3. Embedded Flash memory interface

3.1 Introduction

The Flash memory interface manages CPU AHB I-Code and D-Code accesses to the Flash memory. It implements the erase and program Flash memory operations and the read and write protection mechanisms.

The Flash memory interface accelerates code execution with a system of instruction prefetch and cache lines.

3.2 Main features

• Flash memory read operations
• Flash memory program/erase operations
• Read / write protections
• Prefetch on I-Code
• 64 cache lines of 128 bits on I-Code
• 8 cache lines of 128 bits on D-Code

Figure 3 shows the Flash memory interface connection inside the system architecture.

Figure 3. Flash memory interface connection inside system architecture

Legend:

— Access to instruction in Flash memory
— Access to data and literal pool in Flash memory
— FLITF register access

MS31423V1

Figure 3: Flash memory interface connection inside system architecture. The diagram shows a Cortex-M4 with FPU connected to a system bus. The Cortex core is connected to the I-Code bus (purple), D-Code bus (green), and S bus (blue). The I-Code bus connects to the Flash interface, which is connected to the Flash memory via a 128-bit Flash memory bus. The D-Code bus connects to the AHB 32-bit instruction bus, which is connected to the Flash interface. The S bus connects to the AHB 32-bit data bus, which is connected to the FLITF registers. The FLITF registers are connected to the AHB 32-bit system bus. The AHB 32-bit system bus is connected to DMA1, DMA2, AHB periph1, SRAM and External memories, and AHB periph2. The legend indicates: purple line for Access to instruction in Flash memory, green line for Access to data and literal pool in Flash memory, and blue line for FLITF register access.

3.3 Embedded Flash memory

The Flash memory has the following main features:

• Capacity up to 1.5 Mbyte
• 128 bits wide data read
• Byte, half-word, word and double word write
• Sector and mass erase
• Memory organization

The Flash memory is organized as follows:

– A main memory block divided into 4 sectors of 16 Kbyte, plus 1 sector of 64 Kbyte and plus 11 sector of 128 Kbyte.
– System memory from which the device boots in System memory boot mode
– 512 OTP (one-time programmable) bytes for user data

The OTP area contains 32 additional bits used to lock the corresponding OTP data block.

– Option bytes to configure read and write protection, BOR level, watchdog software/hardware and reset when the device is in Standby or Stop mode.
• Low-power modes (for details refer to the Power control (PWR) section of the reference manual)

Table 5. Flash module organization

Block	Name	Block base addresses	Size
Main memory	Sector 0	0x0800 0000 - 0x0800 3FFF	16 Kbyte
	Sector 1	0x0800 4000 - 0x0800 7FFF	16 Kbyte
	Sector 2	0x0800 8000 - 0x0800 BFFF	16 Kbyte
	Sector 3	0x0800 C000 - 0x0800 FFFF	16 Kbyte
	Sector 4	0x0801 0000 - 0x0801 FFFF	64 Kbyte
	Sector 5	0x0802 0000 - 0x0803 FFFF	128 Kbyte
	Sector 6	0x0804 0000 - 0x0805 FFFF	128 Kbyte
	Sector 7	0x0806 0000 - 0x0807 FFFF	128 Kbyte
	Sector 8	0x0808 0000 - 0x0809 FFFF	128 Kbyte
	Sector 9	0x080A 0000 - 0x080B FFFF	128 Kbyte
	Sector 10	0x080C 0000 - 0x080D FFFF	128 Kbyte
	Sector 11	0x080E 0000 - 0x080F FFFF	128 Kbyte
	Sector 12	0x0810 0000 - 0x0811 FFFF	128 Kbyte
	Sector 13	0x0812 0000 - 0x0813 FFFF	128 Kbyte
	Sector 14	0x0814 0000 - 0x0815 FFFF	128 Kbyte
	Sector 15	0x0816 0000 - 0x0817 FFFF	128 Kbyte
System memory		0x1FFF 0000 - 0x1FFF 77FF	30 Kbyte

Table 5. Flash module organization (continued)

Block	Name	Block base addresses	Size
	OTP area	0x1FFF 7800 - 0x1FFF 7A0F	528 byte
	Option bytes	0x1FFF C000 - 0x1FFF C00F	16 byte

3.4 Read interface

3.4.1 Relation between CPU clock frequency and Flash memory read time

To correctly read data from Flash memory, the number of wait states (LATENCY) must be correctly programmed in the Flash access control register (FLASH_ACR) according to the frequency of the CPU clock (HCLK) and the supply voltage of the device.

• When VOS[1:0] = 0x01, the maximum value of $f_{HCLK} = 64$ MHz.
• When VOS[1:0] = 0x10, the maximum value of $f_{HCLK} = 84$ MHz.
• When VOS[1:0] = 0x11, the maximum value of $f_{HCLK} = 100$ MHz.

Table 6. Number of wait states according to CPU clock (HCLK) frequency

Wait states (WS) (LATENCY)	HCLK (MHz)
Wait states (WS) (LATENCY)	Voltage range 2.7 V - 3.6 V	Voltage range 2.4 V - 2.7 V	Voltage range 2.1 V - 2.4 V	Voltage range 1.7 V - 2.1 V
0 WS (1 CPU cycle)	$0 < HCLK \leq 25$	$0 < HCLK \leq 20$	$0 < HCLK \leq 18$	$0 < HCLK \leq 16$
1 WS (2 CPU cycles)	$25 < HCLK \leq 50$	$20 < HCLK \leq 40$	$18 < HCLK \leq 36$	$16 < HCLK \leq 32$
2 WS (3 CPU cycles)	$50 < HCLK \leq 75$	$40 < HCLK \leq 60$	$36 < HCLK \leq 54$	$32 < HCLK \leq 48$
3 WS (4 CPU cycles)	$75 < HCLK \leq 100$	$60 < HCLK \leq 80$	$54 < HCLK \leq 72$	$48 < HCLK \leq 64$
4 WS (5 CPU cycles)	-	$80 < HCLK \leq 100$	$72 < HCLK \leq 90$	$64 < HCLK \leq 80$
5 WS (6 CPU cycles)	-	-	$90 < HCLK \leq 100$	$80 < HCLK \leq 96$
6 WS (7 CPU cycles)	-	-	-	$96 < HCLK \leq 100$

After reset, the CPU clock frequency is 16 MHz and 0 wait state (WS) is configured in the FLASH_ACR register.

