Home

STM8 bootloader

1. 0 0560 Programming time 6 Programming time The programming time depends on the baud rate speed of the peripheral Programming time examples measured on the following interfaces and speeds include e USART LINUART UART1 UART2 UARTS 128 kbps 256 kbps and 500 kbps SPI 125 kbps 250 kbps 500 kbps and 1 Mbps CAN 125 kbps 250 kbps 500 kbps and 1 Mbps Note Measurements were performed on 48 Kbyte or 32 Kbyte blocks independent of the device type and peripheral used Table 11 Table 12 and Table 13 show the programming times for the USART LINUART UART 1 UART2 UARTS SPI and CAN respectively Table 11 USART LINUART UART1 UART2 UARTS programming times Time to load Kbytes block bytes in Baud rate bps the Flash program memory 128000 256000 500000 48 Kbytes 7 738 5 34 4 08 1 20 13 ms 13 53 ms 10 65 ms 1 7 52 ms 6 93 ms 6 65 ms Table 12 SPI programming time Time to load Kbytes block bytes Baudirate in the Flash program memory 125 kbps 250 kbps 500kbps 1Mbps 32 Kbytes 4 46 3 34 5 2 81 2 55 1 17 44 ms 13 04 ms 11 01 ms 9 95 ms 1 byte 8 52 ms 8 12 ms 7 93 ms 7 84 ms Table 13 CAN programming time Time to load Kbytes block bytes Bang rate in the Flash program memory i55 kbps 250 kbps 500 kbps 1 Mbps 48 Kbytes 9 50s 6 40s 4 85 4 07 1 24 73 ms 16 66 ms 12 63 ms 10 60 ms 1 byte 9 23 ms 8 53 ms 7 91 ms 7 68 ms
2. 45 4 6 1 Go command via USART LINUART UART1 UART2 UART3 45 4 6 2 command via 47 2 70 Doc ID 14798 Rev 5 ky www BDTIC com ST UMO0560 Contents 4 6 3 Go command via 49 4 7 Sector COd S MD 50 4 8 Software model 5 56 56 4 8 1 RAM erase write routines 57 5 Error management 58 6 Programming 59 Appendix How to upload ROP protected device 60 A 1 Rules for upgrading ROP protected 5 60 Appendix B Bootloader entry points 61 Appendix SPI peripheral timing 62 1 SPI with busy state 62 C 2 Modified erase write RAM 5 62 Appendix PC software 63 Appendix Bootloader UART limitation 64 EJ rr 64 E 1 1 UART automatic baudrate 64 E 1 2 Description of UART limitation 64 E 2 Workaround for UART limitation
3. 44 Go command USART LINUART UART1 UART2 UARTS host side 45 Go command USART LINUART UART1 UART2 UARTS device side 46 Go command via SPI host side 47 Go command via SPI device 48 Go command via CAN host side 49 Go command via CAN device 49 Delay elimination in modified RAM routines 62 Flash loader demonstrator 63 Doc ID 14798 Rev 5 5 70 www BDTIC com ST Bootloader introduction 0 0560 2 6 70 Bootloader introduction The main task of the bootloader is to download the application program into the internal memories through the integrated peripherals UARTs SPI or CAN without using the SWIM protocol and dedicated hardware Data are provided by any device host which is capable of sending information through one of the above mentioned serial interfaces The bootloader permits downloading of application software into the device memories including RAM program and data memory using standard serial interfaces It is a complementary solution to programming via the SWIM debugging interface The bootloader code is stored in the internal boot ROM memory After a reset the bootl
4. 1 61 Description of limitation improvements and added features 66 Document revision history 68 Doc ID 14798 Rev 5 www BDTIC com ST UM0560 List of figures List of figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 Figure 12 Figure 13 Figure 14 Figure 15 Figure 16 Figure 17 Figure 18 Figure 19 Figure 20 Figure 21 Figure 22 Figure 23 Figure 24 Figure 25 Figure 26 Figure 27 Figure 28 Figure 29 Figure 30 Figure 31 Figure 32 Figure 33 Figure 34 Figure 35 Figure 36 Bootloader activation flow 8 frame srne cocos eed aa d abs a asta De 13 Get command USART LINUART UART1 UART2 UARTS host side 15 Get command USART LINUART UART1 UART2 UARTS device side 16 Get command via SPI 17 Get command via SPI device 18 Get command CAN 19 Get command CAN device 20 Read memory command via USART LINUART UART1 UART2 UARTS host side 21 Read memory command via U
5. Changes the CAN baud rate according to command sent End of speed ai15031b 1 The host sends the message as follows After setting the new baud rate the bootloader sends the ACK message Therefore the host sets its baud rate while waiting for the ACK Command message Std ID 0x03 DLC 0x01 data OxXX where OxXX assumes the following values depending on the baud rate to be set with HSE 0x01 gt baud rate 125 kbps 0x02 gt baud rate 250 kbps 0x03 gt baud rate 500 kbps 0x04 gt baud rate 1 Mkbps Doc ID 14798 Rev 5 43 70 www BDTIC com ST Bootloader command set 0 0560 Figure 28 Speed command via device side Start speed command Received a message with std ID 03h and with valid data Yes Send ACK message old baud rate Changes the CAN baud rate according to received data new baud rate Send ACK message new baud rate End of speed command Send NACK message old baud rate ai15032b 44 70 Doc ID 14798 Rev 5 www BDTIC com ST UM0560 Bootloader command set 4 6 Go command The go command is used to execute the downloaded code or any other code by branching to an address specified by the host 4 6 1 Go command via USART LINUART UART1 UART2 UART3 Figure 29 Go command USART LINUART UART1 UART2 UARTS host side ait for AC or NACK ACK
6. 0560 J User manual STM8 bootloader 1 Introduction This document describes the features and operation of the STMB8 integrated bootloader program This code embedded in the system memory of the device ROM memory allows memories including Flash program data EEPROM and to be written into the device using the standard serial interfaces LINUART UART USART SPI and CAN The bootloader code is similar for all STM8 versions However even though a peripheral may be present in a product the product may not support it for example the SPI is not supported in 128 Kbyte devices In addition different STM8 device types support different peripherals see Table 5 Serial interfaces associated with STM8 devices for detailed information For further information on the STM8 family features pinout electrical characteristics mechanical data and ordering information please refer to the STM8 datasheets December 201 1 Doc ID 14798 Rev 5 1 70 www st com www BDTIC com ST Contents 0 0560 Contents 1 rige ML 1 2 Bootloader introduction 6 2 1 Bootloader activation 7 3 Peripheral settings 11 3 1 USAHT UAHTS settings E OE d 11 3 1 1 LINUART UARTS in reply mode settings 11 3 2 SPI SSH S cad ax aot e di p R
7. 65 Appendix Limitations and improvements versus bootloader versions 66 REVISION history ca de ame nn 8 8 68 ky Doc ID 14798 Rev 5 3 70 www BDTIC com ST List of tables 0 0560 List of tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 4 70 STMB8 subfamilies featuring a 6 STM8 subfamilies without bootloader 7 Bootloader versions for which bootloader activation flowchart is valid 7 Initial CHECKING CE 10 Serial interfaces associated with STM8 5 11 Bootloader commands 14 Bootloader codes 45 99 14 Examples of delay 1 39 8 OAL A ag 50 Ertor table de oie accio 58 USART LINUART UART1 UART2 UARTS programming 5 59 SPI programming time 4 59 CAN programming time 1 59 Bootloader entry
8. 0 01 97 0x01 9800 gt 0x46 0x01 9BFF 0x01 9C00 gt Oe 0 01 9FFF 0x01 A000 gt 0 01 0 01 400 gt 0 01 A7FF 0 01 A800 gt one 0x01 ABFF 0x01 ACOO gt 0 01 AFFF 0x01 B000 gt ee 0x01 B3FF 0x01 B400 gt oan 0x01 B7FF 0x01 B800 gt Oe 0x01 BBFF ky Doc ID 14798 Rev 5 53 70 www BDTIC com ST Bootloader command set 0 0560 Table 9 STM8 sector codes continued Sector Flash program memory data EEPROM code sTMsA S 128K STM8A S 32K STM8L 32K STM8L 64k STM8L 8k 0078005 ES BO oe IET urs DE ZI 907 ses UE se eren E ser rorem uen 54 70 Doc ID 14798 Rev 5 www BDTIC com ST 0 0560 Bootloader command set Table 9 STM8 sector codes continued Sector Flash program memory data EEPROM code sTM8A S 128K STM8A S 32K STM8L 32K STM8L 64k STM8L 8k om opm oe azo oes mno oes 00 om nemo E E E EL 5023907 oar om mmo T EIE eio oe usns 5 Ky Doc ID 14798 Rev 5 55 70 www BDTIC com ST Bootloader command set UM0560 Table 9 STM8 sector codes
9. GO routine routine _ _ Toutine _ _ routine routine routine Remove EM and WM routines from the RAM Flash reset 8000h Jump to host address ai15360c See Flow chart description on page 9 for explanation of points 1 to 8 See Table 4 Initial checking Dotted routines are loaded in RAM by the host They are removed by the go command before jumping to the Flash program memory to execute an application 8 70 Doc ID 14798 Rev 5 ky www BDTIC com ST UM0560 Bootloader introduction Flow chart description 1 2 Disable all interrupt sources The host can start the bootloader process according to checks shown in Table 4 in keeping with the content of the first Flash program memory location 0x00 8000 and bootloader enable option bytes The host checks the following bootloader start conditions Condition 1 the host checks if the device memory is empty by inspecting the content of address 0x00 8000 reset vector If the content is not equal to 0x82 or OxAC the device is recognized as being empty and the bootloader remains active and waits for host commands without timeouts Condition 2 the host checks if the bootloader option bytes two bytes are set to enable the bootloader or not The bootloader is enabled with a value of Ox55AA and disabled by all other values see the device datasheets for the bootloader option byte locations If the option bytes are enabled the bootloader
10. box in Figure 17 and Figure 23 is replaced with a polling loop until the ACK or NACK answer is received Modified erase write RAM routines for SPI polling support are provided with STM8A S 32 Kbyte devices STM8L devices natively support RAM routines with a BUSY status reply Figure 35 Delay elimination in modified RAM routines received 17218 Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 PC software support Appendix D PC software support To support the bootloader STMicroelectronics provides a PC demo application known as Flash loader demonstrator which allows the user to upload firmware into the STM8 device through the UART interface RS232 on PC side The software runs under Microsoft Windows and can be downloaded from www st com With this software any firmware stored in an 579 file can be uploaded to an STM8A L S device It also performs verification of the uploaded firmware and automatic erasing Figure 36 Flash loader demonstrator software Flash Loader Demonstrator Select the communication port and set settings then click next to open jection Common for all families 1 UART Port Name ow Parity ve BaudRate 115200 v Echo Disabled Data Bits Timeout s 1 Erase Download to device Download from file C Erase necessary pages Erase Global Erase sno Jump to the u
