERCON 042D

H

XRAM1-2, XFlash, CAN1 and XMISC enabled

P4.6/CAN1_TxD 1 Initialized only if bootstrap is run via CAN

DP4.6 1 Initialized only if bootstrap is run via CAN

1. In bootstrap modes (standard or alternate) the ROMEN bit, bit 10 of the SYSCON register, is always set
regardless of the EA pin level. The BYTDIS bit, bit 9 of the SYSCON register, is set according to the data
bus width selection via Port 0 configuration.

2. BUSCON0 is initialized with 0000h which disables the external bus if pin EA is high during reset. If pin EA
is low during reset, the BUSACT0 bit, bit 10, and the ALECTL0 bit, bit 9, are set, enabling the external bus
with a lengthened ALE signal. BTYP field, bit 7 and 6, is set according to Port 0 configuration.

The watchdog timer is disabled, except after a normal reset, so the bootstrap loading
sequence is not time limited. The CAN1_TxD1 pin is configured as output, so the
ST10F296E can return the identification frame. Even if the internal IFlash is enabled, no
code can be executed out of it.

80/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.4.4 Loading the startup code via CAN

After sending the acknowledge byte the BSL enters a loop to receive 128 bytes via CAN1.

Note: The number of bytes loaded when booting via the CAN interface has been extended to 128

bytes to allow re-configuration of the CAN bit timing register with the best timings
(synchronization window, ...). This can be achieved by the following sequence of
instructions:

ReconfigureBaudRate:

MOV R1,#041h
MOV DPP3:0EF00h,R1 ; Put CAN in Init, enable Configuration Change
MOV R1,#01600h
MOV DPP3:0EF06h,R1 ; 1MBaud at Fcpu = 20 MHz

These 128 bytes are stored sequentially into locations 00’FA40H to 00’FABFH of the IRAM.
So, up to 64 instructions may be placed into the RAM area. To execute the loaded code the
BSL jumps to location 00’FA40
sequence is now terminated, however, the ST10F296E remains in BSL mode. It is likely that
the initially loaded routine loads additional code or data (because an average application is
likely to require substantially more than 64 instructions). This second receive loop may
directly use the pre-initialized CAN interface to receive data and store it to arbitrary user­defined locations.

The second level of loaded code may be the final application code. It may also be another,
more sophisticated, loader routine that adds a transmission protocol to enhance the integrity
of the loaded code or data. In addition, it may contain a code sequence to change the
system configuration and enable the bus interface to store the received data into the
external memory.

, the first loaded instruction. The bootstrap loading

H

This process may go through several iterations or may directly execute the final application.
In all cases the ST10F296E runs in BSL mode, with the watchdog timer disabled and limited
access to the internal Flash area. All code fetches from the internal Flash area (01’0000
...08’FFFF

) are redirected to the special Test-Flash. Data read operations access the

H

H

internal Flash of the ST10F296E, if any is available, but return undefined data on ROM-less
devices.

81/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.4.5 Choosing the baud rate for the BSL via CAN

The bootstrap via CAN acts in the same way as the UART bootstrap mode. When the
ST10F296E is started in BSL mode, it polls the RxD0 and CAN1_RxD lines. When polling a
low level on one of these lines, a timer is launched that is stopped when the line goes back
to high level.

For CAN communication, the algorithm is made to receive a zero frame, where the standard
identifier is 0x0 and DLC is 0. This frame produces the following levels on the network: 5D,
1R, 5D, 1R, 5D, 1R, 5D, 1R, 5D, 1R, 4D, 1R, 1D, 11R. The algorithm lets the timer run until
detection of the 5
durations. This minimizes the error introduced by the polling

Figure 13. Bit rate measurement over a predefined zero-frame

Start Stuff bit Stuff bit Stuff bit Stuff bit

th

recessive bit. In this way, the bit timing is calculated over 29 bit time

.

........

Measured time

Error induced by the polling

The code used for polling is as follows:

WaitCom:

JNB P4.5,CAN_Boot ; if SOF detected on CAN, then go to CAN

; loader
JB P3.11,WaitCom ; Wait for start bit at RxD0
BSET T6R ; Start Timer T6

....