It is highly recommended to use the following software sequences to tune the number of wait states needed to access the Flash memory with the CPU frequency.

Increasing the CPU frequency

1. Program the new number of wait states to the LATENCY bits in the FLASH_ACR register
2. Check that the new number of wait states is taken into account to access the Flash memory by reading the FLASH_ACR register
3. Modify the CPU clock source by writing the SW bits in the RCC_CFGR register
4. If needed, modify the CPU clock prescaler by writing the HPRE bits in RCC_CFGR
5. Check that the new CPU clock source or/and the new CPU clock prescaler value is/are taken into account by reading the clock source status (SWS bits) or/and the AHB prescaler value (HPRE bits), respectively, in the RCC_CFGR register.

Decreasing the CPU frequency

1. Modify the CPU clock source by writing the SW bits in the RCC_CFGR register
2. If needed, modify the CPU clock prescaler by writing the HPRE bits in RCC_CFGR
3. Check that the new CPU clock source or/and the new CPU clock prescaler value is/are taken into account by reading the clock source status (SWS bits) or/and the AHB prescaler value (HPRE bits), respectively, in the RCC_CFGR register
4. Program the new number of wait states to the LATENCY bits in FLASH_ACR
5. Check that the new number of wait states is used to access the Flash memory by reading the FLASH_ACR register

Note: A change in CPU clock configuration or wait state (WS) configuration may not be effective straight away. To make sure that the current CPU clock frequency is the one you have configured, you can check the AHB prescaler factor and clock source status values. To make sure that the number of WS you have programmed is effective, you can read the FLASH_ACR register.

3.4.2 Adaptive real-time memory accelerator (ART Accelerator™)

The proprietary Adaptive real-time (ART) memory accelerator is optimized for STM32 industry-standard Arm® Cortex®-M4 with FPU processors. It balances the inherent performance advantage of the Arm® Cortex®-M4 with FPU over Flash memory technologies, which normally requires the processor to wait for the Flash memory at higher operating frequencies.

To release the processor full performance, the accelerator implements an instruction prefetch queue and branch cache which increases program execution speed from the 128-bit Flash memory. Based on CoreMark benchmark, the performance achieved thanks to the ART accelerator is equivalent to 0 wait state program execution from Flash memory at a CPU frequency up to 100 MHz.

Instruction prefetch

Each Flash memory read operation provides 128 bits from either four instructions of 32 bits or 8 instructions of 16 bits according to the program launched. So, in case of sequential code, at least four CPU cycles are needed to execute the previous read instruction line. Prefetch on the I-Code bus can be used to read the next sequential instruction line from the Flash memory while the current instruction line is being requested by the CPU. Prefetch is enabled by setting the PRFTEN bit in the FLASH_ACR register. This feature is useful if at least one wait state is needed to access the Flash memory.

Figure 4 shows the execution of sequential 32-bit instructions with and without prefetch when 3 WSs are needed to access the Flash memory.

Figure 4. Sequential 32-bit instruction execution

Without prefetch

@ 1	WAIT	F 1	D 1	E 1
	@ 2		F 2	D 2	E 2
			@ 3	F 3	D 3	E 3
			@ 4	F 4	D 4	E 4
			@ 5	WAIT	F 5	D 5	E 5
				@ 6	F 6	D 6	E 6
				@ 7	F 7	D 7
				@ 8	F 8

ins 1 fetch ins 2 fetch ins 3 fetch ins 4 fetch ins 5 fetch ins 6 fetch ins 7 fetch ins 8 fetch

Read ins 1, 2, 3, 4

Gives ins 1, 2, 3, 4

Read ins 5, 6, 7, 8

Gives ins 5, 6, 7, 8

With prefetch

@ 1	Wait data	F 1	D 1	E 1
	@ 2		F 2	D 2	E 2
			@ 3	F 3	D 3	E 3
			@ 4	F 4	D 4	E 4
			@ 5	F 5	D 5	E 5
			@ 6	F 6	D 6	E 6
			@ 7	F 7	D 7
			@ 8	F 8

ins 1 fetch ins 2 fetch ins 3 fetch ins 4 fetch ins 5 fetch ins 6 fetch ins 7 fetch ins 8 fetch

Read ins 1, 2, 3, 4	Gives ins 1, 2, 3, 4	Gives ins 5, 6, 7, 8	Read ins 9, 10, ...
	Read ins 5, 6, 7, 8

Cortex-M4 pipeline

AHB protocol

@ : address requested
F: Fetch stage
D: Decode stage
E: Execute stage

MS31831V1

Timing diagrams comparing instruction execution without prefetch and with prefetch. The 'Without prefetch' section shows a pipeline where the Fetch (F) stage is delayed by WAIT states for every instruction. The 'With prefetch' section shows a pipeline where the Fetch stage is overlaid with the Decode (D) and Execute (E) stages of the previous instruction, effectively hiding the latency. A legend defines the stages: @ (address requested), F (Fetch), D (Decode), E (Execute). A small diagram shows the Cortex-M4 pipeline stages and the AHB protocol.

When the code is not sequential (branch), the instruction may not be present in the currently used instruction line or in the prefetched instruction line. In this case (miss), the penalty in terms of number of cycles is at least equal to the number of wait states.

Instruction cache memory

To limit the time lost due to jumps, it is possible to retain 64 lines of 128 bits in an instruction cache memory. This feature can be enabled by setting the instruction cache enable (ICEN) bit in the FLASH_ACR register. Each time a miss occurs (requested data not present in the currently used instruction line, in the prefetched instruction line or in the instruction cache memory), the line read is copied into the instruction cache memory. If some data contained in the instruction cache memory are requested by the CPU, they are provided without inserting any delay. Once all the instruction cache memory lines have been filled, the LRU (least recently used) policy is used to determine the line to replace in the instruction memory cache. This feature is particularly useful in case of code containing loops.

