3. Embedded flash memory (FLASH)

3.1 FLASH introduction

The flash memory interface manages the CPU AHB ICode and DCode accesses to the flash memory. It implements the access, the erase and program flash memory operations, and the read and write protection.

The flash memory interface accelerates code execution with a system of instruction prefetch and cache lines.

3.2 FLASH main features

• • Up to 256 Kbytes of flash memory single bank architecture
• • Memory organization: 1 bank
  • – Main memory: up to 256 Kbytes
  • – Page size: 2 Kbytes
• • 72-bit wide data read (64 bits plus 8 ECC bits)
• • 72-bit wide data write (64 bits plus 8 ECC bits)
• • Page erase (2 Kbytes) and mass erase

Flash memory interface features:

• • Flash memory read operations
• • Flash memory program/erase operations
• • Readout protection activated by option (RDP)
• • 2 write protection areas selected by option (WRP)
• • 2 proprietary code readout protection area selected by option (PCROP)
• • Flash empty check
• • Program and erase suspension feature
• • Prefetch on CPU ICODE
• • CPU instruction cache: 32 cache lines of 4 x 64 bits on ICode (1-Kbyte RAM)
• • CPU data cache: 8 cache lines of 4 x 64 bits on DCode (256-byte RAM)
• • Error code correction (ECC): 8 bits for 64-bit
• • Option byte loader

3.3 FLASH functional description

3.3.1 Flash memory organization

The flash memory is organized as 72-bit wide memory cells (64 bits plus 8 ECC bits) that can be used for storing both code and data constants.

The flash memory is organized as follows:

• • A main memory block containing 128 pages of 2 Kbytes, each page with eight rows of 256 bytes.
• • An information block containing:
  • – System memory, from which the CPU boots in system memory boot mode
    This area is reserved and contains the bootloader used to reprogram the flash memory through one of the following interfaces: USART1, USART2, I2C1, I2C2, I2C3, SPI1, SPI2S2. It is programmed by STMicroelectronics when the device is manufactured and protected against spurious write/erase operations. For further details, refer to AN2606 “ STM32 microcontroller system memory boot mode ”.
  • – 1-Kbyte (128 double-word) OTP (one-time programmable) for user data
    The OTP data cannot be erased and can be written only once. If only one bit is at 0, the entire double-word (64 bits) cannot be written anymore, even with the value 0x0000 0000 0000 0000.
  • – Option bytes for user configuration

The memory organization is based on a main area and an information block, as shown in the table below.

Table 4. Flash memory - Single bank organization

3.3.2 Empty check

During the OBL phase, after loading all options, the flash memory interface checks whether the first location of the main memory is programmed. The result of this check, in conjunction with the BOOT0 and BOOT1 information, is used to determine where the system must boot from. It prevents the system to boot from the flash main memory area when, for example, no user code is programmed.

The flash main memory empty check status can be read from the EMPTY bit in the FLASH_ACR register. Software can modify the flash main memory empty status by writing to the EMPTY bit.

The internal empty check flag (EMPTY bit in FLASH_ACR) is implemented to allow easy programming of virgin devices by the bootloader. This flag is used when the BOOT0 pin defines the main flash memory as target boot area. When this flag is set, the device is

considered as empty and the system memory (bootloader) is selected instead of the main flash memory as a boot area, to allow the user to program the flash memory. Therefore, some of the GPIOs are reconfigured from the high-Z state. Refer to the application note AN2606 for more details concerning the bootloader and GPIO configuration in system memory boot mode. This feature can be disabled by configuring the option bytes to force a boot from the main flash memory (nSWBOOT0 = 0, nBOOT0 = 1).

This empty check flag is updated only during the loading of option bytes: it is set when the content of the address 0x08000 0000 is read as 0xFFFF FFFF, otherwise it is cleared. A power reset or setting of OBL_LAUNCH bit in FLASH_CR is needed to clear this flag after programming of a virgin device to execute user code after a system reset. The EMPTY bit can also directly be written by software.

3.3.3 Error code correction (ECC)

Data in flash memory words are 72-bit wide: eight bits are added per each double-word (64 bits).

The ECC mechanism supports the following modes:

• • one error detection and correction
• • two errors detection

When one error is detected and corrected, the flag ECCC (ECC correction) is set in FLASH_ECCR. If ECCCIE is set, an interrupt is generated.

When two errors are detected, the flag ECCD (ECC detection) is set in FLASH_ECCR. In this case, an NMI is generated.

When an ECC error is detected, the address of the failing double-word is saved in ADDR_ECC[16:0] in FLASH_ECCR. ADDR_ECC[2:0] bits are always cleared. The bus-ID of the CPU accessing the address is saved in CPUID[2:0].

While ECCC or ECCD is set, FLASH_ECCR is not updated if a new ECC error occurs. FLASH_ECCR is updated only when ECC flags are cleared.

Note: For virgin data (0xFF FFFF FFFF FFFF FFFF), one error is detected and corrected, but the two errors detection mode is not supported.

When an ECC error is reported, a new read at the failing address may not generate an ECC error if the data is still present in the current buffer, even if ECCC and ECCD are cleared. If this is not the desired behavior, the user must reset the cache.

3.3.4 Read access latency

To correctly read data from the flash memory, the number of wait states (LATENCY[2:0]) must be correctly programmed in FLASH_ACR according to the frequency of the flash memory clock (HCLK3) and the internal voltage range of the device ( \( V_{CORE} \) ). Refer to Section 5.1.4: Dynamic voltage scaling management .

Table 5 shows the correspondence between wait states and frequency of the memory clock.

Table 5. Number of wait states according to flash clock (HCLK3) frequency

After power-on reset and wake-up from Standby, the HCLK3 clock frequency is 4 MHz in range 1 and 0 wait state (WS) is configured in FLASH_ACR.

When changing the frequency of the flash memory clock or the V _CORE range, the software sequences detailed below must be applied in order to tune the number of wait states needed to access the flash memory:

Increase the CPU frequency

1. 1. Program the new number of wait states to the LATENCY[2:0] bits in FLASH_ACR.
2. 2. Check that the new number of wait states is taken into account to access the flash memory by reading back the LATENCY[2:0] bits in FLASH_ACR, and wait until the new programmed number is read.
3. 3. Modify the system clock source by writing the SW[1:0] bits in RCC_CFGR.
4. 4. If needed, modify the CPU clock prescaler by writing the SHDHPRE[3:0] bits in RCC_EXTCFGR.
5. 5. Optionally, check that the new system clock source or/and the new flash memory clock prescaler value is/are taken into account by reading the clock source status (SWS[1:0] bits) in RCC_CFGR, or/and the AHB prescaler value (SHDH PREF bit) in RCC_EXTCFGR.

Decrease the CPU frequency

1. 1. Modify the system clock source by writing the SW[1:0] bits in RCC_CFGR.
2. 2. If needed, modify the flash memory clock prescaler by writing the SHDHPRE[3:0] bits in RCC_EXTCFGR.
3. 3. Check that the new system clock source or/and the new flash memory clock prescaler value is/are taken into account by reading the clock source status (SWS[1:0] bits) in RCC_CFGR, or/and the AHB prescaler value (SHDH PREF bit) in RCC_EXTCFGR. Wait until the new programmed system clock source or/and new flash memory clock prescaler value is/are read.
4. 4. Program the new number of wait states to the LATENCY[2:0] bits in FLASH_ACR.
5. 5. Optionally, check that the new number of wait states is used to access the flash memory by reading back the LATENCY[2:0] bits in FLASH_ACR.