11. 0x00 A000 gt 0x00 A000 gt 0x00 A000 gt 0x00 1000 gt 0x00 A3FF 0x00 A3FF 0x00 A3FF 0x00 A3FF 0x00 10FF 0x09 0x00 A400 gt 0x00 A400 gt 0x00 A400 gt 0x00 A400 gt 0x00 A7FF 0x00 A7FF 0x00 A7FF 0x00 A7FF 0x00 A800 gt 0x00 A800 gt 0x00 A800 gt 0x00 A800 gt 0x00 ABFF 0x00 ABFF 0x00 ABFF 0x00 ABFF 0x00 gt 0x00 ACOO gt 0x00 ACOO gt 0x00 gt 0x00 AFFF 0x00 AFFF 0x00 AFFF 0x00 AFFF OxOC 0x00 000 gt 0x00 000 gt 0x00 B000 gt 0x00 B000 gt 0x00 B3FF 0x00 B3FF 0x00 B3FF 0x00 B3FF 0x00 B400 gt 0x00 B400 gt 0x00 B400 gt 0x00 B400 gt 0x00 B7FF 0x00 B7FF 0x00 B7FF 0x00 B7FF OxOE 0x00 B800 gt 0x00 B800 gt 0x00 B800 gt 0x00 B800 gt 0x00 BBFF 0x00 BBFF 0x00 BBFF 0x00 BBFF OxOF 0x00 00 gt 0x00 gt 0x00 BCOO gt 0x00 gt 0x00 BFFF 0x00 BFFF 0x00 BFFF 0x00 BFFF 0 10 0x00 gt 0x00 gt 0x00 000 gt 0x00 C000 gt 0x00 C3FF 0x00 C3FF 0x00 C3FF 0x00 C3FF 0x11 0x00 C400 gt 0x00 C400 gt 0x00 C400 gt 0x00 C400 gt 0x00 C7FF 0x00 C7FF 0x00 C7FF 0x00 C7FF 0x12 0x00 C800 gt 0x00 C800 gt 0x00 C800 gt 0x00 C800 gt 0x00 CBFF 0x00 CBFF 0x00 CBFF 0x00 CBFF 50 70 Doc ID 14798 Rev 5 ky www BDTIC com ST UM0560 Bootloader command set Table 9 STM8 sector codes continued Sector Flash p
12. The host sends the bytes as follows Byte 1 Byte 2 Byte 3 token Bytes 4 to 7 Byte 8 Byte 9 token 0x21 Command ID OxDE Complement OxXY host waits for ACK NACK The start address 32 bit address Byte 4 MSB Byte 7 LSB Checksum XOR byte 4 byte 5 byte 6 and byte 7 OxXY host waits for or NACK Doc ID 14798 Rev 5 47 70 www BDTIC com ST Bootloader command set UMO560 48 70 Figure 32 Go command via SPI device side Start go command Received bytes No 21h DEh Send ACK byte Receive the start address 4 bytes and checksum Address valid and checksum ok Send NACK byte Send ACK byte Remove EM and WM routines from the RAM Jump to address End of go 15042 Doc ID 14798 Rev 5 www BDTIC com ST 0 0560 Bootloader command set 4 6 3 3 Go command Figure 33 Go command CAN host side Start go command Send go message std ID 21h Wait for ACK or NACK End of go 1 See product datasheets for valid addresses 15019 The host sends the bytes as follows Go command message Std ID 0x21 DLC 0x04 data MSB OxYY LSB Figure 34 Go command CAN device side Start go command Received message with std ID 21h and with a valid address Send NACK message Send ACK messa
13. continued Sector code 0x77 Flash program memory data EEPROM STM8A S 128K STM8A S 32K STM8L 32K STM8L 64k STM8L 8k 0x02 5C00 gt 0x02 5FFF 0x78 0x02 6000 gt 0x02 63FF 0x79 0x02 6400 gt 0x02 67FF Ox7A 0 0 26800 gt 0x0 26BFF Ox7B 0x02 6 00 gt 0 0 26FFF 0 7 0 02 7000 gt 0 02 73FF 0 70 0 02 7400 gt 0 02 77FF Ox7E 0x02 7800 gt 0x02 7BFF Ox7F 0x02 7 00 gt 0x02 7FFF 0x80 0x00 4000 gt 0x00 43FF 0x81 0x00 4400 gt 0x00 47FF 4 8 Note 56 70 Software model STM8A L S The boot code has been designed with the same logical protocol for exchanging command frames between host and any STMBL S device The boot code can download up to 128 bytes at a time Bootloader variables occupy the RAM from address 0x00 0000 up to address 0x00 009F If the bootloader is enabled according to Table 4 and timeouts have elapsed there is no host activation or jump to the user application the RAM content can be modified by the bootloader For example if the user application is running and a reset occurs the RAM content in a given range is changed by the bootloader before the application restarts If the bootloader is disabled by using an option byte or ROP protection the following minor modifications of the user application are needed e STMBL devices and latest STM8A S bootloader vers
14. ky Doc ID 14798 Rev 5 59 70 www BDTIC com ST How to upload ROP protected device UM0560 Appendix How to upload ROP protected device A 1 60 70 The readout protection ROP feature prevents the device memory content being read through the SWIM interface During its initialization the bootloader checks the ROP state by checking the ROP option byte and if it is enabled the bootloader is not activated This prevents the memory content being read through the bootloader or a Trojan horse being written and executed However in practice the user may need to have the ROP protection enabled and still be able to upload new firmware through IAP in application programming This can be done via a user application and bootloader interaction subject to the following rules Rules for upgrading ROP protected devices 1 The device must be ROP protected to disable reading through the SWIM 2 The bootloader is not activated after reset due to the check on the ROP state to disable reading through the bootloader 3 user application is responsible for enabling a device update after user authentication for example after a user password check 4 user application then allows the authenticated user to invoke the bootloader by jumping to a bootloader specific address The bootloader can then update the user application in the normal way Following the above rules the user application can be updated by the residen
15. own bootloader code and save it in the UBC program area refer to STM8S and STM8A families reference manual for information on the UBC area Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 Bootloader introduction Table 2 STM8 subfamilies without bootloader STM8 group STM8 part numbers STM8A S 8K STM8Sx03xx STM8L 8K STM8L101xx 2 1 Bootloader activation The STMB8 hardware reset vector is located at the beginning of the boot ROM 0x00 6000 while the other interrupt vectors are in the Flash program memory starting at address 0x00 8004 The device executes the boot ROM jumps inside the boot ROM area and after checking certain address locations see Table 4 Initial checking on page 10 it starts to execute the bootloader or the user code defined by the reset vector 0x00 8000 The bootloader activation flowchart is described in Figure 1 Bootloader activation flow chart In previous bootloader versions a return to the wait for SYNCHR state see dashed line in Figure 1 was performed when the Flash virgin test was positive In newer versions it has been replaced by a software SW reset to prevent the customer firmware from remaining in a infinite loop e g due to EMC disturbance This bootloader modification is referred to as EMC lockup protection in Table 15 Table 3 lists the bootloader versions for which the dashed line was replaced by a SW reset The bootloader version number of a given device is o
16. reply mode settings Settings are e Data frame 1 start bit 8 data bit no parity bit 1 stop bit e Baudrate The baud rate is automatically detected by the bootloader When the user sends the synchronization byte Ox7F the bootloader automatically detects the baud rate and sets the UARTs to the same baud rate Maximum baud rate 550 kbps 115200 baud for STM8L 64K minimum baud rate 4800 bps To perform automatic speed detection the RxD line must be stable in the application board internal pull up is enabled on the RxD line by the bootloader Doc ID 14798 Rev 5 11 70 www BDTIC com ST Peripheral settings UMO560 3 2 Note 12 70 1 Reply mode The host must reply to all the bytes sent from the bootloader If TxD and RxD lines share the same physical medium for example 1 wire communication then host replies are not necessary since RxD and TxD pins coincide SPI settings The SPI settings are 8 data bit MSB first Bit rate Set by the host which acts as a master Peripheral set in slave mode with software management of NSS Data polarity CPOL 0 SCK to 0 when idle CPHA 0 the first clock transition is the first data capture edge Before sending a token byte the host has to wait for a delay of a specified period of time If this period is not quantified it is equal to 6 us The SPI peripheral is accessible via SPI SCK SPI MOSI and SPI MISO pins Doc ID 14798 Rev 5 ky www BD
17. 0x02 DLC 1 data bootloader version 0 lt version lt 255 Message 4 Std ID 0x02 DLC 1 data 0x00 Message 5 Std ID 0x02 DLC 1 data 0x03 Message 6 Std ID 0x02 DLC 1 data 0x11 Message 7 Std ID 0x02 DLC 1 data 0x21 Message 8 Std ID 0x02 DLC 1 data 0x31 Message 9 Std ID 0x02 DLC 1 data 0x43 Message 10 Std ID 0x02 DLC 1 data ACK Doc ID 14798 Rev 5 Get command Speed command Read memory command Go command Write memory command Erase memory command www BDTIC com ST 0 0560 Bootloader command set 4 2 Read memory command The read memory command is used to read the memory RAM Flash program memory data EEPROM or registers When the bootloader receives the read memory it transmits the needed data N 1 bytes to the host starting from the received address 4 2 1 Read memory command via USART LINUART UART1 UART2 UART3 Figure 9 Read memory command via USART LINUART UART1 UART2 UARTS host side ait for AC or NACK Send the start address 4 bytes with checksum Send the number of bytes to be read 1 byte and a checksum 1 byte ai15005 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheets If the bootloader receives an invalid address an error occurs see Table 10 Error table on page 58 ky Doc ID 14798 Rev 5 21 70 www BDTIC c
18. be received 1 N 0 127 If gt 127 a cmd error occurs in the bootloader N 1 bytes Max 128 data bytes Checksum byte N N 1 data bytes Important before sending the token byte the host must wait for the bootloader to finish writing all data into the memory See previous delay or polling description Last byte token OXXY host waits for ACK or NACK Doc ID 14798 Rev 5 39 70 www BDTIC com ST Bootloader command set 0 0560 40 70 Figure 24 Write memory command via SPI device side Start write memory eceived byte 31h CEh Send ACK byte Receive the start address 4 bytes and checksum Address valid and Yes Send ACK byte Receive the number of bytes to be written 1 byte the data N 1 byte and the checksum Write the received data to RAM starting from the 00h location Flash data EEPROM address Yes Write the received data to the memory from the startaddress Write the received data to RAM from the start address Yes Send NACK byte Send ACK byte End of write memory ai15040 1 Write the received data to RAM from the start address is performed in RAM The user therefore has to download the write routine in RAM before sending a write command Note that for some bootloader versions this is not necessary see 4 8 1 RAM erase write routines 3 Doc ID 147