Data management

Literal pools are fetched from Flash memory through the D-Code bus during the execution stage of the CPU pipeline. The CPU pipeline is consequently stalled until the requested literal pool is provided. To limit the time lost due to literal pools, accesses through the AHB databus D-Code have priority over accesses through the AHB instruction bus I-Code.

If some literal pools are frequently used, the data cache memory can be enabled by setting the data cache enable (DCEN) bit in the FLASH_ACR register. This feature works like the instruction cache memory, but the retained data size is limited to 8 rows of 128 bits.

Note: Data in user configuration sector are not cacheable.

3.5 Erase and program operations

For any Flash memory program operation (erase or program), the CPU clock frequency (HCLK) must be at least 1 MHz. The contents of the Flash memory are not guaranteed if a device reset occurs during a Flash memory operation.

Any attempt to read the Flash memory on STM32F4xx while it is being written or erased, causes the bus to stall. Read operations are processed correctly once the program operation has completed. This means that code or data fetches cannot be performed while a write/erase operation is ongoing.

3.5.1 Unlocking the Flash control register

After reset, write is not allowed in the Flash control register (FLASH_CR) to protect the Flash memory against possible unwanted operations due, for example, to electric disturbances. The following sequence is used to unlock this register:

1. Write KEY1 = 0x45670123 in the Flash key register (FLASH_KEYR)
2. Write KEY2 = 0xCDEF89AB in the Flash key register (FLASH_KEYR)

Any wrong sequence will return a bus error and lock up the FLASH_CR register until the next reset.

The FLASH_CR register can be locked again by software by setting the LOCK bit in the FLASH_CR register.

Note: The FLASH_CR register is not accessible in write mode when the BSY bit in the FLASH_SR register is set. Any attempt to write to it with the BSY bit set will cause the AHB bus to stall until the BSY bit is cleared.

3.5.2 Program/erase parallelism

The Parallelism size is configured through the PSIZE field in the FLASH_CR register. It represents the number of bytes to be programmed each time a write operation occurs to the Flash memory. PSIZE is limited by the supply voltage and by whether the external V _PPsupply is used or not. It must therefore be correctly configured in the FLASH_CR register before any programming/erasing operation.

A Flash memory erase operation can only be performed by sector or for the whole Flash memory (mass erase). The erase time depends on PSIZE programmed value. For more details on the erase time, refer to the electrical characteristics section of the device datasheet.

Table 7 provides the correct PSIZE values.

Table 7. Maximum program/erase parallelism

	Voltage range 2.7 - 3.6 V with External V _PP	Voltage range 2.7 - 3.6 V	Voltage range 2.4 - 2.7 V	Voltage range 2.1 - 2.4 V	Voltage range 1.7 V - 2.1 V
Maximum parallelism size	x64	x32		x16	x8
PSIZE(1:0)	11	10		01	00

Note: Any program or erase operation started with inconsistent program parallelism/voltage range settings may lead to unpredicted results. Even if a subsequent read operation indicates that the logical value was effectively written to the memory, this value may not be retained.

To use V _PP, an external high-voltage supply (between 8 and 9 V) must be applied to the V _PPpad. The external supply must be able to sustain this voltage range even if the DC consumption exceeds 10 mA. It is advised to limit the use of V _PPto initial programming on the factory line. The V _PPsupply must not be applied for more than an hour, otherwise the Flash memory might be damaged.

3.5.3 Erase

The Flash memory erase operation can be performed at sector level or on the whole Flash memory (Mass Erase). Mass Erase does not affect the OTP sector or the configuration sector.

Sector Erase

To erase a sector, follow the procedure below:

1. Check that no Flash memory operation is ongoing by checking the BSY bit in the FLASH_SR register
2. Set the SER bit and select the sector out of the 16 sectors in the main memory block you wish to erase (SNB) in the FLASH_CR register
3. Set the STRT bit in the FLASH_CR register
4. Wait for the BSY bit to be cleared

Mass Erase

To perform Mass Erase, the following sequence is recommended:

1. Check that no Flash memory operation is ongoing by checking the BSY bit in the FLASH_SR register
2. Set the MER bit in the FLASH_CR register
3. Set the STRT bit in the FLASH_CR register
4. Wait for the BSY bit to be cleared

Note: If MERx and SER bits are both set in the FLASH_CR register, mass erase is performed. If both MERx and SER bits are reset and the STRT bit is set, an unpredictable behavior may occur without generating any error flag. This condition should be forbidden.

3.5.4 Programming

Standard programming

The Flash memory programming sequence is as follows:

1. Check that no main Flash memory operation is ongoing by checking the BSY bit in the FLASH_SR register.
2. Set the PG bit in the FLASH_CR register
3. Perform the data write operation(s) to the desired memory address (inside main memory block or OTP area):
- – Byte access in case of x8 parallelism
- – Half-word access in case of x16 parallelism
- – Word access in case of x32 parallelism
- – Double word access in case of x64 parallelism
4. Wait for the BSY bit to be cleared.

Note: Successive write operations are possible without the need of an erase operation when changing bits from '1' to '0'. Writing '1' requires a Flash memory erase operation. If an erase and a program operation are requested simultaneously, the erase operation is performed first.

Programming errors

It is not allowed to program data to the Flash memory that would cross the 128-bit row boundary. In such a case, the write operation is not performed and a program alignment error flag (PGAERR) is set in the FLASH_SR register.

The write access type (byte, half-word, word or double word) must correspond to the type of parallelism chosen (x8, x16, x32 or x64). If not, the write operation is not performed and a program parallelism error flag (PGPERR) is set in the FLASH_SR register.