3.3.5 Adaptive real-time memory accelerator (ART Accelerator)

The proprietary adaptive real-time (ART) memory accelerator is optimized for STM32 industry-standard Arm Cortex-M4 with DSP processors. It balances the inherent

performance advantage of the Cortex-M4 with DSP over flash memory technologies, which normally require the processor to wait for the flash memory at higher operating frequencies.

To release the processor full performance, the accelerator implements an instruction prefetch queue and branch cache that increases program execution speed from the 64-bit flash memory. Based on CoreMark® benchmark, the performance achieved thanks to the ART Accelerator is equivalent to 0 wait state program execution from the flash memory at a CPU frequency up to 48 MHz.

Instruction prefetch

The CPU fetches the instruction over the ICode bus and the literal pool (constant/data) over the DCode bus. The prefetch block aims at increasing the efficiency of ICode bus accesses.

Each flash memory read operation provides 64 bits from either two instructions of 32 bits or four instructions of 16 bits according to the program launched. This 64-bit current instruction line is saved in a current buffer. In case of sequential code, at least two CPU cycles are needed to execute the previous read instruction line. Prefetch on the CPU ICode bus can be used to read the next sequential instruction line from the flash memory while the current instruction line is being requested by the CPU.

Prefetch is enabled by setting PRFTEN in FLASH_ACR. This feature is useful if at least one wait state is needed to access the flash memory.

The figure below shows the execution of sequential 16-bit instructions with and without prefetch when three wait states are needed to access the flash memory.

Figure 3. Sequential 16 bits instructions execution

When the code is not sequential (branch), the instruction may not be present in the currently used instruction line or in the prefetched instruction line. In this case (miss), the penalty in terms of number of cycles is at least equal to the number of wait states.

If a loop is present in the current buffer, no new access is performed.

CPU instruction cache memory (I-Cache)

To limit the CPU time lost due to jumps, it is possible to retain 32 lines of 4 x 64 bits (1 Kbyte) in an instruction cache memory. This feature is enabled for the CPU by setting the instruction cache enable (ICEN) bit in FLASH_ACR. Each time a miss occurs (requested data not present in the currently used instruction line, in the prefetched instruction line or in the instruction cache memory), the line read is copied into the instruction cache memory. If some data contained in the instruction cache memory are requested by the CPU, they are provided without inserting any delay. Once all the instruction cache memory lines have been filled, the LRU (least recently used) policy is used to determine the line to replace in the instruction memory cache. This feature is particularly useful in case of code containing loops.

The instruction cache memory is enabled after system reset.

CPU data cache memory (D-Cache)

CPU literal pools are fetched from the flash memory through the DCode bus during the execution stage of the CPU pipeline. Each CPU DCode bus read access fetches 64 bits that are saved in a current buffer. The CPU pipeline is consequently stalled until the requested literal pool is provided. To limit the time lost due to literal pools, accesses through the AHB data bus DCode have priority over accesses through the AHB instruction bus ICode.

If some literal pools are frequently used, the CPU data cache memory can be enabled by setting the data cache enable (DCEN) bit in FLASH_ACR. This feature works like the instruction cache memory but the retained data size is limited to eight lines of 4 x 64 bits (256 bytes).

The data cache memory is enabled after system reset.

Note: The D-Cache is active only when data is requested by the CPU (not by DMAs). Data in option bytes block are not cacheable.

3.3.6 Flash program and erase operations

The embedded flash memory can be programmed using in-circuit programming or in-application programming.

The in-circuit programming (ICP) method is used to update the entire contents of the flash memory using the JTAG, SWD protocol or the supported interfaces by the system bootloader, to load the user application for the CPU, into the microcontroller. ICP offers quick and efficient design iterations and eliminates unnecessary package handling or socketing of devices.

In contrast to the ICP method, in-application programming (IAP) can use any communication interface supported by the microcontroller (such as I/Os, UART, I ² C or SPI) to download programming data into memory. IAP allows the user to re-program the flash memory while the application is running. Nevertheless, part of the application must have been previously programmed in the flash memory using ICP.

The contents of the flash memory are not guaranteed if a device reset occurs during a flash memory operation.

During a program/erase operation to the flash memory, any attempt to read the memory stalls the bus. The read operation proceeds correctly once the program/erase operation is completed.

Unlocking the flash memory

After a reset, write is not allowed in FLASH_CR to protect the flash memory against possible unwanted operations (for example, electric disturbances).

The following sequence is used to unlock these registers:

1. 1. Write KEY1 = 0x4567 0123 in FLASH_KEYR.
2. 2. Write KEY2 = 0xCDEF 89AB in FLASH_KEYR.

Any wrong sequence locks up FLASH_CR until the next system reset. In the case of a wrong key sequence, a bus error is detected and a hard fault interrupt is generated.

FLASH_CR can be locked again by software by setting the LOCK bit.

Note: FLASH_CR cannot be written when BSY is set in FLASH_SR. Any attempt to write to this register with BSY set causes the AHB bus to stall until BSY is cleared.

3.3.7 Flash main memory erase sequences

Erase can be performed by page (page erase) or on the whole memory (mass erase). Mass erase does not affect the information block (system flash memory, OTP, and option bytes).

Flash memory page erase

A page erase only starts when allowed by PESD in FLASH_SR.

When a page is protected by PCROP or WRP, it is not erased.

Table 6. Page erase overview

To erase a 2-Kbyte page, follow the steps detailed below:

1. 1. Check that no flash memory operation is ongoing by checking BSY in FLASH_SR.
2. 2. Check that flash program and erase operation is allowed by checking PESD in FLASH_SR.
3. 3. Check and clear all error programming flags due to a previous programming. If not, PGSERR is set.
4. 4. Set PER and select the page to erase (PNB[6:0]) in FLASH_CR.
5. 5. Set STRT in FLASH_CR.
6. 6. Wait for BSY to be cleared in FLASH_SR.

Note: The internal oscillator HSI16 (16 MHz) is enabled automatically when the STRT bit is set, and disabled automatically when the STRT bit is cleared, except if the HSI16 is previously enabled with HSION in the RCC_CR register.

Flash mass erase

When PCROP or WRP is enabled, any flash memory mass erase is aborted and no erase started.

Table 7. Mass erase overview

To perform a mass erase, follow the steps detailed below:

1. 1. Check that no flash memory operation is ongoing by checking BSY in FLASH_SR.
2. 2. Check and clear all error programming flags due to a previous programming. If not, PGSERR is set.
3. 3. Set MER in FLASH_CR.
4. 4. Set STRT in FLASH_CR
5. 5. Wait for BSY to be cleared in FLASH_SR.

Note: The internal oscillator HSI16 (16 MHz) is enabled automatically when the STRT bit is set, and disabled automatically when the STRT bit is cleared, except if the HSI16 is previously enabled with HSION in the RCC_CR register.

3.3.8 Flash main memory programming sequences

The flash memory is programmed with 72 bits at a time (a double-word of 64 bits plus 8 bits ECC).

Programming in a previously programmed double-word is only allowed when programming an all 0 value. It is not allowed to program any other value in a previously programmed double-word. Any attempt sets PROGERR flag in FLASH_SR, except when programming an already programmed double-word with an all 0 value.

It is only possible to program a double-word (2 x 32-bit data), otherwise:

• • Any attempt to write a byte (8 bits) or half-word (16 bits) sets SIZERR in FLASH_SR.
• • Any attempt to write a double-word that is not aligned with a double-word address sets the PGAERR flag in FLASH_SR.