19. case of total erase See also Appendix C SPI peripheral timing options Doc ID 14798 Rev 5 www BDTIC com ST Bootloader command set 0 0560 The host sends the bytes as follows Byte 1 0x43 Command ID Byte 2 OxBC Complement Byte 3 token OxXY host waits for ACK Byte 4 or number of sectors to be erased 0 lt N lt 32 gt 32 a cmd_error occurs Byte 5 or N 1 bytes 0x00 or N 1 bytes and then checksum XOR N N 1 data bytes Last byte token OxXY host waits for ACK NACK Figure 18 Erase memory command via SPI device side Start erase memory Received bytes N No 43h BCh Yes Send ACK byte Receive the number of sectors to be erased 1 byte Yes Fh received No Receive the sector codes Receive the checksum 00h received No Start total erase Erase the corresponding sectors gt Send ACK byte Send NACK byte End of erase memory ai15038 1 Erase the corresponding sectors routine is performed in RAM The user therefore has to download the erase routine in RAM before sending an erase command Note that for some bootloader versions this is not necessary see 4 8 1 RAM erase write routines Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 Bootloader command set 4 3 3 Erase memory command via CAN Figure 19 Erase memory command via CAN host side Star
20. command via USART LINUART UART1 UART2 UARTS host side Send 00h FFh Wait for ACK or NACK ACK Receive 1 byte Number of bytes version commands Receive 1 byte Bootloader version Receive 5 bytes Supported commands Wait for ACK or NACK ai15003 End of get command The host sends the bytes as follows Byte 1 0x00 Command ID Byte 2 OxFF Complement Doc ID 14798 Rev 5 15 70 www BDTIC com ST Bootloader command set UMO560 Figure 4 Get command via USART LINUART UART1 UART2 UARTS device side Start get command Received byte 00h FFh Send ACK byte Send 1 byte Number of bytes version commands Send 1 byte Bootloader version Send 5 bytes Supported commands Send ACK byte Send NACK byte End of get command ai15004 The 5 8 sends the bytes as follows Byte 1 ACK after the host has sent the command Byte 2 N 5 the number of bytes to be sent 1 1 lt N 1 lt 256 Byte 3 Bootloader version 0 lt version lt 255 Byte 4 0x00 Get command Byte 5 0x11 Read memory command Byte 6 0x21 Go command Byte 7 0x31 Write memory command Byte 8 0x43 Erase memory command Byte 9 ACK 16 70 Doc ID 14798 Rev 5 www BDTIC com ST 0 0560 Bootloader command set 4 1 2 4 Get command via SPI Figure 5 Get command via SPI host side Star
21. memory sector by sector according to data contained in the message field is performed in RAM The user therefore has to download the erase routine in RAM before sending an erase command Note that for some bootloader versions this is not necessary see 4 8 1 RAM erase write routines 15012 34 70 Doc ID 14798 Rev 5 www BDTIC com ST UMO560 Bootloader command set 4 4 Write memory command The write memory command allows the host to write data into any memory address RAM Flash program memory data EEPROM or registers starting from the received address Incoming data are always written in RAM before being loaded in the memory locations decided by the host The bootloader then checks whether the host wants to write in RAM or in the Flash program memory data EEPROM The maximum length of the block to be written for the STMB8 is 128 data bytes To write the data in the Flash program memory data EEPROM locations the bootloader performs two different write operations 1 WordWrite FastWordWrite Writes a byte in the Flash program memory data EEPROM It is used when the number of bytes N sent from the host is less than 128 In this case the bootloader performs the operation N times 2 BlockWrite Writes a block in the Flash program memory data EEPROM It is used when the number of bytes N sent from the host is 128 and the destination address is an integer module of 128 In other words to use this operatio
22. remains active and waits for host commands with a 1 second timeout If the host does not send a command within this timeout the bootloader jumps directly to the application user vector jump to address 0x00 8000 Condition 3 If the option bytes disable the bootloader by a value different from the bootloader jumps directly to the application user vector jump to address 0x00 8000 The above checking process is summarized in Table 4 When readout protection ROP is active the Flash program memory is readout protected In this case the bootloader stops and the user application starts If ROP is inactive the bootloader continues to be executed see Appendix A How to upload HOP protected device The CAN peripheral can only be used if an external clock 8 MHz 16 MHz or 24 MHz is present It is initialized at 125 kbps The UARTs and SPI peripherals do not require an external clock Set the high speed internal RC oscillator HSI to 16 MHz and initialize the UARTs receiver pins in input pull up mode in the GPIO registers Initialize the SPI in slave mode Then wait 4 ms for I O pin voltage level stabilization It is recommended that the host waits 10 ms from the reset before sending the SYNCHR byte message This is the time needed for bootloader initialization Doc ID 14798 Rev 5 9 70 www BDTIC com ST Bootloader introduction 0 0560 Note Note Note 10 70 6 Interface polling The boot
23. supports it Doc ID 14798 Rev 5 3 www BDTIC com ST 0 0560 Bootloader command set The delay is calculated according to Equation 1 Equation 1 Delay 8 45 Where n is the number of write cycles number of bytes or number of blocks see Table 8 Table 8 Examples of delay Write command Delay ms 128 bytes aligned with a memory block 8 45 128 bytes not aligned with a memory block 1082 1 byte 8 45 10 bytes 84 5 In SPI mode if the device supports sending a BUSY flag during Flash EEPROM memory programming the delay can be replaced by polling the device status a set of token bytes are sent to the device During programming the device sends the BUSY flag OxAA through SPI When the programming is finished the device sends an ACK NACK answer to indicate if the programming was correct or has failed Currently such polling is allowed only for STM8A S 32K devices with modified RAM routines see Appendix C SPI peripheral timing options On STM8L 8K and STM8L 64K devices the BUSY flag is sent through the SPI interface The host sends the bytes as follows Byte 1 0x31 Command ID Byte 2 OxCE Complement Byte 3 token XY host waits for ACK or NACK Bytes 4 to 7 The start address 32 bit address Byte 4 MSB Byte 7 LSB Byte 8 Checksum XOR byte 4 byte 5 byte 6 and byte 7 Byte 9 token XY host waits for ACK or NACK Byte 10 The number of data bytes to
24. 0 4 2 3 26 70 Read memory command via The CAN message sent by the host is as follows e The ID contains the command type 0x11 e The data field contains a destination address 4 bytes byte 1 is the MSB and byte 4 is LSB of the address and the number of bytes N to be read Figure 13 Read memory command via CAN host side Start read memory Send read message std ID 11h Wait for ACK or NACK ACK Receive N 1 messages from bootloader End of read memory ai15008 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheets If the bootloader receives an invalid address an error occurs see Table 10 Error table on page 58 The host sends the messages as follows Command message Std ID 0x11 DLC 0x05 data MSB OxXX OxYY LSB N where 0 lt lt 255 Figure 14 Read memory command CAN device side Start read memory Received message with std ID 11h es Send ACK message Y Send NACK message Send N 1 messages to the host End of read memory 4 ai15008 Doc ID 14798 Rev 5 ky www BDTIC com ST UMO560 Bootloader command set Note 4 3 The STM8 sends the messages as follows ACK message Std ID 0x02 DLC 1 data ACK Data message 1 Std ID 0x02 DLC 1 data OxXX Data message 2 Std I
25. 1 70 www BDTIC com ST Bootloader command set UMO560 42 70 Figure 26 Write memory command via CAN device side Start write memory Received message No with std ID 31h Start address and number of bytes N Send ACK message Receive the data messages and 3 If a message is corrupted temporarily write the data to RAM starting from the 00h location Receive the checksum message Address in Flash data EEPROM No Write the received data to RAM from the start address ee 2 Write the received data to the Send ACK message End of write memory memory from the start address Send NACK message ai15016 1 Write the received data to the Flash program memory data EEPROM from the start address is performed in RAM The user therefore has to download the write routine in RAM before sending a write command Note that for some bootloader versions this is not necessary see 4 8 1 RAM erase write routines Doc ID 14798 Rev 5 www BDTIC com ST UMO560 Bootloader command set 4 5 4 5 1 Speed command The speed command allows the baud rate for CAN runtime to be changed It can be used only if the CAN is the peripheral being used Speed command via CAN Figure 27 Speed command via CAN host side Start speed command Send speed message std ID 03h Wait for ACK or NACK ACK
26. 9 1 Total erase erases program and data EEPROM The bootloader erases the memory sector by sector 2 Asectoris 1 Kbyte for all devices Therefore the granularity of the erase command 8 blocks To erase one byte the write command can be used by writing 0x00 Warning If the host sends an erase command that includes some correct sector code and one or more forbidden sector codes see Table 9 STM8 sector codes the command fails 3 Doc ID 14798 Rev 5 www BDTIC com ST UMO560 Bootloader command set Note The host sends the bytes as follows Byte 1 0x43 Command ID Byte 2 OxBC Complement Byte 3 OxFF or number of sectors to be erased 0 lt N lt M if N M a cmd error occurs in the bootloader after which the bootloader receives N 1 data bytes and the checksum i e the host completes the command N is product dependent M size of the Flash program memory in Kbyte 4 size of data EEPROM in Kbyte 1 Example STM8S 128K M 129 because Flash program memory is 128 Kbytes and data EEPROM is 2 Kbytes 128 2 1 Example STM8S 32K 32 because Flash program memory is 32 Kbytes and data EEPROM is 1 Kbyte 32 4 1 1 Byte 4 or N 1 bytes 0x00 or N 1 bytes and then checksum XOR N N 1 data bytes Doc ID 14798 Rev 5 29 70 www BDTIC com ST Bootloader command set 0 0560 Figure 16 Erase memory command via USART LINUART UART1 UART2 UARTS device side S