If the standard programming sequence is not respected (for example, if there is an attempt to write to a Flash memory address when the PG bit is not set), the operation is aborted and a program sequence error flag (PGSERR) is set in the FLASH_SR register.

Programming and caches

If a Flash memory write access concerns some data in the data cache, the Flash write access modifies the data in the Flash memory and the data in the cache.

If an erase operation in Flash memory also concerns data in the data or instruction cache, you have to make sure that these data are rewritten before they are accessed during code execution. If this cannot be done safely, it is recommended to flush the caches by setting the DCRST and ICRST bits in the FLASH_CR register.

Note: The I/D cache should be flushed only when it is disabled (I/DCEN = 0).

3.5.5 Interrupts

Setting the end of operation interrupt enable bit (EOPIE) in the FLASH_CR register enables interrupt generation when an erase or program operation ends, that is when the busy bit (BSY) in the FLASH_SR register is cleared (operation completed, correctly or not). In this case, the end of operation (EOP) bit in the FLASH_SR register is set.

If an error occurs during a program, an erase, or a read operation request, one of the following error flags is set in the FLASH_SR register:

• PGAERR, PGPERR, PGSERR (Program error flags)
• WRPERR (Protection error flag)

In this case, if the error interrupt enable bit (ERRIE) is set in the FLASH_CR register, an interrupt is generated and the operation error bit (OPERR) is set in the FLASH_SR register.

Note: If several successive errors are detected (for example, in case of DMA transfer to the Flash memory), the error flags cannot be cleared until the end of the successive write requests.

Table 8. Flash interrupt request

Interrupt event	Event flag	Enable control bit
End of operation	EOP	EOPIE
Write protection error	WRPERR	ERRIE
Programming error	PGAERR, PGPERR, PGSERR	ERRIE

3.6 Option bytes

3.6.1 Description of user option bytes

The option bytes are configured by the end user depending on the application requirements. Table 9 shows the organization of these bytes inside the user configuration sector.

Table 9. Option byte organization

Address	[63:16]	[15:0]
0x1FFF C000	Reserved	ROP & user option bytes (RDP & USER)
0x1FFF C008	Reserved	Write protection nWRP bits for sectors 0 to 15

Table 10. Description of the option bytes

Option bytes (word, address 0x1FFF C000)
RDP: Read protection option byte. The read protection is used to protect the software code stored in Flash memory.
Bits 15:8	0xAA: Level 0, no protection 0xCC: Level 2, chip protection (debug and boot from RAM features disabled) Others: Level 1, read protection of memories (debug features limited)
USER: User option byte This byte is used to configure the following features: – Select the watchdog event: Hardware or software – Reset event when entering the Stop mode – Reset event when entering the Standby mode
Bit 7	nRST_STDBY 0: Reset generated when entering the Standby mode 1: No reset generated
Bit 6	nRST_STOP 0: Reset generated when entering the Stop mode 1: No reset generated
Bit 5	WDG_SW 0: Hardware independent watchdog 1: Software independent watchdog
Bit 4	0x1: Not used
Bits 3:2	BOR_LEV: BOR reset Level These bits contain the supply level threshold that activates/releases the reset. They can be written to program a new BOR level value into Flash memory. 00: BOR Level 3 (VBOR3), brownout threshold level 3 01: BOR Level 2 (VBOR2), brownout threshold level 2 10: BOR Level 1 (VBOR1), brownout threshold level 1 11: BOR off, POR/PDR reset threshold level is applied Note: For full details on BOR characteristics, refer to the “Electrical characteristics” section of the product datasheet.
Bits 1:0	0x1: Not used
Option bytes (word, address 0x1FFF C008)
Bit 15	SPRMOD: Selection of Protection Mode of nWPRI bits 0: nWPRI bits used for sector i write protection (Default) 1: nWPRI bits used for sector i PCROP protection (Sector)
nWRP: Flash memory write protection option bytes sector 0 to 15 can be write protected

Table 10. Description of the option bytes

Bit 14	nWRP15_14: Non Write Protection of sector 15 and 14 If SPRMOD is reset (default value): 0: Write protection active on sector 15 and 14. 1: Write protection not active on sector 15 and 14. If SPRMOD is set (active): 0: PCROP protection not active on sector 15 and 14. 1: PCROP protection active on sector 15 and 14.
Bits 13:0	nWRPi If SPRMOD is reset (default value): 0: Write protection active on sector i. 1: Write protection not active on sector i. If SPRMOD is set (active): 0: PCROP protection not active on sector i. 1: PCROP protection active on sector i.

3.6.2 Programming user option bytes

To run any operation on this sector, the option lock bit (OPTLOCK) in the Flash option control register (FLASH_OPTCR) must be cleared. To be allowed to clear this bit, you have to perform the following sequence:

1. Write OPTKEY1 = 0x0819 2A3B in the Flash option key register (FLASH_OPTKEYR)
2. Write OPTKEY2 = 0x4C5D 6E7F in the Flash option key register (FLASH_OPTKEYR)

The user option bytes can be protected against unwanted erase/program operations by setting the OPTLOCK bit by software.

Modifying user option bytes

To modify the user option value, follow the sequence below:

1. Check that no Flash memory operation is ongoing by checking the BSY bit in the FLASH_SR register
2. Write the desired option value in the FLASH_OPTCR register.
3. Set the option start bit (OPTSTRT) in the FLASH_OPTCR register
4. Wait for the BSY bit to be cleared.

Note: The value of an option is automatically modified by first erasing the user configuration sector and then programming all the option bytes with the values contained in the FLASH_OPTCR register.

3.6.3 Read protection (RDP)

The user area in the Flash memory can be protected against read operations by an entrusted code. Three read protection levels are defined:

• Level 0: no read protection

When the read protection level is set to Level 0 by writing 0xAA into the read protection option byte (RDP), all read/write operations (if no write protection is set) from/to the

Flash memory are possible in all boot configurations (Flash user boot, debug or boot from RAM).

