* Reserved for ST tests, must be left unconnected
** V
TEST
must be kept low in standard operating mode
*** The ST92F150-EMU2 emulator does not emulate ADC channels from AIN0 to AIN7 and extended function timers because they are not implemented on the emulator chip. See also Section 17.8 on page 516
Main Power Supply Voltage
(Pins internally connected)
274239
-6562
609390
AV
AV
V
V
TEST
V
REG
SS
DD
SS
Digital Circuit Ground
(Pins internally connected)
Analog Circuit Supply Voltage498279
Analog Circuit Ground508380
Must be kept low in standard operating mode294441
Stabilization capacitor(s) for internal voltage regulator28
-1714
264138
-6461
599289
31
43
28
40
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Pinout and pin description
Table 4.ST92F124/F150/F250 primary function pins
NameFunctionLQFP64 PQFP100 LQFP100
ASAddress Strobe-5653
DSData Strobe-5552
RW
OSCINCrystal Oscillator Input619491
OSCOUTCrystal Oscillator Output629592
RESETReset to initialize the Microcontroller639693
HW0SW1Watchdog HW/SW enabling selection649794
(1)
VPWO
RX1/WKUP6
(1)
TX1
1. ST92F150JDV1 only.
Read/Write-3229
J1850 JBLPD Output-7370
(1)
CAN1 Receive Data / Wake-up Line 6-4946
CAN1 Transmit Data.-5047
Doc ID 8848 Rev 739/523
Voltage regulatorST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2
PQFP100
QFP64
C
L
L = Ferrite bead for EMI protection.
Pin 28
C
L
Pin 43
Pin 31
LQFP100
C
L
Pin 40
Pin 28
Suggested type: Murata BLM18BE601FH1: (Imp. 600 Ω at 100 MHz).
C = 300 to 600nF
C
PQFP100QFP64
C
Pin 43Pin 31Pin 28
C
LQFP100
Pin 40Pin 28
C = 300 to 600nF
3 Voltage regulator
The internal Voltage Regulator (VR) is used to power the microcontroller starting from the
external power supply. The VR comprises a Main voltage regulator and a Low-power
regulator.
●The Main voltage regulator generates sufficient current for the microcontroller to
operate in any mode. It has a static power consumption (300 µA typ.).
●The separate Low-Power regulator consumes less power; it is used only when the
microcontroller is in Low Power mode. It has a different design from the main VR and
generates a lower, non-stabilized and non-thermally-compensated voltage sufficient for
maintaining the data in RAM and the Register File.
For both the Main VR and the Low-Power VR, stabilization is achieved by an external
capacitor, connected to one of the V
and care must be taken to minimize distance between the chip and the capacitor. Care
should also be taken to limit the serial inductance to less than 60 nH.
pins. The minimum recommended value is 300 nF,
REG
Figure 16. Recommended connections for V
IMPORTANT: The V
pin cannot be used to drive external devices.
REG
Figure 17. Minimum required connections for V
REG
REG
Note:Pin 31 of PQFP100 or pin 28 of LQFP100 can be left unconnected. A secondary
stabilization network can also be connected to these pins.
Port 0, Port 1 and Port 9[7:2] provide the external memory interface. All the ports of the
device can be programmed as Input/Output or in Input mode, compatible with TTL or CMOS
levels (except where Schmitt Trigger is present). Each bit can be programmed individually
(Refer to Section 13: I/O ports).
Internal weak pull-up
As shown in Ta bl e , not all input sections implement a Weak Pull-up. This means that the
pull-up must be connected externally when the pin is not used or programmed as
bidirectional.
TTL/CMOS input
For all those port bits where no input schmitt trigger is implemented, it is always possible to
program the input level as TTL or CMOS compatible by programming the relevant PxC2.n
control bit. Refer to Section 13.4: Input/output bit configuration in Section 13: I/O ports.
Schmitt trigger input
Two different kinds of Schmitt Trigger circuitries are implemented: Standard and High
Hysteresis. Standard Schmitt Trigger is widely used (see Tab l e ), while the High Hysteresis
Schmitt Trigger is present on ports P4[7:6] and P6[5:4].
All inputs which can be used for detecting interrupt events have been configured with a
“Standard” Schmitt Trigger, apart from the NMI pin which implements the “High Hysteresis”
version. In this way, all interrupt lines are guaranteed as “edge sensitive”.
Push-pull/OD output
The output buffer can be programmed as push-pull or open-drain: attention must be paid to
the fact that the open-drain option corresponds only to a disabling of P-channel MOS
transistor of the buffer itself: it is still present and physically connected to the pin.
Consequently, it is not possible to increase the output voltage on the pin over V
+0.3 Volt,
DD
to avoid direct junction biasing.
Pure open-drain output
The user can increase the voltage on an I/O pin over V
+0.3 Volt where the P-channel
DD
MOS transistor is physically absent: this is allowed on all “Pure Open Drain” pins. In this
case, the push-pull option is not available and any weak pull-up must be implemented
externally.
1. The ST92F150-EMU2 emulator does not emulate ADC channels from AIN0 to AIN7 and extended function
timers because they are not implemented on the emulator chip. See also Section 17.8 on page 516.
2. Available on some devices only.
3. For the ST92F250 device, since A[18:17] share the same pins as SDA1 and SCL1 of I²C_1, these address
bits are not available when the I²C_1 is in use (when I2CCR.PE bit is set).
To optimize the performance versus the power consumption of the device, the
ST92F124/F150/F250 supports different operating modes that can be dynamically selected
depending on the performance and functionality requirements of the application at a given
moment.
RUN MODE: This is the full speed execution mode with CPU and peripherals running at the
maximum clock speed delivered by the Phase Locked Loop (PLL) of the Clock Control Unit
(CCU).
SLOW MODE: Power consumption can be significantly reduced by running the CPU and the
peripherals at reduced clock speed using the CPU Prescaler and CCU Clock Divider.
WAIT FOR INTERRUPT MODE: The Wait For Interrupt (WFI) instruction suspends program
execution until an interrupt request is acknowledged. During WFI, the CPU clock is halted
while the peripheral and interrupt controller keep running at a frequency depending on the
CCU programming.
LOW POWER WAIT FOR INTERRUPT MODE: Combining SLOW mode and Wait For
Interrupt mode, it is possible to reduce the power consumption by more than 80%.
STOP MODE: When the STOP is requested by executing the STOP bit writing sequence
(see dedicated section on Wake-up Management Unit paragraph), and if NMI is kept low,
the CPU and the peripherals stop operating. Operations resume after a wake-up line is
activated (16 wake-up lines plus NMI pin). See the RCCU and Wake-up Management Unit
paragraphs in the following for the details. The difference with the HALT mode consists in
the way the CPU exits this state: when the STOP is executed, the status of the registers is
recorded; and when the system exits from the STOP mode, the CPU continues the
execution with the same status, without a system reset.
When the MCU enters STOP mode, the Watchdog stops counting. After the MCU exits from
STOP mode, the Watchdog resumes counting from where it left off.
When the MCU exits from STOP mode, the oscillator, which was sleeping too, requires
about 5 ms to restart working properly (at a 4 MHz oscillator frequency). An internal counter
is present to guarantee that all operations after exiting STOP Mode, take place with the
clock stabilized.
The counter is active only when the oscillation has already taken place. This means that 1-2
ms must be added to take into account the first phase of the oscillator restart.
In STOP mode, the oscillator is stopped. Therefore, if the PLL is used to provide the CPU
clock before entering STOP mode, it will have to be selected again when the MCU exits
STOP mode.
HALT MODE: When executing the HALT instruction, and if the Watchdog is not enabled, the
CPU and its peripherals stop operating and the status of the machine remains frozen (the
clock is also stopped). A reset is necessary to exit from Halt mode.
The ST9 Core or Central Processing Unit (CPU) features a highly optimized instruction set,
capable of handling bit, byte (8-bit) and word (16-bit) data, as well as BCD and Boolean
formats; 14 addressing modes are available.
Four independent buses are controlled by the Core: a 16-bit Memory bus, an 8-bit Register
data bus, an 8-bit Register address bus and a 6-bit Interrupt/DMA bus which connects the
interrupt and DMA controllers in the on-chip peripherals with the Core.
This multiple bus architecture affords a high degree of pipelining and parallel operation, thus
making the ST9 family devices highly efficient, both for numerical calculation, data handling
and with regard to communication with on-chip peripheral resources.
6.2 Memory spaces
There are two separate memory spaces:
●The Register File, which comprises 240 8-bit registers, arranged as 15 groups (Group 0
to E), each containing sixteen 8-bit registers plus up to 64 pages of 16 registers
mapped in Group F, which hold data and control bits for the on-chip peripherals and
I/Os.
●A single linear memory space accommodating both program and data. All of the
physically separate memory areas, including the internal ROM, internal RAM and
external memory are mapped in this common address space. The total addressable
memory space of 4 Mbytes (limited by the size of on-chip memory and the number of
external address pins) is arranged as 64 segments of 64 Kbytes. Each segment is
further subdivided into four pages of 16 Kbytes, as illustrated in Figure 18. A Memory
Management Unit uses a set of pointer registers to address a 22-bit memory field using
16-bit address-based instructions.
6.2.1 Register file
The Register File consists of (see Figure 19):
●224 general purpose registers (Group 0 to D, registers R0 to R223)
●6 system registers in the System Group (Group E, registers R224 to R239)
●Up to 64 pages, depending on device configuration, each containing up to 16 registers,
Note:An upper case “R” is used to denote this direct addressing mode.
Register File registers, including Group F paged registers (but excluding Group D), may be
addressed explicitly by means of a decimal, hexadecimal or binary address; thus R231, RE7h and R11100111b represent the same register (see Figure 21). Group D registers can
only be addressed in Working Register mode.
Certain types of instruction require that registers be specified in the form “rx”, where x is in
the range 0 to 15: these are known as Working Registers.