27. 98 Rev 5 www BDTIC com ST UM0560 Bootloader command set 4 4 3 Write memory command via CAN Figure 25 Write memory command via CAN host side Send write message std ID 31h Wait for ACK SNACK or NACK If NACK message received Send the data messages At same time the host checks whether it received a NACK message from the STM8 Send message with checksum Wait for ACK or NACK End of write memory ai15015 1 See product datasheets for valid addresses If the bootloader receives an invalid address an add_error occurs see Table 10 Error table on page 58 The host sends the messages as follows Command message Std ID 0x31 DLC 0x05 data MSB OxXX OxYY LSB N 0 127 number of data bytes 1 If N gt 127 a cmd error occurs in the bootloader Data message_1 Std ID 0x04 DLC_1 1 to 8 data byte_11 byte_18 Data message_2 Std ID 0x04 DLC_2 1 to 8 data byte_21 byte_28 Data message_3 Std ID 0x04 DLC_3 1 to 8 data byte_31 byte_38 Data message M Std ID 0x04 DLC M 1 to 8 data byte m1 byte M8 Checksum message Std ID 0x04 DLC 1 data XOR N N 1 data bytes Note 1 14 DLC 2 M 128 maximum 2 The bootloader does not check the standard ID of the data and checksum messages Therefore an ID from 0x00 to OxFF can be used It is recommended to use 0x04 ky Doc ID 14798 Rev 5 4
28. D 0x02 DLC 1 data OxXX Data message N 1 Std ID 0x02 DLC 1 data OxXX The bootloader sends as many data messages as bytes which can be read Erase memory command The erase memory command allows the host to erase sectors of the Flash program memory data EEPROM The bootloader receives the erase command message when the ID contains the command type 0x43 and the data field contains the sectors to be erased see Table 9 STM8 sector codes on page 50 A sector size is 1 Kbyte therefore the granularity with the erase command is eight blocks 1 block 128 bytes If the host wants to erase one byte only the write command write 0x00 can be used Erase memory command description 1 The bootloader receives one byte which contains the number N of sectors to be erased N is device dependent 2 Then the bootloader receives N 1 bytes where each byte contains a sector code see Table 9 STM8 sector codes on page 50 Doc ID 14798 Rev 5 27 70 www BDTIC com ST Bootloader command set 0 0560 4 3 1 28 70 Erase memory command via USART LINUART UART1 UART2 UART3 Figure 15 Erase memory command via USART LINUART UART1 UART2 UARTS host side Start erase memory Send 43h BCh ait for AC NACK or NACK Total erase Send FFh Send the number of sectors to be erased 1 byte Send the sector codes Send 00h Send checksum End of erase memory ai1500
29. Erase memory command Byte 9 ACK 18 70 Doc ID 14798 Rev 5 ky www BDTIC com ST UM0560 Bootloader command set 4 1 3 4 Get command Figure 7 Get command CAN host side Send message with std ID 00h ACK Receive 1 message number of bytes version commands Receive 1 message Bootloader version Receive 1 message Get command Receive 1 message Speed command Receive 1 message Read command Receive 1 message Go command Receive 1 message Write command Receive 1 message Erase command for AC or NACK End of get command ai15029 Doc ID 14798 Rev 5 19 70 www BDTIC com ST Bootloader command set 0 0560 20 70 The host sends the messages as follows Command message Std ID 0x00 data length code DLC not important Figure 8 Get command via CAN device side Start get command Received message with ID 00h Yes Send ACK message Send 1 message Number of bytes version commands Send ACK message Send 1 message Bootloader version Send 6 messages Supported commands Send NACK message End of get command ai15030 The STM8 sends the messages as follows Message 1 Std ID 0x02 DLC 1 data ACK Message 2 Std ID 0x02 DLC 1 data N 6 the number of bytes to be sent 1 1 lt 1 lt 256 Message 3 Std ID
30. FBFF 0x00 FBFF E 0x00 gt 0x00 0 gt 0x00 00 gt 0x00 0 gt 0x00 FFFF 0x00 FFFF 0x00 FFFF 0x00 FFFF 0x01 0000 gt 0x00 4000 gt 0x00 1000 gt 0x01 0000 gt 0x01 03FF 0x00 43FF 0x00 13FF 0x01 03FF 0 01 0400 gt 0 01 0400 gt 0x1 O7FF 0 1 07 0x01 0800 gt 0x01 0800 gt 0x01 OBFF 0x01 OBFF 0x01 0 00 gt 0x01 0 00 gt 0x01 OFFF 0x01 OFFF s 0 01 1000 gt 0 01 1000 gt 0x01 13FF 0x01 13FF 0 01 1400 gt 0x01 1400 gt 0x01 17FF 0x01 17FF 0 01 1800 gt 0 01 1800 gt 0x01 1BFF 0x01 1BFF ky Doc ID 14798 Rev 5 51 70 www BDTIC com ST Bootloader command set 0 0560 Table 9 STM8 sector codes continued Sector Flash program memory data EEPROM code STM8A S 128K STM8A S 32K STM8L 32K STM8L 64k STM8L 8k nas 0x01 1C00 gt 0x01 1C00 gt 0x01 1FFF 0x01 1FFF nm 0x01 2000 gt 0x01 2000 gt 0x01 23FF 0x01 23FF 0x01 2400 gt 0 01 2400 gt 0x01 27FF 0x01 27FF 0 01 2800 gt 0 01 2800 gt 0 01 2 0 01 2 0x01 2600 gt 0x01 2C00 gt 0x01 2FFF 0x01 2FFF 0 01 3000 gt 0 01 3000 gt 0 01 0 01 Son 0x01 3400 gt 0x01 3400 gt 0x01 37FF 0x01 37FF 0x01 3800 gt 0x01 3800 gt 0x01 3BFF 0x01 3BFF DE 0x01 3C00 gt 0x01 3C00 gt 0x01 SFFF 0x01 3FFF itn 0
31. SART LINUART UART1 UART2 UARTS device side 22 Read memory command via SPI host side 23 Read memory command via SPI device 5 25 Read memory command via CAN host side 26 Read memory command CAN device 26 Erase memory command USART LINUART UART1 UART2 UARTS host side 28 Erase memory command via USART LINUART UART 1 UART2 UARTS device side 30 Erase memory command via SPI 31 Erase memory command via SPI device side 32 Erase memory command CAN host side 33 Erase memory command CAN device side 34 Write memory command via USART LINUART UART1 UART2 UARTS host side 36 Write memory command via USART LINUART UART 1 UART2 UARTS device side 37 Write memory command via SPI 38 Write memory command via SPI device 40 Write memory command via CAN 41 Write memory command via CAN device 5 ee 42 Speed command via CAN 43 Speed command CAN device
32. ST UMO560 Peripheral settings 3 Note 3 1 Peripheral settings This section describes the hardware settings of the STM8 communication peripherals e UARTS LINUART e SPI e CAN During bootloading only one peripheral first addressed is enabled All others are disabled Table5 Serial interfaces associated with STM8 devices STM8 groups Serial interface 8 128 USART LINUART in reply mode STM8A 32K LINUART SPI 5 85 128 UART1 UARTS in reply mode STM8S 32K UART2 in reply mode SPI STM8L 8K UART SPI STM8L 32K UART UART1 UART2 UARTS in reply mode SPI1 SPI2 1 The above table reflects only current bootloader versions and device states STM8L 64K USART UARTS settings This peripheral supports asynchronous serial communication The USART UARTS settings are e Data frame 1 start bit 8 data bit 1 parity bit set to even 1 stop bit e Baudrate The baud rate is automatically detected by the bootloader When the user sends the synchronization byte Ox7F the bootloader automatically detects the baud rate and sets the USART UARTS to the same baud rate Maximum baud rate 1 Mbps 115200 baud for STM8L 64K minimum baud rate 4800 bps To perform the automatic speed detection the RxD line must be stable in the application board internal pull up is enabled on the RxD line by the bootloader LINUART UARTS in
33. Send the start address 4 bytes and checksum Wait for ACK or NACK ai15017 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheets If the bootloader receives an invalid address an add error occurs see Table 10 Error table on page 58 The host sends the bytes as follows Byte 1 0x21 Command ID Byte 2 OxDE Complement Bytes 3 6 The start address 32 bit address Byte 3 MSB Byte 6 LSB Byte 7 Checksum XOR byte 3 byte 4 byte 5 byte 6 ky Doc ID 14798 Rev 5 45 70 www BDTIC com ST Bootloader command set UMO560 Figure 30 Go command USART LINUART UART1 UART2 UARTS device side Received bytes No 21h DEh Yes Send ACK byte Receive the start address 4 bytes and checksum Send NACK byte End of Go ai15018b Send ACK byte 46 70 Doc ID 14798 Rev 5 www BDTIC com ST 0 0560 Bootloader command set 4 6 2 Go command via SPI Figure 31 Go command via SPI host side Send 21h DEh Send token byte ACK Send the start address 4 bytes and checksum Send token byte Wait for ACK or NACK End of Go ai15041 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheets If the bootloader receives an invalid address an add error occurs see Table 10 Error table on page 56
34. TIC com ST 0 0560 Peripheral settings 3 3 CAN settings To address additional devices on the same bus the CAN protocol provides a standard identifier field 11 bit and an optional extended identifier field 18 bit in the frame Figure 2 shows the CAN frame that uses the standard identifier only Figure 2 frame Inter frame space Inter frame space Data frame standard identifier or overload frame 44 8 Control field ACK field Arbitration field Data field CRC field x 9 5 3115001 The CAN settings are as follows e Standard identifier not extended e Bitrate By default it is 125 kbps The runtime can be changed via the speed command to achieve a maximum bitrate of 1 Mbps The transmit settings from the STM8 to the host are e Tx mailbox0 On e Tx mailbox1 and Tx mailbox2 Off e Tx identifier 0x02 Outgoing messages contain 1 data byte The receive settings from the host to the 8 are e The synchronization byte Ox7F is in the RX identifier and not in the data field e The RX identifier depends on the command 0x00 0x03 0x11 0x21 0x31 0x43 e Error checking If the error field bit 6 4 in the CESR register is different from 000 the message is discarded and a NACK is sent to the host e In FIFO overrun condition the message is discarded and a NACK is sent to the host e Incoming messages can contain from 1 to 8 data bytes Note The CAN peripheral is accessible
35. ble 5 Serial interfaces associated with STM8 devices added devices which have no bootloader Section 3 3 CAN settings replaced the transmit and receive settings from the STMB8L S to the 5 85 4 8 1 RAM erase write routines removed sentence this is necessary because the routines are consecutive with no empty memory locations between them Section 5 Error management added new explanatory text Section 6 Programming time replaced note 68 70 3 Doc ID 14798 Rev 5 www BDTIC com ST UM0560 Revision history 4 Table 16 Document revision history continued Date 17 Mar 2011 Revision Changes Changed hexadecimal notation for bytes and addresses Removed external crystal frequency condition of 16 MHz for CAN transfer rate transfer rate in the Replaced device part numbers par 5 8 groups Added Table 1 STM8 subfamilies featuring a bootloader and Table 2 STM8 subfamilies without bootloader in Section 2 Bootloader introduction Updated Table 3 Bootloader versions for which bootloader activation flowchart is valid to replace device by STM8 groups STMB8L 8K In Section 2 1 Bootloader activation removed important note concerning STM8L15xxx devices and clarified differences between previous and newer bootloader Updated Table 5 Serial interfaces associated with STM8 devices Added STM8L 8K and STM8L 64K in Table 9 STM8 sector codes Updated RAM erase write
