STM8S bootloader user manual
Contents
1. 1 After interface initialization a write protection test is performed to avoid non authorised reading of the Flash program memory data EEPROM 9 58 Peripheral settings UM0560 3 Note 3 1 Note 3 2 Note 10 58 Peripheral settings This section describes the hardware settings of the STM8S communication peripherals UART1 UART2 UART3 SPI CAN During bootloading only one peripheral is enabled all others are disabled Table 2 Serial interfaces associated with STM8S devices Device Serial interface STM8S20xxx UART1 UART3 CAN STM8S105xx UART2 SPI UART1 settings All UART peripherals support asynchronous serial communication UART1 settings are e Data frame 1 start bit 8 data bit 1 parity bit even 1 stop bit e Baudrate The baud rate is autodetected by the bootloader When the user sends the synchronization byte 7Fh the bootloader automatically detects the baud rate and sets the UART1 to the same baud rate Maximum baud rate 1 Mbps minimum baud rate 4800 bps Mandatory To perform the automatic speed detection the RX line PA4 has to be stable in the application board The UART1 peripheral is accessible via pins PA4 RX and PAS TX UART2 and UARTS settings All UART peripherals support asynchronous serial communication UART2 and UARTS settings are e Data frame 1 start bit 8 data bit no parity bit 1 stop bit e Baud rate The baud rate is au2. Bootloader command set UM0560 4 1 14 58 Get command The get command allows the host to get the version of the bootloader and the supported commands When the bootloader receives the get command it transmits the bootloader version and the supported command codes to the host Get command via UART1 UART2 UART3 Figure 3 Get command via UART1 UART2 UARTS Host side Send 00h FFh Wait for ACK or NACK ACK Receive 1 byte Number of bytes version commands Receive 1 byte Bootloader version Receive 5 bytes Supported commands Wait for ACK or NACK End of get command ai15003 The host sends the bytes as follows Byte 1 00h Command ID Byte 2 FFh Complement UM0560 Bootloader command set Figure 4 Get command via UART1 UART2 UART3 Device side Start get command Received byte 00h FFh Send NACK byte Send ACK byte Send 1 byte Number of bytes version commands ai15004 The STM8S sends the bytes as follows Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Byte 9 ACK after the host has sent the command N 5 the number of bytes to be sent 1 1 lt N 1 lt 256 Bootloader version O version 255 00h Get command 11h Read memory command 21h Go command 31h Write memory command 43h Erase memory command ACK 15 58 Boot
3. wv UM0560 Ts User manual STM8S bootloader user manual 1 Introduction This user manual contains the bootloader specifications for STM8S devices which contain a bootloader embedded in the system memory of the device the ROM memory Through this firmware the device memory can be erased and programmed using one of the standard communication interfaces present on the particular device For each device please refer to the corresponding datasheets to know if the bootloader is present and which peripherals are supported The document describes the features and operation of the STM8S integrated bootloader program This code allows memories including Flash program data EEPROM and RAM to be written into the device using the standard serial interfaces UART1 UART2 UART3 CAN and SPI only available on STM8S105xx devices The bootloader code is the same for all STM8S versions including STM8S20xxx and STM8S105xx devices However even though a peripheral may be present in a product the product may not support it for example the SPI is not supported in STM8S20xxx devices In addition different cuts support different peripherals The bootloader code can be accessed via the UART1 UART3 and CAN peripherals in STM8S20xxx devices and via UART2 and SPI in STM8S105xx devices For further information on the STM8S family features pinout electrical characteristics mechanical data and ordering information please refer to the STM8S datas
4. Byte 9 Checksum byte 8 Figure 10 Read memory command via UART1 UART2 UARTS Device side Start read memory Received byte 11h EEh Receive the start address 4 bytes with checksum Address valid 8 checksum OK Send ACK byte Receive the number of bytes to be read 1 byte and the checksum byte lt gt Send ACK byte Send data to the host End of read memory Send NACK byte ai15006 KYT 21 58 Bootloader command set UM0560 4 2 2 Read memory command via SPI Figure 11 Read memory command via SPI Host side Send 11h EEh Start token byte Wait for ACKNy NACK or NACK ACK Send the start address 4 bytes with checksum Start token byte Wait for ACK SNACK or NACK ACK Send the number of bytes N to be read 1 byte and a checksum 1 byte Start token byte Start token byte Receive 1 byte from STM8A No N 1 bytes received Yes End of read memory ai15035 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheet If the bootloader receives an invalid address an add error occurs see Table 6 Error table on page 55 a 22 58 UM0560 Bootloader command set The host sends the bytes to the STM8S as follows Byte 1 Byte 2 Byte 3 token Bytes 4 to 7 Byte 8 Byte 9 token Byte 10 Byte 11 Byte 12 to
5. 31 58 Bootloader command set UM0560 4 3 3 Erase memory command via CAN Figure 19 Erase memory command via CAN Host side Start erase memory Has the user to perform a otal erase Yes Send a message with std ID 43h and data byte 1 FFh The bootloader takes no account of other data in the message Send a message with std ID 43h and data field containing sector codes Wait for 2 ACK or 1 NACK End of erase memory ai15011 1 Memory erased 130 Kbytes for devices with 128 Kbytes of Flash program memory and 2 Kbytes of Data EEPROM and 33 Kbytes for devices with 32 Kbytes of Flash program memory and 1 Kbyte of Data EEPROM 2 Asector is 8 blocks i e 1 Kbyte for any devices Therefore the granularity of the erase command is 1 Kbyte Warning If the host sends an erase command that includes some correct sector code and one or more forbidden sector codes the command fails The host sends the message as follows Total erase message Std ID 43h DLC 01h data FFh Erase sector by sector message Std ID 43h DLC 01h to 08h data see product datasheet a 32 58 UM0560 Bootloader command set Figure 20 Erase memory command via CAN Device side Start erase memory Received message with std ID 43h Send ACK message Is byte 1 of the data field FFh Start total erase Erase memory sector by sector accord