CAN_Boot:

BSET PWMCON0.0 ; Start PWM Timer0

; (resolution is 1 CPU clk cycle)
JMPR cc_UC,WaitRecessiveBit

WaitDominantBit:

JB P4.5,WaitDominantBit ; wait for end of stuff bit

WaitRecessiveBit:

JNB P4.5,WaitRecessiveBit ; wait for 1st dominant bit = Stuff bit
CMPI1 R1,#5 ; Test if 5th stuff bit detected
JMPR cc_NE,WaitDominantBit ; No, go back to count more
BCLR PWMCON.0 ; Stop timer

; here the 5th stuff bit is detected:

; PT0 = 29 Bit_Time (25D and 4R)

The maximum error at detection of communication on the CAN pin is: (1 not taken + 1 taken
jumps) + 1 taken jump + 1 bit set: (6) + 6 CPU clock cycles

The error at detection of the 5
compare + 1 bit clear: (4) + 6 CPU cycles

th

recessive bit is: (1 taken jump) + 1 not taken jump + 1

82/346

In the worst case scenario, the induced error is 6 CPU clock cycles. So, polling could induce
an error of 6 timer ticks.

ST10F296E The bootstrap loader

www.BDTIC.com/ST

Error induced by the baud rate calculation

The content of the PT0 timer counter corresponds to 29 bit times. This gives the following
equation:

Equation 4

PT0 58 BRP 1+()× 1Tseg1Tseg2++()×=

where BRP (bit rate prescaler), Tseg1 and Tseg2 are the field of the CAN bit timing register.
The CAN protocol specification recommends implementing a bit time composed of at least

eight time quantum (tq). This recommendation has been applied above. The maximum bit
time length is 25 tq. To achieve good precision, the target must have the smallest BRP and
the maximum number of tq in a bit time.

The ranges for PT0 according to BRP are given in Equation 5.

Equation 5

8 ≤ 1 + Tseg1 + Tseg2 ≤ 25
464 x (1 + BRP) ≤ PT0 ≤ 1450 x (1 + BRP)

Table 39. Timer content ranges of BRP value in Equation 5

BRP PT0_min PT0_max Comments

0 464 1450

1 1451 2900

2 2901 4350

3 4351 5800

4 5801 7250

5 7251 8700

.. .. ..

43 20416 63800

44 20880 65250

45 21344 66700 Possible timer overflow

.. .. ..

63 X X

The error coming from the measurement of bit 29 is:

6PTO[]⁄=

e

1

It is maximal for the smallest BRP value and the smallest number of ticks in PT0.
Therefore:

= 1.29%

e

1 Max

For the best precision possible, the target must have the smallest BRP, which minimises
errors when calculating time quanta in a bit time.

83/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

To achieve this, the PT0 value is divided into ranges of 1450 ticks. In the bootstrap
algorithm, PT0 is divided by 1451 and the result gives the BRP value.3

This calculated BRP value is then divided into PT0 to give the ‘1+ Tseg1 + Tseg2’ value. A
table is then made to set the values for Tseg1 and Tseg2 according to the ‘1+ Tseg1 +
Tseg2’ value. The Tseg1 and Tseg2 values are chosen to reach a sample point between
70% and 80% of the bit time.

During the calculation of ‘1+ Tseg1 + Tseg2’, an error, e
value of this error is 1 time quantum.

To compensate for any possible errors on the bit rate, the (re)synchronization jump width is
fixed to two time quanta.

6.4.6 How to compute the baud rate error

An example of the baud rate error computation is as follows:
Conditions:

● CPU frequency: 20 MHz

● Target bit rate: 1 Mbit/s

The content of the PTO timer for bit 29 is given in Equation 6:

Equation 6

PT0

] 29 f

× BitRate()⁄ 29 20× 6110

CPU

Therefore:
574 < [PT0] < 586
This gives:

–BRP = 0
– tq = 100 ns

, can be introduced. The maximum

2

6

×⁄× 580===

Computation of 1 + Tseg1 + Tseg2 considering Equation 4 is given in Equation 7:

Equation 7

574

--------- -

9

Tseg1 Tseg2

58

586

--------- -10=≤+≤=
58

In the algorithm, a rounding to the superior value is made if the remainder of the division is
greater than half of the divisor. This would have been the case above, if the PT0 content was

574. Thus in this example, 1+Tseg1+Tseg2 = 10, giving a bit time of exactly 1µs => no error
in bit rate.

Note: In most cases (24 MHz, 32 MHz, and 40 MHz of CPU frequency and 125, 250, 500 or

1Mbyte/s of bit rate) there is no error. However, it is better to check the error with real
application parameters.

The content of the bit timing register is : 0x1640. This gives a sample point of 80%.

Note: The (re)synchronization jump width is fixed to 2 time quanta.

84/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.4.7 Bootstrap via CAN

After the bootstrap phase, the ST10F296E CAN module is configured as follows:

● Pin P4.6 is configured as output (the latch value is: 1 = recessive) to assume

CAN1_TxD function.

● The MO2 is configured to output the acknowledge of the bootstrap with the standard

identifier E6h, DLC = 3, Data0 = D5h, and Data1&2 = IDCHIP.