Note:A lower case “r” is used to denote this indirect addressing mode.
Two addressing schemes are available: a single group of 16 working registers, or two
separately mapped groups, each consisting of 8 working registers. These groups may be
mapped starting at any 8- or 16-byte boundary in the register file by means of dedicated
pointer registers. This technique is described in more detail in Section 6.3.3 Register
pointing techniques, and illustrated in Figure 22 and in Figure 23.
System registers
The 16 registers in Group E (R224 to R239) are System registers and may be addressed
using any of the register addressing modes. These registers are described in greater detail
in Section 6.3 System registers.
Paged registers
Up to 64 pages, each containing 16 registers, may be mapped to Group F. These are
addressed using any register addressing mode, in conjunction with the Page Pointer
register, R234, which is one of the System registers. This register selects the page to be
mapped to Group F and, once set, does not need to be changed if two or more registers on
the same page are to be addressed in succession.
Therefore if the Page Pointer, R234, is set to 5, the instructions:
spp #5
ld R242, r4
will load the contents of working register r4 into the third register of page 5 (R242).
These paged registers hold data and control information relating to the on-chip peripherals,
each peripheral always being associated with the same pages and registers to ensure code
compatibility between ST9 devices. The number of these registers therefore depends on the
peripherals which are present in the specific ST9 family device. In other words, pages only
exist if the relevant peripheral is present.
The System registers are listed in Ta bl e 8 . They are used to perform all the important
system settings. Their purpose is described in the following pages. Refer to the chapter
dealing with I/O for a description of the PORT[5:0] Data registers.
Bit 7 = GCEN: Global Counter Enable.
This bit is the Global Counter Enable of the Multifunction Timers. The GCEN bit is ANDed
with the CE bit in the TCR Register (only in devices featuring the MFT Multifunction Timer)
in order to enable the Timers when both bits are set. This bit is set after the Reset cycle.
Note:If an MFT is not included in the ST9 device, then this bit has no effect.
Bit 6 = TLIP: Top Level Interrupt Pending.
This bit is set by hardware when a Top Level Interrupt Request is recognized. This bit can
also be set by software to simulate a Top Level Interrupt Request.
0: No Top Level Interrupt pending
1: Top Level Interrupt pending
Bit 5 = TLI: Top Level Interrupt bit.
0: Top Level Interrupt is acknowledged depending on the TLNM bit in the NICR Register.
1: Top Level Interrupt is acknowledged depending on the IEN and TLNM bits in the NICR
Register (described in the Interrupt chapter).
Bit 4 = IEN: Interrupt Enable.
This bit is cleared by interrupt acknowledgement, and set by interrupt return (iret). IEN is
modified implicitly by iret, ei and di instructions or by an interrupt acknowledge cycle. It
can also be explicitly written by the user, but only when no interrupt is pending. Therefore,
the user should execute a di instruction (or guarantee by other means that no interrupt
request can arrive) before any write operation to the CICR register.
0: Disable all interrupts except Top Level Interrupt.
Bit 3 = IAM: Interrupt Arbitration Mode.
This bit is set and cleared by software to select the arbitration mode.
0: Concurrent Mode
1: Nested Mode.
Bits 2:0 = CPL[2:0]: Current Priority Level.
These three bits record the priority level of the routine currently running (i.e. the Current
Priority Level, CPL). The highest priority level is represented by 000, and the lowest by 111.
The CPL bits can be set by hardware or software and provide the reference according to
which subsequent interrupts are either left pending or are allowed to interrupt the current
interrupt service routine. When the current interrupt is replaced by one of a higher priority,
the current priority value is automatically stored until required in the NICR register.
6.3.2 Flag register
The Flag Register contains 8 flags which indicate the CPU status. During an interrupt, the
flag register is automatically stored in the system stack area and recalled at the end of the
interrupt service routine, thus returning the CPU to its original status.
This occurs for all interrupts and, when operating in nested mode, up to seven versions of
the flag register may be stored.
Bit 7 = C: Carry Flag.
The carry flag is affected by:
Addition (add, addw, adc, adcw),
Subtraction (sub, subw, sbc, sbcw),
Compare (cp, cpw),
Shift Right Arithmetic (sra, sraw),
Shift Left Arithmetic (sla, slaw),
Swap Nibbles (swap),
Rotate (rrc, rrcw, rlc, rlcw, ror, rol),
Decimal Adjust (da),
Multiply and Divide (mul, div, divws).
When set, it generally indicates a carry out of the most significant bit position of the register
being used as an accumulator (bit 7 for byte operations and bit 15 for word operations).
The carry flag can be set by the Set Carry Flag (scf) instruction, cleared by the Reset Carry
Flag (rcf) instruction, and complemented by the Complement Carry Flag (ccf) instruction.
Bit 6 = Z: Zero Flag. The Zero flag is affected by:
Addition (add, addw, adc, adcw),
Subtraction (sub, subw, sbc, sbcw),
Compare (cp, cpw),
Shift Right Arithmetic (sra, sraw),
Shift Left Arithmetic (sla, slaw),
Swap Nibbles (swap),
Rotate (rrc, rrcw, rlc, rlcw, ror, rol),
Decimal Adjust (da),
Multiply and Divide (mul, div, divws),
Logical (and, andw, or, orw, xor, xorw, cpl),
Increment and Decrement (inc, incw, dec, decw),
Test (tm, tmw, tcm, tcmw, btset).
In most cases, the Zero flag is set when the contents of the register being used as an
accumulator become zero, following one of the above operations.
Bit 5 = S: Sign Flag.
The Sign flag is affected by the same instructions as the Zero flag.
The Sign flag is set when bit 7 (for a byte operation) or bit 15 (for a word operation) of the
register used as an accumulator is one.
Bit 4 = V: Overflow Flag.
The Overflow flag is affected by the same instructions as the Zero and Sign flags.
When set, the Overflow flag indicates that a two's-complement number, in a result register,
is in error, since it has exceeded the largest (or is less than the smallest), number that can
be represented in two’s-complement notation.
Bit 3 = DA: Decimal Adjust Flag.
The DA flag is used for BCD arithmetic. Since the algorithm for correcting BCD operations is
different for addition and subtraction, this flag is used to specify which type of instruction
was executed last, so that the subsequent Decimal Adjust (da) operation can perform its
function correctly. The DA flag cannot normally be used as a test condition by the
programmer.
Bit 2 = H: Half Carry Flag.
The H flag indicates a carry out of (or a borrow into) bit 3, as the result of adding or
subtracting two 8-bit bytes, each representing two BCD digits. The H flag is used by the
Decimal Adjust (da) instruction to convert the binary result of a previous addition or
subtraction into the correct BCD result. Like the DA flag, this flag is not normally accessed
by the user.
Bit 0 = DP: Data/Program Memory Flag.
This bit indicates the memory area addressed. Its value is affected by the Set Data Memory
(sdm) and Set Program Memory (spm) instructions. Refer to the Memory Management Unit
for further details.
If the bit is set, data is accessed using the Data Pointers (DPRs registers), otherwise it is
pointed to by the Code Pointer (CSR register); therefore, the user initialization routine must
include a Sdm instruction. Note that code is always pointed to by the Code Pointer (CSR).
Note:In the current ST9 devices, the DP flag is only for compatibility with software developed for
the first generation of ST9 devices. With the single memory addressing space, its use is now
redundant. It must be kept to 1 with an Sdm instruction at the beginning of the program to
ensure a normal use of the different memory pointers.
6.3.3 Register pointing techniques
Two registers within the System register group are used as pointers to the working registers.
Register Pointer 0 (R232) may be used on its own as a single pointer to a 16-register
working space, or in conjunction with Register Pointer 1 (R233), to point to two separate 8register spaces.
For the purpose of register pointing, the 16 register groups of the register file are subdivided
into 32 8-register blocks. The values specified with the Set Register Pointer instructions refer
to the blocks to be pointed to in twin 8-register mode, or to the lower 8-register block location
in single 16-register mode.
The Set Register Pointer instructions srp, srp0 and srp1 automatically inform the CPU
whether the Register File is to operate in single 16-register mode or in twin 8-register mode.
The srp instruction selects the single 16-register group mode and specifies the location of
the lower 8-register block, while the srp0 and srp1 instructions automatically select the
twin 8-register group mode and specify the locations of each 8-register block.
There is no limitation on the order or position of these register groups, other than that they
must start on an 8-register boundary in twin 8-register mode, or on a 16-register boundary in
single 16-register mode.
The block number should always be an even number in single 16-register mode. The 16register group will always start at the block whose number is the nearest even number equal
to or lower than the block number specified in the srp instruction. Avoid using odd block
numbers, since this can be confusing if twin mode is subsequently selected.
Thus:
srp #3 will be interpreted as srp #2 and will allow using R16 ..R31 as r0 .. r15.
In single 16-register mode, the working registers are referred to as r0 to r15. In twin 8register mode, registers r0 to r7 are in the block pointed to by RP0 (by means of the srp0
instruction), while registers r8 to r15 are in the block pointed to by RP1 (by means of the
srp1 instruction).
Caution:Group D registers can only be accessed as working registers using the Register Pointers, or
by means of the Stack Pointers. They cannot be addressed explicitly in the form “Rxxx”.
Register Group: E (System)
Reset Value: xxxx xx00 (xxh)
70
RG4RG3RG2RG1RG0RPS00
Bits 7:3 = RG[4:0]: Register Group number.
These bits contain the number (in the range 0 to 31) of the register block specified in the
srp0 or srp instructions. In single 16-register mode the number indicates the lower of the
two 8-register blocks to which the 16 working registers are to be mapped, while in twin 8register mode it indicates the 8-register block to which r0 to r7 are to be mapped.
Bit 2 = RPS: Register Pointer Selector.
This bit is set by the instructions srp0 and srp1 to indicate that the twin register pointing
mode is selected. The bit is reset by the srp instruction to indicate that the single register
pointing mode is selected.