36. btained by the Get command see Section 4 1 Get command The bootloader version is represented by a two digit binary coded decimal BCD number with a decimal point between the two digits which is coded into one byte in the Get command result For example 0x21 version byte is bootloader version 2 1 Table 3 Bootloader versions for which bootloader activation flowchart is valid STM8 group Bootloader version STMBA S 128K v2 2 STMB8A S 32K v1 3 STM8L 64K v1 0 STM8L 32K v1 2 STM8L 8K v1 0 Doc ID 14798 Rev 5 7 70 www BDTIC com ST Bootloader introduction UM0560 Figure 1 Bootloader activation flow chart ROM reset 6000h 1 Disable all interrupt sources 2 3rd condition verified 15 condition verified Checks according to table 1 see note 2 219 condition verified Yes memory readout protected Is ROP active No memory not readout protected Ye s an external clock present k i 2 No CAN at bps Initializes 125 Configure HSI and initialize RxD UART pins in GPIO mode pull up state Configure SPI in slave mode Received a byte message SYNCHR Timeout 1 Wait for SYNCHR SYNCHR received 7 Send ACK byte and disable unused peripherals 6 SYNCHR failed Yes Wait for a command 6 Recover the registers reset status Command received GO cmd GET cmd RM cmd EMemd WMcmd 0
37. cx pa RC HC UR d ao iod 12 3 3 CAN settings 13 4 Bootloader command 14 4 1 aet command aus xe Rx Rx RA Ge de ARR cd 15 4 1 1 Get command via USART LINUART UART1 UART2 UART3 15 4 1 2 Get command SPI 17 4 1 3 Get command 19 4 2 Read memory command 21 4 2 1 Read memory command via USART LINUART UART1 UART2 UARTS 21 4 2 2 Read memory command via 23 4 2 3 Read memory command via CAN 26 4 3 Erase memory command 27 4 3 1 Erase memory command via USART LINUART UART 1 UART2 WARTS ex epe e dear Nas 28 4 3 2 Erase memory command via SPI 31 4 3 3 Erase memory command 33 4 4 Write memory command 35 4 4 1 Write memory command via USART LINUART UART1 UART2 UART3 36 4 4 2 Write memory command via 38 4 4 3 Write memory command via CAN 41 45 Speedcommand 43 4 5 1 Speed command via CAN 43 4 6 GO commandi
38. d any warranty granted by ST for the ST product or service described herein and shall not create or extend in any manner whatsoever any liability of ST ST and the ST logo are trademarks or registered trademarks of ST in various countries Information in this document supersedes and replaces all information previously supplied The ST logo is a registered trademark of STMicroelectronics All other names are the property of their respective owners 2011 STMicroelectronics All rights reserved STMicroelectronics group of companies Australia Belgium Brazil Canada China Czech Republic Finland France Germany Hong Kong India Israel Italy Japan Malaysia Malta Morocco Philippines Singapore Spain Sweden Switzerland United Kingdom United States of America www st com 70 70 Doc ID 14798 Rev 5 ky www BDTIC com ST
39. der UART limitation E 2 between master and bootloader fails due to indifferent baudrates and the bootloader enters an endless loop waiting for valid master command This state can only be exited by resetting the STMB8 device The master must consequently send 0x7F after reset to launch the bootloader correctly or must sent nothing during 1 second after reset to avoid launching the bootloader and continue executing the user application Any another byte sent to the bootloader up to 1 second after reset causes the bootloader to enter an endless loop This situation may occur in user application if the STM8 device is reset and huge data transfers are in progress through the UART interface The device then enters an endless loop due to several synchronization byte reception Workaround for UART limitation The issue described above can be fixed by using the workaround below This workaround consists in modifying your application code and the device configuration It is recommended if your application is subject to enter an endless loop when starting UART communications The following steps are required 1 Disable the bootloader by using the option bytes disabled on virgin devices 2 Insert your application code a routine that invokes the bootloader when a firmware upgrade is required e g your code jumps to given bootloader entry point after pressing a button see Appendix B Bootloader entry points for details on entry point ad
40. dresses As a result the bootloader is not active after reset and will not enter an endless loop when receiving random UART bytes After reset the bootloader executes the application code without any delay which is also a benefit for your application If an upgrade of the application code is required follow the sequence below 1 Press the button so that the code invokes the bootloader and jumps to a given bootloader entry point You must make sure that a master device is connected to the UART interface and no random byte is sent 2 Run the master to upgrade the code through the standard ROM bootloader 3 Reset the device when the upgrade is complete Invoking the bootloader by pressing a button can be replaced by any similar action e g receiving a specific command or an authentication password to launch an upgrade of the application code only authenticated person can upgrade The programming operation might crash during code upgrade for example when powering off the device In this case the bootloader cannot be entered again because the application code was not properly upgraded and is invalid To prevent this issue from occurring it is recommended that the master executes the following steps before entering the bootloader 1 Enable the ROM bootloader through the option bytes before downloading the application code into device 2 Download the application code and verify it 3 Disable again the ROM bootloader by using the op
41. e from the previous polling So the host has no way of knowing if the received byte is the correct new answer or the byte from the previous answer In practice if the host asks the device to complete an ongoing erase or write command ACK or NACK from the device after the operation is finished it knows that the device is not busy and has finished operations So the host must add an appropriate minimum delay to allow the device to finish an operation see the Delay box in Figure 17 and Figure 23 Otherwise the answer is meaningless and communication is desynchronized This behavior is specific only to host driven interfaces such as the SPI Other interfaces used by the bootloader including the UART and CAN are not master driven and the device can answer without host polling Modified erase write RAM routines To remove dependency from delay implementations on the host side and to speed up SPI communication because delays with a margin are longer special erase write RAM routines have been developed These RAM routines perform long time operations such as standard erase write operations During device busy state they send a BUSY byte answer to the host The host can then periodically ask the device for an answer and the device sends a BUSY answer until the operation is finished When the operation is finished the device answers with an ACK or NACK according to the operation result At this point the Delay
42. faces receives the synchronization message all others are disabled 8 Waiting for commands Commands are checked in an infinite loop and executed To exit from the bootloader the host has to send a GO command When this is done the bootloader removes the EM and WM routines from the RAM memory and jumps to the address selected by the host To be able to write erase data in Flash and EEPROM the host must write into RAM executable routines for writing and erasing Those routines s19 files are provided with the bootloader Host must upload those routines at address See section 4 8 1 RAM erase write routines for more information Table 4 Initial checking Program memory Bootloader check Checks byte location option bytes Actual 5 status 0x00 8000 BL 4st 0x00 8000 lt gt BL_OPT 0x00 Flash program memory virgin 0x82 or OxAC XXXX gt jump to bootloader Flash program memory already written and ine ME 9X00 bootloader enabled by option bytes gt jump to bootloader Flash program memory already written gn us 1 E bootloader disabled by option bytes gt jump to Flash program memory reset 1 See device datasheet for the BL_OPT location in the option byte area memory map After interface initialization the ROP bit is checked to avoid non authorized reading of the Flash program memory and data EEPROM Doc ID 14798 Rev 5 ky www BDTIC com
43. ge Jump to address End of go ai15020 Doc ID 14798 Rev 5 49 70 www BDTIC com ST Bootloader command set 0 0560 4 7 Sector codes Table 9 8 sector codes Sector Flash program memory data EEPROM code STMBA S 128K STM8A S 32K STM8L 32K STM8L 64k STMS8L 8k 0x00 0x00 8000 gt 0x00 8000 gt 0x00 8000 gt 0x00 8000 gt 0x00 8000 gt 0x00 83FF 0x00 83FF 0x00 83FF 0x00 83FF 0x00 83FF 0x01 0x00 8400 gt 0x00 8400 gt 0x00 8400 gt 0x00 8400 gt 0x00 8400 gt 0x00 87FF 0x00 87FF 0x00 87FF 0x00 87FF 0x00 87FF 0x02 0x00 8800 gt 0x00 8800 gt 0x00 8800 gt 0x00 8800 gt 0x00 8800 gt 0x00 8BFF 0x00 8BFF 0x00 8BFF 0x00 8BFF 0x00 8BFF 0x03 0x00 8C00 gt 0x00 8C00 gt 0x00 8C00 gt 0x00 8C00 gt 0x00 8C00 gt 0x00 8FFF 0x00 8FFF 0x00 8FFF 0x00 8FFF 0x00 8FFF 0x04 0x00 9000 gt 0x00 9000 gt 0x00 9000 gt 0x00 9000 gt 0x00 9000 gt 0x00 93FF 0x00 93FF 0x00 93FF 0x00 93FF 0x00 93FF 0x05 0x00 9400 gt 0x00 9400 gt 0x00 9400 gt 0x00 9400 gt 0x00 9400 gt 0x00 97FF 0x00 97FF 0x00 97FF 0x00 97FF 0x00 97FF 0x06 0x00 9800 gt 0x00 9800 gt 0x00 9800 gt 0x00 9800 gt 0x00 9800 gt 0x00 9BFF 0x00 9BFF 0x00 9BFF 0x00 9BFF 0x00 9BFF 0x07 0x00 9C00 gt 0x00 9C00 gt 0x00 9C00 gt 0x00 9C00 gt 0x00 9C00 gt 0x00 9FFF 0x00 9FFF 0x00 9FFF 0x00 9FFF 0x00 9FFF 0x08 0x00 A000 gt