Standard programming

The flash memory programming sequence in standard mode is as follows:

1. 1. Check that no flash main memory operation is ongoing by checking BSY in FLASH_SR.
2. 2. Check that flash program and erase operation is allowed by checking PESD in FLASH_SR.

1. 3. Check and clear all error programming flags due to a previous programming. If not, PGSERR is set.
2. 4. Set PG in FLASH_CR.
3. 5. Perform the data write operation at the desired memory address, inside the main memory block or OTP area. Only double-word (64 bits) can be programmed.
   1. a) Write a first word in an address aligned with double-word
   2. b) Write the second word (see the note below)

Note: When the flash memory interface received a good sequence (a double-word), programming is automatically launched and the BSY bit is set. The internal oscillator HSI16 (16 MHz) is enabled automatically when the PG bit is set, and disabled automatically when the PG bit is cleared, except if the HSI16 is previously enabled with HSION in the RCC_CR register.

If the user needs to program only one word, double-word must be completed with the erase value 0xFFFF FFFF to launch automatically the programming.

ECC is calculated from the double-word to program.

For correct operation, the firmware must guarantee that the flash page access protection is not changed during the programming sequence. This is between the first and second word write.

1. 6. Wait until BSY is cleared in FLASH_SR.
2. 7. Check that EOP is set in FLASH_SR (meaning the programming operation succeeded), and clear it by software.
3. 8. Clear PG in FLASH_SR if there no more programming request.

Fast programming

This mode allows a row to be programmed, 32 double-words (256 bytes), and the page programming time to be reduced by eliminating the need for verifying the flash memory locations before they are programmed and to avoid rising and falling time of high voltage for each double-word. During fast programming, the flash clock frequency (HCLK3) must be at least 8 MHz.

Fast row programming must be performed by executing firmware from SRAM and disabling interrupts when not relocating the CPU interrupt vector table. A read access from the CPU requesting row programming causes a bus error. A read from any other source (such as the DMA) is stalled until the row programming is finished (standard double-word programming does not cause a bus error to the requesting CPU but stalls any read until standard programming is finished).

Only the main memory can be programmed in Fast programming mode.

The flash main memory programming sequence in Fast programming mode is described below:

1. 1. Perform a mass erase. If not, PGSERR is set.
2. 2. Check that no flash main memory operation is ongoing by checking BSY bit FLASH_SR.
3. 3. Check that flash memory program and erase operation is allowed by checking PESD in FLASH_SR.
4. 4. Check and clear all error programming flag due to a previous programming.
5. 5. Set FSTPG in FLASH_CR.
6. 6. Write the 32 double-words to program a row (256 bytes).

1. 7. Wait until BSY is cleared in FLASH_SR.
2. 8. Check that the EOP flag is set in FLASH_SR(meaning the programming operation succeeded), and clear it by software.
3. 9. Clear FSTPG in FLASH_SR if there are no more programming requests.

Note: When attempting to write in Fast programming mode while a read operation is ongoing, the programming is aborted without any system notification (no error flag is set).

When the flash memory interface receives the first double-word, programming is automatically launched. The BSY bit is set when the high voltage is applied for the first double-word, and it is cleared when the last double-word is programmed or in case of error. The internal oscillator HSI16 (16 MHz) is enabled automatically when FSTPG is set, and disabled automatically when the FSTPG bit is cleared, except if the HSI16 is previously enabled with HSION in the RCC_CR register.

The 32 double-word must be written successively. The high voltage is kept on the flash memory for all the programming. Maximum time between two double-words write requests is the time programming (~ 20 µs). If a second double-word arrives after this time programming, fast programming is interrupted and MISSERR is set.

High voltage must not exceed 8 ms for a full row between two erases. This is guaranteed by the sequence of 32 double-words successively written with a clock system greater or equal to 8 MHz. An internal time-out counter counts 7 ms when Fast programming is set and stops the programming when time-out is over. In this case FASTERR is set.

If an error occurs, high voltage is stopped and next double-word to programmed is not programmed. Anyway, all previous double-words have been properly programmed.

Programming errors signaled by flags

Several kind of errors can be detected. In case of error, the flash operation (programming or erasing) is aborted.

• • PROGERR: programming error

In standard programming, PROGERR is set if the word to write, with a different value than all zero, is not previously erased (except if the value to program is all zero).

If any other error occurs (such as SIZERR, PAGERR, PGSERR, WRPERR), PROGRERR may not be set even if there is a word re-programming without erase error.

• • SIZERR: size programming error

In standard programming or in fast programming: only double-word can be programmed and only 32-bit data can be written. SIZERR is set if a byte or an half-word is written.

• • PGAERR: alignment programming error

PGAERR is set if one of the following conditions occurs:

• – In standard programming, the first word to be programmed is not aligned with a double-word address, or the second word does not belong to the same double-word address.
• – In fast programming, the data to program does not belong to the same row than the previous programmed double-words, or the address to program is not greater than the previous one.

• • PGSERR: programming sequence error

PGSERR is set if one of the following conditions occurs:

• – In the standard programming sequence or the fast programming sequence, a data is written when PG and FSTPG are cleared.
• – In the standard programming sequence or the fast programming sequence, MER and PER are not cleared when PG or FSTPG is set.
• – In the fast programming sequence, the mass erase is not performed before setting the FSTPG bit.
• – In the mass erase sequence, PG, FSTPG, and PER are not cleared when MER is set, when the security of the flash allows a mass erase. A non-secure mass erase request on a secure flash memory does not set a PGSERR. An illegal access event is generated instead.
• – In the page erase sequence, PG, FSTPG and MER are not cleared when PER is set, when the security of the page allows access. When the security of this page does not allow access, no PGSERR is set but an illegal access event is generated instead.
• – PGSERR is set also if PROGERR, SIZERR, PGAERR, WRPERR, MISSERR, FASTERR or PGSERR is set due to a previous programming error.
• – In the fast programming sequence, if the page containing the row to be programmed has not been erased by the last page erase action (If a mass erase has been done, it is allowed to program rows on higher order pages but not on lower order)
• • WRPERR: write protection error

  WRPERR is set if one of the following conditions occurs:

  • – Attempt to program or erase in a write protected area (WRP) or in a PCROP area, when the security of the area allows access. When the security of this area does not allow access, no WRPERR is set but an illegal access event is generated instead.
  • – Attempt to perform a mass erase when one page or more is protected by WRP or PCROP, when the security of the flash allows a mass erase. A non-secure mass erase request on a secure flash memory does not set a WRPERR. An illegal access event is generated instead.
  • – The debug features are connected or the boot is executed from SRAM or from system flash memory when the readout protection (RDP) is set to level 1.
  • – Attempt to modify the option bytes when the readout protection (RDP) is set to Level 2
• • MISSERR: fast programming data miss error

  In fast programming, all the data must be written successively. MISSERR is set if the previous data programming is finished and the next data to program is not written yet.

• • FASTERR: fast programming error

  In fast programming, FASTERR is set if one of the following conditions occurs:

  • – When FSTPG bit is set for more than 7 µs (generating a time-out detection).
  • – When the row fast programming is interrupted by a MISSERR, PGAERR, WRPERR or SIZERR.