6. Send 21h DEh ait for AC or NACK Send the start address 4 bytes and checksum Wait for ACK or NACK End of Go ai15017 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheet If the bootloader receives an invalid address an add error occurs see Table 6 Error table on page 55 The host sends the bytes as follows Byte 1 Byte 2 Bytes 3 6 Byte 7 Command ID Complement The start address Byte 3 MSB Byte 6 LSB Checksum XOR byte 3 byte 4 byte 5 byte 6 45 58 Bootloader command set UM0560 46 58 Figure 30 Go command via UART1 UART2 UART3 Device side Received bytes 21h DEh Yes Send ACK byte Receive the start address 4 bytes and checksum Send ACK byte Send NACK byte End of Go ai15018b a UM0560 Bootloader command set 4 6 2 Go command via SPI Figure 31 Go command via SPI Host side Send 21h DEh Send token byte ACK Send the start address 4 bytes and checksum Send token byte Wait for ACK or NACK End of Go ai15041 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheet If the bootloader receives an invalid address an add error occurs see Table 6 Error table on page 55 The host sends th
7. 03h Speed command Std ID 02h DLC 1 data 11h Read memory command Std ID 02h DLC 1 data 21h Go command Std ID 02h DLC 1 data 31h Write memory command Std ID 02h DLC 1 data 43h Erase memory command Std ID 02h DLC 1 data ACK 19 58 Bootloader command set UM0560 4 2 4 2 1 20 58 Read memory command The read memory command is used to read the memory RAM Flash program memory data EEPROM or registers When the bootloader receives the read memory command it transmits the needed data N 1 bytes to the host starting from the received address Read memory command via UART1 UART2 UARTS3 Figure 9 Read memory command via UART1 UART2 UARTS Host side Send 11h EEh Send the start address 4 bytes with checksum Send the number of bytes to be read 1 byte and a checksum 1 byte Receive data from the bootloader End of read memory 1 The valid addresses are RAM Flash program memory data EEPROM and register addresses see product datasheet If the bootloader receives an invalid address an add error occurs see Table 6 Error table on page 55 ai15005 a UM0560 Bootloader command set The host sends the bytes to the STM8S as follows Bytes 1 2 11h EEh Bytes 3 6 The start address Byte 3 MSB Byte 6 LSB Byte 7 Checksum XOR byte 3 byte 4 byte 5 byte 6 Byte 8 The number of bytes to be read 0 N lt 255
8. 128 and the destination address is an integer module of 128 In other words to use this operation the block sent from the host has to be aligned with a memory block 1 Write memory command via UART1 UART2 UART3 Figure 21 Write memory command via UART1 UART2 UARTS Host side Send 31h CEh Send the start address 4 bytes and checksum Send the number of bytes to be written 1 byte the data N 1 bytes and checksum ait for AC or NACK End of write memory ai15013 1 See product datasheet for valid addresses If the start address is invalid an add error occurs see Table 6 Error table on page 55 ky UM0560 Bootloader command set The host sends the bytes as follows Byte 1 Byte 2 Bytes 3 6 Byte 7 Byte 8 Checksum byte 31h Command ID CEh Complement The start address Byte 3 MSB Byte 6 LSB Checksum XOR byte 3 byte 4 byte 5 byte 6 The number of bytes to be received O lt N lt 127 if N gt 127a cmd error occurs in the bootloader N 1 data bytes Max 128 bytes XOR N N 1 databytes 35 58 Bootloader command set UM0560 36 58 Figure 22 Write memory command via UART1 UART2 UARTS Device side Start write memory Received byte IN No 31h CEh Send ACK byte Receive the start address 4 bytes and checksum Address valid and checksum OK Yes Send ACK byte Receiv
9. eee ae 56 CAN programming time EE Ee EE Ee ee ee ee ee ee EG ee ee ee ee ee ke ee 56 Document revision history ie EE Ee EE ee ee ke ee Ee ee rr 57 UM0560 List of figures List of figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 Figure 12 Figure 13 Figure 14 Figure 15 Figure 16 Figure 17 Figure 18 Figure 19 Figure 20 Figure 21 Figure 22 Figure 23 Figure 24 Figure 25 Figure 26 Figure 27 Figure 28 Figure 29 Figure 30 Figure 31 Figure 32 Figure 33 Figure 34 Bootloader activation flow chart 000 cece ee 7 oi P 11 Get command via UART1 UART2 UARTS Host side es SS ES ee Sk ee ee 14 Get command via UART1 UART2 UARTS Device side ss ee aa 15 Get command via SPI Host side es Se es eee ee se ee ee 16 Get command via SPI Device side is GE Se SS Se eens 17 Get command via CAN Host side es se ccc Ge ee Ge ee ee ee eee eens 18 Get command via CAN Device side es Se eee se ee ee 19 Read memory command via UART1 UART2 UARTS Host side 20 Read memory command via UART1 UART2 UART3 Device side 21 Read memory command via SPI Host side es ee Se se ee ee ee ee ee 22 Read memory command via SPI Device side 1 0 nee 24 Read memory command via CAN Hostside ss es ee nee 25 Read memory command
10. follows Byte 1 Byte 2 Byte 3 token Bytes 4 to 7 Byte 8 Byte 9 token Byte 10 Checksum byte Last byte token 31h Command ID CEh Complement XY host waits for ACK or NACK The start address Byte 4 MSB Byte 7 LSB Checksum XOR byte 3 byte 4 byte 5 byte 6 XY host waits for ACK or NACK The number of bytes to be received 0 N 127 If N 127 a cmd error occurs in the bootloader N 1 data bytes Max 128 bytes XOR N N 1 databytes before sending the token byte the host must wait for the bootloader to finish writing all data into the memory XYh host waits for ACK or NACK UM0560 Bootloader command set 4 Figure 24 Write memory command via SPI Device side Start write memory Received byte 3 No 31h CEh Send ACK byte Receive the start address 4 bytes and checksum Address valid and Yes Send ACK byte Receive the number of bytes to be written 1 byte the data N 1 byte and the checksum Write the received data to RAM memory starting from the 00h location Flash data EEPROM address Yes Write the received data to the l memory from the start address Write the received data to RAM from the start address Send NACK byte Send ACK byte End of write memory ai15040 1 For safety reasons no write routine is placed into ROM The write the received data to RAM