● The MO1 is configured to receive messages with the standard identifier 5h. Its

acceptance mask is set in order that all bits must match. The DLC received is not
checked: The ST10 expects only 1 byte of data at a time.

No other message is sent by the ST10F296E after the acknowledge.

Note: The CAN bootstrap loader waits for 128 bytes of data instead of 32 bytes (see Section 6.3:

Standard bootstrap with UART (RS232 or K-line) on page 73). This is to allow the user to

reconfigure the CAN bit rate as soon as possible.

6.5 Comparing the old and the new bootstrap loader

Ta bl e 4 0 and Ta bl e 4 1 summarize the differences between bootstrapping via UART only (old

ST10 method) and bootstrapping via UART or CAN (new ST10F296E method).

Table 40. Software topics summary

Old bootstrap loader New bootstrap loader Comments

Uses only 32 bytes in dual­port RAM from 00’FA40h

Loads 32 bytes from the
UART

User selected XPeripherals
can be enabled during
bootstrapping (see steps 3
and 4 of Section 6.2.3:

Booting steps on page 70)

6.5.1 Software aspects

As CAN1 is needed, the XPERCON register is configured by the bootstrap loader code and
the XPEN bit of the SYSCON register is set. This is done as follows:

● Disable the XPeripherals by clearing the XPEN bit in the SYSCON register.

Caution: This part of code must not be located in the XRAM, because if so, it is
disabled.

● Enable the XPeripherals that are needed by writing the correct value in the XPERCON

register.

● Set the XPEN bit in the SYSCON.

Uses up to 128 bytes in
dual-port RAM from
00’FA40h

Loads 32 bytes from UART
(bootstrapping via UART
mode)

XPeripherals selection is
fixed.

For compatibility between bootstrapping
via UART and bootstrapping via CAN1,
avoid loading the application software in
the 00’FA60h/00’FABFh range

Same files can be used for bootstrapping
via UART

User can change the XPeripheral
selections through a specific code

Note: The settings can be modified if the EINIT instruction is not executed (and is not in the

bootstrap loader code).

85/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.5.2 Hardware aspects

The new bootstrap loading method via UART and CAN is compatible with the old method via
UART only. However, some additional hardware is required with the new method which is
summarized in Ta bl e 4 1.

.

Table 41. Hardware topics summary

Actual bootstrap loader New bootstrap loader Comments

P4.5 cannot be used as user output
P4.5 can be used as output in
BSL mode

in BSL mode. It can only be used as

CAN1_RxD, input, or address-

segments.

The level on CAN1_RxD can
change during step 2 of the
booting steps (see

Section 6.2.3 on page 70)

The level on CAN1_RxD must be

stable at 1 during step 2 of the

booting steps (see Section 6.2.3 on

page 70)

6.6 Alternate boot mode (ABM)

6.6.1 Activation

Alternate boot mode is activated with the combination 01 on Port 0L[5..4] at the rising edge
of RSTIN

6.6.2 Memory mapping

ST10F296E has the same memory mapping for standard and alternate boot mode:

● Test-Flash: Mapped from 00’0000h. The standard bootstrap loader can be started by

● User Flash: The user Flash is divided into two parts: The IFlash, visible only for

● All ST10F296E XRAM and XPeripheral modules can be accessed if enabled in the

.

executing a jump to the address of this routine (JMPS 00’xxxx; address to be defined).

memory reads and memory writes (no code fetch) and the XFlash, visible for any ST10
access (memory read, memory write, code fetch).

XPERCON register.

External pull-up on P4.5
needed

Note: The alternate boot mode can be used to reprogram the whole content of ST10F296E user

Flash (except Block 0 in Bank 2).

6.6.3 Interrupts

The ST10 interrupt vector table is always mapped from address 00’0000h.
As a consequence, interrupts are not allowed in alternate boot mode. All maskable and non

maskable interrupts must be disabled.

86/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.6.4 ST10 configuration in alternate boot mode

When the ST10F296E has entered BSL mode via CAN, the configuration shown in Ta bl e 42
is automatically set (values that deviate from the normal reset values, are marked in bold
italic).

Table 42. ST10 configuration in alternate boot mode

Watchdog timer Disabled

Register SYSCON

Context pointer CP FA00

Register STKUN FA00

Stack pointer SP FA40

Register STKOV FC00

Register BUSCON0

Acc. to startup

XPERCON 002D

1. In bootstrap modes (standard or alternate) the ROMEN bit, bit 10 of the SYSCON register, is always set
regardless of the EA pin level. The BYTDIS bit, bit 9 of the SYSCON register, is set according to the data
bus width selection via Port 0 configuration.