If an error occurs during a program or erase operation, one of the following error flags is set in FLASH_SR:

• • PROGERR, SIZERR, PGAERR, PGSERR, MISSERR (program error flags)
• • WRPERR (protection error flag)

In this case, if the error interrupt enable bit ERRIE is set in FLASH_CR, an interrupt is generated and the operation error flag OPERR is set in FLASH_SR.

Note: If several successive errors are detected (for example, in case of DMA transfer to the flash memory), the error flags cannot be cleared until the end of the successive write request.

PGSERR and PGAERR in a page-based row programming

In case of fast programming, the table below describes how PGAERR and PGSERR are handled.

Table 8. Errors in page-based row programming

After a system reset, no MER or PER is performed. Any programming attempt causes a PGAERR and a PGSERR.

Programming errors causing a bus error

The error conditions listed below do not generate an error flag but a bus error instead:

• • AHB write to any page when RDP level 1 and boot is performed from the system flash memory or SRAM1
• • AHB write when the flash memory is powered down
• • Read or write from the flash memory through the debugger
• • Read from the flash memory when fast row programming is ongoing, for the source which requested the fast row programming
• • New programming request when the previous one is not finished
• • FLASH_CR register write between the two accesses of a double-word programming
• • FLASH_CR register write when PESD is active (set)
• • Write a wrong key in FLASH_KEYR or FLASH_OPTKEYR register
• • Any subsequent write to FLASH_KEYR or FLASH_OPTKEYR after unlocking the respective feature

Programming and caches

If a flash memory write access impacts data in the data cache, the flash memory write access modifies the data in the memory and in the cache.

If an erase operation in the flash memory also concerns data in the data cache or instruction cache, the user must ensure that these data are rewritten before they are accessed during code execution. Upon an erase operation, the cache content is invalidated.

Note: The ICACHE and DCACHE must be flushed only when disabled (ICEN or DCEN = 0).

3.4 FLASH option bytes

3.4.1 Option bytes description

The option bytes can be read from the memory locations listed in the table below or from the following option byte registers:

• • FLASH option register (FLASH_OPTR)
• • FLASH PCROP zone A start address register (FLASH_PCROP1ASR)
• • FLASH PCROP zone A end address register (FLASH_PCROP1AER)
• • FLASH PCROP zone B start address register (FLASH_PCROP1BSR)
• • FLASH PCROP zone B end address register (FLASH_PCROP1BER)
• • FLASH WRP area A address register (FLASH_WRP1AR)
• • FLASH WRP area B address register (FLASH_WRP1BR)

Table 9. Option bytes organization

1. The upper 32 bits of the double-word address contain the inverted data from the lower 32 bits.

3.4.2 Option bytes programming

After a reset, the options related bits in FLASH_CR are write-protected. To run any operation on the option bytes page, the option lock bit OPTLOCK in FLASH_CR must be cleared.

The following sequence is used to unlock the FLASH_CR and flash memory option registers:

1. 1. Unlock FLASH_CR with the LOCK clearing sequence (refer to Unlocking the flash memory ).
2. 2. Write OPTKEY1 = 0x0819 2A3B in FLASH_OPTKEYR
3. 3. Write OPTKEY2 = 0x4C5D 6E7F in FLASH_OPTKEYR

Any wrong sequence locks up the flash option register until the next system reset. In the case of a wrong key sequence, a bus error is detected and a hard fault interrupt is generated.

The user options can be protected against unwanted erase/program operations by setting the OPTLOCK bit by software.

Note: If LOCK is set by software, OPTLOCK is automatically set as well.

Modify user options

The option bytes are programmed differently from a main memory user address.

To modify the user options value, follow the procedure below:

1. 1. Clear OPTLOCK option lock bit with the clearing sequence described above
2. 2. Write the desired options value in the options registers.
3. 3. Check that no flash memory operation is ongoing by checking the BSY bit in FLASH_SR.
4. 4. Check that flash program and erase operation is allowed by checking the PESD bit in FLASH_SR.
5. 5. Set the options start bit OPTSTRT in FLASH_CR.
6. 6. Wait for the BSY bit to be cleared.

Note: Any modification of the value of one option is automatically performed by erasing user option bytes pages first, and then programming all the option bytes with the values contained in the flash option registers.

Warning: On RDP regression from level 1 to level 0, starting the option programming by the OPTSTRT bit causes the flash memory, SRAM1 and SRAM2 to be erased. All device software in all memories is erased. A subsequent OBL_LAUNCH must be started by an external tool or a POR must be performed to restart the device and reload the options.

Option byte loading

After the BSY bit is cleared, all new options are updated into the flash memory but not applied to the system. A read from the option registers still returns the last loaded option byte values. The new options have effect on the system only after they are loaded.

Option bytes loading is performed in the following two cases:

• • when OBL_LAUNCH bit is set in FLASH_CR
• • after a power reset (BOR reset or exit from Standby/Shutdown modes)

Option byte loader performs a read of the options block and stores the data into internal option registers. These internal registers configure the system and can be read by software. Setting OBL_LAUNCH generates a reset so the option byte loading is performed under system reset.

Each option bit has also its complement in the same double-word. During option loading, a verification of the option bit and its complement allows the correct loading to be checked.

During option byte loading, the options are read by double-word. ECC on option words is not taken into account during OBL but only during direct software read of option area.

If the word and its complement are matching, the option word/byte is copied into the option register.

If the comparison between the word and its complement fails, a status bit OPTVERR is set. Mismatch values are forced into the option registers as follows:

• • For USR OPT option, the value of mismatch is all options at '1', except for BOR_LEV that is "000" (lowest threshold).
• • For WRP option, the value of mismatch is the default value "No protection".
• • For RDP option, the value of mismatch is the default value "Level 1".
• • For PCROP, the value of mismatch is "all memory protected".
• • For BOOT_LOCK option, the value of mismatch is "CPU boot lock disabled".
• • For OPTVAL option, the value of mismatch is "not valid". OPTVAL is a check word programmed at the last user option address. It is used to check if all user options have been programmed during an OPTSTART. If the user option program sequence has not terminated completely, OPTVAL is not programmed and OPTNV is set.

If the OPTVAL option indicates "not valid", SRAM1, SRAM2, and PKA SRAM memories are erased.

Table 10. Option loading control

On system reset rising, internal option registers are copied into the following option registers that can be read and written by software:

• • FLASH_OPTR
• • FLASH_PCROP1xSR (x = A or B)

• • FLASH_PCROP1xER (x = A or B)
• • FLASH_WRP1xR (x = A or B)

These registers are also used to modify the options. If these registers are not modified by the user, they reflect the options states of the system. See Modify user options for more details.

3.5 Flash memory protection

The main flash memory can be protected against external accesses with the readout protection (RDP). The pages can also be protected against unwanted write (WRP) due to loss of program counter context. The write protection WRP granularity is 2 Kbytes.

Apart from the RDP and WRP, the flash memory can also be protected against read and write from third parties (PCROP). The PCROP granularity is 1 Kbyte.

3.5.1 Readout protection (RDP)

The readout protection is activated by setting the RDP option byte and performing an option byte programming with OPTSTRT followed by a OBL_LAUNCH, POR or wake-up from Standby or Shutdown mode. The readout protection protects the main flash memory, the option bytes, the backup registers (TAMP_BKPxR in TAMP) and SRAM2.

There is no exception while the debugger is connected.

There are three levels of readout protection from no protection (level 0) to maximum protection or no debug (level 2).

The flash memory is protected when the RDP option byte and its complement contain the pair of values shown in the table below.

Table 11. Flash memory readout protection status

The system memory area is read accessible whatever the protection level. It is never accessible for program/erase operation.