11. host can reprogram the Flash program memory and the bootloader option byte values as shown in Table 1 according to the content of the first Flash program memory location 8000h When read out protection ROP is equal to AAh ROP active the Flash program memory is read out protected In this case the bootloader stops and the user application starts If ROP is not equal to AAh the bootloader continues to be executed The CAN peripheral can only be used if an external clock 8 MHz 16 MHz or 24 MHz is present It is initialized at 125 kbps The UART1 UART2 UART3 and SPI peripherals do not require an external clock Set the high speed internal RC oscillator HSI to 16 MHz and initialize the UART1 UART2 and UARTS receiver pins in input pull up mode in the GPIO registers Initialize the SPI in slave mode Interface polling point S The bootloader polls the peripherals waiting for a synchronization byte message SYNCHR within a timeout of 1 s If a timeout occurs either the Flash program memory is virgin in which case it waits for a synchronization byte message in an infinite loop or the Flash program memory is not virgin and the bootloader restores the registers reset status before going to the Flash program memory reset vector at 8000h Note When synchronization fails and the bootloader receives a byte message different to SYNCHR two different situations can be distinguished according to the peripheral With UART1 UART2 or UA
12. via CAN Device side is SG Ee ee ee ee es ee 25 Erase memory command via UART1 UART2 UART3 Host side 27 Erase memory command via UART1 UART2 UARTS Device side 29 Erase memory command via SPI Host side ces 30 Erase memory command via SPI Device side ie Ge eens 31 Erase memory command via CAN Host side ss Es ee eee 32 Erase memory command via CAN Device side ie Es lille 33 Write memory command via UART1 UART2 UARTS Host side 34 Write memory command via UART1 UART2 UARTS Device side 36 Write memory command via SPI Host side Se es ee ee ee Ge ee es ee 37 Write memory command via SPI Device side ie 0 00 cee 39 Write memory command via CAN Host side se ss SE ee Se ee ed ek ee 40 Write memory command via CAN Device side 0 42 Speed command via CAN Host side 22 ee lees 43 Speed command via CAN Device side EE ES GE EE GE ee ee ee ee ee 44 Go command via UART1 UART2 UARTS Host side 0 0 0 eee 45 Go command via UART1 UART2 UARTS Device side 00 eee eee 46 Go command via SPI Host side 2 eee 47 Go command via SPI Device side ete eens 48 Go command via CAN Hostside ies se eee een eens 49 Go command via CAN Device Side 0 00 cette 49 5 58 Bootloader introduction UM0560 2 2 1 6 58 Bootloader int
13. 6Dh 22400h gt 227FFh 6Eh 23800h gt 23BFFh 6Fh 23C00h 23FFFh 70h 24000h gt 243FFh 71h 24400h 247FFh 72h 24800h 24BFFh 73h 24C00h gt 24FFFh 74h 25000h gt 253FFh 75h 25400h 257FFh 76h 25800h gt 25BFFh 77h 25C00h gt 25FFFh 78h 26000h 263FFh 79h 26400h gt 267FFh 7Ah 26800h gt 26BFFh 7Bh 26C00h gt 26FFFh 7Ch 27000h gt 273FFh 7Dh 27400h gt 277FFh 7Eh 27800h gt 27BFFh 7Fh 27C00h gt 27FFFh 80h 4000h gt 43FFh 81h 4400h 47FFh 53 58 Software model UM0560 5 Note Caution Note 54 58 Software model The boot code has been designed with the same logical protocol for exchanging command frames between host and any STM8S device The boot code can download up to 128 bytes at a time The first 130 bytes of RAM from 00h store data coming from the serial interface thus allowing the boot to use the stack The 25 bytes following the first 130 bytes are used for the bootloader s variables Unused empty bootloader ROM is filled with an opcode that is not allowed 71h If for any reason i e noise the core starts to execute in the 71h area an illegal opcode is returned and consequently a reset This prevents the bootloader falling into an infinite loop with no reset in the event that it jumps in the empty locations Thus normal execution can resume To erase or program the Flash program memory the respective routines must be downloaded in RAM starting
14. 7 68 ms ky UM0560 Revision history 8 Revision history Table 10 Document revision history Date 15 Dec 2008 Revision 1 Initial release Changes 57 58 UM0560 Please Read Carefully Information in this document is provided solely in connection with ST products STMicroelectronics NV and its subsidiaries ST reserve the right to make changes corrections modifications or improvements to this document and the products and services described herein at any time without notice All ST products are sold pursuant to ST s terms and conditions of sale Purchasers are solely responsible for the choice selection and use of the ST products and services described herein and ST assumes no liability whatsoever relating to the choice selection or use of the ST products and services described herein No license express or implied by estoppel or otherwise to any intellectual property rights is granted under this document If any part of this document refers to any third party products or services it shall not be deemed a license grant by ST for the use of such third party products or services or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoever of such third party products or services or any intellectual property contained therein UNLESS OTHERWISE SET FORTH IN ST S TERMS AND CONDITIONS OF SALE ST DISCLAIMS ANY EXPRESS OR IM
15. 8S20xxx devices STM8S105xx devices 40h 18000h 183FFh 41h 18400h gt 187FFh 42h 18800h gt 18BFFh 43h 18CO00h gt 18FFFh 44h 19000h gt 193FFh 45h 19400h 197FFh 46h 19800h gt 19BFFh 47h 19C00h 19FFFh 48h 1A000h gt 1A3FFh 49h 1A400h gt 1A7FFh 4Ah 1A800h gt 1ABFFh 4Bh 1AC00h gt 1AFFFh 4Ch 1B000h gt 1B3FFh 4Dh 1B400h gt 1B7FFh 4Eh 1B800h gt 1BBFFh 4Fh 1BCOOh gt 1BFFFh 50h 1C000h gt 1C3FFh 51h 1C400h 1C7FFh 52h 1C800h gt 1CBFFh 53h 1CCOOh gt 1CFFFh 54h 1D000h gt 1D3FFh 55h 1D400h 1D7FFh 56h 1D800h gt 1DBFFh 57h 1DCOOh gt 1DFFFh 58h 1E000h gt 1E3FFh 59h 1E400h gt 1E7FFh 5Ah 1E800h gt 1EBFFh 5Bh 1ECOOh gt 1EFFFh 5Ch 1FOOOh gt 1F3FFh 5Dh 1F400h gt 1F7FFh 5Eh 1F800h gt 1FBFFh 5Fh 1FCOOh gt 1FFFFh 60h 20000h gt 203FFh a UM0560 Bootloader command set q Table 5 STMBS sector codes continued Sector code Flash program memory data EEPROM Flash program memory data EEPROM STM8S20xxx devices STM8S105xx devices 61h 20400h gt 207FFh 62h 20800h gt 20BFFh 63h 20C00h gt 20FFFh 64h 21000h 213FFh 65h 21400h 217FFh 66h 21800h 21BFFh 67h 21C00h s 21FFFh 68h 22000h gt 223FFh 69h 22400h gt 227FFh 6Ah 22800h gt 22BFFh 6Bh 22C00h s 22FFFh 6Ch 22000h 223FFh
16. CK AC Total erase Send FFh Send the number of sectors N to be erased 1 byte Sn GER Send the sector code Send checksum Send token byte Wait for ACK or NACK End of erase memory 1 When using the erase command via SPI it is necessary to wait for a brief time interval see delay in Figure 17 above before sending the last token byte This delay interval depends on the SPI baud rate and on the number of sectors to be erased Delay 13 N 1 ms where 0 lt N lt 32 N 32 in the case of tatal erase ai15037 The host sends the bytes as follows Byte 1 43h Command ID Byte 2 BCh Complement Byte 3 token XYh host waits for ACK or NACK Byte 4 Byte 5 or N 1 bytes FFh or number of sectors to be erased 0 lt N lt 32 If N 532 a cmd error occurs 00h or N 1 bytes and then checksum XOR N N 1 bytes Last byte token XYh host waits for ACK or NACK ky UM0560 Bootloader command set 4 Figure 18 Erase memory command via SPI Device side Start erase memory Received bytes 43h BCh Yes Send ACK byte Receive the number of sectors to be erased 1 byte FFh received No Receive the sector codes Receive the checksum 00h No received Yes Start total erase l Erase the corresponding sectors Send ACK byte End of erase memory ai15038 Send NACK byte