This register is only used in the twin register pointing mode. When using the single register
pointing mode, or when using only one of the twin register groups, the RP1 register must be
considered as RESERVED and may NOT be used as a general purpose register.
Bits 7:3 = RG[4:0]: Register Group number. These bits contain the number (in the range 0
to 31) of the 8-register block specified in the srp1 instruction, to which r8 to r15 are to be
mapped.
Bit 2 = RPS: Register Pointer Selector.
This bit is set by the srp0 and srp1 instructions to indicate that the twin register pointing
mode is selected. The bit is reset by the srp instruction to indicate that the single register
pointing mode is selected.
Up to 64 pages, each containing 16 registers, may be mapped to Group F. These paged
registers hold data and control information relating to the on-chip peripherals, each
peripheral always being associated with the same pages and registers to ensure code
compatibility between ST9 devices. The number of these registers depends on the
peripherals present in the specific ST9 device. In other words, pages only exist if the
relevant peripheral is present.
The paged registers are addressed using the normal register addressing modes, in
conjunction with the Page Pointer register, R234, which is one of the System registers. This
register selects the page to be mapped to Group F and, once set, does not need to be
changed if two or more registers on the same page are to be addressed in succession.
Bits 7:2 = PP[5:0]: Page Pointer.
These bits contain the number (in the range 0 to 63) of the page specified in the spp
instruction. Once the page pointer has been set, there is no need to refresh it unless a
different page is required.
Bits 1:0: Reserved. Forced by hardware to 0.
6.3.5 Mode register
The Mode Register allows control of the following operating parameters:
●Selection of internal or external System and User Stack areas,
●Management of the clock frequency,
●Enabling of Bus request and Wait signals when interfacing to external memory.
Bit 5 = DIV2: Crystal Oscillator Clock Divided by 2.
This bit controls the divide-by-2 circuit operating on the crystal oscillator clock (CLOCK1).
0: Clock divided by 1
1: Clock divided by 2
Bits 4:2 = PRS[2:0]: CPUCLK Prescaler.
These bits load the prescaler division factor for the internal clock (INTCLK). The prescaler
factor selects the internal clock frequency, which can be divided by a factor from 1 to 8.
Refer to the Reset and Clock Control chapter for further information.
Bit 1 = BRQEN: Bus Request Enable.
0: External Memory Bus Request disabled
1: External Memory Bus Request enabled on BREQ
Note:Disregard this bit if BREQ
Bit 0 = HIMP: High Impedance Enable.
When a port is programmed as Address and Data lines to interface external Memory, these
lines and the Memory interface control lines (AS, DS, R/W) can be forced into the High
Impedance state.
0: External memory interface lines in normal state
1: High Impedance state.
Note:Setting the HIMP bit is recommended for noise reduction when only internal Memory is
used.
If the memory access ports are declared as an address AND as an I/O port (for example:
P10... P14 = Address, and P15... P17 = I/O), the HIMP bit has no effect on the I/O lines.
pin is not available.
pin (where available).
6.3.6 Stack pointers
Two separate, double-register stack pointers are available: the System Stack Pointer and the
User Stack Pointer, both of which can address registers or memory.
The stack pointers point to the “bottom” of the stacks which are filled using the push
commands and emptied using the pop commands. The stack pointer is automatically predecremented when data is “pushed” in and post-incremented when data is “popped” out.
The push and pop commands used to manage the System Stack may be addressed to the
User Stack by adding the suffix “u”. To use a stack instruction for a word, the suffix “w” is
added. These suffixes may be combined.
When bytes (or words) are “popped” out from a stack, the contents of the stack locations are
unchanged until fresh data is loaded. Thus, when data is “popped” from a stack area, the
stack contents remain unchanged.
Note:Instructions such as: pushuw RR236 or pushw RR238, as well as the corresponding
pop instructions (where R236 & R237, and R238 & R239 are themselves the user and
system stack pointers respectively), must not be used, since the pointer values are
themselves automatically changed by the push or pop instruction, thus corrupting their
value.
System Stack
The System Stack is used for the temporary storage of system and/or control data, such as
the Flag register and the Program counter.
The following automatically push data onto the System Stack:
●Interrupts
When entering an interrupt, the PC and the Flag Register are pushed onto the System
Stack. If the ENCSR bit in the EMR2 register is set, then the Code Segment Register is
also pushed onto the System Stack.
●Subroutine Calls
When a call instruction is executed, only the PC is pushed onto stack, whereas when
a calls instruction (call segment) is executed, both the PC and the Code Segment
Register are pushed onto the System Stack.
●Link Instruction
The link or linku instructions create a C language stack frame of user-defined
length in the System or User Stack.
All of the above conditions are associated with their counterparts, such as return
instructions, which pop the stored data items off the stack.
1.User Stack
The User Stack provides a totally user-controlled stacking area.
The User Stack Pointer consists of two registers, R236 and R237, which are both used for
addressing a stack in memory. When stacking in the Register File, the User Stack Pointer
High Register, R236, becomes redundant but must be considered as reserved.
Stack Pointers
Both System and User stacks are pointed to by double-byte stack pointers. Stacks may be
set up in RAM or in the Register File. Only the lower byte will be required if the stack is in the
Register File. The upper byte must then be considered as reserved and must not be used as
a general purpose register.
The stack pointer registers are located in the System Group of the Register File, this is
illustrated in Ta bl e 8 .
Stack Location
Care is necessary when managing stacks as there is no limit to stack sizes apart from the
bottom of any address space in which the stack is placed. Consequently programmers are
advised to use a stack pointer value as high as possible, particularly when using the
Register File as a stacking area.
Group D is a good location for a stack in the Register File, since it is the highest available
area. The stacks may be located anywhere in the first 14 groups of the Register File
(internal stacks) or in RAM (external stacks).
Note:Stacks must not be located in the Paged Register Group or in the System Register Group.
Code and data are accessed within the same linear address space. All of the physically
separate memory areas, including the internal ROM, internal RAM and external memory are
mapped in a common address space.
The ST9 provides a total addressable memory space of 4 Mbytes. This address space is
arranged as 64 segments of 64 Kbytes; each segment is again subdivided into four 16Kbyte pages.
The mapping of the various memory areas (internal RAM or ROM, external memory) differs
from device to device. Each 64-Kbyte physical memory segment is mapped either internally
or externally; if the memory is internal and smaller than 64 Kbytes, the remaining locations
in the 64-Kbyte segment are not used (reserved).
Refer to the Register and Memory Map Chapter for more details on the memory map.
The CPU Core includes a Memory Management Unit (MMU) which must be programmed to
perform memory accesses (even if external memory is not used).
The MMU is controlled by 7 registers and 2 bits (ENCSR and DPRREM) present in EMR2,
which may be written and read by the user program. These registers are mapped within
group F, Page 21 of the Register File. The 7 registers may be sub-divided into 2 main
groups: a first group of four 8-bit registers (DPR[3:0]), and a second group of three 6-bit
registers (CSR, ISR, and DMASR). The first group is used to extend the address during
Data Memory access (DPR[3:0]). The second is used to manage Program and Data
Memory accesses during Code execution (CSR), Interrupts Service Routines (ISR or CSR),
and DMA transfers (DMASR or ISR).
Figure 26. Page 21 registers
6.6 Address space extension
6.6.1 Addressing 16-Kbyte pages
66/523Doc ID 8848 Rev 7
To manage 4 Mbytes of addressing space, it is necessary to have 22 address bits. The
MMU adds 6 bits to the usual 16-bit address, thus translating a 16-bit virtual address into a
22-bit physical address. There are 2 different ways to do this depending on the memory
involved and on the operation being performed.
This extension mode is implicitly used to address Data memory space if no DMA is being
performed.
The Data memory space is divided into 4 pages of 16 Kbytes. Each one of the four 8-bit
registers (DPR[3:0], Data Page Registers) selects a different 16-Kbyte page. The DPR
registers allow access to the entire memory space which contains 256 pages of 16 Kbytes.
Data paging is performed by extending the 14 LSB of the 16-bit address with the contents of
a DPR register. The two MSBs of the 16-bit address are interpreted as the identification
number of the DPR register to be used. Therefore, the DPR registers are involved in the
following virtual address ranges:
DPR0: from 0000h to 3FFFh;
DPR1: from 4000h to 7FFFh;
DPR2: from 8000h to BFFFh;
DPR3: from C000h to FFFFh.
The contents of the selected DPR register specify one of the 256 possible data memory
pages. This 8-bit data page number, in addition to the remaining 14-bit page offset address
forms the physical 22-bit address (see Figure 27).
A DPR register cannot be modified via an addressing mode that uses the same DPR
register. For instance, the instruction “POPW DPR0” is legal only if the stack is kept either in
the register file or in a memory location above 8000h, where DPR2 and DPR3 are used.
Otherwise, since DPR0 and DPR1 are modified by the instruction, unpredictable behavior
could result.
Figure 27. Addressing via DPR[3:0]
6.6.2 Addressing 64-Kbyte segments
This extension mode is used to address Data memory space during a DMA and Program
memory space during any code execution (normal code and interrupt routines).
Three registers are used: CSR, ISR, and DMASR. The 6-bit contents of one of the registers
CSR, ISR, or DMASR define one out of 64 Memory segments of 64 Kbytes within the 4
Mbytes address space. The register contents represent the 6 MSBs of the memory address,
whereas the 16 LSBs of the address (intra-segment address) are given by the virtual 16-bit
address (see Figure 28).
6.7 MMU registers
The MMU uses 7 registers mapped into Group F, Page 21 of the Register File and 2 bits of
the EMR2 register.
Most of these registers do not have a default value after reset.
6.7.1 DPR[3:0]: data page registers
The DPR[3:0] registers allow access to the entire 4-Mbyte memory space composed of 256
pages of 16 Kbytes.