• Level 1: read protection enabled

It is the default read protection level after option byte erase. The read protection Level 1 is activated by writing any value (except for 0xAA and 0xCC used to set Level 0 and Level 2, respectively) into the RDP option byte. When the read protection Level 1 is set:

– No access (read, erase, program) to Flash memory can be performed while the debug feature is connected or while booting from RAM or system memory bootloader. A bus error is generated in case of read request.
– When booting from Flash memory, accesses (read, erase, program) to Flash memory from user code are allowed.

When Level 1 is active, programming the protection option byte (RDP) to Level 0 causes the Flash memory to be mass-erased. As a result the user code area is cleared before the read protection is removed. The mass erase only erases the user code area. The other option bytes including write protections remain unchanged from before the mass-erase operation. The OTP area is not affected by mass erase and remains unchanged. Mass erase is performed only when Level 1 is active and Level 0 requested. When the protection level is increased (0->1, 1->2, 0->2) there is no mass erase.

• Level 2: debug/chip read protection disabled

The read protection Level 2 is activated by writing 0xCC to the RDP option byte. When the read protection Level 2 is set:

– All protections provided by Level 1 are active.
– Booting from RAM or system memory bootloader is no more allowed.
– JTAG, SWV (single-wire viewer), ETM, and boundary scan are disabled.
– User option bytes can no longer be changed.
– When booting from Flash memory, accesses (read, erase and program) to Flash memory from user code are allowed.

Memory read protection Level 2 is an irreversible operation. When Level 2 is activated, the level of protection cannot be decreased to Level 0 or Level 1.

Note: The JTAG port is permanently disabled when Level 2 is active (acting as a JTAG fuse). As a consequence, boundary scan cannot be performed. STMicroelectronics is not able to perform analysis on defective parts on which the Level 2 protection has been set.

Note: If the read protection is set while the debugger is still connected (or had been connected since the last power on) through JTAG/SWD, apply a POR (power-on reset) instead of a system reset. If the read protection is programmed through software, do not set the OBL_LAUNCH bit (FLASH_CR register) but perform a POR to reload the option byte. This can be done with a transition Standby (or Shutdown) mode followed by a wakeup.

Table 11. Access versus read protection level

Memory area	Protection Level	Debug features, Boot from RAM or from System memory bootloader			Booting from Flash memory
Memory area	Protection Level	Read	Write	Erase	Read	Write	Erase
Main Flash Memory	Level 1	NO		NO ⁽¹⁾	YES
Main Flash Memory	Level 2	NO			YES
Option Bytes	Level 1	YES			YES
Option Bytes	Level 2	NO			NO
OTP	Level 1	NO		NA	YES		NA
OTP	Level 2	NO		NA	YES		NA

1. The main Flash memory is only erased when the RDP changes from level 1 to 0. The OTP area remains unchanged.

Figure 5 shows how to go from one RDP level to another.

Figure 5. RDP levels

The diagram illustrates the transitions between three Read Protection (RDP) levels:

Level 1 (Default): RDP != AAh & RDP != CCh. This is the starting point for all transitions.
Level 0: RDP = AAh. Reached from Level 1 by writing options including RDP = AAh. From Level 0, one can go to Level 1 (write options including RDP != CCh & RDP != AAh) or Level 2 (write options including RDP = CCh). Self-loops on Level 0 allow modifying other options while keeping RDP = AAh.
Level 2: RDP = CCh. Reached from Level 1 by writing options including RDP = CCh. From Level 2, one can go to Level 1 (write options including RDP != CCh & RDP != AAh) or Level 0 (write options including RDP = AAh). Self-loops on Level 2 allow modifying other options while keeping RDP = CCh.

Legend:

Options write (RDP level increase) includes:
- - Options erase
- - New options program
Options write (RDP level decrease) includes:
- - Mass erase
- - Options erase
- - New options program
Options write (RDP level identical) includes:
- - Options erase
- - New options program

ai16045

Figure 5. RDP levels diagram showing transitions between Level 0, Level 1, and Level 2. Level 1 is the default state (RDP != AAh, RDP != CCh). Level 0 has RDP = AAh. Level 2 has RDP = CCh. Transitions are shown with arrows and associated write options.

3.6.4 Write protections

Up to 16 user sectors in Flash memory can be protected against unwanted write operations due to loss of program counter contexts. When the non-write protection nWRPi bit ( $0 \leq i \leq 14$ ) in the FLASH_OPTCR registers is low, the corresponding sector cannot be erased or programmed. Consequently, a mass erase cannot be performed if one of the sectors is write-protected.

If an erase/program operation to a write-protected part of the Flash memory is attempted (sector protected by write protection bit, OTP part locked or part of the Flash memory that can never be written like the ICP), the write protection error flag (WRPERR) is set in the FLASH_SR register.

Note: When the memory read protection level is selected (RDP level = 1), it is not possible to program or erase Flash memory sector i if the CPU debug features are connected (JTAG or single wire) or boot code is being executed from RAM, even if nWRPi = 1.
Sector 14 and 15 are linked together and cannot be write-protected separately.

Write protection error flag

If an erase/program operation to a write protected area of the Flash memory is performed, the Write Protection Error flag (WRPERR) is set in the FLASH_SR register.

If an erase operation is requested, the WRPERR bit is set when:

• Mass, sector erase are configured (MER or MER/MER1 and SER = 1)
• A sector erase is requested and the Sector Number SNB field is not valid
• A mass erase is requested while at least one of the user sector is write protected by option bit (MER or MER/MER1 = 1 and nWRPi = 0 with $0 \leq i \leq 14$ bits in the FLASH_OPTCRx register)
• A sector erase is requested on a write protected sector. (SER = 1, SNB = i and nWRPi = 0 with $0 \leq i \leq 14$ bits in the FLASH_OPTCRx register)
• The Flash memory is readout protected and an intrusion is detected.

If a program operation is requested, the WRPERR bit is set when:

• A write operation is performed on system memory or on the reserved part of the user specific sector.
• A write operation is performed to the user configuration sector
• A write operation is performed on a sector write protected by option bit.
• A write operation is requested on an OTP area which is already locked
• The Flash memory is read protected and an intrusion is detected.