17. FFh a UM0560 Bootloader command set q Table 5 STMBS sector codes continued Sector code Flash program memory data EEPROM Flash program memory data EEPROM STM8S20xxx devices STM8S105xx devices 1Fh FCOOh gt FFFFh FCOOh FFFFh 20h 10000h gt 103FFh 4000h gt 43FFh 21h 10400h gt 107FFh 22h 10800h gt 10BFFh 23h 10C00h gt 10FFFh 24h 11000h gt 113FFh 25h 11400h gt 117FFh 26h 11800h gt 11BFFh 27h 11C00h gt 11FFFh 28h 12000h 123FFh 29h 12400h gt 127FFh 2Ah 12800h gt 12BFFh 2Bh 12C00h gt 12FFFh 2Ch 13000h gt 133FFh 2Dh 13400h gt 137FFh 2Eh 13800h gt 13BFFh 2Fh 13C00h gt 13FFFh 30h 14000h 143FFh 31h 14400h 147FFh 32h 14800h 14BFFh 33h 14C00h gt 14FFFh 34h 15000h 153FFh 35h 15400h gt 157FFh 36h 15800h gt 15BFFh 37h 15C00h gt 15FFFh 38h 16000h gt 163FFh 39h 16400h gt 167FFh 3Ah 16800h gt 16BFFh 3Bh 16COOh gt 16FFFh 3Ch 17000h gt 173FFh 3Dh 17400h gt 177FFh 3Eh 17800h gt 17BFFh 3Fh 17C00h gt 17FFFh 51 58 Bootloader command set UM0560 52 58 Table 5 STMBS sector codes continued Sector code Flash program memory data EEPROM Flash program memory data EEPROM STM
18. ID of the data and checksum messages Therefore an ID from Oh to FFh can be used It is recommended to use 04h 41 58 Bootloader command set UM0560 42 58 Figure 26 Write memory command via CAN Device side Start write memory Received message No with std ID 31h Start address and number of bytes N Send ACK message Receive the data messages and If a message is corrupted temporarily write the data to RAM starting from the 00h location Receive the checksum message Address in Flash data EEPROM No Write the received data to RAM from the start address L m Write the received data to the memory from the start address End of write memory Send ACK message Send NACK message ai15016 1 For safety reasons no write routine is placed into ROM The write the received data to the Flash program memory data EEPROM from the start address see Figure 26 is performed in RAM The user therefore has to download the write routine in RAM before sending a write command 2 See product datasheet for valid addresses If the bootloader receives an invalid address an add_error occurs see Table 6 Error table on page 55 a UM0560 Bootloader command set 4 5 4 5 1 Speed command The speed command allows the baud rate for CAN run time to be changed It can be used only if the CAN is the peripheral
19. PLIED WARRANTY WITH RESPECT TO THE USE AND OR SALE OF ST PRODUCTS INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND THEIR EQUIVALENTS UNDER THE LAWS OF ANY JURISDICTION OR INFRINGEMENT OF ANY PATENT COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT UNLESS EXPRESSLY APPROVED IN WRITING BY AN AUTHORIZED ST REPRESENTATIVE ST PRODUCTS ARE NOT RECOMMENDED AUTHORIZED OR WARRANTED FOR USE IN MILITARY AIR CRAFT SPACE LIFE SAVING OR LIFE SUSTAINING APPLICATIONS NOR IN PRODUCTS OR SYSTEMS WHERE FAILURE OR MALFUNCTION MAY RESULT IN PERSONAL INJURY DEATH OR SEVERE PROPERTY OR ENVIRONMENTAL DAMAGE ST PRODUCTS WHICH ARE NOT SPECIFIED AS AUTOMOTIVE GRADE MAY ONLY BE USED IN AUTOMOTIVE APPLICATIONS AT USER S OWN RISK Resale of ST products with provisions different from the statements and or technical features set forth in this document shall immediately void any warranty granted by ST for the ST product or service described herein and shall not create or extend in any manner whatsoever any liability of ST ST and the ST logo are trademarks or registered trademarks of ST in various countries Information in this document supersedes and replaces all information previously supplied The ST logo is a registered trademark of STMicroelectronics All other names are the property of their respective owners 2008 STMicroelectronics All rights reserved STMicroelectronics group of companies Austra
20. RT53 a device reset or power down is necessary before synchronization can be tried again With CAN or SPI the user can continue to poll the interfaces until a synchronization or a timeout occurs If the synchronization message is received by the UART1 UART2 or UARTS the bootloader detects the baud rate and initializes the UART1 UART2 or VART3 respectively and goes to step 8 below If the synchronization message is received by the CAN or SPI the bootloader goes directly to step 8 below Note Once one of the available interfaces receives the synchronization message all others are disabled Waiting for commands point C Commands are checked in an infinite loop and executed To exit from the bootloader the host has to send a go command When this is done the bootloader removes the EM and WM routines from the RAM memory before jumping to the address selected by the host UM0560 Bootloader introduction 4 Table 1 Initial checking P Bootloader Bootloader Actual Flash program rogram memory Checks location 8000h check check memory status opt byte 487Eh opt byteN 487Fh gt Flash action Flash program memory det XXh 82h or ACh XXh XXh virgin jump to bootloader Flash program memory gna XXh 82h or ACh 55h AAh already written gt jump to bootloader Flash program memory grd XXh 82h or ACh XXh 55h XXh AAh already Winen gt jump to Flash program memory reset
21. a UART1 UART2 UART3 34 4 4 2 Write memory command via SPI 0000 0c eee eee 37 4 4 3 Write memory command via CAN 0 0000 ee ee eee 40 4 5 Speed command uude Dd d xA Rs ALACRES do iet oR cR nae PR SERA 43 4 5 1 Speed command via CAN 2 2 22 ee 43 AG ie AA EE km o EE REIR Due ml alea OR EE DIT 45 4 6 1 Go command via UART1 UART2 UART3 2 45 4 6 2 Go command via SPI ee ed ee Se ee ee ee ee ee ee 47 2 58 Ti UM0560 Contents 4 6 3 Go command via CAN 2 Ee tee 49 47 Sector codes Loc sss EER EO EN HEER 50 5 Software model aaa a AGA AABANG KAWA ee eae ee Es NG 54 6 Error management eee eee 55 7 Programming time sie so RE RR RE NE EN N ER RE N N Q8 Q8 le nn RR N 56 8 Revision history isi NAG Rok Daa HAKA AGERE le RC ena dea 57 ky 3 58 List of tables UM0560 List of tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 4 58 Initial CHECKING M 9 Serial interfaces associated with STM8S devices 0 0 10 Bootloader commands EE EE Ee SE Ee SE Ee ek ee ee rr 13 Examples of delay si ss cee EE SR se EE Re Ee Re ee Ek a ee Re ee ke ee ee ee 38 STM8S sector codes EE Ee Ee Ee Ee ee de ee Se eae 50 Ertot le RR Meade tien oped OR EA EO RA Sg ate ees 55 UART1 UART2 UART3 programming times ses EE eee eee ee 56 SPI programming time ii ER