Data page register relocation
If these registers are to be used frequently, they may be relocated in register group E, by
programming bit 5 of the EMR2-R246 register in page 21. If this bit is set, the DPR[3:0]
registers are located at R224-227 in place of the Port 0-3 Data Registers, which are remapped to the default DPR's locations: R240-243 page 21.
Data Page Register relocation is illustrated in Figure 26.
Bits 7:0 = DPR0_[7:0]: These bits define the 16-Kbyte Data Memory page number. They
are used as the most significant address bits (A21-14) to extend the address during a Data
Memory access. The DPR0 register is used when addressing the virtual address range
0000h-3FFFh.
This register is relocated to R225 if EMR2.5 is set.
70
DPR1_7DPR1_6DPR1_5DPR1_4DPR1_3DPR1_2DPR1_1DPR1_0
Bits 7:0 = DPR1_[7:0]: These bits define the 16-Kbyte Data Memory page number. They
are used as the most significant address bits (A21-14) to extend the address during a Data
Memory access. The DPR1 register is used when addressing the virtual address range
4000h-7FFFh.
This register is relocated to R226 if EMR2.5 is set.
70
DPR2_7DPR2_6DPR2_5DPR2_4DPR2_3DPR2_2DPR2_1DPR2_0
Bits 7:0 = DPR2_[7:0]: These bits define the 16-Kbyte Data memory page. They are used
as the most significant address bits (A21-14) to extend the address during a Data memory
access. The DPR2 register is involved when the virtual address is in the range 8000hBFFFh.
This register is relocated to R227 if EMR2.5 is set.
70
DPR3_7DPR3_6DPR3_5DPR3_4DPR3_3DPR3_2DPR3_1DPR3_0
Bits 7:0 = DPR3_[7:0]: These bits define the 16-Kbyte Data memory page. They are used
as the most significant address bits (A21-14) to extend the address during a Data memory
access. The DPR3 register is involved when the virtual address is in the range C000hFFFFh.
This register selects the 64-Kbyte code segment being used at run-time to access
instructions. It can also be used to access data if the spm instruction has been executed (or
ldpp, ldpd, lddp). Only the 6 LSBs of the CSR register are implemented, and bits 6
and 7 are reserved. The CSR register allows access to the entire memory space, divided
into 64 segments of 64 Kbytes.
To generate the 22-bit Program memory address, the contents of the CSR register is directly
used as the 6 MSBs, and the 16-bit virtual address as the 16 LSBs.
Note:The CSR register should only be read and not written for data operations (there are some
exceptions which are documented in the following paragraph). It is, however, modified either
directly by means of the jps and calls instructions, or indirectly via the stack, by means of
the rets instruction.
Bits 5:0 = CSR_[5:0]: These bits define the 64-Kbyte memory segment (among 64) which
contains the code being executed. These bits are used as the most significant address bits
(A21-16).
ISR and ENCSR bit (EMR2 register) are also described in the chapter relating to Interrupts,
please refer to this description for further details.
Bits 7:6 = Reserved, keep in reset state.
Bits 5:0 = ISR_[5:0]: These bits define the 64-Kbyte memory segment (among 64) which
contains the interrupt vector table and the code for interrupt service routines and DMA
transfers (when the PS bit of the DAPR register is reset). These bits are used as the most
significant address bits (A21-16). The ISR is used to extend the address space in two cases:
●Whenever an interrupt occurs: ISR points to the 64-Kbyte memory segment containing
the interrupt vector table and the interrupt service routine code. See also the Interrupts
Bits 5:0 = DMASR_[5:0]: These bits define the 64-Kbyte Memory segment (among 64) used
when a DMA transaction is performed between the peripheral's data register and Memory,
with the PS bit of the DAPR register set. These bits are used as the most significant address
bits (A21-16). If the PS bit is reset, the ISR register is used to extend the address.
Program memory is organized as a set of 64-Kbyte segments. The program can span as
many segments as needed, but a procedure cannot stretch across segment boundaries.
jps, calls and rets instructions, which automatically modify the CSR, must be used to
jump across segment boundaries. Writing to the CSR is forbidden during normal program
execution because it is not synchronized with the opcode fetch. This could result in fetching
the first byte of an instruction from one memory segment and the second byte from another.
Writing to the CSR is allowed when it is not being used, i.e during an interrupt service
routine if ENCSR is reset.
Note:A routine must always be called in the same way, i.e. either always with call or always with
calls, depending on whether the routine ends with ret or rets. This means that if the
routine is written without prior knowledge of the location of other routines which call it, and
all the program code does not fit into a single 64-Kbyte segment, then calls/rets should
be used.
In typical microcontroller applications, less than 64 Kbytes of RAM are used, so the four
Data space pages are normally sufficient, and no change of DPR[3:0] is needed during
Program execution. It may be useful however to map part of the ROM into the data space if
it contains strings, tables, bit maps, etc.
If there is to be frequent use of paging, the user can set bit 5 (DPRREM) in register R246
(EMR2) of Page 21. This swaps the location of registers DPR[3:0] with that of the data
registers of Ports 0-3. In this way, DPR registers can be accessed without the need to
save/set/restore the Page Pointer Register. Port registers are therefore moved to page 21.
Applications that require a lot of paging typically use more than 64 Kbytes of external
memory, and as ports 0, 1 and 9 are required to address it, their data registers are unused.
6.8.2 Interrupts
The ISR register has been created so that the interrupt routines may be found by means of
the same vector table even after a segment jump/call.
When an interrupt occurs, the CPU behaves in one of 2 ways, depending on the value of the
ENCSR bit in the EMR2 register (R246 on Page 21).
If this bit is reset (default condition), the CPU works in original ST9 compatibility mode. For
the duration of the interrupt service routine, the ISR is used instead of the CSR, and the
interrupt stack frame is kept exactly as in the original ST9 (only the PC and flags are
pushed). This avoids the need to save the CSR on the stack in the case of an interrupt,
ensuring a fast interrupt response time. The drawback is that it is not possible for an
interrupt service routine to perform segment calls/jps: these instructions would update
the CSR, which, in this case, is not used (ISR is used instead). The code size of all interrupt
service routines is thus limited to 64 Kbytes.
If, instead, bit 6 of the EMR2 register is set, the ISR is used only to point to the interrupt
vector table and to initialize the CSR at the beginning of the interrupt service routine: the old
CSR is pushed onto the stack together with the PC and the flags, and then the CSR is
loaded with the ISR. In this case, an iret will also restore the CSR from the stack. This
approach lets interrupt service routines access the whole 4-Mbyte address space. The
drawback is that the interrupt response time is slightly increased, because of the need to
also save the CSR on the stack. Compatibility with the original ST9 is also lost in this case,
because the interrupt stack frame is different; this difference, however, would not be
noticeable for a vast majority of programs.
Data memory mapping is independent of the value of bit 6 of the EMR2 register, and
remains the same as for normal code execution: the stack is the same as that used by the
main program, as in the ST9. If the interrupt service routine needs to access additional Data
memory, it must save one (or more) of the DPRs, load it with the needed memory page and
restore it before completion.
Depending on the PS bit in the DAPR register (see DMA chapter), DMA uses either the ISR
or the DMASR for memory accesses: this guarantees that a DMA will always find its
memory segment(s), no matter what segment changes the application has performed.
Unlike interrupts, DMA transactions cannot save/restore paging registers, so a dedicated
segment register (DMASR) has been created. Having only one register of this kind means
that all DMA accesses should be programmed in one of the two following segments: the one
pointed to by the ISR (when the PS bit of the DAPR register is reset), and the one
referenced by the DMASR (when the PS bit is set).
74/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
230000h
004000h
002000h
000000h
Sector F1
8 Kbytes
Sector F0
8 Kbytes
TestFlash
8 Kbytes
Program / Erase
Controller
RAM buffer
16 bytes
Register
Interface
AddressData
231F80h
UserOTP and Protection registers
Sector F2
48 Kbytes
sense amplifiers
22CFFFh
228000h
Hardware emulated EEPROM sectors
8 Kbytes (Reserved)
Emulated EEPROM
1 Kbyte
sense amplifiers
220000h
2203FFh
010000h
7 Single voltage Flash and E
7.1 Introduction
The Flash circuitry contains one array divided in two main parts that can each be read
independently. The first part contains the main Flash array for code storage, a reserved
array (TestFlash) for system routines and a 128-byte area available as one time
programmable memory (OTP). The second part contains the two dedicated Flash sectors
used for EEPROM Hardware Emulation.
The write operations of the two parts are managed by an embedded Program/Erase
Controller. Through a dedicated RAM buffer the Flash and the E
of 16 bytes.
Figure 30. Flash memory structure (example for 64K Flash device)
3™
(emulated EEPROM)
3 ™
can be written in blocks
Doc ID 8848 Rev 775/523
Single voltage Flash and E3™ (emulated EEPROM)
230000h
010000h
004000h
002000h
000000h
22CFFFh
228000h
Sector F3
64 Kbytes
Sector F2
48 Kbytes
Sector F1
8 Kbytes
Sector F0
8 Kbytes
Hardware emulated EEPROM sectors
8 Kbytes (Reserved)
Emulated EEPROM
1 Kbyte
Te st F l as h
8 Kbytes
Program / Erase
Controller
RAM buffer
16 bytes
Register
Interface
AddressData
231F80h
UserOTP and Protection registers
sense amplifiers
sense amplifiers
220000h
2203FFh
Figure 31. Flash memory structure (example for 128K Flash device)
7.2 Functional description
7.2.1 Structure
The memory is composed of three parts:
●a sector with the system routines (TestFlash) and the user OTP area
●4 main sectors for code
●an emulated EEPROM
124 bytes are available to the user as an OTP area. The user can program these bytes, but
cannot erase them.
7.2.2 EEPROM emulation
A hardware EEPROM emulation is implemented using special flash sectors to emulate an
EEPROM memory. This E
(For more details on hardware EEPROM emulation, see application note AN1152)
3 TM
is directly addressed from 220000h to 2203FFh.