3.6.5 Proprietary code readout protection (PCROP)

Flash memory user sectors (0 to 15) can be protected against D-bus read accesses by using the proprietary readout protection (PCROP).

The PCROP protection is selected as follows, through the SPRMOD option bit in the FLASH_CR register:

• SPRMOD = 0: nWRPi control the write protection of respective user sectors
• SPRMOD = 1: nWRPi control the read and write protection (PCROP) of respective user sectors.

When a sector is readout protected (PCROP mode activated), it can only be accessed for code fetch through ICODE Bus on Flash interface:

• Any read access performed through the D-bus triggers a RDERR flag error.
• Any program/erase operation on a PCROPed sector triggers a WRPERR flag error.

Figure 6. PCROP levels

Diagram showing PCROP levels (Level 0, Level 1, Level 2) and transitions between them with write option restrictions.

The diagram illustrates the relationship between PCROP levels and write options:

Level 1: RDP != 0xAA, RDP != 0xCC default. It has a self-loop for 'Program new options' (green line) labeled 'Write options SPMOD = active and valid nWRPi*'. It has a blue arrow to Level 2 labeled 'Write options SPMOD = active and valid nWRPi*'. It has a purple arrow to Level 0 labeled 'Write options SPMOD = active and valid nWRPi*'. It also has a purple arrow from Level 0 back to Level 1 labeled 'No restriction on Write options'.
Level 2: RDP = 0xCC. It has a blue arrow from Level 1. It has a purple arrow from Level 0. It has a blue arrow to Level 0 labeled 'Write options SPMOD = active and valid nWRPi*'. It has a self-loop for 'Program new options' (green line) labeled 'Write options SPMOD = active and valid nWRPi*'. It has a purple arrow to Level 1 labeled 'Write options SPMOD = active and valid nWRPi*'. It also has a purple arrow from Level 1 back to Level 2 labeled 'No restriction on Write options'.
Level 0: RDP = 0xAA. It has a purple arrow from Level 1. It has a purple arrow from Level 2. It has a blue arrow to Level 1 labeled 'Write options SPMOD = active and valid nWRPi*'. It has a blue arrow to Level 2 labeled 'Write options SPMOD = active and valid nWRPi*'. It has a self-loop for 'Program new options' (green line) labeled 'Write options SPMOD = active and valid nWRPi*'. It also has a purple arrow from Level 2 back to Level 0 labeled 'No restriction on Write options'.

Legend:

Blue line: User option sector erase
Green line: Program new options
Purple line: Global mass erase, User option section erase, Program new options

* Valid nWRPi means that none of the nWRP bits set can be reset (transition from 1 to 0)

MS30467V1

Diagram showing PCROP levels (Level 0, Level 1, Level 2) and transitions between them with write option restrictions.

The deactivation of the SPRMOD and/or the unprotection of PCROPed user sectors can only occur when, at the same time, the RDP level changes from 1 to 0. If this condition is not respected, the user option byte modification is canceled and the write error WRPERR flag is set. The modification of the users option bytes (BOR_LEV, RST_STDBY, ..) is allowed since none of the active nWRPi bits is reset and SPRMOD is kept active.

Note: The active value of nWRPi bits is inverted when PCROP mode is active (SPRMOD =1).

3.7 One-time programmable bytes

Table 12 shows the organization of the one-time programmable (OTP) part of the OTP area.

Table 12. OTP area organization

Block	[128:96]	[95:64]	[63:32]	[31:0]	Address byte 0
0	OTP0	OTP0	OTP0	OTP0	0x1FFF 7800
0	OTP0	OTP0	OTP0	OTP0	0x1FFF 7810
1	OTP1	OTP1	OTP1	OTP1	0x1FFF 7820
1	OTP1	OTP1	OTP1	OTP1	0x1FFF 7830
.					.
.					.
.					.
15	OTP15	OTP15	OTP15	OTP15	0x1FFF 79E0
15	OTP15	OTP15	OTP15	OTP15	0x1FFF 79F0
Lock block	LOCKB15 ... LOCKB12	LOCKB11 ... LOCKB8	LOCKB7 ... LOCKB4	LOCKB3 ... LOCKB0	0x1FFF 7A00

The OTP area is divided into 16 OTP data blocks of 32 bytes and one lock OTP block of 16 bytes. The OTP data and lock blocks cannot be erased. The lock block contains 16 bytes LOCKBi ( $0 \leq i \leq 15$ ) to lock the corresponding OTP data block (blocks 0 to 15). Each OTP data block can be programmed until the value 0x00 is programmed in the corresponding OTP lock byte. The lock bytes must only contain 0x00 and 0xFF values, otherwise the OTP bytes might not be taken into account correctly.

3.8 Flash interface registers

3.8.1 Flash access control register (FLASH_ACR)

The Flash access control register is used to enable/disable the acceleration features and control the Flash memory access time according to CPU frequency.

Address offset: 0x00

Reset value: 0x0000 0000

Access: no wait state, word, half-word and byte access

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Res.	Res.	Res.	DCRST	ICRST	DCEN	ICEN	PRFTEN	Res.	Res.	Res.	Res.	LATENCY
			rw	w	rw	rw	rw					rw	rw	rw	rw

Bits 31:13 Reserved, must be kept cleared.

Bit 12 DCRST : Data cache reset

0: Data cache is not reset

1: Data cache is reset

This bit can be written only when the D cache is disabled.

Bit 11 ICRST : Instruction cache reset

0: Instruction cache is not reset

1: Instruction cache is reset

This bit can be written only when the I cache is disabled.

Bit 10 DCEN : Data cache enable

0: Data cache is disabled

1: Data cache is enabled

Bit 9 ICEN : Instruction cache enable

0: Instruction cache is disabled

1: Instruction cache is enabled

Bit 8 PRFTEN : Prefetch enable

0: Prefetch is disabled

1: Prefetch is enabled

Bits 7:4 Reserved, must be kept cleared.