22. at 00AOh This is imperative because the routines are consecutive with no empty memory locations between them The routines are included in the following files e STM8S20xxx devices E W ROUTINEs 128K s19 e STM8S105xx devices E W ROUTINEs 32K s19 To execute any of the commands get read erase write speed and go the bootloader uses part of the RAM memory Therefore it is forbidden to run write commands with the exception of write commands that are useful for downloading routines to erase and program the Flash program memory with destination addresses in the following RAM memory locations e STM8S20xxx devices Oh to O1FFh e STM8S105xx devices Oh to O1CFh UM0560 Error management 6 4 Error management Table 6 describes the error type and the bootloader behavior Table 6 Error table Error cmd error Description If a denied command is received If a parity error occurs during command transmission If an error occurs during the command execution See Table 3 Bootloader commands on page 13 Bootloader actions Sends NACK byte and goes back to command checking add error If a received command contains a denied destination address for information on valid address ranges refer to the product datasheet Sends NACK byte and goes back to command checking 55 58 Programming time UM0560 7 Note 56 58 1 Programming time The programming time depen
23. being used Speed command via CAN Figure 27 Speed command via CAN Host side Start speed command Send speed message std ID 03h Wait for ACK or NACK ACK Changes the CAN baud rate according to command sent End of speed ai15031b 1 After setting the new baud rate the bootloader sends the ACK message Therefore the host sets its baud rate while waiting for the ACK The host sends the message as follows Command message Std ID 03h DLC 01h data XXh where XXh assumes the following values depending on the baud rate to be set e Oth gt baud rate 125 kbps e 02h gt baud rate 250 kbps e 03h gt baud rate 500 kbps e 04h gt baud rate 1 Mkbps 43 58 Bootloader command set UM0560 Figure 28 Speed command via CAN Device side Start speed command Received a message with std ID 03h and with valid data Yes Send ACK message old baud rate Changes the CAN baud rate according to received data new baud rate Send ACK message new baud rate End of speed command Send NACK message old baud rate ai15032b a 44 58 UM0560 Bootloader command set 4 6 4 6 1 Go command The go command is used to execute the downloaded code or any other code by branching to an address specified by the host Go command via UART1 UART2 UART3 Figure 29 Go command via UART1 UART2 UART3 Host side
24. ds on the baud rate of the peripheral e 7 UART1 UART2 UART3 128 kbps 256 kbps and 500 kbps e SPI 125 kbps 250 kbps 500 kbps and 1 Mbps CAN 125 kbps 250 kbps 500 kbps and 1 Mbps The programming time of the SPI is measured based on 32 Kbytes instead of 48 Kbytes because the boot code via the SPI is implemented on the STM8S 32 Kbyte device only After a go command the bootloader removes the erase and write routines from the RAM memory before jumping to the host address It takes about 150 us to remove these routines Table 7 Table 8 and Table 9 show the programming times for the UART1 UART2 UART3 SPI and CAN respectively Table 7 UART1 UART2 UARTS programming times Time to load Kbytes block bytes in Baud rate bps the Flash program memory 128000 256000 500000 48 Kbytes 7 738 5 34 s 4 08 s 1 block 20 13 ms 13 53 ms 10 65 ms 1 byte 7 52 ms 6 93 ms 6 65 ms Table 8 SPI programming time Time to load Kbytes block bytes Baudirat in the Flash program memory 125 kbps 250 kbps 500kbps 1Mbps 32 Kbytes 4 46 s 3 34 s 2 81s 2 55 s 1 block 17 44 ms 13 04 ms 11 01 ms 9 95 ms 1 byte 8 52 ms 8 12 ms 7 93 ms 7 84 ms Table 9 CAN programming time Time to load Kbytes block bytes Baudirate in the Flash program memory 125 kbps 250 kbps 500 kbps 1 Mbps 48 Kbytes 9 50 s 6 40 s 4 85 s 4 07 s 1 block 24 73 ms 16 66 ms 12 63 ms 10 60 ms 1 byte 9 23 ms 8 53 ms 7 91 ms
25. e Bitrate At the beginning is 125 kbps run time can be changed via the speed command to achieve a maximum bit rate of 1 Mbps The transmit settings from STM8S to the host are e TxmailboxO On Tx mailbox1 and Tx mailbox2 Off Tx identifier 02h Outgoing messages contain 1 data byte 11 58 Peripheral settings UM0560 Note 12 58 The receive settings from the host to STM8S are Synchronization byte 7Fh is in the RX identifier and not in the data field RX identifier depends on the command 00h 03h 11h 21h 31h 43h Error checking If the error field bit 6 4 in the CESR register is different from 000b the message is discarded and a NACK is sent to the host In FIFO overrun condition the message is discarded and a NACK is sent to the host Incoming messages can contain from 1 to 8 data bytes The CAN peripheral is accessible via pins PGO TX and PG1 RX UM0560 Bootloader command set 4 Bootloader command set The supported commands are listed in Table 3 below Table 3 Bootloader commands Command Command code Command description Gets the version and the allowed commands supported by Gal gon the current version of the bootloader Read memory 41h Reads up to 256 bytes of memory starting from an address specified by the host Erase memory 43h Erases from one to all of the Flash program memory data EEPROM memory sectors Writes up to 128 bytes to the RAM or the Flash prog
26. e bytes as follows Byte 1 Byte 2 Byte 3 token Bytes 4 to 7 Byte 8 Byte 9 token 21h Command ID DEh Complement XYh host waits for ACK or NACK The start address Byte 4 MSB Byte 7 LSB Checksum XOR byte 3 byte 4 byte 5 byte 6 XYh host waits for ACK or NACK 47 58 Bootloader command set UM0560 Figure 32 Go command via SPI Device side Start go command Received bytes No 21h 4 DEh Send ACK byte Receive the start address 4 bytes and checksum Address valid and checksum ok Send ACK byte Remove EM and WM routines from the RAM Jump to address Send NACK byte End of go ai15042 48 58 a UM0560 Bootloader command set 4 6 3 a Go command via CAN Figure 33 Go command via CAN Host side Start go command Send go message std ID 21h Wait for ACK or NACK End of go 1 See product datasheet for valid addresses ai15019 The host sends the bytes as follows Go command message Std ID 21h DLC 04h data MSB XXh YYh LSB Figure 34 Go command via CAN Device side Start go command Received message with std ID 21h and with a valid address Send ACK message Send NACK message Jump to address End of go ai15020 49 58 Bootloader command set UM0560 4 7 50 58 Sector code