76/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
Table 9.Memory structure for 64K Flash device
SectorAddressesMax size
TestFlash (TF) (Reserved)230000h to 231F7Fh8064 bytes
OTP Area
Protection Registers (reserved)
Flash 0 (F0)000000h to 001FFFh8 Kbytes
Flash 1 (F1)002000h to 003FFFh8 Kbytes
Flash 2 (F2)004000h to 00FFFFh48 Kbytes
Hardware Emulated EEPROM
sectors
(reserved)
Emulated EEPROM220000h to 2203FFh1 Kbyte
Table 10.Memory structure for 128K Flash device
SectorAddressesMax size
TestFlash (TF) (Reserved)230000h to 231F7Fh8064 bytes
OTP Area
Protection Registers (reserved)
Flash 0 (F0)000000h to 001FFFh8 Kbytes
Flash 1 (F1)002000h to 003FFFh8 Kbytes
231F80h to 231FFBh
231FFCh to 231FFFh
124 bytes
4 bytes
228000h to 22CFFFh8 Kbytes
231F80h to 231FFBh
231FFCh to 231FFFh
124 bytes
4 bytes
Flash 2 (F2)004000h to 00FFFFh48 Kbytes
Flash 3 (F3)010000h to 01FFFFh64 Kbytes
Hardware Emulated EEPROM
sectors
228000h to 22CFFFh8 Kbytes
(reserved)
Emulated EEPROM220000h to 2203FFh1 Kbyte
Table 11.Memory structure for 256K Flash device
SectorAddressesMax size
TestFlash (TF) (Reserved)230000h to 231F7Fh8064 bytes
OTP Area
Protection Registers (reserved)
231F80h to 231FFBh
231FFCh to 231FFFh
Flash 0 (F0)000000h to 001FFFh8 Kbytes
Flash 1 (F1)002000h to 003FFFh8 Kbytes
Flash 2 (F2)004000h to 00FFFFh48 Kbytes
Flash 3 (F3)
Flash 4 (F4)
Flash 5 (F5)
010000h to 01FFFFh
020000h to 02FFFFh
030000h to 03FFFFh
124 bytes
4 bytes
64 Kbytes
64 Kbytes
64 Kbytes
Doc ID 8848 Rev 777/523
Single voltage Flash and E3™ (emulated EEPROM)
224000h
224001h
Register Interface
224002h
FCR
ECR
FESR0
FESR1
224003h
221000h
221001h
221002h
221003h
/
/
/
/
Table 11.Memory structure for 256K Flash device (continued)
SectorAddressesMax size
Hardware Emulated EEPROM
sectors
(reserved)
Emulated EEPROM220000h to 2203FFh1 Kbyte
7.2.3 Operation
228000h to 22CFFFh8 Kbytes
The memory has a register interface mapped in memory space (segment 22h). All
operations are enabled through the FCR (Flash Control Register), ECR (E
3 TM
Control
Register).
All operations on the Flash must be executed from another memory (internal RAM, E
external memory).
Flash (including TestFlash) and E
while the other is written. However simultaneous Flash and E
3 TM
are independent, this means that one can be read
3 TM
write operations are
forbidden.
An interrupt can be generated at the end of a Flash or an E
3 TM
write operation: this interrupt
is multiplexed with an external interrupt EXTINTx (device dependent) to generate an
interrupt INTx.
The status of a write operation inside the Flash and the E
3 TM
memories can be monitored
through the FESR[1:0] registers.
Control and Status registers are mapped in memory (segment 22h), as shown in the
following figure.
Figure 32. Control and status register map
3 TM
,
In order to use the same data pointer register (DPR) to point both to the E
2203FFh) and to these control and status registers, the Flash and E
are mapped not only at page 0x89 (224000h-224003h) but also on page 0x88 (221000h221003h).
If the RESET
pin is activated during a write operation, the write operation is interrupted. In
this case the user must repeat this last write operation following power on or reset. If the
internal supply voltage drops below the V
threshold, a reset sequence is generated
IT-
automatically by hardware.
7.2.4 E
3 TM
update operation
The update of the E
3 TM
content can be made by pages of 16 consecutive bytes. The Page
Update operation allows up to 16 bytes to be loaded into the RAM buffer that replace the
ones already contained in the specified address.
78/523Doc ID 8848 Rev 7
3 TM
3 TM
(220000h-
control registers
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
Emulation Flow
Reset
Read Status Pages
Map E
3 TM
in current sector
Write operation
to complete ?
Complete
Write operation
Update
Status page
Ye s
No
Wait for
Update commands
Page
Update
Command
End Page
Update
Interrupt
(to Core)
Program selected
Page from RAM buffer
in next free block
Copy all other Pages
into RAM buffer;
then program them
in next free block
1/4 erase of
complementary sector
Update
Status Page
new
sector ?
Ye s
No
Complementary
sector erased ?
Ye s
No
Each time a Page Update operation is executed in the E
3 TM
, the RAM buffer content is
programmed in the next free block relative to the specified page (the RAM buffer is
previously automatically filled with old data for all the page addresses not selected for
updating). If all the 4 blocks of the specified page in the current E
3 TM
sector are full, the
page content is copied to the complementary sector, that becomes the new current one.
After that the specified page has been copied to the next free block, one erase phase is
executed on the complementary sector, if the 4 erase phases have not yet been executed.
When the selected page is copied to the complementary sector, the remaining 63 pages are
also copied to the first block of the new sector; then the first erase phase is executed on the
previous full sector. All this is executed in a hidden manner, and the End Page Update
Interrupt is generated only after the end of the complete operation.
At Reset the two status pages are read in order to detect which is the sector that is currently
mapping the E
3 TM
, and in which block each page is mapped. A system defined routine
written in TestFlash is executed at reset, so that any previously aborted write operation is
restarted and completed.
Figure 33. Hardware emulation flow
7.2.5 Important note on Flash erase suspend
Refer to Section 17.1.
Doc ID 8848 Rev 779/523
Single voltage Flash and E3™ (emulated EEPROM)
7.3 Register description
7.3.1 Control registers
FLASH CONTROL REGISTER (FCR)
Address: 224000h / 221000h- Read/Write
Reset value: 0000 0000 (00h)
7654 3 210
FWMSFPAGEFCHIPFBYTEFSECTFSUSPPROTFBUSY
The Flash Control Register is used to enable all the operations for the Flash and the
TestFlash memories.
Bit 7 = FWMS: Flash Write Mode Start (Read/Write).
This bit must be set to start each write/erase operation in Flash memory. At the end of the
write/erase operation or during a Sector Erase Suspend this bit is automatically reset. To
resume a suspended Sector Erase operation, this bit must be set again. Resetting this bit by
software does not stop the current write operation.
0: No effect
1: Start Flash write
Bit 6 = FPAGE: Flash Page program (Read/Write).
This bit must be set to select the Page Program operation in Flash memory. This bit is
automatically reset at the end of the Page Program operation.
The Page Program operation allows to program “0”s in place of “1”s. From 1 to 16 bytes can
be entered (in any order, no need for an ordered address sequence) before starting the
execution by setting the FWMS bit. All the addresses must belong to the same page (only
the 4 LSBs of address can change). Data to be programmed and addresses in which to
program must be provided (through an LD instruction, for example). Data contained in page
addresses that are not entered are left unchanged.
0: Deselect page program
1: Select page program
Bit 5 = FCHIP: Flash CHIP erase (Read/Write). This bit must be set to select the Chip Erase
operation in Flash memory. This bit is automatically reset at the end of the Chip Erase
operation.
The Chip Erase operation erases all the Flash locations to FFh. The operation is limited to
Flash code: sectors F0-F3 (or F0-F5 for the ST92F250), TestFlash and
3 TM
E
excluded. The
execution starts by setting the FWMS bit. It is not necessary to pre-program the sectors to
00h, because this is done automatically.
0: Deselect chip erase
1: Select chip erase
80/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
Bit 4 = FBYTE: Flash byte program (Read/Write). This bit must be set to select the Byte
Program operation in Flash memory. This bit is automatically reset at the end of the Byte
Program operation.
The Byte Program operation allows “0”s to be programmed in place of “1”s. Data to be
programmed and an address in which to program must be provided (through an LD
instruction, for example) before starting execution by setting bit FWMS.
0: Deselect byte program
1: Select byte program
Bit 3 = FSECT: Flash sector erase (Read/Write). This bit must be set to select the Sector
Erase operation in Flash memory. This bit is automatically reset at the end of the Sector
Erase operation.
The Sector Erase operation erases all the Flash locations to FFh. From 1 to 6 sectors (F0F5) can be simultaneously erased. These sectors can be entered before starting the
execution by setting the FWMS bit. An address located in the sector to erase must be
provided (through an LD instruction, for example), while the data to be provided is don’t
care. It is not necessary to pre-program the sectors to 00h, because this is done
automatically.
0: Deselect sector erase
1: Select sector erase
Bit 2 = FSUSP: Flash sector erase suspend (Read/Write).
This bit must be set to suspend the current Sector Erase operation in Flash memory in order
to read data to or from program data to a sector not being erased. The FSUSP bit must be
reset (and FWMS must be set again) to resume a suspended Sector Erase operation.
The Erase Suspend operation resets the Flash memory to normal read mode (automatically
resetting bit FBUSY) in a maximum time of 15μs.
When in Erase Suspend the memory accepts only the following operations: Read, Erase
Resume and Byte Program. Updating the
3 TM
E
memory is not possible during a Flash Erase
Suspend.
0: Resume sector erase when FWMS is set again.
1: Suspend Sector erase
Bit 1 = PROT: Set Protection (Read/Write).
This bit must be set to select the Set Protection operation. This bit is automatically reset at
the end of the Set Protection operation.
