2. System and memory overview
2.1 System architecture
The main system consists of 32-bit multilayer AHB bus matrix that interconnects:
- • Seven masters:
- – CPU1 (CPU1 Cortex ® -M4 with FPU) core I-bus
- – CPU1 (CPU1 Cortex ® -M4 with FPU) core D-bus
- – CPU1 (CPU1 Cortex ® -M4 with FPU) core S-bus
- – CPU2 (Cortex ® -M0+) core S-bus
- – DMA1
- – Radio system
- • Ten slaves:
- – Internal Flash memory on the CPU1 (CPU1 Cortex ® -M4) ICode bus
- – Internal Flash memory on CPU1 (CPU1 Cortex ® -M4) DCode bus
- – Internal Flash memory on CPU2 (Cortex ® -M0+) S bus
- – Internal SRAM1 (64 KB for the STM32WB50CG, 32 KB for the STM32WB30CE)
- – Internal SRAM2a (32 KB) + SRAM2b (32 KB)
- – AHB1 peripherals including AHB to APB bridges and APB peripherals (connected to APB1 and APB2)
- – AHB2 peripherals
- – AHB4 shared peripheral
- – AHB5 including AHB to APB bridge and Radio peripherals (connected to APB3)
The bus matrix provides access from a master to a slave, enabling concurrent access and efficient operation even when several high-speed peripherals work simultaneously. This architecture is shown in Figure 1 .
Figure 1. System architecture

The diagram illustrates the system architecture centered around a BusMatrix . On the left, four masters are connected to the matrix: CPU1 Arm® Cortex®-M4 (via S0, S1, S2), CPU2 Arm® Cortex®-M0+ (via S3), DMA1 (via S4), and Radio system (via S6). The matrix has 10 slave ports (M0-M9) on the right, which connect to various targets:
- M0 : CFI arbiter
- M1 : Flash memory
- M2 : SRAM1
- M3 : SRAM2
- M4 : AHB1
- M5 : AHB2
- M6 : AHB4
- M8 : AHB5
- M9 : (unlabeled)
- S0 (CPU1 I-bus) connects to M0, M1, M2, and M3 (when remapped).
- S1 (CPU1 D-bus) connects to M0, M1, M2, and M3 (when remapped).
- S2 (CPU1 S-bus) connects to M0, M1, M2, M3, M4, M5, M6, and M8.
- S3 (CPU2) connects to M0, M1, M2, M3, M4, M5, M6, and M8.
- S4 (DMA1) connects to M0, M1, M2, M3, M4, M5, M6, and M8.
- S6 (Radio system) connects to M0, M1, M2, M3, M4, M5, M6, and M8.
2.1.1 S0: CPU1 (CPU1 Cortex®-M4) I-bus
This bus connects the instruction bus of the CPU1 core to the BusMatrix. This bus is used by the core to fetch instructions. The targets of this bus are the internal Flash memory, SRAM1, SRAM2a (backup) and SRAM2b (non backup).
2.1.2 S1: CPU1 (CPU1 Cortex®-M4) D-bus
This bus connects the data bus of the CPU1 core to the BusMatrix. This bus is used by the core for literal load and debug access. The targets of this bus are the internal Flash memory, SRAM1, SRAM2a (backup) and SRAM2b (non backup).
2.1.3 S2: CPU1 (CPU1 Cortex®-M4) S-bus
This bus connects the system bus of the CPU1 core to the BusMatrix. This bus is used by the core to access data located in a peripheral or SRAM area. The targets of this bus are SRAM1, SRAM2a (backup), SRAM2b (non backup), the AHB1 peripherals including the APB1 and APB2 peripherals, the AHB2 peripherals and the AHB4 peripherals.
2.1.4 S3: CPU2 (Cortex®-M0+) S-bus
This bus connects the system bus of the CPU2 core to the BusMatrix. This bus is used by the core to fetch instructions, for literal load and debug access, and access data located in a peripheral or SRAM area. The targets of this bus are the internal Flash memory, SRAM1, SRAM2a (backup), SRAM2b (non backup), the AHB1 peripherals including the APB1 and APB2 peripherals, the AHB2 peripherals, and the AHB4 peripherals and the AHB5 peripherals including the APB3 peripherals.
2.1.5 S4: DMA-bus
This bus connects the AHB master interface of the DMA to the BusMatrix. The targets of this bus are the SRAM1, SRAM2a (backup), SRAM2b (non backup), the AHB1 peripherals including the APB1 and APB2 peripherals, the AHB2 peripherals and the AHB4 peripherals.