2. BUSCON0 is initialized with 0000h which disables the external bus if pin EA is high during reset. If pin EA
is low during reset, the BUSACT0 bit, bit 10, and the ALECTL0 bit, bit 9, are set, enabling the external bus
with a lengthened ALE signal. BTYP field, bit 7 and 6, is set according to Port 0 configuration.

0404

config.

(1)

H

H

H

H

H

(2)

H

XPEN bit set

XRAM1-2, XFlash, CAN1 enabled

Even if the internal IFlash is enabled, no code can be executed out of it.

Warning: As the XFlash is needed, the XPERCON register is configured

by the ABM loader code and the XPEN bit of the SYSCON
register

To do this:

● Copy a function into DPRAM that can do the following:

– Disable the XPeripherals by clearing the XPEN bit in the SYSCON register
– Enable the XPeripherals that are needed by writing the correct value in the

XPERCON register
– Set the XPEN bit in the SYSCON register
– Return to the calling address

● Call the function from XFlash

Changing the XPERCON value can not be executed from the XFlash because the XFlash is
disabled when the XPEN bit in the SYSCON register is cleared.

Note: The settings can be modified if the EINIT instruction is not executed (and is not in the

bootstrap loader code).

87/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.6.5 Watchdog

The watchdog timer remains disabled during both standard and alternate boot mode. If a
watchdog reset occurs, a software reset is generated.

Note: See note concerning software reset in Section 6.2.7 on page 73.

6.6.6 Exiting alternate boot mode

Once the ABM mode is entered, it can be exited only with a software or hardware reset.

Note: See note concerning software reset in Section 6.2.7 on page 73.

6.6.7 Alternate boot user software

Users can write the software they want to execute in alternate boot user mode if the rules
concerning the following items are met:

● Mapping variables

● Disabling interrupts

● Exiting conditions

● Predefining vectors in Block 0 of Bank 2

● Using the watchdog

The starting address is 09’0000h.

6.6.8 User/alternate boot mode signature check

To operate user/alternate boot mode, the signature of two memory location contents are
calculated and compared to a reference signature. Flash memory locations must be
reserved and programmed as follows:

User mode signature

00'0000h: Memory address of operand0 for the signature computing
00’1FFCh: Memory address of operand1 for the signature computing
00’1FFEh: Memory address for the signature reference

Alternate mode signature

09'0000h: Memory address of operand0 for the signature computing
09’1FFCh: Memory address of operand1 for the signature computing
09’1FFEh: Memory address for the signature reference

Correct values for operand0, operand1 and the reference signature allow the sequence in

Figure 14 to execute successfully.

Figure 14. Reference signature computation

MOV Rx, CheckBlock1Addr ; 00’0000h for standard reset
ADD Rx, CheckBlock2Addr ; 00’1FFCh for standard reset
CPLB RLx ; 1s complement of the lower

CMP Rx, CheckBlock3Addr ; 00’1FFEh for standard reset

;byte of the sum

88/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

6.6.9 Alternate boot user software aspects

User defined alternate boot code must start at 09’0000h. A new SFR has been created on
ST10F296E to indicate that the device is running in alternate boot mode. Bit 5 of the
EMUCON register (mapped at 0xFE0Ah) is set when the alternate boot is selected by the
reset configuration. All other bits must be ignored when checking the content of this register
to read the value of bit5.

This bit is a read-only bit. It remains set until the next software or hardware reset.

EMUCON register

EMUCON (FE0Ah/05h) SFR Reset value: xxh

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Reserved ABM Reserved

-R-

Table 43. EMUCON register description

Bit Bit name Function

15-6 - Reserved

ABM Flag (or TMOD3)

5 ABM

4-0 - Reserved

0: Alternate boot mode is not selected by reset configuration on
P0L[5..4]
1: Alternate boot mode is selected by reset configuration on P0L[5..4].
This bit is set if P0L[5..4] = 01 during hardware reset.

6.6.10 Internal decoding of test modes

The test mode decoding logic is located inside the ST10F296E bus controller.
The decoding is as follows:

● Alternate boot mode decoding: (P0L.5 & P0L.4)

● Standard bootstrap decoding: (P0L.5 & P0L.4)

● Normal operation: (P0L.5 & P0L.4)

The other configurations select ST internal test modes.

6.6.11 Example of alternate boot mode operation

● The reset configuration is latched on the rising edge of the RSTIN pin.

● If bootstrap loader mode is not enabled (P0L[5..4] = 11), ST10F296E hardware starts a

standard hardware reset procedure.

● If standard bootstrap loader is enabled (P0L[5..4] = 10), the standard ST10 bootstrap

loader is enabled and a variable is cleared to indicate that ABM is not enabled.