44. go the bootloader uses part of the RAM for its own variables and RAM erase write routines Therefore it is forbidden to run write commands with the exception of write commands that are used for downloading erase write routines with destination addresses in the following RAM locations e STM8MA S devices 0x00 0000 to 0x00 e STMBL devices 0x00 0000 to 0x00 O1FF ky Doc ID 14798 Rev 5 57 70 www BDTIC com ST Error management UMO560 5 58 70 Error management The bootloader performs more internal checks including valid address range in commands commands checksum and write verification The bootloader does not check the UBC area access If a write is performed to a write protected area the verification fails and the bootloader returns a NACK Table 10 describes the error type and the bootloader behavior Table 10 Error table Error cmd error Description If a denied command is received If a parity error occurs during command transmission If an error occurs during the command execution See Table 6 Bootloader commands on page 14 Bootloader actions Sends NACK byte and goes back to command checking add error If a received command contains a denied destination address For information on valid address ranges see the product datasheets for STM8A L S devices Sends NACK byte and goes back to command checking Doc ID 14798 Rev 5 www BDTIC com ST
45. h program memory data EEPROM and register addresses see product datasheets If the bootloader receives an invalid address an error occurs see Table 10 Error table on page 58 Doc ID 14798 Rev 5 23 70 www BDTIC com ST Bootloader command set 0 0560 The host sends the bytes to the STM8 as follows Byte 1 0x11 Command ID Byte 2 OxEE Complement Byte 3 token OxXY host waits for ACK or Bytes 4 to 7 The start address 32 bit address Byte 4 MSB Byte 7 LSB Byte 8 Checksum XOR byte 4 byte 5 byte 6 byte 7 Byte 9 token host waits for ACK or NACK Byte 10 The number of bytes to be read 1 0 lt lt 255 Byte 11 Checksum complement of byte 10 Byte 12 token OxXY host waits for the 15t data byte Byte 12 N token OxXY host waits for the 1 data byte 24 70 Doc ID 14798 Rev 5 ky www BDTIC com ST UMO560 Bootloader command set 3 Figure 12 Read memory command via SPI device side Start read memory Received byte Bo 11h EEh Send ACK byte Receive the start address 4 bytes with checksum Address valid amp checksum OK Yes Send ACK byte Receive the number of bytes to be read 1 byte and the checksum byte Yes Send ACK byte Send data to the host No Send NACK byte End of read memory ai15036 Doc ID 14798 Rev 5 25 70 www BDTIC com ST Bootloader command set 0 056
46. ions see Table 3 the RAM is not modified e STMB8A S devices with older bootloader versions only the content RAM address 0x00 0099 is changed to 0x01 Unused empty bootloader ROM is filled with an opcode that is not allowed 0x71 If for any reason i e EMC noise the core starts to execute in the 0x71 area an illegal opcode is Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 Bootloader command set returned and consequently a reset This prevents the bootloader falling into an infinite loop with no reset in the event that it jumps in the empty locations Thus normal execution can resume 4 8 1 RAM erase write routines RAM erase write routines are attached to this document as binary code files in S19 format The file name defines the STM8 group e g 128 Kbytes 32 Kbytes 8 Kbytes and bootloader version number for which the given routine is written To erase or program the Flash program memory or data EEPROM the respective routines must be downloaded into RAM starting at 0x00 RAM erase write routine naming example STMB8A S 128 Kbyte devices E W ROUTINEs 128K ver 2 2 519 e STM8A S 32 Kbyte devices E W ROUTINEs 32K ver 1 3 519 e STMBL devices no need to download RAM routines the routines are copied into RAM from ROM automatically when the bootloader is activated by the host after it has received a valid SYNCH byte Note To execute any of the commands get read erase write speed and
47. k is set back to its reset state when bootloader resumes Timeout for SYNCH byte receiving after reset has been changed to 1 second STM8L 8K 1 0 Rev Z Initial version Improvement EMC lock up protection 4 Doc ID 14798 Rev 5 67 70 www BDTIC com ST Revision history 0 0560 Revision history Table 16 Document revision history Date 15 Dec 2008 Revision 1 Changes Initial release 10 Nov 2009 Added STM8L15xxx device and changed title of document to STMBL S Updated point 2 of the Flow chart description Added 3 1 1 LINUART UARTS in reply mode settings Added Table 7 Bootloader codes Updated Section 4 8 Software model STM8A L S concerning modification of the RAM content Added 4 8 1 RAM erase write routines sections Added Appendix A How to upload ROP protected device Added Appendix B Bootloader entry points Added Appendix C SPI peripheral timing options Added Appendix D PC software support Edited English and rewrote several sections 24 Aug 2010 Document merged with the STM8A bootloader user manual UMO0500 and consequently every section was reworked The sections LINUART settings and Memory model STM8A were removed Additional technical changes include Updated point 5 of the Flow chart description Section 2 1 Bootloader activation added important note about CLK CKDIVR register bug on STM8L devices Ta
48. loader polls all peripherals waiting for a synchronization byte message SYNCHR 0x7F within a timeout of 1 second If a timeout occurs either the Flash program memory is virgin in which case it waits for a synchronization byte message in an infinite loop through a software reset or the Flash program memory is not virgin and the bootloader restores the registers reset status and jumps to the memory address given by the reset vector located at 0x00 8000 For the bootloader versions listed in Table 3 a software reset is generated after a timeout has elapsed in case the Flash program memory is empty this is because it is safer to stay in an infinite loop if there is a hardware chip error When synchronization fails the bootloader receives a byte message different to SYNCHR 0x7F two different situations can be distinguished according to the peripheral With the UART peripherals a device reset or power down is necessary before synchronization can be tried again Refer to Appendix E Bootloader UART limitation With the CAN or SPI peripheral the user can continue to poll the interfaces until a synchronization or a timeout occurs 7 synchronization message is received by the UARTs the bootloader automatically detects the baud rate initializes the UART and goes to step 8 below If the synchronization message is received by the CAN or SPI the bootloader goes directly to step 8 below Note Once one of the available inter
49. n the block sent from the host has to be aligned with a memory block If not aligned the byte write operation is used which is slower Doc ID 14798 Rev 5 35 70 www BDTIC com ST Bootloader command set UMO560 4 4 1 36 70 Write memory command via USART LINUART UART1 UART2 UART3 Figure 21 Write memory command USART LINUART UART1 UART2 UARTS host side Send 31h CEh ait for AC or NACK ACK Send the start address 4 bytes and checksum Send the number of bytes to be written 1 byte the data N 1 bytes and checksum ait for AC or NACK 4 End of write memory ai15013 1 See product datasheets for valid addresses If the start address is invalid an add error occurs see Table 10 Error table on page 58 The host sends the bytes as follows Byte 1 0x31 Command ID Byte 2 OxCE Complement Bytes 3 6 The start address 32 bit address Byte 3 MSB Byte 6 LSB Byte 7 Checksum XOR byte 3 byte 4 byte 5 byte 6 Byte 8 The number of bytes to be received 1 N 0 127 If N gt 127 a cmd_error occurs in the bootloader N 1 bytes Max 128 data bytes Checksum byte N N 1 data bytes Doc ID 14798 Rev 5 www BDTIC com ST UM0560 Bootloader command set Figure 22 Write memory command via USART LINUART UART1 UART2 UARTS device side Start write memory Received byte 31h CEh Send ACK byte Receive the start addre
50. oader code checks whether the program memory is virgin or whether a specific option byte is set allowing code modifications If these conditions are not fulfilled the bootloader resumes and the user application is started In case of a successful check the bootloader is executed When the bootloader procedure starts the main tasks are e Polling all supported serial interfaces to check which peripheral is used e Programming code data option bytes and or vector tables at the address es received from the host Each STM8 device embeds a specific bootloader code which is common to a whole group of STMB8 devices The correspondence between groups and part numbers is given in Table 1 Group names are used all over this user manual Table 1 STM8 subfamilies featuring a bootloader STM8 group 5 8 part numbers 5 5 STM8AF6269 8x Ax STMBA S 128K STM8AF51xx STM8AF6169 7x 8x 9x Ax STM8S20xxx STM8AF622x 4x STM8AF6266 68 STMBA S 32K STM8AF612x 4x STM8AF6166 68 STM8S105xx STM8L 64k STM8L15xx8 STM8L15xR6 STM8L16xx8 STM8L15xC4 STM8L15xK4 STM8L15xG4 STM8L 32K STM8L15xC6 STM8L15xK6 STM8L15xG6 x 1 or 2 STM8L15xC2 STM8L15xK2 STM8L15xG2 STM8L 8K STM8L15xC3 STM8L15xK3 STM8L15xG3 x 1 or 2 Table 2 gives the list of STM8 devices without embedded bootloader no ROM bootloader is implemented inside the microcontroller When using these devices you have to write your
51. om ST Bootloader command set 0 0560 22 70 The host sends the bytes to the STM8 as follows Bytes 1 2 0x11 0xEE Bytes 3 6 The start address 32 bit address Byte 3 MSB Byte 6 LSB Byte 7 Checksum XOR byte 3 byte 4 byte 5 byte 6 Byte 8 The number of bytes to be read 1 0 lt N lt 255 Byte 9 Checksum complement of byte 8 Figure 10 Read memory command via USART LINUART UART1 UART2 UARTS device side Start read memory Received byte 11h EEh Send ACK byte Receive the start address 4 bytes with checksum Address valid 8 checksum OK Send ACK byte Receive the number of bytes to be read 1 byte and the checksum byte Send ACK byte Send data to the host End of read memory Send NACK byte ai15006 Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 Bootloader command set 4 2 2 3 Read memory command SPI Figure 11 Read memory command via SPI host side Send 11h EEh Start token byte Wait for or NACK ACK Send the start address 4 bytes with checksum Start token byte Wait for ACK SNACK or NACK ACK Send the number of bytes N to be read 1 byte and a checksum 1 byte Start token byte Start token byte Receive 1 byte from STM8 No N 1 bytes received Yes End of read memory ai15035 1 The valid addresses are RAM Flas