2.1.6 S6: Radio system-bus
This bus connects the AHB master interface of the Radio system to the BusMatrix. The targets of this bus are the SRAM2a (backup) and SRAM2b (non backup).
2.1.7 BusMatrix
The BusMatrix manages the access arbitration between masters. The arbitration uses a Round Robin algorithm. The BusMatrix is composed by six masters (CPU1: system bus, DCode bus, ICode bus, CPU2: system bus, DMA1-bus and Radio system-bus) and nine slaves (3 x Flash memory, SRAM1, SRAM2a (backup), SRAM2b (non backup), AHB1 (including APB1 and APB2), AHB2, AHB4, and AHB5).
AHB/APB bridges
The two bridges AHB to APB1 and AHB to APB2 provide full synchronous connections between the AHB and the two APB buses, allowing flexible selection of the peripheral frequency.
The bridges AHB to APB3 provide an a-synchronous connections between the AHB and the APB bus, allowing flexible selection of the frequency between the AHB and peripheral.
Refer to Section 2.2: Memory organization for the address mapping of the peripherals connected to this bridge.
After each device reset, all peripheral clocks are disabled (except for the SRAM1/2 and Flash memory interface). Before using a peripheral you have to enable its clock in the RCC_AHBxENR and the RCC_APBxENR registers.
Note: When a 16- or 8-bit access is performed on an APB register, the access is transformed into a 32-bit access: the bridge duplicates the 16- or 8-bit data to feed the 32-bit vector.
2.2 Memory organization
2.2.1 Introduction
Program memory, data memory, registers and I/O ports are organized within the same linear 4-Gbyte address space.
The bytes are coded in memory in Little Endian format. The lowest numbered byte in a word is considered the word's least significant byte and the highest numbered byte the most significant.
The addressable memory space is divided into eight main blocks, of 512 Mbytes each.
2.2.2 Memory map and register boundary addresses
Figure 2. Memory map

Legend
- Securable IP
- (1) Accessible only by CPU1
- (2) Accessible by only CPU2
- (3) At this address range accessible only by CPU1
- (4) CPU2 execution from SRAM can be disabled by SYSCFG sticky register bit C2RFD
- (5) Contain the trimmed or configuration values obtained during production. This area is not described in this document, and is reserved for internal use by STMicroelectronics.
- Reserved
Memory Map Details:
- 0xFFFF FFFF to 0xE000 0000: Cortex® M4 and M0+ internal
- 0xE000 0000 to 0x6000 0000: CFI, PKA RAM, PKA, AES, HSEM, TRNG, IPCC, EXTI, PWR, RCC
- 0x6000 0000 to 0x5800 0000: APB3 RF (2)
- 0x5800 0000 to 0x4800 0000: AHB shared
- 0x4800 0000 to 0x4000 0000: AHB2
- 0x4000 0000 to 0x2004 0000: AHB1
- 0x2004 0000 to 0x2003 8000: SRAM2b (4)
- 0x2003 8000 to 0x2003 0000: SRAM2a (4)
- 0x2003 0000 to 0x2001 0000: SRAM1 (4)
- 0x2001 0000 to 0x2000 0000: Option bytes
- 0x2000 0000 to 0x1FFF 8000: ADC, GPIOH, GPIOE, GPIOC, GPIOB, GPIOA
- 0x1FFF 8000 to 0x1FFF 7400: Engineering bytes (5)
- 0x1FFF 7400 to 0x1FFF 7000: OTP area
- 0x1FFF 7000 to 0x1FFF 0000: System flash
- 0x1FFF 0000 to 0x1001 0000: SRAM2b (3)(4)
- 0x1001 0000 to 0x1000 0000: SRAM2a (3)(4)
- 0x1000 0000 to 0x0810 0000: Flash
- 0x0810 0000 to 0x0800 0000: CRC, TSC, DMAMUX, DMA, APB2, APB1
- 0x0800 0000 to 0x0010 0000: TIM17, TIM16, USART1, SPI1, TIM1, SYSCFG
- 0x0010 0000 to 0x0000 0000: Cortex® M4 and M0+ internal code space
- Additional Peripherals: LPTIM2, LPTIM1, I2C1, IWDG, WWDG, RTC and TAMP, TIM2
MS52643V2
All the memory areas not allocated to on-chip memories and peripherals are considered “Reserved”. For the detailed mapping of available memory and register areas, refer to the following table, which gives the boundary addresses of the available peripherals.