Level 0: no protection

Read, program and erase operations into the main flash memory area are possible. The option bytes, SRAM2 and backup registers are also accessible by all operations.

Level 1: readout protection

This is the default protection level when the RDP option byte is erased. It is defined as well when the RDP value is at any value different from 0xAA and 0xCC, or even if the complement is not correct.

• • User mode
  The code executing in user mode (Boot flash) can access the main flash memory, option bytes, SRAM2 and backup registers with all operations.
• • Debug, boot RAM and bootloader and SFI/RSS modes
  In debug mode or when the code is running from boot RAM or bootloader or SFI/RSS, the main flash memory, backup registers (RTC_BKPxR in the RTC) and SRAM2 are totally inaccessible. In these modes, a read or write access to the flash memory generates a bus error and a hard fault interrupt.

Caution: In case the level 1 is configured and no PCROP areas are defined, it is mandatory to set PCROP_RDP bit to 1 (full mass erase when the RDP level is decreased from level 1 to level 0). In case the level 1 is configured and a PCROP area is defined, if the user code needs to be protected by RDP but not by PCROP, it must not be placed in a page containing a PCROP area.

Level 2: no debug

In this level, the protection level 1 is guaranteed. In addition, the CPU debug port, the boot from RAM (boot RAM mode) and the boot from system memory (bootloader mode) are no more available. In user execution mode (boot FLASH mode), all operations are allowed on the main flash memory. On the contrary, only read and secure write operations can be performed on the option bytes.

Note: The debug feature is also disabled under reset.
STMicroelectronics is not able to perform analysis on defective parts on which the level 2 protection has been set.

Change the readout protection level

It is easy to move from level 0 to level 1 by changing the value of the RDP byte to any value (except 0xCC). By programming the 0xCC value in the RDP byte, it is possible to go to level 2 directly from level 0 or from level 1. Once in level 2 it is no more possible to modify the readout protection level.

When the RDP is reprogrammed to the value 0xAA to move from level 1 to level 0, a mass erase of the main flash memory is performed if PCROP_RDP is set in FLASH_PCROP1AER. Backup registers (RTC_BKPxR in the RTC), SRAM1, SRAM2 and PKA SRAM are also erased. The user options except PCROP protection are set to their previous values copied from FLASH_OPTR, FLASH_WRP1xR (x= A or B). PCROP is disabled. The OTP area is not affected by mass erase and remains unchanged.

If the bit PCROP_RDP is cleared in FLASH_PCROP1AER, the full mass erase is replaced by a partial mass erase that is successive page erases, except for the pages protected by PCROP. This is done in order to keep the PCROP code. Only when the flash memory is erased, options are re-programmed with their previous values. This is also true for FLASH_PCROP1xSR and FLASH_PCROP1xER registers (x= A or B).

Table 12. RDP regression from level 1 to level 0 and memory erase

Note: Full or partial mass erase is performed only when level 1 is active and level 0 is requested. When the protection level is increased (0→1, 1→2, 0→2), there is no mass erase. To validate the protection level change, the option bytes must be reloaded through the OBL_LAUNCH bit in FLASH_CR, or a POR, or wake-up from Standby or Shutdown mode.

Figure 4. Changing the RDP level

Table 13. Access status versus protection level and execution modes

Table 13. Access status versus protection level and execution modes (continued)

1. 1. When the protection level 2 is active, the debug port, the boot from RAM and the boot from system memory are disabled.
2. 2. The system memory is only read-accessible, whatever the protection level (0, 1 or 2) and execution mode.
3. 3. The Flash non secure main memory is erased when the RDP option byte is programmed from level 1 to level 0.
4. 4. The backup registers are erased when RDP changes from level 1 to level 0.
5. 5. SRAM1, SRAM2 and PKA SRAM are erased when RDP changes from level 1 to level 0.

3.5.2 Proprietary code readout protection (PCROP)

Two parts of the flash memory can be protected against read and write from third parties.

The protected area is execute-only: it can only be reached by the STM32 CPU with an instruction code, while all other accesses (DMA, debug and CPU data read, write and erase) are strictly prohibited. The PCROP areas have a 1-Kbyte granularity. An additional option bit (PCROP_RDP) defines if the PCROP area is erased or not when the RDP protection is changed from level 1 to level 0 (refer to Change the readout protection level ).

Each PCROP area is defined by a start page offset and an end page offset into the flash memory. These offsets are defined in the PCROP address registers (FLASH_PCROP1ASR, FLASH_PCROP1AER), FLASH_PCROP1BSR and FLASH_PCROP1BER).

A PCROP area is defined from the address:

Flash memory base address + [PCROP1x_STRT x 0x400] (included) to the address

Flash memory base address + [(PCROP1x_END+1) x 0x400] (excluded).

The minimum PCROP area size is two PCROP pages (2 Kbytes)

PCROP1x_END = PCROP1x_STRT + 1.

When PCROP1x_END = PCROP1x_STRT, the full flash memory is PCROP protected.

For example, to protect by PCROP from the address 0x0801 2F80 (included) to the address 0x0801 D004 (included), if boot in flash is selected, one of the FLASH_PCROP1xSR and FLASH_PCROP1xER registers (x =A or B) must be programmed with:

• • PCROP1x_STRT = 0x4B (PCROP area first address 0x0801 2C00)
• • PCROP1x_END = 0x74 (PCROP area last address 0x0801 D3FF)

Any data read access performed through a PCROP protected area triggers the RDERR flag error.

Any PCROP protected address is also write protected and any write access to one of these addresses triggers WRPERR.

Any PCROP area is also erase protected. Consequently, any erase to a page in this zone is impossible (including the page containing the start address and the end address of this zone). Moreover, a software mass erase cannot be performed if one zone is PCROP protected.

In the previous example, due to erase by page, all pages from page 0x4B to 0x74 are protected. In case of page erase, all addresses from 0x0801 2C00 to 0x0801 D3FF cannot be erased.

Deactivation of PCROP can only occurs when the RDP is changing from level 1 to level 0. If the user options modification tries to clear PCROP or to decrease the PCROP areas, the options programming is launched but PCROP areas stays unchanged. On the contrary, it is possible to increase the PCROP areas.

When option bit PCROP_RDP is cleared and when the RDP is changing from level 1 to level 0, the full mass erase is replaced by a partial mass erase to preserve the PCROP area (refer to Change the readout protection level ). In this case, PCROP1x_STRT and PCROP1x_END (x =A or B) are not erased.

Table 14: PCROP protection

Note: It is recommended to align PCROP areas with the page granularity when using PCROP_RDP, or to leave free the rest of the page where PCROP zones starts or ends.

3.5.3 Write protection (WRP)

The user area in the flash memory can be protected against unwanted write operations. Two write-protected (WRP) areas can be defined, with 2-Kbyte granularity page. Each area is defined by a start page offset and an end page offset related to the physical flash memory base address. These offsets are defined in the WRP address registers FLASH_WRP1AR and FLASH_WRP1BR.

The WRP “x” area (x = A, B) is defined from the address:

Flash memory Base address + [WRP1x_STRT x 0x800] (included) to the address:

Flash memory Base address + [(WRP1x_END+1) x 0x800] (excluded).

The minimum WRP area size is one WRP 2_Kbyte page, WRP1x_END = WRP1x_STRT.