The Set Protection operation allows “0”s in place of “1”s to be programmed in the four Non
Volatile Protection registers. From 1 to 4 bytes can be entered (in any order, no need for an
ordered address sequence) before starting the execution by setting the FWMS bit. Data to
be programmed and addresses in which to program must be provided (through an LD
instruction, for example). Protection contained in addresses that are not entered are left
unchanged.
0: Deselect protection
Doc ID 8848 Rev 781/523
Single voltage Flash and E3™ (emulated EEPROM)
1: Select protection
Bit 0 = FBUSY: Flash Busy (Read Only).
This bit is automatically set during Page Program, Byte Program, Sector Erase or Set
Protection operations when the first address to be modified is latched in Flash memory, or
during Chip Erase operation when bit FWMS is set. When this bit is set every read access to
the Flash memory will output invalid data (FFh equivalent to a NOP instruction), while every
write access to the Flash memory will be ignored. At the end of the write operations or
during a Sector Erase Suspend this bit is automatically reset and the memory returns to
read mode. After an Erase Resume this bit is automatically set again. The FBUSY bit
remains high for a maximum of 10μs after Power-Up and when exiting Power-Down mode,
meaning that the Flash memory is not yet ready to be accessed.
0: Flash not busy
1: Flash busy
3 TM
E
CONTROL REGISTER (ECR)
Address: 224001h /221001h- Read/Write
Reset value: 000x x000 (xxh)
76543210
EWMSEPAGEECHIPWFISFEIENEBUSY
3 TM
The
E
Control Register is used to enable all the operations for the E
The ECR also contains two bits (WFIS and FEIEN) that are related to both Flash and
memories.
Bit 7 = EWMS:
3 TM
E
Write Mode Start.
This bit must be set to start every write/erase operation in the
write/erase operation this bit is automatically reset. Resetting by software this bit does not
stop the current write operation.
3 TM
memory.
3 TM
E
memory. At the end of the
3 TM
E
0: No effect
1: Start
Bit 6 = EPAGE:
E
3 TM
write
E
3 TM
page update.
This bit must be set to select the Page Update operation in
operation allows to write a new content: both “0”s in place of “1”s and “1”s in place of “0”s.
From 1 to 16 bytes can be entered (in any order, no need for an ordered address sequence)
before starting the execution by setting bit EWMS. All the addresses must belong to the
same page (only the 4 LSBs of address can change). Data to be programmed and
addresses in which to program must be provided (through an LD instruction, for example).
Data contained in page addresses that are not entered are left unchanged. This bit is
automatically reset at the end of the Page Update operation.
0: Deselect page update
1: Select page update
82/523Doc ID 8848 Rev 7
3 TM
E
memory. The Page Update
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
Bit 5 = ECHIP: E
This bit must be set to select the Chip Erase operation in the
operation allows to erase all the
3 TM
chip erase.
3 TM
E
3 TM
E
locations to FFh. The execution starts by setting bit
memory. The Chip Erase
EWMS. This bit is automatically reset at the end of the Chip Erase operation.
0: Deselect chip erase
1: Select chip erase
Bit 4:3 = Reserved.
Bit 2 = WFIS: Wait For Interrupt Status.
If this bit is reset, the WFI instruction puts the Flash macrocell in Stand-by mode (immediate
read possible, but higher consumption: 100 μA); if it is set, the WFI instruction puts the Flash
macrocell in Power-Down mode (recovery time of 10μs needed before reading, but lower
consumption: 10μA). The Stand-by mode or the Power-Down mode will be entered only at
the end of any current Flash or
3 TM
E
write operation.
In the same way following an HALT or a STOP instruction, the Memory enters Power-Down
mode only after the completion of any current write operation.
0: Flash in Stand-by mode on WFI
1: Flash in Power-Down mode on WFI
Note:HALT or STOP mode can be exited without problems, but the user should take care when
exiting WFI Power Down mode. If WFIS is set, the user code must reset the XT_DIV16 bit in
the R242 register (page 55) before executing the WFI instruction. When exiting WFI mode,
this gives the Flash enough time to wake up before the interrupt vector fetch.
Bit 1 = FEIEN: Flash &
3 TM
E
Interrupt enable.
This bit selects the source of interrupt channel
INTx between the external interrupt pin and the Flash/
3 TM
E
End of Write interrupt. Refer to
the Interrupt chapter for the channel number.
0: External interrupt enabled
1: Flash &
Bit 0 = EBUSY:
3 TM
E
Interrupt enabled
3 TM
E
Busy (Read Only).
This bit is automatically set during a Page Update operation when the first address to be
modified is latched in the
3 TM
E
memory, or during Chip Erase operation when bit EWMS is
set. At the end of the write operation or during a Sector Erase Suspend this bit is
automatically reset and the memory returns to read mode. When this bit is set every read
access to the
while every write access to the
3 TM
E
memory will output invalid data (FFh equivalent to a NOP instruction),
3 TM
E
memory will be ignored. At the end of the write operation
this bit is automatically reset and the memory returns to read mode. Bit EBUSY remains
high for a maximum of 10ms after Power-Up and when exiting Power-Down mode, meaning
3 TM
E
3 TM
E
3 TM
E
memory is not yet ready to be accessed.
not busy
busy
that the
0:
1:
Doc ID 8848 Rev 783/523
Single voltage Flash and E3™ (emulated EEPROM)
7.3.2 Status registers
Two Status Registers (FESR[1:0] are available to check the status of the current write
operation in Flash and
During a Flash or an
3 TM
E
memories.
3 TM
E
write operation any attempt to read the memory under modification
will output invalid data (FFh equivalent to a NOP instruction). This means that the Flash
memory is not fetchable when a write operation is active: the write operation commands
must be given from another memory (
3 TM
E
FLASH &
STATUS REGISTER 0 (FESR0)
3 TM
E
, internal RAM, or external memory).
Address: 224002h /221002h -Read/Write
Reset value: 0000 0000 (00h)
7 6543210
FEERRFESS6FESS5FESS4FESS3FESS2FESS1FESS0
Bit 7 = FEERR: Flash or
This bit is set by hardware when an error occurs during a Flash or an
3 TM
E
write ERRor (Read/Write).
3 TM
E
write operation. It
must be cleared by software.
0: Write OK
1: Flash or
Bit 6:0 = FESS[6:0]. Flash and
These bits are set by hardware and give the status of the 7 Flash and
●FESS6 = TestFlash and OTP
●FESS5:4 = E
3 TM
E
write error
3 TM
sectors
3 TM
E
Sectors Status Bits (Read Only).
E
3 TM
sectors.
For 128K and 64K Flash devices:
●FESS3:0 = Flash sectors (F3:0)
For the ST92F250 (256K):
●FESS3 gives the status of F5, F4 and F3 sectors: the status of all these three sectors
are ORed on this bit
●FESS2:0 = Flash sectors (F2:0)
The meaning of the FESSx bit for sector x is given in Tabl e 1 2.
Table 12.Sector status bits
FEERR
1--Write Error in Sector x
01-Write operation on-going in sector x
001Sector Erase Suspended in sector x
000Don’t care
84/523Doc ID 8848 Rev 7
FBUSY
EBUSY
FSUSPFESSx=1 meaning
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
FLASH & E
3 TM
STATUS REGISTER 1 (FESR1)
Address: 224003h /221003h-Read Only
Reset value: 0000 0000 (00h)
76543210
ERERPGERSWER
Bit 7 = ERER. Erase error (Read Only).
This bit is set by hardware when an Erase error occurs during a Flash or an
E
3 TM
write
operation. This error is due to a real failure of a Flash cell, that can no longer be erased.
This kind of error is fatal and the sector where it occurred must be discarded. This bit is
automatically cleared when bit FEERR of the FESR0 register is cleared by software.
0: Erase OK
1: Erase error
Bit 6 = PGER. Program error (Read Only).
This bit is automatically set when a Program error occurs during a Flash or an
E
3 TM
write
operation. This error is due to a real failure of a Flash cell, that can no longer be
programmed. The byte where this error occurred must be discarded (if it was in the
E
3 TM
memory, the byte must be reprogrammed to FFh and then discarded, to avoid the error
occurring again when that byte is internally moved). This bit is automatically cleared when
bit FEERR of the FESR0 register is cleared by software.
0: Program OK
1: Flash or
3 TM
E
Programming error
Bit 5 = SWER. Swap or 1 over 0 Error (Read Only).
This bit has two different meanings, depending on whether the current write operation is to
3 TM
E
Flash or
memory.
In Flash memory this bit is automatically set when trying to program at 1 bits previously set
at 0 (this does not happen when programming the Protection bits). This error is not due to a
failure of the Flash cell, but only flags that the desired data has not been written.
In the
3 TM
E
memory this bit is automatically set when a Program error occurs during the
swapping of the unselected pages to the new sector when the old sector is full (see AN1152
for more details).
This error is due to a real failure of a Flash cell, that can no longer be programmed. When
this error is detected, the embedded algorithm automatically exits the Page Update
operation at the end of the Swap phase, without performing the Erase Phase 0 on the full
sector. In this way the old data are kept, and through predefined routines in TestFlash (Find
Wrong Pages = 230029h and Find Wrong Bytes = 23002Ch), the user can compare the old
and the new data to find where the error occurred.
Once the error has been discovered the user must take to end the stopped Erase Phase 0
on the old sector (through another predefined routine in TestFlash: Complete Swap =
23002Fh). The byte where the error occurred must be reprogrammed to FFh and then
discarded, to avoid the error occurring again when that byte is internally moved.
Doc ID 8848 Rev 785/523
Single voltage Flash and E3™ (emulated EEPROM)
This bit is automatically cleared when bit FEERR of the FESR0 register is cleared by
software.
Bit 4:0 = Reserved.
7.4 Write operation example
Each operation (both Flash and E
following:
ORFCR, #OPMASK;Operation selection
LDADD1, #DATA1;1st Add and Data
LDADD2, #DATA2;2nd Add and Data
......, ......