Bits 3:0 LATENCY : Latency

These bits represent the ratio of the CPU clock period to the Flash memory access time.

0000: Zero wait state

0001: One wait state

0010: Two wait states

1110: Fourteen wait states

1111: Fifteen wait states

3.8.2 Flash key register (FLASH_KEYR)

The Flash key register is used to allow access to the Flash control register and so, to allow program and erase operations.

Address offset: 0x04

Reset value: 0x0000 0000

Access: no wait state, word access

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
KEY[31:16]
w	w	w	w	w	w	w	w	w	w	w	w	w	w	w	w
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
KEY[15:0]
w	w	w	w	w	w	w	w	w	w	w	w	w	w	w	w

Bits 31:0 FKEYR : FPEC key

The following values must be programmed consecutively to unlock the FLASH_CR register and allow programming/erasing it:

KEY1 = 0x45670123
KEY2 = 0xCDEF89AB

3.8.3 Flash option key register (FLASH_OPTKEYR)

The Flash option key register is used to allow program and erase operations in the user configuration sector.

Address offset: 0x08

Reset value: 0x0000 0000

Access: no wait state, word access

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
OPTKEYR[31:16]
w	w	w	w	w	w	w	w	w	w	w	w	w	w	w	w
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
OPTKEYR[15:0]
w	w	w	w	w	w	w	w	w	w	w	w	w	w	w	w

Bits 31:0 OPTKEYR : Option byte key

The following values must be programmed consecutively to unlock the FLASH_OPTCR register and allow programming it:

OPTKEY1 = 0x08192A3B
OPTKEY2 = 0x4C5D6E7F

3.8.4 Flash status register (FLASH_SR)

The Flash status register gives information on ongoing program and erase operations.

Address offset: 0x0C

Reset value: 0x0000 0000

Access: no wait state, word, half-word and byte access

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	BSY
															r
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Res.	Res.	Res.	Res.	Res.	Res.	Res.	RDERR	PGSERR	PGPERR	PGAERR	WRPERR	Res.	Res.	OPERR	EOP
							rw	rc_w1	rc_w1	rc_w1	rc_w1			rc_w1	rc_w1

Bits 31:17 Reserved, must be kept cleared.

Bit 16 BSY : Busy

This bit indicates that a Flash memory operation is in progress. It is set at the beginning of a Flash memory operation and cleared when the operation finishes or an error occurs.

0: no Flash memory operation ongoing

1: Flash memory operation ongoing

Bits 15:9 Reserved, must be kept cleared.

Bit 8 RDERR : Read Protection Error (PCROP)

Set by hardware when an address to be read through the Dbus belongs to a read protected part of the flash.

Reset by writing 1.

Bit 7 PGSERR : Programming sequence error

Set by hardware when a write access to the Flash memory is performed by the code while the control register has not been correctly configured.

Cleared by writing 1.

Bit 6 PGPERR : Programming parallelism error

Set by hardware when the size of the access (byte, half-word, word, double word) during the program sequence does not correspond to the parallelism configuration PSIZE (x8, x16, x32, x64).

Cleared by writing 1.

Bit 5 PGAERR : Programming alignment error

Set by hardware when the data to program cannot be contained in the same 128-bit Flash memory row.

Cleared by writing 1.

Bit 4 WRPERR : Write protection error

Set by hardware when an address to be erased/programmed belongs to a write-protected part of the Flash memory.

Cleared by writing 1.

Bits 3:2 Reserved, must be kept cleared.

Bit 1 OPERR : Operation error

Set by hardware when a flash operation (programming / erase /read) request is detected and can not be run because of parallelism, alignment, or write protection error. This bit is set only if error interrupts are enabled (ERRIE = 1).

Bit 0 EOP : End of operation

Set by hardware when one or more Flash memory operations (program/erase) has/have completed successfully. It is set only if the end of operation interrupts are enabled (EOPIE = 1).

Cleared by writing a 1.

3.8.5 Flash control register (FLASH_CR)

The Flash control register is used to configure and start Flash memory operations.

Address offset: 0x10

Reset value: 0x8000 0000

Access: no wait state when no Flash memory operation is ongoing, word, half-word and byte access.

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
LOCK	Res.	Res.	Res.	Res.	Res.	ERRIE	EOPIE	Res.	Res.	Res.	Res.	Res.	Res.	Res.	STRT
rs						rw	rw								rs
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
Res.	Res.	Res.	Res.	Res.	Res.	PSIZE[1:0]	Res.	SNB[3:0]					MER	SER	PG
						rw	rw		rw	rw	rw	rw	rw	rw	rw

Bit 31 LOCK : Lock

Write to 1 only. When it is set, this bit indicates that the FLASH_CR register is locked. It is cleared by hardware after detecting the unlock sequence.

In the event of an unsuccessful unlock operation, this bit remains set until the next reset.

Bits 30:26 Reserved, must be kept cleared.

Bit 25 ERRIE : Error interrupt enable

This bit enables the interrupt generation when the OPERR bit in the FLASH_SR register is set to 1.

0: Error interrupt generation disabled

1: Error interrupt generation enabled

Bit 24 EOPIE : End of operation interrupt enable

This bit enables the interrupt generation when the EOP bit in the FLASH_SR register goes to 1.

0: Interrupt generation disabled

1: Interrupt generation enabled

Bits 23:17 Reserved, must be kept cleared.

Bit 16 STRT : Start

This bit triggers an erase operation when set. It is set only by software and cleared when the BSY bit is cleared.

Bits 15:10 Reserved, must be kept cleared.

Bits 9:8 PSIZE : Program size

These bits select the program parallelism.

00 program x8

01 program x16

10 program x32

11 program x64

Bit 7 Reserved, must be kept cleared.

Bits 6:3 SNB : Sector number

These bits select the sector to erase.

0000 sector 0

0001 sector 1

...