For example, to protect by WRP from the address 0x0801 2000 (included) to the address 0x0801 9FFF (included), if boot in flash is selected, FLASH_WRP1AR register must be programmed with:

• • WRP1A_STRT = 0x24
• • WRP1A_END = 0x33

WRP1B_STRT and WRP1B_END in FLASH_WRP1BR can be used instead (area “B” in flash memory).

When WRP is active, it cannot be erased or programmed. Consequently, a software mass erase cannot be performed if one area is write-protected.

If an erase/program operation to a write-protected part of the flash memory is attempted, the write protection error flag (WRPERR) is set in FLASH_SR. This flag is also set for any write access to on the following area:

• • OTP area
• • part of the flash memory that can never be written like the ICP
• • PCROP area

Note: When the flash memory readout protection level is selected (RDP level1), it is not possible to program or erase the memory if the CPU debug features are connected (JTAG or single wire) or boot code is being executed from RAM or system flash, even if WRP is not activated. Any attempt generates an hard fault (BusFault).

Table 15: WRP protection

Note: To validate the WRP options, the option bytes must be reloaded through the OBL_LAUNCH bit in FLASH_CR.

3.5.4 Security (ESE)

When OPTVAL option indicates “not valid” or the comparison between the user options word and its complement fails (indicated in OPTVERR), the Flash memory is secured and SRAM1, SRAM2 and PKA SRAM memories are erased. The CPU is no longer able to execute firmware from the Flash memory. When booting in SRAM1, the CPU debug is enabled. In this case, any CPU firmware can be downloaded in SRAM or JTAG can be used to perform an RDP regression from level1 to level 0 with ESE = 0. This restores valid option bytes and erases all user Flash memory, SRAM1, SRAM2 and PKA SRAM content.

3.5.5 CPU boot lock chain of trust

The BOOT_LOCK forces the CPU to boot from the user flash memory, regardless of what is selected by BOOT0 and BOOT1. When BOOT_LOCK is enabled and BOOT0/BOOT1 select anything different than the user flash memory boot, the system boots anyway from the user flash memory. System boot via BOOT0/BOOT1 from SRAM1 or bootloader is no longer possible.

It is still possible to boot the CPU according to the software selected remap by MEM_MODE bits in SYSCFG memory remap register (SYSCFG_MEMRMP) from SRAM1 or bootloader.

3.6 FLASH program erase suspension

Flash program and erase operation can be suspended by setting the PES bit in FLASH_ACR. This feature is useful when executing time critical sections by a CPU. It makes possible to suspend any new program or erase operation from being started, preventing CPU instruction and data fetches from being blocked.

When PES bit is set, the following occurs:

• • Any ongoing program or erase operation is completed.
  The maximum latency for a flash program erase suspension is the maximum time for one program or erase operation to complete (see product datasheets for more information on the flash program and erase timing).
• • All new requested program and erase operations is not started but suspended.
  PESD bit in FLASH_SR is set as soon as PES is set, no matter if a program/erase is currently suspended. This allows a CPU to test PESD prior to requesting a program or an erase operation.

When PES bit is reset to 0, a suspended program or erase operation is started: the PESD bit is cleared.

3.7 FLASH interrupts

Table 16. Flash interrupt requests

1. EOP is set only if EOPIE is set.

2. OPERR is set only if ERRIE is set.

3.8 FLASH registers

3.8.1 FLASH access control register (FLASH_ACR)

Address offset: 0x000

Reset value: 0x0000 0600

Bits 31:17 Reserved, must be kept at reset value.

Bit 16 EMPTY : Flash user area empty

When read, this bit indicates whether the first location of the user flash is erased or has a programmed value.

0: Read: user flash programmed

1: Read: user flash empty

Bit 15 PES : CPU program/erase suspend request

0: Flash program and erase operations granted

1: Any new flash program and erase operation is suspended until this bit is cleared. The PESD bit in FLASH_SR is set when PES bit in FLASH_ACR is set.

Bits 14:13 Reserved, must be kept at reset value.

Bit 12 DCRST : CPU data cache reset

0: CPU data cache not reset

1: CPU data cache reset

This bit can be written only when the data cache is disabled.

Bit 11 ICRST : CPU instruction cache reset

0: CPU instruction cache not reset

1: CPU instruction cache reset

This bit can be written only when the instruction cache is disabled.

Bit 10 DCEN : CPU data cache enable

0: CPU data cache disabled

1: CPU data cache enabled

Bit 9 ICEN : CPU instruction cache enable

0: CPU instruction cache disabled

1: CPU instruction cache enabled

Bit 8 PRFTEN : CPU prefetch enable

0: CPU prefetch disabled

1: CPU prefetch enabled

Bits 7:3 Reserved, must be kept at reset value.

Bits 2:0 LATENCY[2:0] : Latency

These bits represent the ratio of the flash HCLK clock period to the flash memory access time.

000: Zero wait state

001: One wait state

010: Two wait states

Others: reserved

3.8.2 FLASH key register (FLASH_KEYR)

Address offset: 0x008

Reset value: 0x0000 0000

Bits 31:0 KEY[31:0] : Flash key

The following values must be written consecutively to unlock FLASH_CR, thus enabling programming/erasing operations:

KEY1: 0x4567 0123

KEY2: 0xCDEF 89AB

3.8.3 FLASH option key register (FLASH_OPTKEYR)

Address offset: 0x00C

Reset value: 0x0000 0000

Bits 31:0 OPTKEY[31:0] : Option byte key lower bits

The following values must be written consecutively to unlock the flash memory option registers, enabling option byte programming/erasing operations:

KEY1: 0x0819 2A3B

KEY2: 0x4C5D 6E7F

3.8.4 FLASH status register (FLASH_SR)

Address offset: 0x010

Reset value: 0x000X 0000

Bits 31:20 Reserved, must be kept at reset value.

Bit 19 PESD : Program/erase operation suspended

This bit is set and reset by hardware.

Set when PES bit in FLASH_ACR is set.

Cleared when PES bit in FLASH_ACR is cleared.

When set, new program or erase operations are not started.

Bit 18 CFGBSY : Program or erase configuration busy

This bit is set and reset by hardware (set when first word is sent and reset when program operation completes or is interrupted by an error).

When set, the program and erase settings in PG, PNB[6:0], PER, and MER bits in FLASH_CR are used (busy) and cannot be changed (a programming or erase operation is ongoing).

When reset, the program and erase settings in PG, PNB[6:0], PER, and MER bits in FLASH_CR can be modified.

Bit 17 Reserved, must be kept at reset value.

Bit 16 BSY : Busy

This bit indicates that a flash operation requested in FLASH_CR is in progress. This bit is set at the beginning of a flash operation and reset when the operation finishes or when an error occurs.

Bit 15 OPTVERR : Option and engineering bits loading validity error

Set by hardware when the options and engineering bits read may not be the one configured by the user or production. If options and engineering bits are not properly loaded, OPTVERR is set again after each system reset. Option bytes that fail loading are forced to a safe value (see Section 3.4.2: Option bytes programming ).

This bit is cleared by writing 1.

Bit 14 RDERR : PCROP read error

Set by hardware when an address to be read through the D-bus belongs to a read protected area of the flash memory (PCROP protection). An interrupt is generated if RDERRIE is set in FLASH_CR.

This bit is cleared by writing 1.

Bit 13 OPTNV : User option OPTVAL indication

This bit is set and reset by hardware.

0: The OBL user option OPTVAL indicates “valid” (user option program sequence has not terminated completely).

1: The OBL user option OPTVAL indicates “not valid” (OPTVAL check word has been erroneously read).