27. e the boot ROM area and after checking certain address locations see Table 1 Initial checking on page 9 it starts to execute the user code via the reset vector 8000h in the Flash program memory The bootloader activation flowchart is described in Figure 1 on page 7 UM0560 Bootloader introduction Figure 1 Bootloader activation flow chart ROM reset 6000h Disable all interrupt sources 3rd condition verified Checks according to 18t condition verified ee 2nd condition verified Yes memory read out protected Is ROP active No memory not read out protected s an external clock present Initializes CAN at 125 Yes i a No kbps Configure HSI and initialize RX UART3 pin PD6 and RX UART1 pin PDA in GPIO mofe pull up state Configure SPI in slave mode Received a byte message SYNCHR Timeout 1 s Wait for SYNCHR SYNCHR failed GO cmd routine GET cmd RM cmd routine routine Remove EM and WM routines from the RAM Flash reset 8000h Jump to host address ai15360 1 See Flow chart description on page 8 for explanation of points 1 to 8 2 Dotted routines are loaded in RAM by the host They are removed by the go command before jumping to the Flash program memory to execute an application KYT 7 58 Bootloader introduction UM0560 8 58 Flow chart description 1 2 Disable all interrupt sources The
28. e the number of bytes to be written 1 byte the data N 1 bytes and the checksum Write the received data to RAM memory starting from the 00h location Flash data EEPROM address Yes aa Write the received data to the l memory from the start address Write the received data to RAM from the start address Yes Send NACK byte Send ACK byte End of write memory ai15014 1 For safety reasons no write routine is placed into ROM The write the received data to RAM from the start address see Figure 22 is performed in RAM The user therefore has to download the write routine in RAM before sending a write command a UM0560 Bootloader command set 4 4 2 Write memory command via SPI Figure 23 Write memory command via SPI Host side Send 31h CEh Send token byte Wait for ACK or NACK Send the start address 4 bytes and checksum Send token byte Send the number of bytes to be written 1 byte the data N 1 byte and checksum End of write memory ai15039 4 37 58 Bootloader command set UM0560 38 58 The delay is calculated as follows Delay 8 45 N 1 ms Where 0 lt N lt 127 Table 4 Examples of delay Write command Delay ms 128 bytes aligned with a memory block 8 45 128 bytes not aligned with a memory block 1082 The host sends the bytes as
29. from the start address see Figure 22 is performed in RAM The user therefore has to download the write routine in RAM before sending a write command 39 58 Bootloader command set UM0560 4 4 3 40 58 Write memory command via CAN Figure 25 Write memory command via CAN Host side Send write message std ID 31h Wait for ACK or NACK If NACK message received Send the data messages At same time the host checks whether it received a NACK message from the STM8A Send message with checksum Wait for ACK or NACK End of write memory ai15015 1 See product datasheet for valid addresses If the bootloader receives an invalid address an add error occurs see Table 6 Error table on page 55 a UM0560 Bootloader command set Note The host sends the messages as follows Command message Std ID 31h DLC 05h data MSB XXh YYh LSB N Ox N lt 127 If N gt 127 a cmd error occurs in the bootloader Data message 1 Std ID 04h DLC 1 1 to 8 data byte 11 byte 18 Data message 2 Std ID 04h DLC 2 1 to 8 data byte 21 byte 28 Data message 3 Std ID 04h DLC 3 1 to 8 data byte 31 byte 38 Data message M Std ID 04h DLC_M 1 to 8 data byte m1 byte M8 Checksum message Std ID 04h DLC 1 data XOR N N 1 data bytes DLC 14 DLC 2 4 DLC M 128 maximum The bootloader does not check the standard
30. heets December 2008 Rev 1 1 58 www st com Contents UM0560 Contents 1 Introductio Mr 1 2 Bootloader introduction ss EE RR RR RR RR RR RR RR RR RR RR ee 6 2 1 Bootloader activation ss choker eri ved seen eee Send ie VEREER ER ERE 6 3 Peripheral settings iss sd ss N N EE eee een we eae ees 10 3 1 VARTI SENINGS ius sEERS SERE EER DEER EER ved BEE RE XO doe m DER EE d 10 3 2 UART2Z and UARTA settings cess ex y ra tee eR ER GES WAG GURNA 10 3 3 SPL settings maabala ad Se RR Ee HA EE EG RD De G 11 34 GAN settings ikea e x Rx RR RR RR RE RE EE We RE ER pad 11 4 Bootloader command set RR RR ee RR RR RR RR RR RR RR ee 13 4 1 Get command usus HE REGE AG US EE ON 14 4 1 1 Get command via UART1 UART2 UART3 0 aa 14 4 1 2 Get command via SPI ee ee Ee Ee Ge ee ee see 16 4 1 3 Get command via CAN ie ee EE Se ee ees 18 4 2 Read memory command ss se EE ER ke ee ee 20 4 2 1 Read memory command via UART1 UART2 UART3 20 4 2 2 Read memory command via SPI is Ee 0c eee eee eee 22 4 2 3 Read memory command via CAN assassanin ss es ee Ge ee 25 4 3 Erase memory command ses ee ee eee ek ke ee eene 26 4 3 1 Erase memory command via UART1 UART2 UARTS 27 4 3 2 Erase memory command via SPI ee Se de dee ee ee 30 4 3 3 Erase memory command via CAN 0 2 2 32 4 4 Write memory command ss EE EE Ee ee EE ee 34 4 4 1 Write memory command vi
31. ing to data contained in the L messages data field J Send ACK message End of erase memory Send NACK message ai15012 1 For safety reasons no erase routine is placed into ROM The erase memory sector by sector according to data contained in the messages data field see Figure 20 is performed in RAM The user therefore has to download the erase routine in RAM before sending an erase command 33 58 Bootloader command set UM0560 4 4 4 4 1 34 58 Write memory command The write memory command allows the host to write data to any memory address RAM Flash program memory data EEPROM or registers starting from the received address Incoming data are always written in RAM before being loaded in the memory locations decided by the host The bootloader then checks whether the host wants to write in RAM or in the Flash program memory data EEPROM The maximum length of the block to be written for the STM8S is 128 data bytes To write the data in the Flash program memory data EEPROM memory locations the bootloader performs two different write operations WordWrite FastWordWrite Writes a byte in the Flash program memory data EEPROM It is used when the number of bytes N sent from the host is less than 128 In this case the bootloader performs the operation N times BlockWrite Writes a block in the Flash program memory data EEPROM It is used when the number of bytes N sent from the host is