● If alternate boot mode is selected (P0L[5..4] = 01), a predefined reset sequence may

be activated. This depends on the user/alternate boot mode signature check.

89/346

The bootstrap loader ST10F296E

www.BDTIC.com/ST

6.7 Selective boot mode

Selective boot mode is a sub-case of alternate boot mode.
The following additional check is made when no signature of the alternate boot mode

signature check is correct:
Address 00’1FFCh is read again.

● If a value 0000h or FFFFh is obtained, a jump is performed to the standard bootstrap

loader.

● If the value obtained is not 0000h or FFFFh:

– High byte bits are disregarded
– Low byte bits select which communication channel is enabled (see Ta bl e 4 4 ).

Table 44. Selective boot mode configurations

Bit Function

UART selection

0

1

0: UART not watched for a start condition
1: UART is watched for a start condition

CAN1 selection

0: CAN1 not watched for a start condition
1: CAN1 is watched for a start condition

2-7

● 0xXX03 configures the selective bootstrap loader to poll for RxD0 and CAN1_RxD.

● 0xXX01 configures the selective bootstrap loader to poll RxD0 only (no bootloading via

Reserved

Must be programmed to 0 for upward compatibility

CAN).

● 0xXX02 configures the selective bootstrap loader to poll CAN1_RxD only (no

bootloading via UART).

● other values will let the ST10F296E executing an endless loop into the Test-Flash.

90/346

ST10F296E The bootstrap loader

www.BDTIC.com/ST

Figure 15. Reset boot sequence

0 to 1

RSTIN

Standard start

Yes (P0L[5..4] = ‘01’)

Boot mode?

Yes (P0L[5..4] = ‘10’)

No (P0L[5..4] = ‘11’)

No (P0L[5..4] = ‘other config.’)

ST test modes

Software checks
user reset vector

(K1 is OK?)

K1 is not OK

Software checks

alternate reset vector

(K2 is OK?)

K2 is OK

Long Jump to

09’0000h

ABM/user Flash

Start at 09’0000h

K1 is OK

K2 is not OK

Read 00’1FFCh

Selective bootstrap loader

Jump to Test-Flash

SW reset

Running from test Flash

Std. bootstrap loader

Jump to Test-Flash

User mode/User Flash

Start at 00’0000h

91/346

Central processing unit (CPU) ST10F296E

www.BDTIC.com/ST

7 Central processing unit (CPU)

The CPU includes a four-stage instruction pipeline, a 16-bit arithmetic and logic unit (ALU)
and dedicated SFRs. Additional hardware has been added for a separate multiply and divide
unit, a bit-mask generator and a barrel shifter.

Most instructions of the ST10F296E can be executed in one instruction cycle which requires

31.25 ns at 25 MHz CPU clock. For example, shift and rotate instructions are processed in
one instruction cycle independent of the number of bits to be shifted.

Multiple-cycle instructions have been optimized. Branches are carried out in two cycles, 16 x
16-bit multiplication in five cycles and a 32/16-bit division in 10 cycles.

The jump cache reduces the execution time of repeatedly performed jumps in a loop, from
two cycles to one cycle.

The CPU uses a bank of 16 word registers to run the current context. This bank of general
purpose registers (GPR) is physically stored within the on-chip internal RAM (IRAM) area. A
context pointer (CP) register determines the base address of the active register bank to be
accessed by the CPU.

The number of register banks is restricted by the available internal RAM space. For easy
parameter passing, a register bank may overlap others.

A system stack of up to 1024 bytes is provided as a storage for temporary data. The system
stack is allocated in the on-chip RAM area, and it is accessed by the CPU via the stack
pointer (SP) register.

Two separate SFRs, STKOV and STKUN, are implicitly compared against the stack pointer
value upon each stack access for the detection of a stack overflow or underflow.

Figure 16. CPU block diagram (MAC unit not included)

16

16

2 Kbyte
internal

RAM

Bank

n

Bank

i

Bank

0

512 Kbyte

Flash

memory

32

SP

STKOV
STKUN

Exec. unit

Instr. ptr

4-stage

pipeline

PSW

SYSCON

BUSCON 0
BUSCON 1

BUSCON 2
BUSCON 3
BUSCON 4

Data pg. ptrs

CPU

MDH

MDL

Mul./div.-HW

Bit-mask gen.

ALU

16-bit

Barrel-Shift

CP

ADDRSEL 1
ADDRSEL 2

ADDRSEL 3
ADDRSEL 4

Code seg. ptr.

R15

General
purpose
registers

R0

92/346

ST10F296E Central processing unit (CPU)

www.BDTIC.com/ST

7.1 Multiplier-accumulator unit (MAC)

The specialized MAC coprocessor has been added to the ST10 CPU core to improve the
computing performances of the ST10 device during signal processing tasks.