Bits 12:10 Reserved, must be kept at reset value.

Set by hardware when a fast programming sequence (activated by FSTPG) is interrupted due to an error (alignment, size, write protection or data miss). The corresponding status bit (PGAERR, SIZERR, WRPERR or MISSERR) is set at the same time.

This bit is cleared by writing 1.

In Fast programming mode, 32 double-words (256 bytes) must be sent to the flash memory successively and the new data must be sent to the logic control before the current data is fully programmed.

This bit is set by hardware when the new data is not present in time and cleared by writing 1.

This bit is set by hardware when a write access to the flash memory is performed by the code, while PG or FSTPG have not been set previously. This bit is also set by hardware when PROGERR, SIZERR, PGAERR, WRPERR, MISSERR or FASTERR is set due to a previous programming error.

This bit is cleared by writing 1.

This bit is set by hardware when the size of the access is a byte or half-word during a program or a fast program sequence. Only double-word programming is allowed (consequently: word access).

This bit is cleared by writing 1.

This bit is set by hardware when the data to program cannot be contained in the same double-word (64 bits) flash memory in case of standard programming, or if there is a change of page during fast programming.

This bit is cleared by writing 1.

This bit is set by hardware when an address to be erased/programmed belongs to a write-protected part (by WRP, PCROP or RDP level 1) of the flash memory.

This bit is cleared by writing 1.

This bit is set by hardware when a double-word address to be programmed contains a value different from 0xFFFF FFFF FFFF FFFF before programming, except if the data to write is 0x0000 0000 0000 0000.

This bit is cleared by writing 1.

This bit is set by hardware when a flash memory operation (program/erase) completes unsuccessfully. This bit is set only if error interrupts are enabled (ERRIE = 1).

This bit is cleared by writing 1.

This bit is set by hardware when one or more flash memory operation (program/erase) completes successfully. This bit is set only if the end of operation interrupts are enabled (EOPIE = 1).

This bit is cleared by writing 1.

3.8.5 FLASH control register (FLASH_CR)

Address offset: 0x014

Reset value: 0xC000 0000

Access: no wait state when no flash memory operation is ongoing. Word, half-word and byte access.

This register cannot be modified when CFGBSY is set in FLASH_SR.

When PESD is cleared in FLASH_SR, the register write access is stalled until the CFGBSY bit is cleared.

When PESD is set in FLASH_SR and a program or an erase operation is ongoing, the register write access causes a bus error.

When PESD is set in FLASH_SR but there is no ongoing programming or erase operation, the register write access is completed, but the requested operation is suspended.

BSY/CFGBSY is set and remains 1 until suspend is deactivated by clearing the PES bits in FALSH_ACR. Consequently PESD goes back to 0 and the suspended operation completes.

Bit 31 LOCK: FLASH_CR lock

This bit can only be set by software. When set, the FLASH_CR register is locked. This bit is cleared by hardware after detecting the unlock sequence.

In case of an unsuccessful unlock operation, this bit remains set until the next system reset.

Bit 30 OPTLOCK: Options lock

This bit can only be set by software. When set, all bits concerning user option in FLASH_CR and so option page are locked. This bit is cleared by hardware after detecting the option unlock sequence. The LOCK bit must be cleared before doing the unlock sequence for OPTLOCK bit.

In case of an unsuccessful option unlock operation, this bit remains set until the next reset.

Bits 29:28 Reserved, must be kept at reset value.

Bit 27 OBL_LAUNCH: forces the option byte loading

When set to 1, this bit forces the option byte reloading. This bit is cleared only when the option byte loading is complete. It cannot be written if OPTLOCK is set.

0: Option byte loading completed

1: Option byte loading requested

Bit 26 RDERRIE: PCROP read error interrupt enable

This bit enables the interrupt generation when the RDERR bit in FLASH_SR is set to 1.

0: PCROP read error interrupt disabled

1: PCROP read error interrupt enabled

Bit 25 ERRIE : error interrupt enable

This bit enables the interrupt generation when the OPERR bit in FLASH_SR is set to 1.

0: OPERR error interrupt disabled

1: OPERR error interrupt enabled

Bit 24 EOPIE : end of operation interrupt enable

This bit enables the interrupt generation when the EOP bit in FLASH_SR is set to 1.

0: EOP Interrupt disabled

1: EOP Interrupt enabled

Bits 23:19 Reserved, must be kept at reset value.

Bit 18 FSTPG : fast programming

0: Fast programming disabled

1: Fast programming enabled

Bit 17 OPTSTRT : options modification start

When set, this bit triggers an options programming operation. When RDP level is regressed from level 1 to level 0, this bit also launches a flash memory, SRAM1 and SRAM2 erase.

This bit is set only by software and cleared when BSY is cleared in FLASH_SR.

Bit 16 STRT : start

When set, this bit triggers an erase operation. If MER and PER are reset and STRT is set, an unpredictable behavior may occur without generating any error flag. This condition is forbidden.

This bit is set only by software and cleared when BSY is cleared in FLASH_SR.

Bits 15:10 Reserved, must be kept at reset value.

Bits 9:3 PNB[6:0] : page number selection

These bits select the 2-Kbyte page to erase.

0x00: page 0

0x01: page 1

...

0x3F: page 63

Bit 2 MER : mass erase

When set, this bit triggers the mass erase (all user pages).

Bit 1 PER : page erase

0: page erase disabled

1: page erase enabled

Bit 0 PG : programming

0: Flash programming disabled

1: Flash programming enabled

3.8.6 FLASH ECC register (FLASH_ECCR)

Address offset: 0x018

Reset value: 0x0000 0000

Access: no wait state when no flash memory operation is ongoing. Word, half-word and byte access.

Bit 31 ECCD : ECC detection

Set by hardware when two ECC errors have been detected. When this bit is set, a NMI is generated.

This bit is cleared by writing 1.

Bit 30 ECCC : ECC correction

Set by hardware when one ECC error has been detected and corrected. An interrupt is generated if ECCIE is set.

This bit is cleared by writing 1.

Bits 29:25 Reserved, must be kept at reset value.

Bit 24 ECCIE : ECC correction interrupt enable

0: ECCC interrupt disabled

1: ECCC interrupt enabled

Bits 23:21 Reserved, must be kept at reset value.

Bit 20 SYSF_ECC : system flash memory ECC fail

This bit indicates that the ECC error correction or double ECC error detection is located in the system flash memory.

Bits 19:17 Reserved, must be kept at reset value.

Bits 16:0 ADDR_ECC[16:0] : ECC fail double-word address

This bit indicates that double-word address is concerned by the ECC error correction or causes the double ECC error detection.

3.8.7 FLASH option register (FLASH_OPTR)

Address offset: 0x020

Reset value: 0x3FFF F0AA

Default reset value from ST production is given. Subsequently, 0bXX11 XXXX X111 XXXX 1XXX XXXX XXXX XXXX, the option bits are loaded with user values from the flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word, half-word and byte access.

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bit 31 Reserved, must be kept at reset value.

Bit 30 BOOT_LOCK : CPU boot lock enable option bit

This bit may be set by software at any time, but a write to clear is only taken into account in one of the following conditions:

• - when staying in RDP level 0
• - when regressing RDP level from 1 to 0

0: CPU boot lock disabled

1: CPU boot lock enabled

Bits 29:28 Reserved, must be kept at reset value.