32. ken Byte 12 N token 11h Command ID EEh Complement XYh host waits for ACK or NACK The start address Byte 4 MSB Byte 7 LSB Checksum XOR byte 4 byte 5 byte 6 byte 7 XYh host waits for ACK or NACK The number of bytes to be read 0 N lt 255 Checksum Complement of byte 10 XYh host waits for the 1 data byte XYh host waits for the N 1 data byte 23 58 Bootloader command set UM0560 Figure 12 Read memory command via SPI Device side Start read memory Received byte Ng 11h EEh Send ACK byte Receive the start address 4 bytes with checksum Address valid amp checksum OK Receive the number of bytes to be read 1 byte and the checksum byte Send NACK byte 5036 24 58 a UM0560 Bootloader command set 4 2 3 Read memory command via CAN The CAN message sent by the host is as follows e The ID contains the command type 11h e The data field contains a destination address 4 bytes byte 1 is the MSB and byte 4 is LSB of the address and the number of bytes N to be read Figure 13 Read memory command via CAN Host side Start read memory Send read message std ID 11h Wait for ACK or NACK ACK Receive N 1 messages from bootloader End of read memorya ai15008 1 The valid addresses are RAM Flash program memory data EEPROM and regis
33. lia Belgium Brazil Canada China Czech Republic Finland France Germany Hong Kong India Israel Italy Japan Malaysia Malta Morocco Singapore Spain Sweden Switzerland United Kingdom United States of America www st com a 58 58
34. loader command set UM0560 41 2 16 58 Get command via SPI Figure 5 Get command via SPI Host side Start get command Send 00h FFh Send token byte NACK Wait for ACK or NACK ACK Send token byte Receive 1 byte 05h Number of bytes Send token byte Receive 1 byte Bootloader version Send token byte Receive 1 byte 00h Get command ID Send token byte Receive 1 byte 11h Read command ID Send token byte Receive 1 byte 21h Go command ID Send token byte Receive 1 byte 31h Write command ID Send token byte Receive 1 byte 43h Erase command ID Send token byte End of get command Wait for ACK or NACK ai15033b a UM0560 Bootloader command set The host sends the bytes as follows Byte 1 00h Command ID Byte 2 FFh Complement Byte 3 token XYh host waits for ACK or NACK Byte 4 token XYh host waits for 05h Byte 4 token XYh host waits for ACK or NACK Figure 6 Get command via SPI Device side Start get command Received byte 00h FFh Send NACK byte Send ACK byte Send 1 byte Number of bytes version commands ai15034 The STM8S sends the bytes as follows Byte 1 ACK Byte 2 N 5 the number of bytes to be sent 1 1 lt N 1 lt 256 Byte 3 Bootloader version O version 255 Byte 4 00h Get command Byte 5 11h Read memory command Byte 6 21h Go com
35. mand Byte 7 31h Write memory command Byte 8 43h Erase memory command Byte 9 ACK 17 58 Bootloader command set UM0560 4 1 3 Get command via CAN Figure 7 Get command via CAN Host side or NACK ACK ait for AC or NACK Send message with std ID 00h version commands Receive 1 message Write command Receive 1 message Erase command End of get command ai15029 The host sends the messages as follows Command message Std ID 00h data length code DLC not important 18 58 a UM0560 Bootloader command set Figure 8 Get command via CAN Device side Start get command Received message with ID 00h Yes Send NACK message Send ACK message Send 1 message Number of bytes version commands Send 1 message Bootloader version Send 6 messages Supported commands Send ACK message Y End of get command ai15030 The STM8S sends the messages as follows Message 1 Message 2 Message 3 Message 4 Message 5 Message 6 Message 7 Message 8 Message 9 Message 10 Std ID 02h DLC 1 data ACK Std ID 02h DLC 1 data N 6 the number of bytes to be sent 1 1 lt N 1 lt 256 Std ID 02h DLC 1 data bootloader version O version lt 255 Std ID 02h DLC 1 data 00h Get command Std ID 02h DLC 1 data
36. mand specifications 1 The bootloader receives one byte which contains the number N of sectors to be erased N is device dependent 2 The bootloader receives N 1 bytes where each byte contains a sector code see UM0560 Bootloader command set 4 3 1 Erase memory command via UART1 UART2 UART3 Figure 15 Erase memory command via UART1 UART2 UARTS Host side Start erase memory Send 43h BCh NACK ait for AC or NACK Total erase Send FFh Send the number of sectors to be erased 1 byte Send Oo Send the sector codes Send checksum Wait for ACK or NACK End of erase memory ai15009 1 Memory erased 130 Kbytes for devices with 128 Kbytes of Flash program memory and 2 Kbytes of Data EEPROM and 33 Kbytes for devices with 32 Kbytes of Flash program memory and 1 Kbyte of Data EEPROM 2 Asector is 8 blocks i e 1 Kbyte for any device Therefore the granularity of the erase command is 1 Kbyte Warning If the host sends an erase command that includes some correct sector code and one or more forbidden sector codes the command fails 27 58 4 Bootloader command set UM0560 Note 28 58 The host sends the bytes as follows Byte 1 43h Command ID Byte 2 BCh Complement Byte 3 FFh or number of sectors to be erased 0 lt N lt M if N M a cmd error occurs in the bootloader afterwhich the bootloader receives N 1 data by
37. ram Write memory 31h memory data EEPROM memory starting from an address specified by the host Speed 03h Allows the baud rate for CAN run time to be changed Jumps to an address specified by the host to execute a Go aL loaded code When the bootloader receives a command via the UART1 UART2 UART3 CAN or SPI peripherals the general protocol is as follows The bootloader sends an ACK byte to the host and waits for an address and for a checksum byte both of which are checked when received If the address is valid and the checksum is correct the bootloader transmits an ACK byte otherwise it transmits a NACK byte and aborts the command When the address is valid and the checksum is correct the bootloader waits for the number of bytes to be transmitted N bytes and for its complemented byte checksum If the checksum is correct it then carries out the command starting from the received address If the checksum is incorrect it sends a NACK byte before aborting the command The bootloader protocol via UART1 UART2 UART3 and SPI are identical on the device side but differ regarding the host A token byte is needed when sending each byte to the host via SPI see Figure 5 Figure 11 Figure 17 Figure 23 and Figure 31 The bootloader protocol via CAN differs from all other peripherals The following sections are organised as follows e Commands via UART1 UART2 UART3 e Commands via SPI e Commands via CAN ky 13 58