LDADDn, #DATAn;nth Add and Data
ORFCR, #80h;Operation start
3 TM
) is activated by a sequence of instructions like the
;n range = (1 to 16)
The first instruction is used to select the desired operation by setting its corresponding
selection bit in the Control Register (FCR for Flash operations, ECR for E
The load instructions are used to set the addresses (in the Flash or in the E
3 TM
operations).
3 TM
memory
space) and the data to be modified.
The last instruction is used to start the write operation, by setting the start bit (FWMS for
Flash operations, EWMS for E
3 TM
operation) in the Control register.
Once selected, but not yet started, one operation can be cancelled by resetting the
operation selection bit. Any latched address and data will be reset.
Warning: during the Flash Page Program or the E
3 TM
Page Update operation it is forbidden
to change the page address: only the last page address is effectively kept and all
programming will effect only that page.
A summary of the available Flash and E
3 TM
write operations are shown in the following
tables:
Table 13.Flash write operations
OperationSelection bitAddresses and dataStart bitTypical duration
Byte ProgramFBYTE1 byteFWMS10 μs
Page ProgramFPAGEFrom 1 to 16 bytesFWMS160 μs (16 bytes)
Sector EraseFSECTFrom 1 to 4 sectorsFWMS1.5 s (1 sector)
Sector Erase SuspendFSUSPNoneNone15 μs
Chip EraseFCHIPNoneFWMS3 s
Set ProtectionPROTFrom 1 to 4 bytesFWMS40 μs (4 bytes)
Table 14.E
OperationSelection bitAddresses and dataStart bitTypical duration
Page UpdateEPAGEFrom 1 to 16 bytesEWMS30 ms
Chip EraseECHIPNoneEWMS
86/523Doc ID 8848 Rev 7
3 TM
Write operations
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
NVAPR
NVWPR
231FFCh
231FFDh
231FFEhNVPWD0
NVPWD1231FFFh
7.5 Protection strategy
The protection bits are stored in the 4 locations from 231FFCh to 231FFFh (see Figure 34).
All the available protections are forced active during reset, then in the initialization phase
they are read from the TestFlash.
The protections are stored in 2 Non Volatile Registers. Other 2 Non Volatile Registers can
be used as a password to re-enable test modes once they have been disabled.
The protections can be programmed using the Set Protection operation (see Control
Registers paragraph), that can be executed from all the internal or external memories
except the Flash or TestFlash itself.
The TestFlash area (230000h to 231F7Fh) is always protected against write access.
Figure 34. Protection register map
7.5.1 Non volatile registers
The 4 Non Volatile Registers used to store the protection bits for the different protection
features are one time programmable by the user.
Access to these registers is controlled by the protections related to the TestFlash. Since the
code to program the Protection Registers cannot be fetched by the Flash or the TestFlash
memories, this means that, once the APRO or APBR bits in the NVAPR register are
programmed, it is no longer possible to modify any of the protection bits. For this reason the
NV Password, if needed, must be set with the same Set Protection operation used to
program these bits. For the same reason it is strongly advised to never program the WPBR
bit in the NVWPR register, as this will prevent any further write access to the TestFlash, and
consequently to the Protection Registers.
NON VOLATILE ACCESS PROTECTION REGISTER (NVAPR)
Address: 231FFCh - Read/Write
Delivery value: 1111 1111 (FFh)
76543210
1APROAPBRAPEEAPEXPWT2PWT1PWT0
Bit 7 = Reserved.
Bit 6 = APRO: FLASH access protection.
This bit, if programmed at 0, disables any access (read/write) to operands mapped inside
the Flash address space (E3 TM excluded), unless the current instruction is fetched from
the TestFlash or from the Flash itself.
0: ROM protection on
1: ROM protection off
Doc ID 8848 Rev 787/523
Single voltage Flash and E3™ (emulated EEPROM)
Bit 5 = APBR: TestFlash access protection.
This bit, if programmed at 0, disables any access (read/write) to operands mapped inside
the TestFlash, the OTP and the protection registers, unless the current instruction is fetched
from the TestFlash or the OTP area.
0: TestFlash protection on
1: TestFlash protection off
Bit 4 = APEE:
3 TM
E
access protection.
This bit, if programmed at 0, disables any access (read/write) to operands mapped inside
3 TM
the
E
address space, unless the current instruction is fetched from the TestFlash or from
the Flash, or from the E
3 TM
0:
E
protection on
3 TM
1:
E
protection off
3 TM
itself.
Bit 3 = APEX: Access Protection from External memory.
This bit, if programmed at 0, disables any access (read/write) to operands mapped inside
the address space of one of the internal memories (TestFlash, Flash, E
3 TM
, RAM), if the
current instruction is fetched from an external memory.
0: Protection from external memory on
1: Protection from external memory off
Bit 2:0 = PWT[2:0]: Password Attempt 2-0.
If the TMDIS bit in the NVWPR register (231FFDh) is programmed to 0, every time a Set
Protection operation is executed with Program Addresses equal to NVPWD1-0 (231FFEFh), the two provided Program Data are compared with the NVPWD1-0 content; if there is
not a match one of PWT2-0 bits is automatically programmed to 0: when these three bits are
all programmed to 0 the test modes are disabled forever. In order to intentionally disable test
modes forever, it is sufficient to set a random Password and then to make 3 wrong attempts
to enter it.
NON VOLATILE WRITE PROTECTION REGISTER (NVWPR)
Address: 231FFDh - Read/Write
Delivery value: 1111 1111 (FFh)
76543210
TMDISPWOKWPBRWPEEWPRS3WPRS2WPRS1WPRS0
Bit 7 = TMDIS: Test mode disable (Read Only).
This bit, if set to 1, allows to bypass all the protections in test and EPB modes. If
programmed to 0, on the contrary, all the protections remain active also in test mode. The
only way to enable the test modes if this bit is programmed to 0, is to execute the Set
Protection operation with Program Addresses equal to NVPWD1-0 (231FFF-Eh) and
Program Data matching with the content of NVPWD1-0. This bit is read only: it is
automatically programmed to 0 when NVPWD1-0 are written for the first time.
88/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
0: Test mode disabled
1: Test mode enabled
Bit 6 = PWOK: Password OK (Read Only).
If the TMDIS bit is programmed to 0, when the Set Protection operation is executed with
Program Addresses equal to NVPWD[1:0] and Program Data matching with NVPWD[1:0]
content, the PWOK bit is automatically programmed to 0. When this bit is programmed to 0
TMDIS protection is bypassed and the test and EPB modes are enabled.
0: Password OK
1: Password not OK
Bit 5 = WPBR: TestFlash Write Protection.
This bit, if programmed at 0, disables any write access to the TestFlash, the OTP and the
protection registers. This protection cannot be temporarily disabled.
0: TestFlash write protection on
1: TestFlash write protection off
Note:it is strongly advised to never program the WPBR bit in the NVWPR register, as this will
prevent any further write access to the protection registers.
Bit 4 = WPEE:
This bit, if programmed to 0, disables any write access to the
3 TM
E
Write Protection.
3 TM
E
address space. This
protection can be temporary disabled by executing the Set Protection operation and writing
1 into this bit. To restore the protection, reset the micro or execute another Set Protection
operation on this bit.
3 TM
0:
E
write protection on
Note:1:
3 TM
E
write protection off
A read access to the NVWPR register restores any protection previously enabled.
Bit 3 = WPRS3: FLASH Sectors 5-3 Write Protection.
This bit, if programmed to 0, disables any write access to the Flash sector 3 (and sectors 4
and 5 when available) address space(s). This protection can be temporary disabled by
executing the Set Protection operation and writing 1 into this bit. To restore the protection,
reset the micro or execute another Set Protection operation on this bit.
0: FLASH Sectors 5-3 write protection on
1: FLASH Sectors 5-3 write protection off
Note:A read access to the NVWPR register restores any protection previously enabled.
Bit 2:0 = WPRS[2:0]: FLASH Sectors 2-0 Write Protection.
These bits, if programmed to 0, disable any write access to the 3 Flash sectors address
spaces. These protections can be temporary disabled by executing the Set Protection
Doc ID 8848 Rev 789/523
Single voltage Flash and E3™ (emulated EEPROM)
operation and writing 1 into these bits. To restore the protection, reset the micro or execute
another Set Protection operation on this bit.
0: FLASH Sectors 2-0 write protection on
1: FLASH Sectors 2-0 write protection off
Note:A read access to the NVWPR register restores any protection previously enabled.
NON VOLATILE PASSWORD (NVPWD1-0)
Address: 231FFF-231FFEh - Write Only
Delivery value: 1111 1111 (FFh)
76543210
PWD7PWD6PWD5PWD4PWD3PWD2PWD1PWD0
Bit 7:0 = PWD[7:0]: Password bits 7:0 (Write Only).
These bits must be programmed with the Non Volatile Password that must be provided with
the Set Protection operation to disable (first write access) or to reenable (second write
access) the test and EPB modes. The first write access fixes the password value and resets
the TMDIS bit of NVWPR (231FFDh). The second write access, with Program Data
matching with NVPWD[1:0] content, resets the PWOK bit of NVWPR.
These two registers can be accessed only in write mode (a read access returns FFh).
7.5.2 Temporary unprotection
On user request the memory can be configured so as to allow the temporary unprotection
also of all access protections bits of NVAPR (write protection bits of NVWPR are always
temporarily unprotectable).
Bit APEX can be temporarily disabled by executing the Set Protection operation and writing
1 into this bit, but only if this write instruction is executed from an internal memory (Flash
and Test Flash excluded).
Bit APEE can be temporarily disabled by executing the Set Protection operation and writing
1 into this bit, but only if this write instruction is executed from the memory itself to unprotect
3 TM
(
E
).
Bits APRO and APBR can be temporarily disabled through a direct write at NVAPR location,
by overwriting at 1 these bits, but only if this write instruction is executed from the memory
itself to unprotect.