52. otloader sends an ACK byte 0x79 to the host and waits for an address and for a checksum byte both of which are checked when received 2 When the address is valid and the checksum is correct the bootloader transmits an ACK byte 0x79 otherwise it transmits NACK byte 0x1F and aborts the command The bootloader waits for the number of bytes to be transmitted N bytes and for its complemented byte checksum the checksum is correct it then carries out the command starting from the received address the checksum is incorrect it sends a NACK 0x1F byte before aborting the command Doc ID 14798 Rev 5 ky www BDTIC com ST UMO560 Bootloader command set 4 1 The bootloader protocols via the UARTS and SPI are identical on the device side but differ regarding the host A token byte is needed when sending each byte to the host via SPI see Figure 5 Figure 11 Figure 17 Figure 23 and Figure 31 The bootloader protocol via CAN differs from all other peripherals The following sections are organized as follows e Commands via USART LINUART UART1 UART2 UART3 e Commands via SPI e Commands via CAN Get command The get command allows the host to get the version of the bootloader and the supported commands When the bootloader receives the get command it transmits the bootloader version and the supported command codes to the host Get command via USART LINUART UART1 UART2 UART3 Figure 3 Get
53. ovements EMC lockup protection Rev X W STM8AF622x 4x All registers are set back to their reset values 1 3 STM8AF6266 68 when bootloader resumes Rev Y 6 X 7 STM8S105xx Feature added SPI peripheral uses BUSY flag see Appendix C SPI peripheral timing options Initial version Improvement EMC lockup protection Limitation STM8L 64K Bootloader clock disabled when bootloader resumes 1 0 RevA Fixed limitations 1 1 Rev 2 Bootloader clock not disabled when bootloader resumes 66 70 Doc ID 14798 Rev 5 www BDTIC com ST 0 0560 Limitations and improvements versus bootloader versions Table 15 Description of limitation improvements and added features continued STM8 group STM8L 32K Bootloader version 1 0 Device revision RevA Limitations improvements and added features Initial version Limitations Readout protection option bit ROP not checked CPU clock is set to HSI 1 16 MHz when bootloader resumes Timeout for SYNCH byte receiving after reset is 500 ms instead of 1 second 1 1 RevB Limitations CPU clock is set to HSI 1 16 MHz when bootloader resumes Fixed limitation Readout protection option bit is checked Timeout for SYNCH byte receiving after reset is 500 ms instead of 1 second 1 2 Rev Z Improvement EMC lockup protection Fixed limitations CPU cloc
54. r otherwise to any intellectual property rights is granted under this document If any part of this document refers to any third party products or services it shall not be deemed a license grant by ST for the use of such third party products or services or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoever of such third party products or services or any intellectual property contained therein UNLESS OTHERWISE SET FORTH IN ST S TERMS AND CONDITIONS OF SALE ST DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY WITH RESPECT TO THE USE AND OR SALE OF ST PRODUCTS INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND THEIR EQUIVALENTS UNDER THE LAWS OF ANY JURISDICTION OR INFRINGEMENT OF ANY PATENT COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT UNLESS EXPRESSLY APPROVED IN WRITING BY TWO AUTHORIZED ST REPRESENTATIVES ST PRODUCTS ARE NOT RECOMMENDED AUTHORIZED OR WARRANTED FOR USE IN MILITARY AIR CRAFT SPACE LIFE SAVING OR LIFE SUSTAINING APPLICATIONS NOR IN PRODUCTS OR SYSTEMS WHERE FAILURE OR MALFUNCTION MAY RESULT IN PERSONAL INJURY DEATH OR SEVERE PROPERTY OR ENVIRONMENTAL DAMAGE ST PRODUCTS WHICH ARE NOT SPECIFIED AS AUTOMOTIVE GRADE MAY ONLY BE USED IN AUTOMOTIVE APPLICATIONS AT USER S OWN RISK Resale of ST products with provisions different from the statements and or technical features set forth in this document shall immediately voi
55. rogram memory data EEPROM code STM8A S 128K STM8A S 32K STM8L 32K STM8L 64k STM8L 8k Bun 0x00 00 gt 0x00 00 gt 0x00 gt 0x00 00 gt 0 00 0 00 0 00 0 00 v 0x00 0000 gt 0 00 0000 gt 0 00 0000 gt 0x00 2000 gt 0 00 0 00 0 00 0 00 adie 0x00 D400 gt 0x00 D400 gt 0x00 D400 gt 0x00 D400 gt 0x00 D7FF 0x00 D7FF 0x00 D7FF 0x00 D7FF bu 0x00 D800 gt 0x00 D800 gt 0x00 D800 gt 0x00 D800 gt 0x00 DBFF 0x00 DBFF 0x00 DBFF 0x00 DBFF 0x00 gt 0x00 gt 0x00 gt 0x00 gt 0x00 DFFF 0x00 DFFF 0x00 DFFF 0x00 DFFF 0x00 E000 gt 0x00 E000 gt 0x00 E000 gt 0x00 E000 gt 0x00 0x00 0x00 0x00 aad 0x00 E400 gt 0x00 E400 gt 0x00 E400 gt 0x00 E400 gt 0x00 E7FF 0x00 E7FF 0x00 E7FF 0x00 E7FF w 0x00 E800 gt 0x00 E800 gt 0x00 E800 gt 0x00 E800 gt 0x00 EBFF 0x00 EBFF 0x00 EBFF 0x00 EBFF 0x00 ECOO gt 0x00 ECOO gt 0x00 ECOO gt 0x00 ECOO gt 0x00 EFFF 0x00 EFFF 0x00 EFFF 0x00 EFFF 0x00 F000 gt 0x00 F000 gt 0x00 F000 gt 0x00 F000 gt 0x00 F3FF 0x00 F3FF 0x00 F3FF 0x00 F3FF 0x00 F400 gt 0x00 F400 gt 0x00 F400 gt 0x00 F400 gt 0x00 F7FF 0x00 F7FF 0x00 F7FF 0x00 F7FF 0 00 800 gt 0 00 800 gt 0 00 800 gt 0 00 800 gt 0 00 0x00 FBFF 0x00
56. routine names in Section 4 8 1 RAM erase write routines Added STM8L 8K and updated Reset BL option ROP checks for all the other groups in Table 14 Bootloader entry points Removed 16 Kbyte devices in Section C 2 Modified erase write RAM routines Added Appendix E Bootloader UART limitation Added the device versions corresponding to each bootloader version as well as the limitation for bootloader version 1 2 of STM8S A 32K in Table 15 Description of limitation improvements and added features 12 Dec 2011 Updated STM8S A 128K and STM8S A 32K device revisions in Appendix F Limitations and improvements versus bootloader versions Updated disclaimer on last page Doc ID 14798 Rev 5 69 70 www BDTIC com ST UMO560 Please Read Carefully Information in this document is provided solely in connection with ST products STMicroelectronics NV and its subsidiaries ST reserve the right to make changes corrections modifications or improvements to this document and the products and services described herein at any time without notice All ST products are sold pursuant to ST s terms and conditions of sale Purchasers are solely responsible for the choice selection and use of the ST products and services described herein and ST assumes no liability whatsoever relating to the choice selection or use of the ST products and services described herein No license express or implied by estoppel o
57. ser program Optimize Remove some FFs Verify after download Upload from device Upload to file Doc ID 14798 Rev 5 63 70 www BDTIC com ST Bootloader UART limitation 0 0560 Appendix Bootloader UART limitation E 1 E 1 1 64 70 Description The bootloader limitation is not caused by a wrong bootloader implementation or a non compliance with specifications but results from customer specific usage of the STM8 ROM bootloader To prevent future problems for occurring use the workarounds that apply to your specific case see Section E 2 Workaround for UART limitation UART automatic baudrate calculation As explained in Section 3 1 USART UARTS settings the bootloader polls all peripherals CAN SPI UART SPI waiting for a synchronization byte The communications start when a synchronization byte equal to Ox7F has been received For UART communications the baudrate at which UART data transfers are performed by the master is unknown whereas it is preknown for SPI communications and fixed to 125 kbps for CAN Before initializing the UART interface the bootloader waits for the Ox7F byte and deduces the master baudrate from the speed at which the synchronization byte is sent This is called the automatic baudrate mechanism This is done by polling the RxD GPIO pin 1 The master sends 0x7F in serial format LSB first through the UART interface Ox7F is composed of S
58. ss 4 bytes and checksum No Address valid and Yes Send ACK byte Receive the number of bytes to be written 1 byte the data N 1 bytes and the checksum Write the received data to RAM starting from the 00h location Flash data EEPROM address Write the received data to RAM from the start address Yes Write the received data to the memory from the start address Yes Send NACK byte Send ACK byte End of write memory ai15014 1 Write the received data to RAM from the start address is performed in RAM The user therefore has to download the write routine in RAM before sending a write command Note that for some bootloader versions this is not necessary see 4 8 1 RAM erase write routines Doc ID 14798 Rev 5 37 70 4 www BDTIC com ST Bootloader command set UMO560 4 4 2 38 70 Write memory command via SPI Figure 23 Write memory command via SPI host side Send 31h CEh Send token byte Wait for ACK SNACK or NACK Send the start address 4 bytes and checksum Send token byte Wait for ACK SNACK or NACK Send the number of bytes to be written 1 byte the data N 1 byte and checksum Delay 1 Send token byte Wait for ACK or NACK End of write memory 1 Delay or poll BUSY flag if device
59. t ROM bootloader The only condition is that the user application must interact with the upload process as outlined below e The application must implement an authentication procedure for example by sending an authentication command with a password through the communication interface e The application must jump to the ROP check in which the bootloader entry point is checked See Table 14 Bootloader entry points for the addresses of the principle bootloader entry points Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 Bootloader entry points Appendix B Bootloader entry points The ROM bootloader can be activated by the host after device reset However the bootloader can also be used by the user application for various purposes In Table 14 lists the main bootloader entry points and describes how they can be used by the user application Table 14 Bootloader entry points Entry Address and bootloader version Entry point point Usages name STM8A S 128K STM8A S 32K STM8L 32K STM8L 64K Bootloader starts here Reset 0x00 6000 0x00 6000 0x00 6000 0x00 6000 0x00 6000 It can be used to perform a hard reset Point after checking if bootloader is enabled BL 0x00 601E v2 1 2 4A v1 1 by option byte It can be option x v2 1 0 00 601E v1 2 0 00 601A v1 1 0x00 601F 0 00 601F used to jump to the check 0x00 601E v2 2 0x00 6018 v1 3 0x00 601F v1 2 v1 1 v1 0 bootloader