The standard ST10 CPU has been modified to include new addressing capabilities which
enable the CPU to supply the new coprocessor with up to two operands per instruction
cycle.

This new MAC coprocessor contains a fast multiply-accumulate unit and a repeat unit.
The coprocessor instructions extend the ST10 CPU instruction set with multiply, multiply-

accumulate, and 32-bit signed arithmetic operations.

Figure 17. MAC unit architecture

GPR pointers

IDX0 pointer
IDX1 pointer

QR0 GPR offset register
QR1 GPR offset register

QX0 IDX offset register
QX1 IDX offset register

Interrupt

controller

ST10 CPU

(1)

Concatenation

32 32

MRW

Repeat unit

MCW

Control unit

40 40

MSW

Flags MAE

16

signed/unsigned

Mux

Sign extend

Scaler

0h 0h08000h

40

40

Mux

40

AB

40-bit signed arithmetic unit

Operand 2Operand 1

16

16 x 16

multiplier

40

MAH MAL

40

8-bit left/right

shifter

40

Mux

40

1. Shared with standard ALU

93/346

Central processing unit (CPU) ST10F296E

www.BDTIC.com/ST

7.2 Instruction set summary

Ta bl e 4 5 lists the instructions of the ST10F296E. A detailed description of each instruction

can be found in the ST10 family programming manual (PM0036).

Table 45. Instruction set summary

Mnemonic Description Bytes

ADD(B) Add word (byte) operands 2/4

ADDC(B) Add word (byte) operands with carry 2/4

SUB(B) Subtract word (byte) operands 2/4

SUBC(B) Subtract word (byte) operands with carry 2/4

MUL(U) (Un)Signed multiply direct GPR by direct GPR (16-16-bit) 2

DIV(U) (Un)Signed divide register MDL by direct GPR (16-/16-bit) 2

DIVL(U) (Un)Signed long divide reg. MD by direct GPR (32-/16-bit) 2

CPL(B) Complement direct word (byte) GPR 2

NEG(B) Negate direct word (byte) GPR 2

AND(B) Bit-wise AND, (word/byte operands) 2/4

OR(B) Bit-wise OR, (word/byte operands) 2/4

XOR(B) Bit-wise XOR, (word/byte operands) 2/4

BCLR Clear direct bit 2

BSET Set direct bit 2

BMOV(N) Move (negated) direct bit to direct bit 4

BAND, BOR,
BXOR

BCMP Compare direct bit to direct bit 4

BFLDH/L

CMP(B) Compare word (byte) operands 2/4

CMPD1/2 Compare word data to GPR and decrement GPR by 1/2 2/4

CMPI1/2 Compare word data to GPR and increment GPR by 1/2 2/4

PRIOR

SHL/SHR Shift left/right direct word GPR 2

ROL/ROR Rotate left/right direct word GPR 2

ASHR Arithmetic (sign bit) shift right direct word GPR 2

MOV(B) Move word (byte) data 2/4

MOVBS Move byte operand to word operand with sign extension 2/4

MOVBZ Move byte operand to word operand with zero extension 2/4

JMPA, JMPI,
JMPR

AND/OR/XOR direct bit with direct bit 4

Bit-wise modify masked high/low byte of bit-addressable direct word
memory with immediate data

Determine number of shift cycles to normalize direct word GPR and
store result in direct word GPR

Jump absolute/indirect/relative if condition is met 4

4

2

94/346

ST10F296E Central processing unit (CPU)

www.BDTIC.com/ST

Table 45. Instruction set summary (continued)

Mnemonic Description Bytes

JMPS Jump absolute to a code segment 4

J(N)B Jump relative if direct bit is (not) set 4

JBC Jump relative and clear bit if direct bit is set 4

JNBS Jump relative and set bit if direct bit is not set 4

CALLA, CALLI,
CALLR

CALLS Call absolute subroutine in any code segment 4

PCALL

TRAP Call interrupt service routine via immediate trap number 2

PUSH, POP Push/pop direct word register onto/from system stack 2

SCXT

RET Return from intra-segment subroutine 2

RETS Return from inter-segment subroutine 2

RETP

RETI Return from interrupt service subroutine 2

SRST Software reset 4

IDLE Enter idle mode 4

PWRDN Enter power-down mode (supposes NMI

SRVWDT Service watchdog timer 4

DISWDT Disable watchdog timer 4

EINIT Signify end-of-initialization on RSTOUT pin 4

Call absolute/indirect/relative subroutine if condition is met 4

Push direct word register onto system stack and call absolute
subroutine

Push direct word register onto system stack and update register with
word operand

Return from intra-segment subroutine and pop direct word register from
system stack

-pin being low) 4

4

4

2

ATOMIC Begin ATOMIC sequence 2

EXTR Begin EXTended register sequence 2

EXTP(R) Begin EXTended page (and register) sequence 2/4

EXTS(R) Begin EXTended segment (and register) sequence 2/4

NOP Null operation 2

95/346

Central processing unit (CPU) ST10F296E

www.BDTIC.com/ST

7.3 MAC coprocessor specific instructions

Ta bl e 4 6 lists the MAC instructions of the ST10F296E. A detailed description of each

instruction can be found in the ST10 family programming manual (PM0036). Note that all
MAC instructions are encoded on four bytes.