1010 sector 10

1011 sector 11

1100 sector 12

1101 sector 13

1110 sector 14

1111 sector 15

Bit 2 MER : Mass Erase

Erase activated for all user sectors.

Bit 1 SER : Sector Erase

Sector Erase activated.

Bit 0 PG : Programming

Flash programming activated.

3.8.6 Flash option control register (FLASH_OPTCR)

The FLASH_OPTCR register is used to modify the user option bytes.

Address offset: 0x14

Reset value: 0x7FFF AAED

The option bits are loaded with values from Flash memory at reset release.

Access: no wait state when no Flash memory operation is ongoing, word, half-word and byte access.

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16
SPR MOD	nWRP 14_15	nWRP[13:0]
rw	rw	rw	rw	rw	rw	rw	rw	rw	rw	rw	rw	rw	rw	rw	rw
15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RDP[7:0]							nRST_ STDBY	nRST_ STOP	WDG_ SW	Res.	BOR_LEV		OPT STRT	OPT LOCK
rw	rw	rw	rw	rw	rw	rw	rw	rw	rw		rw	rw	rs	rs

Bit 31 SPRMOD : Selection of Protection Mode of nWPRI bits

0: PCROP disabled, nWPRI bits used for Write Protection on sector i
1: PCROP enabled, nWPRI bits used for PCROP Protection on sector i

Bit 30 nWRP14_15 : Not write protect

This bit contains the value of the write-protection option byte of sectors 14 and 15. They can be written to program a new write protect value into Flash memory. Sectors 14 and 15 are linked together and cannot be programmed separately

0: Write protection active on sectors 14 and 15
1: Write protection not active on sectors 14 and 15

These bits contain the value of the write-protection and read-protection (PCROP) option bytes for sectors 14 and 15 after reset. They can be written to program a new write-protect or PCROP value into Flash memory.

If SPRMOD is reset:

0: Write protection active on sectors 14 and 15
1: Write protection not active on sectors 14 and 15

If SPRMOD is set:

0: PCROP protection not active on sectors 14 and 15
1: PCROP protection active on sectors 14 and 15

Bits 29:16 nWRP[13:0] : Not write protect

These bits contain the value of the write-protection option bytes of sectors after reset. They can be written to program a new write protect value into Flash memory.

0: Write protection active on selected sector
1: Write protection not active on selected sector

These bits contain the value of the write-protection and read-protection (PCROP) option bytes for sectors 0 to 13 after reset. They can be written to program a new write-protect or PCROP value into Flash memory.

If SPRMOD is reset:

0: Write protection active on sector i
1: Write protection not active on sector i

If SPRMOD is set:

0: PCROP protection not active on sector i
1: PCROP protection active on sector i

Bits 15:8 RDP : Read protect

These bits contain the value of the read-protection option level after reset. They can be written to program a new read protection value into Flash memory.

0xAA: Level 0, read protection not active
0xCC: Level 2, chip read protection active
Others: Level 1, read protection of memories active

Bits 7:5 USER : User option bytes

These bits contain the value of the user option byte after reset. They can be written to program a new user option byte value into Flash memory.

Bit 7: nRST_STDBY
Bit 6: nRST_STOP
Bit 5: WDG_SW

Note: When changing the WDG mode from hardware to software or from software to hardware, a system reset is required to make the change effective.

Bit 4 Reserved, must be kept cleared. Always read as "0".

Bits 3:2 BOR_LEV: BOR reset Level

These bits contain the supply level threshold that activates/releases the reset. They can be written to program a new BOR level. By default, BOR is off. When the supply voltage (V _DD) drops below the selected BOR level, a device reset is generated.

00: BOR Level 3 (VBOR3), brownout threshold level 3
01: BOR Level 2 (VBOR2), brownout threshold level 2
10: BOR Level 1 (VBOR1), brownout threshold level 1
11: BOR off, POR/PDR reset threshold level is applied

Note: For full details about BOR characteristics, refer to the “Electrical characteristics” section in the device datasheet.

Bit 1 OPTSTRT: Option start

This bit triggers a user option operation when set. It is set only by software and cleared when the BSY bit is cleared.

Bit 0 OPTLOCK: Option lock

Write to 1 only. When this bit is set, it indicates that the FLASH_OPTCR register is locked.
This bit is cleared by hardware after detecting the unlock sequence.
In the event of an unsuccessful unlock operation, this bit remains set until the next reset.

3.8.7 Flash interface register map

Table 13. Flash register map and reset values

Offset	Register	31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
0x00	FLASH_ACR	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	DORST	ICRST	DCEN	ICEN	PRFTEN	Res.	Res.	Res.	Res.	LATENCY
0x00	Reset value																				0	0	0	0	0					0	0	0	0
0x04	FLASH_KEYR	KEY[31:16]
0x04	Reset value	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
0x08	FLASH_OPTKEYR	OPTKEYR[31:16]
0x08	Reset value	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
0x0C	FLASH_SR	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	Res.	BSY	Res.	Res.	Res.	Res.	Res.	Res.	Res.	RDERR	PGSERR	PGPERR	PGAERR	WRPERR	Res.	Res.	Res.	EOP
0x0C	Reset value																0								0	0	0	0	0			0	0
0x10	FLASH_CR	LOCK	Res.	Res.	Res.	Res.	Res.	ERRIE	EOPIE	Res.	Res.	Res.	Res.	Res.	Res.	Res.	STRT	Res.	Res.	Res.	Res.	Res.	Res.	PSIZE[1:0]		Res.	SNB[3:0]			MER	SER	PG
0x10	Reset value	1						0	0								0							0	0		0	0	0	0	0	0	0
0x14	FLASH_OPTCR	SPRMOD	nWRP14_15	nWRP[13:0]																						nRST_STDB	nRST_STOP	WDG_SW	Res.	BOR_LEV	OPTSTRT	OPTLOCK
0x14	Reset value	0	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1	0	0	1	0	1	0	1	0	1	1	1		1	1	0	1

Refer to Section 2.2 on page 57 for the register boundary addresses.