Bit 27 nBOOT0 : nBOOT0 option bit

If nSWBOOT0 bit selects BOOT0 to be taken from option bit nBOOT0, then this bit, together with option nBOOT1, selects the boot modes (from the user flash memory, SRAM1 or system flash memory). Refer to Section 2.2: Boot configuration .

0: nBOOT0 = 0

1: nBOOT0 = 1

Bit 26 nSWBOOT0 : software BOOT0 selection

0: BOOT0 taken from the option bit nBOOT0

1: BOOT0 taken from PH3/BOOT0 pin

Bit 25 SRAM_RST : SRAM1 and SRAM2 erase when system reset

0: SRAM1 and SRAM2 erased when a system reset occurs

1: SRAM1 and SRAM2 not erased when a system reset occurs

Note: PKA SRAM is always erased on any system.

Bit 24 SRAM2_PE : SRAM2 parity check enable

0: SRAM2 parity check enabled

1: SRAM2 parity check disabled

Bit 23 nBOOT1 : boot configuration

Together with the BOOT0 pin or option bit nBOOT0 (depending on nSWBOOT0 option bit configuration), this bit selects boot mode from the user flash memory, SRAM or system flash memory. Refer to Section 2.2: Boot configuration .

Bits 22:20 Reserved, must be kept at reset value.

Bit 19 WWDG_SW : window watchdog selection

0: Hardware window watchdog

1: Software window watchdog

Bit 18 IWDG_STDBY : independent watchdog counter freeze in Standby mode

0: Independent watchdog counter frozen in Standby mode

1: Independent watchdog counter running in Standby mode

1. Bit 17 IWDG_STOP : independent watchdog counter freeze in Stop mode
   0: Independent watchdog counter frozen in Stop mode
   1: Independent watchdog counter running in Stop mode
2. Bit 16 IWDG_SW : independent watchdog selection
   0: Hardware independent watchdog
   1: Software independent watchdog
3. Bit 15 Reserved, must be kept at reset value.
4. Bit 14 nRST_SHDW : reset generation in Shutdown mode
   0: Reset generated when entering the Shutdown mode
   1: No reset generated when entering the Shutdown mode
5. Bit 13 nRST_STDBY : reset generation in Standby mode
   0: Reset generated when entering the Standby mode
   1: No reset generated when entering the Standby mode
6. Bit 12 nRST_STOP : reset generation in Stop mode
   0: Reset generated when entering the Stop mode
   1: No reset generated when entering the Stop mode
7. Bits 11:9 BOR_LEV[2:0] : BOR reset Level
   These bits contain the V _DD supply level threshold that activates/releases the reset.
   000: BOR level 0. Reset level threshold is ~ 1.7 V
   001: BOR level 1. Reset level threshold is ~ 2.0 V
   010: BOR level 2. Reset level threshold is ~ 2.2 V
   011: BOR level 3. Reset level threshold is ~ 2.5 V
   100: BOR level 4. Reset level threshold is ~ 2.8 V
8. Bit 8 ESE : system security enable flag
   When read, this bit indicates whether the system security is enabled, meaning a not valid option byte has been loaded. Writing 0 to this bit and regressing the RDP from level 1 to level 0 disables the security.
   0: Security disabled
   1: Security enabled
9. Bits 7:0 RDP[7:0] : readout protection level
   0xAA: Level 0, readout protection not active
   0xCC: Level 2, chip readout protection active
   Others: Level 1, memories readout protection active
   Note: Take care about PCROP_RDP configuration in level 1. Refer to Level 1: readout protection for more details.

3.8.8 FLASH PCROP zone A start address register (FLASH_PCROP1ASR)

Address offset: 0x024

Reset value: 0xFFFF FFFF

Default reset value from ST production is given. Subsequently, 0b1111 1111 1111 1111 1111 1111 XXXX XXXX, the option bits are loaded with user values from the flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word, half-word access.

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PCROP1A_STR[7:0] : PCROP1A area start offset

PCROP1A_STR contains the first 1-Kbyte page of the PCROP1A area.

3.8.9 FLASH PCROP zone A end address register (FLASH_PCROP1AER)

Address offset: 0x028

Reset value: 0xFFFF FF00

Default reset value from ST production is given. Subsequently, 0bX111 1111 1111 1111 1111 1111 XXXX XXXX, the option bits are loaded with user values from flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word, half-word access. PCROP_RDP bit can be accessed with byte access

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bit 31 PCROP_RDP : PCROP area preserved when RDP level decreased

This bit is set only. It is reset after a full mass erase due to a change of RDP from level 1 to level 0.

0: PCROP area not erased when the RDP level is decreased from level 1 to level 0

1: PCROP area erased when the RDP level is decreased from level 1 to level 0 (full mass erase)

Bits 30:8 Reserved, must be kept at reset value.

Bits 7:0 PCROP1A_END[7:0] : PCROP1A area end offset

PCROP1A_END contains the last 1-Kbyte page of the PCROP1A area.

3.8.10 FLASH WRP area A address register (FLASH_WRP1AR)

Address offset: 0x02C

Reset value: 0xFF80 FFFF

Default reset value from ST production is given as 0b1111 1111 1XXX XXXX 1111 1111 1XXX XXXX, the option bits are loaded with user values from the flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word, half-word and byte access.

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bits 31:23 Reserved, must be kept at reset value.

Bits 22:16 WRP1A_END[6:0] : WRP area A end offset

Contains the last 2-Kbyte page of the WRP area A.

Bits 15:7 Reserved, must be kept at reset value.

Bits 6:0 WRP1A_STR[6:0] : WRP area A start offset

Contains the first 2-Kbyte page of the WRP area A.

3.8.11 FLASH WRP area B address register (FLASH_WRP1BR)

Address offset: 0x030

Reset value: 0xFF80 FFFF

Default reset value from ST production is given as 0b1111 1111 1XXX XXXX 1111 1111 1XXX XXXX, the option bits are loaded with user values from flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word, half-word and byte access.

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bits 31:23 Reserved, must be kept at reset value.

Bits 22:16 WRP1B_END[6:0] : WRP area B end offset

WRP1B_END contains the last 2-Kbyte page of the WRP area B.

Bits 15:7 Reserved, must be kept at reset value.

Bits 6:0 WRP1B_STR[6:0] : WRP area B start offset

WRP1B_STR contains the first 2-Kbyte page of the WRP area B.

3.8.12 FLASH PCROP zone B start address register (FLASH_PCROP1BSR)

Address offset: 0x034

Reset value: 0xFFFF FFFF

Default reset value from ST production is given. Subsequently, 0b1111 1111 1111 1111 1111 1111 XXXX XXXX, the option bits are loaded with user values from the flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word and half-word access.

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PCROP1B_STRT[7:0] : PCROP1B area start offset
Contains the first 1-Kbyte page of the PCROP1B area.

3.8.13 FLASH PCROP zone B end address register (FLASH_PCROP1BER)

Address offset: 0x038

Reset value: 0xFFFF FF00

Default reset value from ST production is given. Subsequently, 0b1111 1111 1111 1111 1111 1111 XXXX XXXX, the option bits are loaded with user values from the flash memory at reset release.

Access: no wait state when no flash memory operation is ongoing. Word and half-word access.

This register can only be written by the CPU in RDP level 0 or RDP level 1.

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PCROP1B_END[7:0] : PCROP1B area end offset
Contains the first 1-Kbyte page of the PCROP1B area.

3.8.14 FLASH register map

Table 17. Flash interface register map and reset values (continued)

Refer to Section 2.4 for the register boundary addresses.