Table 46. MAC instruction set summary

Mnemonic Description

CoABS Absolute value of the accumulator

CoADD(2) Addition

CoASHR(rnd) Accumulator arithmetic shift right and optional round

CoCMP Compare accumulator with operands

CoLOAD(-,2) Load accumulator with operands

CoMAC(R,u,s,-,rnd) (Un)signed/(un)signed multiply-accumulate and optional round

CoMACM(R)(u,s,-,rnd)

CoMAX/CoMIN Maximum/minimum of operands and accumulator

CoMOV Memory to memory move

CoMUL(u,s,-,rnd) (Un)signed/(un)signed multiply and optional round

CoNEG(rnd) Negate accumulator and optional round

CoNOP No-operation

CoRND Round accumulator

CoSHL/CoSHR Accumulator logical shift left/right

CoSTORE Store a MAC unit register

CoSUB(2,R) Substraction

(Un)signed/(un)signed multiply-accumulate with parallel data move
and optional round

96/346

ST10F296E External bus controller (EBC)

www.BDTIC.com/ST

8 External bus controller (EBC)

All external memory access is performed by the on-chip external bus controller.
The EBC can be programmed to single chip mode when no external memory is required, or

to one of four different external memory access modes:

● 16-/18-/20-/24-bit addresses and 16-bit data, demultiplexed

● 16-/18-/ 20-/24-bit addresses and 16-bit data, multiplexed

● 16-/18-/20-/24-bit addresses and 8-bit data, multiplexed

● 16-/18-/20-/24-bit addresses and 8-bit data, demultiplexed

In demultiplexed bus modes addresses are output on Port 1 and data is input/output on Port
0 or P0L, respectively. In the multiplexed bus modes both addresses and data use Port 0 for
input/output.

Timing characteristics of the external bus interface (memory cycle time, memory tri-state
time, length of ALE and read/write delay) are programmable giving the choice of a wide
range of memories and external peripherals.

Up to four independent address windows may be defined (using register pairs
ADDRSELx/BUSCONx) to access different resources and bus characteristics.

These address windows are arranged hierarchically where BUSCON4 overrides BUSCON3
and BUSCON2 overrides BUSCON1.

Access to locations not covered by these four address windows is controlled by BUSCON0.
Up to five external CS
glue logic. Access to very slow memories is supported by a ‘ready’ function.

A HOLD
other bus masters.

The bus arbitration is enabled by setting the HLDEN bit in the PSW register. After setting
HLDEN once, pins P6.7 to P6.5 (BREQ
the EBC. In master mode (default after reset) the HLDA
to 1, slave mode is selected where pin HLDA
slave controller to another master controller without glue logic.

For applications which require less external memory space, the address space can be
restricted to 1 Mbyte, 256 Kbytes or to 64 Kbytes. Port 4 outputs all eight address lines if an
address space of 16 Mbytes is used, otherwise four, two or no address lines.

Chip select timing can be made programmable. By default (after reset), the CSx
change half a CPU clock cycle after the rising edge of ALE. With the CSCFG bit set in the
SYSCON register, the CSx

The active level of the READY pin can be set by the RDYPOL bit in the BUSCONx registers.
When the READY function is enabled for a specific address window, each bus cycle within
the window must be terminated with the active level defined by the RDYPOL bit in the
associated BUSCON register.

/HLDA protocol is available for bus arbitration which shares external resources with

signals (four windows plus default) can be generated to save external

, HLDA, and HOLD) are automatically controlled by

pin is an output. By setting bit DP6.7

is switched to input. This directly connects the

lines

lines change with the rising edge of ALE.

97/346

External bus controller (EBC) ST10F296E

www.BDTIC.com/ST

8.1 Programmable chip select timing control

The ST10F296E allows the user to adjust the position of the CSx line changes. By default
(after reset), the CSx
after the rising edge of ALE. With the CSCFG bit set in the SYSCON register the CSx
change with the rising edge of ALE, thus the CSx

lines change half a CPU clock cycle (7.8 ns at 64 MHz of CPU clock)

lines

lines and the address lines change at the

same time (see Figure 18).