60. t erase memory Has the user to perform a otal erase Yes Send a message with std ID 43h and data byte 1 The bootloader Send a message with std k roti ID 43h and data field 18 ee no accountot other containing sector codes data in the message Wait for 2 ACK or 1 NACK End of erase memory ai15011 1 The bootloader erases the memory sector by sector 2 A sector is 1 Kbyte for all devices Therefore the granularity of the erase command 8 blocks To erase one byte the write command can be used by writing 0x00 Warning If the host sends an erase command that includes some correct sector code and one or more forbidden sector codes see Table 9 STM8 sector codes the command fails and no block is erased The host sends the message as follows Total erase message Std ID 0x43 DLC 0x01 data OxFF Erase sector by sector message Std ID 0x43 DLC 0x01 to 0x08 data see Table 9 STM8 sector codes Doc ID 14798 Rev 5 33 70 www BDTIC com ST Bootloader command set 0 0560 Figure 20 Erase memory command via device side Start erase memory Received message with std ID 43h Send ACK message Is byte 1 of the data field FFh Start total erase Erase memory sector by sector according to data contained in the messages data field _ Send NACK message End of erase memory 1 Erase
61. t get command Send 00h FFh Send token byte NACK wait for ACK or NACK ACK Send token byte Receive 1 byte 05h Number of bytes Send token byte Receive 1 byte Bootloader version Send token byte Receive 1 byte 00h Get command ID Send token byte Receive 1 byte 11h Read command ID Send token byte Receive 1 byte 21h Go command ID Send token byte Receive 1 byte 31h Write command ID Send token byte Receive 1 byte 43h Erase command ID Send token byte End of get command Wait for ACK or NACK ai15033b Doc ID 14798 Rev 5 17 70 www BDTIC com ST Bootloader command set 0 0560 host sends the bytes as follows Byte 1 0x00 Command ID Byte 2 OxFF Complement Byte 3 token host waits for ACK or NACK Byte 4 token host waits for 0x05 Byte 11 token OxXY host waits for ACK or NACK Figure 6 Get command via SPI device side Start get command Received byte OOh FFh Send NACK byte Send ACK byte Send 1 byte Number of bytes version commands ai15034 The 5 8 sends the bytes as follows Byte 1 ACK Byte 2 5 the number of bytes to be sent 1 1 lt 1 lt 256 Byte 3 Bootloader version 0 lt version lt 255 Byte 4 0x00 Get command Byte 5 0x11 Read memory command Byte 6 0x21 Go command Byte 7 0x31 Write memory command Byte 8 0x43
62. tart bit 0 7 consecutive logical 1s bits LSB first 1 logical 0 MSB bit of Ox7F Even parity bit 1 Stop bit 1 2 The bootloader polls the RxD pin and waits for the start bit 0 3 bootloader starts the timer just after a rising edge has been detected on RxD LSB bit and measures the duration of the 7 logical 1s transmission 4 The bootloader stops the timer when a falling edge is detected on RxD end of 7 consecutive logical 1s beginning of MSB The number of timer ticks represents the duration the 7 logical 1s The bootloader deduces the time required to transmit one bit by dividing the timer ticks by 7 calculates the baudrate and initializes the UART baudrate accordingly The bootloader is then ready to receive the next command from the master Description of UART limitation Automatic baudrate calculation assumes that the master sends Ox7F as synchronization byte However the calculated baudrate is incorrect if the master sends a value different from Ox7F This is due to fact that the bootloader expects 7 consecutive logical 1s after the start bit As an example if the master sends 0x78 as synchronization byte the start bit is followed by 4 consecutive logical 1s Since the bootloader expects 7 consecutive 1s the baudrate computed by the bootloader is 7 4 of the master baudrate The next communication Doc ID 14798 Rev 5 ky www BDTIC com ST UM0560 Bootloa
63. tart erase memory Received bytes N 43h BCh Yes Send ACK byte Receive the number of sectors to be erased 1 byte FFh received No Receive the sector codes 00h received Receive the checksum No Yes Start total erase Erase the corresponding sectors Send NACK byte End of erase memory ai15010 1 Erase the corresponding sectors routine is performed in RAM The user therefore has to download the erase routine in RAM before sending an erase command Note that for some bootloader versions this is not necessary see 4 8 1 RAM erase write routines 3 30 70 Doc ID 14798 Rev 5 www BDTIC com ST 0 0560 Bootloader command set 4 3 2 3 Erase memory command SPI Figure 17 Erase memory command via SPI host side Start erase memory Send 43h BCh Send token byte Wait for ACK or NACK AC Total erase Send FFh Send the number of sectors N to be erased 1 byte Send token byte Wait for ACK or NACK End of erase memory ai15037 1 When using the erase command via SPI it is necessary to wait for a brief time interval see delay in Figure 17 above before sending the last token byte This delay interval depends on the SPI baud rate and on the number of sectors to be erased Delay 13 1 ms where 0 lt lt 32 32 in the
64. tion bytes Doc ID 14798 Rev 5 65 70 www BDTIC com ST Limitations and improvements versus bootloader versions 0 0560 Appendix F Limitations and improvements versus bootloader versions A given STMB8 group is associated with a specific bootloader code This code has been improved during the device life and new bootloader versions have been implemented The differences between bootloader versions are summarized in Table 15 together with the limitations improvements and added features for a given bootloader version Table 15 Description of limitation improvements and added features 8 group 2 Device revision Limitations added Initial version Limitations CPU clock is set to HSI 1 16 MHz when 21 Rev bootloader resumes CAN interface does not work correctly Contact your nearest STMicroelectronics sales office for the CAN workaround that can STM8S A 128K be implemented on this bootloader version Improvement tecti Rev U and T STM8AFxxxx52xx EMG lockup protection 99 STM8AF6269 8x Ax Fixed Rev Y 6 W 7 STM8S207 208xx CPU clock is set back to its reset state when bootloader resumes CAN peripheral works correctly Initial version Rev Y STM8AF612x 4x Limitations 1 2 STM8AF6166 68 Some peripheral registers are not set back to Rev Z STM8S105xx their reset value when jumping to user application after a 1 second timeout STMB8S A 32K Impr
65. via CAN TX CAN pins ky Doc ID 14798 Rev 5 13 70 www BDTIC com ST Bootloader command set UMO560 4 14 70 Bootloader command set The commands supported by the bootloader are listed in Table 6 below Table 6 Bootloader commands Command Command code Command description Get 0x00 Gets the version and the allowed commands supported by 2 the current version of the bootloader Read memory 0 11 Reads up to 256 bytes of memory starting from an address specified by the host Erases from one to all of the Flash program memory data Erase memory 0x43 EEPROM sectors Writes up to 128 bytes to RAM or the Flash program Write memory 0x31 memory data EEPROM starting from an address specified by the host Speed 0x03 Allows the baud rate for CAN runtime to be changed 0x21 Jumps to an address specified by the host to execute a loaded code Table 7 Bootloader codes Name Code Description SYNCH Ox7F Synchronization byte ACK 0x79 Acknowledge NACK Ox1F No acknowledge Any byte which the host sends to the bootloader via the SPI interface to receive an answer from the bootloader it is Token OxXX necessary to put data into the SPI when it is needed to receive data SPI clock generation The usual token value is 0 00 BUSY OxAA Busy flag status When the bootloader receives a command via the UARTs CAN or SPI peripherals the general protocol is as follows 1 The bo
66. which was disabled by the option bytes Point after checking the readout protection It can be used to jump to ROP 0x00 602E v2 1 0x00 602E v1 2 0x00 6028 v1 1 0x00 602D 0x00 602D the bootloader if ROP check 0x00 602E v2 2 0x00 6028 v1 3 0x00 602D v1 2 v1 1 v1 0 is active for upgrading an ROP protected device after master user authentication 1 The address depends on the bootloader version and may be changed in the next bootloader version STMicroelectronics office for the latest information Contact your local 2 The RAM variable at address 0x00 0099 should be set to the value 0x00 or 0x01 for this bootloader version 0x00 no timeout 0x01 1 second bootloader timeout 3 No ROP check entry point is defined for bootloader version 1 0 4 Doc ID 14798 Rev 5 61 70 www BDTIC com ST SPI peripheral timing options 0 0560 Appendix SPI peripheral timing options C 1 C 2 62 70 SPI with busy state checking Sections 4 3 2 Erase memory command via SPI and 4 4 2 Write memory command via SPI contain flowcharts for the SPI erase and write commands A disadvantage of the SPI interface is that it is driven by the host which controls the transfers by polling the data from the device If the device is busy for example if it is programming the Flash memory the device answers by writing the last byte in the SPI data register which is the last sent byt
67. x01 4000 gt 0x01 4000 gt 0x01 43FF 0x01 43FF aa 0x01 4400 gt 0x01 4400 gt 0x01 47FF 0x01 47FF ee 0x01 4800 gt 0x01 4800 gt 0x01 4BFF 0x01 4BFF 0x33 0x01 4C00 gt 0x01 4C00 gt 0x01 4FFF 0x01 4FFF 0x01 1000 gt 0x01 1000 gt 0x01 53FF 0x01 53FF 0 01 5400 gt 0 01 5400 gt 0 01 57FF 0 01 57FF 0 01 5800 gt 0 01 5800 gt 0 01 5BFF 0 01 5BFF ds 0x01 5 00 gt 0x01 5C00 gt 0x01 5FFF 0x01 5FFF PET 0x01 6000 gt 0x01 6000 gt 0x01 63FF 0x01 63FF daa 0x01 6400 gt 0x01 6400 gt 0x01 67FF 0x01 67FF 0 01 6800 gt 0 01 6800 gt 0x01 6BFF 0x01 6BFF 52 70 Doc ID 14798 Rev 5 ky www BDTIC com ST 0 0560 Bootloader command set Table 9 STM8 sector codes continued Sector Flash program memory data EEPROM code STM8A S 128K STM8A S 32K STM8L 32K STM8L 64k STM8L 8k e 0x01 6 00 gt 0x01 6 00 gt 0 01 6FFF 0 01 6FFF 0x01 7000 gt 0x01 7000 gt 0x01 73FF 0x01 73FF 0x01 7400 gt 0x01 7400 gt 0x01 77FF 0x01 77FF a 0x01 7800 gt 0x01 7800 gt 0x01 7BFF 0x01 7BFF me 0x01 7 00 gt 0x01 7 00 gt 0 01 7 0 01 7 m 0x01 8000 gt 0x00 1000 gt 0x01 83FF 0x00 13FF m 0x01 8400 gt 0x00 1400 gt 0x01 87FF 0x00 17FF 0x01 8800 gt 0x42 0x01 8BFF 0x01 8C00 gt Ons 0 01 18FFF 0x01 9000 gt Ons 0x01 93FF 0x01 9400 gt

STM8 bootloader

Contents

Download Pdf Manuals

Related Search

Related Contents