To restore the access protections, reset the micro or execute another Set Protection
operation by writing 0 to the desired bits.
Note:To restore all the protections previously enabled in the NVAPR or NVWPR register, read the
corresponding register.
When an internal memory (Flash, TestFlash or E
access through a DMA of a peripheral is forbidden (it returns FFh). To read data in DMA
mode from a protected memory, first it is necessary to temporarily unprotect that memory.
3 TM
) is protected in access, also the data
The temporary unprotection allows also to update a protected code.
Refer to the following figures to manage the Test/EPB, Access and Write protection modes.
90/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
Test/EPB Mode
Protected
1st
Bad Password
2nd
Password
3rd Bad Password
Good
Password
Bad Password
Good
PassWord
Bad
Test/EPB Mode
Protected
Test/EPB Mode
Protected
Unprotected
Test/EPB Mode
Good
Password
Bad Password
Test/EPB Mode
Unprotected
Good
Password
Access Mode
Reset the Access Protection bit
executed from RAM
Set the
by an OR operation executed
SW/HW
Reset
NVAPR
Read
Access
by a Set Protection
Executed from RAM
Access Mode
Temporarily
Unprotected
Access Mode
Protected
Unprotected
Operation
Access Protection Bit
by a Set Protection Operation
from the Memory
Reset the
Access Protection bit
to unprotect
Figure 35. Test /EPB mode protection
Figure 36. Access mode protection
Doc ID 8848 Rev 791/523
Single voltage Flash and E3™ (emulated EEPROM)
Write Mode
Reset the Write Protection Bit
executed from RAM
Set the
SW/HW
Reset
NVWPR
Read
Access
by a Set Protection Operation
executed from RAM
Unprotected
Write Mode
Protected
Set Protection
Operation exectued
from RAM
Write Mode
Temporarily
Unprotected
Write Protection Bit
by a Set Protection Operation
Reset the Write
Protection Bit by a
Figure 37. WRITE mode protection
7.6 Flash in-system programming
The Flash memory can be programmed in-system through a serial interface (SCI0).
Exiting from reset, the ST9 executes the initialization from the TestFlash code (written in
TestFlash), where it checks the value of the SOUT0 pin. If it is at 0, this means that the user
wishes to update the Flash code, otherwise normal execution continues. In this second
case, the TestFlash code reads the Reset vector.
If the Flash is virgin (read content is always FFh), the reset vector contains FFFFh. This will
represent the last location of segment 0h, and it is interpreted by the TestFlash code as a
flag indicating that the Flash memory is virgin and needs to be programmed. If the value 1 is
detected on the SOUT0 pin and the Flash is virgin, a HALT instruction is executed, waiting
for a hardware Reset.
7.6.1 Code update routine
The TestFlash Code Update routine is called automatically if the SOUT0 pin is held low
during power-on.
The Code Update routine performs the following operations:
●Enables the SCI0 peripheral in synchronous mode
●Transmits a synchronization datum (25h);
●Waits for an address match (23h) with a timeout of 10ms (@ f
●If the match is not received before the timeout, the execution returns to the Power-On
routine;
●If the match is received, the SCI0 transmits a new datum (21h) to tell the external
device that it is ready to receive the data to be loaded in RAM (that represents the code
of the in-system programming routine);
●Receives two data representing the number of bytes to be loaded (max. 4 Kbytes);
●Receives the specified number of bytes (each one preceded by the transmission of a
Ready to Receive character: (21h) and writes them in internal RAM starting from
OSC
4 MHz);
92/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Single voltage Flash and E3™ (emulated
address 200010h. The first 4 words should be the interrupt vectors of the 4 possible
SCI interrupts, to be used by the in-system programming routine;
●Transmits a last datum (21h) as a request for end of communications;
●Receives the end of communication confirmation datum (any byte other than 25h);
●Resets all the unused RAM locations to FFh;
●Calls address 200018h in internal RAM;
●After completion of the in-system programming routine, an HALT instruction is executed
and an Hardware Reset is needed.
The Code Update routine initializes the SCI0 peripheral as shown in the following table:
Table 15.SCI0 registers (page 24) initialization
RegisterValueNotes
IVR - R24410hVector Table in 0010h
ACR - R24523hAddress Match is 23h
IDPR - R24900hSCI interrupt priority is 0
CHCR - R25083h8 Data Bits
CCR - R251E8h
BRGHR - R25200h
BRGLR - R25304hBaud Rate Divider is 4
rec. clock: ext RXCLK0
trx clock: int CLKOUT0
SICR - R25483hSynchronous Mode
SOCR - R25501h
In addition, the Code Update routine remaps the interrupts in the TestFlash (ISR = 23h), and
configures I/O Ports P5.3 (SOUT0) and P5.4 (CLKOUT0) as Alternate Functions.
Note:Four interrupt routines are used by the code update routine: SCI Receiver Error Interrupt
routine (vector in 0010h), SCI address Match Interrupt routine (vector in 0012h), SCI
Receiver Data Ready Interrupt routine (vector in 0014h) and SCI Transmitter Buffer Empty
Interrupt routine (vector in 0016h).
Doc ID 8848 Rev 793/523
Single voltage Flash and E3™ (emulated EEPROM)
TestFlash Code
Start
Initialisation
Enable Serial
Interface
Jump to Flash
Main
Code
In-system
prog routine
Flash
virgin ?
Erase sectors
Ye s
No
Load 1st table
of data in RAM
through S.I.
Prog 1st table
of data from
RAM in Flash
Load 2nd table
of data in RAM
through SCI
Inc. Address
Last
Address ?
RET
Ye s
No
Code Update
Routine
Enable DMA
Load in-system
prog routine
in internal RAM
through SCI.
Call in-system
prog routine
HALT
Address
Match
Interrupt
(from SCI)
User
Test
Internal RAM (User Code Example)
SOUT0
= 0 ?
Ye sNo
WFI
Flash
Figure 38. Flash in-system programming
94/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Register and memory map
8 Register and memory map
8.1 Introduction
The ST92F124/F150/F250 register map, memory map and peripheral options are
documented in this section. Use this reference information to supplement the functional
descriptions given elsewhere in this document.
8.2 Memory configuration
The Program memory space of the ST92F124/F150/F250 up to 256 Kbytes of directly
addressable on-chip memory, is fully available to the user.
8.2.1 Reset vector location
The user power on reset vector must be stored in the first two physical bytes of memory,
000000h and 000001h.
8.2.2 Location of vector for external watchdog refresh
If an external watchdog is used, it must be refreshed during TestFlash execution by a user
written routine. This routine has to be located in Flash memory, the address where the
routine starts has to be written in 000006h (one word) while the segment where the routine
is located has to be written in 000009h (one byte).
This routine is called at least once every time that the TestFlash executes an E
operation. If the write operation has a long duration, the user routine is called with a rate
fixed by location 000008h with an internal clock frequency of 2 MHz, location 000008h fixes
the number of milliseconds to wait between two calls of the user routine.
Table 16.User routine parameters
LocationSizeDescription
000006h to 000007h2 bytesUser routine address
000008h1 bytems rate at 2 MHz.
000009h1 byteUser routine segment
If location 000006h to 000007h is virgin (FFFFh), the user routine is not called.
3 TM
write
Doc ID 8848 Rev 795/523
Register and memory mapST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2
(Reserved for
External
Memory
External
Memory
250000h
3FFFFFh
Lower Memory
(usually external ROM/FLASH
Upper Memory
(usually external RAM starting
starting in Segment 4h)
in Segment 24h)
1FFFFFh
050000h
Segments 0h to 3h
(256Kbytes)
internal
memory)
(Reserved for
Segments 20h to 23h
(256Kbytes)
internal
memory)
(1.8 Mbytes)
(1.8 Mbytes)
040000h
04FFFFh
04C000h
04BFFFh
048000h
047FFFh
044000h
043FFFh
PAGE 10h - 16 Kbytes
PAGE 11h - 16 Kbytes
PAGE 12h - 16 Kbytes
PAGE 13h - 16 Kbytes
SEGMENT 4h
64 Kbytes
240000h
24FFFFh
24C000h
24BFFFh
248000h
247FFFh
244000h
243FFFh
PAGE 90h - 16 Kbytes
PAGE 91h - 16 Kbytes
PAGE 92h - 16 Kbytes
PAGE 93h - 16 Kbytes
SEGMENT 24h
64 Kbytes
Figure 39. ST92F150/F250 external memory map
96/523Doc ID 8848 Rev 7
ST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2Register and memory map
TESTFLASH - 8 Kbytes
SEGMENT 23h
64 Kbytes
230000h
23FFFFh
23C000h
23BFFFh
238000h
237FFFh
234000h
233FFFh
PAGE 8Ch - 16 Kbytes
PAGE 8Dh - 16 Kbytes
PAGE 8Eh - 16 Kbytes
PAGE 8Fh - 16 Kbytes
230000h
231FFFh
8 Kbytes
231F80h
231FFFh
FLASH OTP - 128 bytes
231FFCh
231FFFh
FLASH OTP Protection Registers - 4 bytes
128 bytes
4 bytes
Emulated EEPROM - 1 Kbyte
SEGMENT 22h
64 Kbytes
220000h
22FFFFh
22C000h
22BFFFh
228000h
227FFFh
224000h
223FFFh
PAGE 88h - 16 Kbytes
PAGE 89h- 16 Kbytes
PAGE 8Ah - 16 Kbytes
PAGE 8Bh - 16 Kbytes
220000h
2203FFh
1 Kbyte
Not Available
FLASH and E
3 TM
224000h/221003h
224003h/221000h
mapped in both locations
Control Registers - 4 bytes
Figure 40. ST92F124/F150/F250 TESTFLASH and E
3 TM
memory map
Doc ID 8848 Rev 797/523
Register and memory mapST92F124xx/ST92F150Cxx/ST92F150JDV1/ST92F250CV2