8.2 READY programmable polarity

The active level of the READY pin can be selected by software via the RDYPOL bit in the
BUSCONx registers.

When the READY function is enabled for a specific address window, each bus cycle within
this window must be terminated with the active level defined by the RDYPOL bit in the
associated BUSCON register.

BUSCONx registers are described in Section 23.10: System configuration registers on

page 280.

Note: ST10F296E has no internal pull-up resistor on the READY pin.

Figure 18. Chip select delay

Segment (P4)

Address (P1)

ALE

Normal CSx

Unlatched CSx

BUS (P0)

RD

BUS (P0)

WR

Normal demultiplexed

Bus cycle

Read/write

Delay

Data

ALE lengthen demultiplexed

Data

Bus cycle

Data

Data

Read/write

Delay

98/346

ST10F296E External bus controller (EBC)

www.BDTIC.com/ST

8.3 EA functionality

The EA pin of the ST10F296E is shared with the V
and stable, V
by V
V

DD

(that is standby voltage regulator and 16 Kbyte portion of XRAM), is powered by

STBY

main. This allows the EA pin to be driven low during reset, as requested, to configure

can be temporarily grounded: The logic that in standby mode is powered

STBY

supply pin. When VDD main is on

STBY

the system to start from the external memory.
An appropriate external circuit must be provided to manage dynamically both functionalities

associated with the EA
after reset (or before turning off the main V

pin. During reset and with stable VDD, the pin can be tied low, while

to enter in standby mode) the V

DD

STBY

supply is

applied.

Figure 19 shows a diagram of a possible external circuit. Care should be taken when

implementing the resistance for current limitation of bipolar. The resistance should not
disturb standby mode when some current (in the order of hundreds of µA) is provided to the
device by the V

voltage supply source. The voltage at the EA pin of ST10F296E should

STBY

not become lower than 4.5 V.
To reduce the effect of current consumption transients on the V

pin (refer to I

STBY

SB3

in

Section 24: Electrical characteristics) which may create voltage drops if a very low power

external voltage regulator is used, it is suggested to add an external capacitance which can
filter the eventual current peaks. Additional care must be paid to external hardware to limit
the current peaks due to the presence of the capacitance (when EA

functionality is used and

the external bipolar is turned on, see Figure 19).

Figure 19. EA

/V

external circuit

STBY

ST10F296

EA

/V

STBY

4 - 5.5 V

function

EA

V

SS

99/346

V

SS

V

STBY

Interrupt system ST10F296E

www.BDTIC.com/ST

9 Interrupt system

The interrupt response time for internal program execution is from 78 ns to 187.5 ns at 64
MHz CPU clock.

The ST10F296E architecture supports several mechanisms for fast, flexible responses to
service requests that can be generated from various sources (internal or external) to the
microcontroller. Any of these interrupt requests can be serviced by the Interrupt controller or
by the peripheral event controller (PEC).

In contrast to a standard interrupt service where the current program execution is
suspended and a branch to the interrupt vector table is performed, just one cycle is ‘stolen’
from the current CPU activity to perform a PEC service. A PEC service implies a single byte
or word data transfer between any two memory locations with an additional increment of
either the PEC source or destination pointer. An individual PEC transfer counter is implicitly
decremented for each PEC service except when performing in the continuous transfer
mode. When this counter reaches zero, a standard interrupt is performed to the
corresponding source related vector location. PEC services are very well suited to perform
the transmission or the reception of blocks of data. The ST10F296E has eight PEC
channels, each of them offers such fast interrupt-driven data transfer capabilities.

An interrupt control register which contains an interrupt request flag, an interrupt enable flag
and an interrupt priority bit-field is dedicated to each existing interrupt source. Because of its
related register, each source can be programmed to one of sixteen interrupt priority levels.
Once processing by the CPU starts, an interrupt service can only be interrupted by a higher
prioritized service request. For standard interrupt processing, each possible interrupt
sources has a dedicated vector location.

Software interrupts are supported by means of the ‘TRAP’ instruction in combination with an
individual trap (interrupt) number.

Fast external interrupt inputs are provided to service external interrupts with high precision
requirements. These fast interrupt inputs feature programmable edge detection (rising edge,
falling edge or both edges).

Fast external interrupts may also have interrupt sources selected from other peripherals. For
example, the CANx controller receive signals (CANx_RxD) and I
be used to interrupt the system.

Ta bl e 4 7 shows all the available ST10F296E interrupt sources and the corresponding

hardware-related interrupt flags, vectors, vector locations and trap (interrupt) numbers.

2

C serial clock signal can

100/346