38. roduction The main task of the bootloader is to download the application program into the internal memories through the UART1 UART2 UART3 SPI or CAN peripherals without using the SWIM protocol and dedicated hardware Data are provided by any device host capable of sending information through one of the above serial interfaces The bootloader permits downloading of application software into the device memories including the program memory using standard serial interfaces UART1 UART2 UART3 SPI and CAN without dedicated hardware It is a complementary solution to programming Via the SWIM debugging interface The bootloader code is stored in the internal boot ROM memory After a reset the bootloader code checks whether the program memory is virgin or whether a specific option byte is set allowing code modifications If these conditions are not fulfilled the bootloader resumes and the user application is started In case of a successful check the bootloader is executed When the bootloader procedure starts the main tasks are e Polling all supported serial interfaces to check which peripheral is used e Programming code data option bytes and or vector tables at the address es received from the host Bootloader activation The STMBS reset vector is located at the beginning of the boot ROM 6000h while the other vectors are in the Flash program memory starting at address 8004h The device executes the boot ROM jumps insid
39. s Table 5 STMB8S sector codes Sector code Flash program memory data EEPROM Flash program memory data EEPROM STM8S20xxx devices STM8S105xx devices 00h 8000h gt 83FFh 8000h gt 83FFh 01h 8400h gt 87FFh 8400h 87FFh 02h 8800h gt 8BFFh 8800h gt 8BFFh 03h BCOOh gt 8FFFh BCOOh s 8FFFh 04h 9000h gt 93FFh 9000h 93FFh 05h 9400h gt 97FFh 9400h 97FFh 06h 9800h 5 9BFFh 9800h 5 9BFFh 07h 9C00h gt 9FFFh 9C00h gt 9FFFh 08h A000h gt A3FFh A000h gt A3FFh 09h A400h A7FFh A400h A7FFh OAh A800h gt ABFFh A800h gt ABFFh OBh ACOOh gt AFFFh ACOOh gt AFFFh OCh BOOOh gt B3FFh BOOOh gt B3FFh ODh B400h gt B7FFh B400h gt B7FFh OEh B800h 5 BBFFh B800h gt BBFFh OFh BCOOh gt BFFFh BCOOh gt BFFFh 10h COOOh gt C3FFh C000h gt C3FFh 11h C400h gt C7FFh C400h gt C7FFh 12h C800h gt CBFFh C800h gt CBFFh 13h CCOOh gt CFFFh CCOOh CFFFh 14h D000h gt D3FFh DOOON gt D3FFh 15h D400h D7FFh D400h D7FFh 16h D800h DBFFh D800h gt DBFFh 17h DCOOh gt DFFFh DCOOh gt DFFFh 18h E000h gt E3FFh E000h gt E3FFh 19h E400h gt E7FFh E400h gt E7FFh 1Ah E800h 5 EBFFh E800h gt EBFFh 1Bh ECOOh gt EFFFh ECOOh gt EFFFh 1Ch FOOOh gt F3FFh F000h gt F3FFh 1Dh F400h gt F7FFh F400h gt F7FFh 1Eh F800h gt FBFFh F800h gt FB
40. ter addresses see product datasheet If the bootloader receives an invalid address an add error occurs see Table 6 Error table on page 55 The host sends the messages as follows Command message Std ID 11h DLC 05h data MSB XXh YYh LSB N where Ox N lt 255 Figure 14 Read memory command via CAN Device side Start read memory Heceived message with std ID 11h es Send ACK message Y Send NACK message Send N 1 messages to the host End of read memory 4 ai15008 25 58 Bootloader command set UM0560 Note 4 3 26 58 The STM8S sends the messages as follows ACK message Std ID 02h DLC 1 data ACK Data message 1 Std ID 02h DLC 1 data XXh Data message 2 Std ID 02h DLC 1 data XXh Data message N 1 Std ID 02h DLC 1 data XXh The bootloader sends as many data messages as bytes which can be read Erase memory command The erase memory command allows the host to erase sectors of the Flash program memory data EEPROM memory The bootloader receives the erase command message when the ID contains the command type 43h and the data field contains the sectors to be erased see Table 5 STM8S sector codes on page 50 A sector is 1 Kbyte therefore the granularity with the erase command is 8 blocks If the host wants to erase one byte the write command write 00h can be used Erase memory com
41. tes and the checksum i e the host completes the command N is product dependent M size of the Flash program memory in Kbyte size of Data EEPROM in Kbyte 1 For instance For STM8S20xxB M 129 as Flash program memory is 128 Kbytes and Data EEPROM memory is 2 Kbytes 128 2 1 For STM8S105x6 M 32 as Flash program memory is 32Kbytes and Data EEPROM is 1Kbyte 32 1 1 Byte 4 or N 1 bytes 00h or N 1 bytes and then checksum XOR N N 1 bytes UM0560 Bootloader command set a Figure 16 Erase memory command via UART1 UART2 UARTS Device side Start erase memory Received bytes No 43h BCh Yes Send ACK byte Receive the number of sectors to be erased 1 byte Yes lt FFn received No Receive the sector codes 00h No received Receive the checksum Yes Start total erase l Erase the corresponding sectors gt Send ACK byte Send NACK byte End of erase memory ai15010 1 For safety reasons no erase routine is placed into ROM The erase the corresponding sectors routine see Figure 16 is performed in RAM The user therefore has to download the erase routine in RAM before sending an erase command 29 58 Bootloader command set UM0560 4 3 2 30 58 Erase memory command via SPI Figure 17 Erase memory command via SPI Host side Send 43h BCh Send token byte Wait for ACK or NA
42. todetected by the bootloader When the user sends the byte 7Fh the bootloader automatically detects the baud rate and sets the UART2 or UART3 to the same baud rate Maximum baud rate 550 kbps minimum baud rate 4800 bps Mandatory To perform the automatic speed detection the RX line PD6 for UART3 has to be stable in the application board UART2 and UARTS peripherals are accessible via pins PD5 TX and PD6 RX UM0560 Peripheral settings 3 3 SPI settings The SPI settings are e 8 data bit LSB first e Bit rate Set by the host which acts as a master e Peripheral set in slave mode with NSS not used e Data polarity CPOL CPOH 0 Note 1 Before sending a token byte the host has to wait for a delay of a specified period of time If this period is not guantified it is equal to 6 us 2 The SPI peripheral is accessible via pins PC5 SCK PC6 MOSI and PD7 MISO 3 4 CAN settings To address additional devices on the same bus the CAN protocol provides a standard identifier field 11 bit and an optional extended identifier field 18 bit in the frame Figure 2 shows the CAN frame that uses the standard identifier only Figure 2 CAN frame Inter frame space Inter frame space Data frame standard identifier or overload frame 44 8 N ACK field Control field Arbitration field Data field CRC field ai15001 The CAN settings are e Standard identifier not extended
Download Pdf Manuals
Related Search