Table 1. STM32WB50CG/30CE memory map and peripheral register boundary addresses| Bus | Boundary address | Size (bytes) | Peripheral | Peripheral register map |
|---|---|---|---|---|
| - | 0x6000 2000 - 0xDFFF FFFF | - | Reserved | - |
| APB3 | 0x6000 1000 - 0x6000 1FFF | 4 K | 802.15.4 CTRL | - |
| 0x6000 0800 - 0x6000 0FFF | 2 K | Reserved | - | |
| 0x6000 0400 - 0x6000 07FF | 1 K | Radio CTRL | - | |
| 0x6000 0000 - 0x6000 03FF | 1 K | BLE CTRL | - | |
| AHB4 | 0x5800 4400 - 0x5FFF FFFF | - | Reserved | - |
| 0x5800 4000 - 0x5800 43FF | 1 K | FLASH | Section 3.10.20: FLASH register map on page 116 | |
| 0x5800 3400 - 0x5800 3FFF | - | Reserved | - | |
| 0x5800 2400 - 0x5800 33FF | 5 K | PKA RAM | Section 18.7.5: PKA register map on page 531 | |
| 0x5800 2000 - 0x5800 23FF | PKA | |||
| 0x5800 1C00 - 0x5800 1FFF | 1 K | Reserved | - | |
| 0x5800 1800 - 0x5800 1BFF | 1 K | AES2 | Section 17.7.18: AES register map on page 504 | |
| 0x5800 1400 - 0x5800 17FF | 1 K | HSEM | Section 31.4.9: HSEM register map on page 1048 | |
| 0x5800 1000 - 0x5800 13FF | 1 K | True RNG | Section 16.7.4: RNG register map on page 456 | |
| 0x5800 0C00 - 0x5800 0FFF | 1 K | IPCC | Section 30.4.9: IPCC register map on page 1035 | |
| 0x5800 0800 - 0x5800 0BFF | 1 K | EXTI | Section 14.5.17: EXTI register map on page 352 | |
| 0x5800 0400 - 0x5800 07FF | 1 K | PWR | Section 6.6.21: PWR register map and reset value table on page 169 | |
| 0x5800 0000 - 0x5800 03FF | 1 K | RCC | Section 7.4.47: RCC register map on page 242 | |
| AHB2 | 0x5004 0400 - 0x57FF FFFF | - | Reserved | - |
| 0x5004 0000 - 0x5004 03FF | 1 K | ADC | Section 15.8: ADC register map on page 442 | |
| 0x4800 1C00 - 0x4800 1FFF | 1 KB | GPIOH | Section 8.4.12: GPIO register map on page 266 | |
| 0x4800 1400 - 0x4800 1BFF | 3 K | Reserved | ||
| 0x4800 1000 - 0x4800 13FF | 1 K | GPIOE | ||
| 0x4800 0C00 - 0x4800 0FFF | 1 K | Reserved | ||
| 0x4800 0800 - 0x4800 0BFF | 1 K | GPIOC | ||
| 0x4800 0400 - 0x4800 07FF | 1 K | GPIOB | ||
| 0x4800 0000 - 0x4800 03FF | 1 K | GPIOA |
Table 1. STM32WB50CG/30CE memory map and peripheral register boundary addresses
| Bus | Boundary address | Size (bytes) | Peripheral | Peripheral register map |
|---|---|---|---|---|
| AHB1 | 0x4002 3400 - 0x47FF FFFF | - | Reserved | - |
| 0x4002 3000 - 0x4002 33FF | 1 K | CRC | Section 5.4.6: CRC register map on page 126 | |
| 0x4002 0C00 - 0x4002 2FFF | 9 K | Reserved | - | |
| 0x4002 0800 - 0x4002 0BFF | 1 K | DMAMUX | Section 12.6.7: DMAMUX register map on page 325 | |
| 0x4002 0400 - 0x4002 07FF | 1 K | Reserved | - | |
| 0x4002 0000 - 0x4002 03FF | 1 K | DMA1 | Section 11.6.7: DMA register map on page 308 | |
| - | 0x4001 4C00 - 0x4001 FFFF | 45 K | Reserved | - |
| APB2 | 0x4001 4800 - 4001 4BFF | 1 K | TIM17 | Section 21.4.23: TIM16/TIM17 register map on page 752 |
| 0x4001 4400 - 4001 47FF | 1 K | TIM16 | Section 21.4.23: TIM16/TIM17 register map on page 752 | |
| 0x4001 3C00 - 4001 43FF | 2 K | Reserved | - | |
| 0x4001 3800 - 4001 3BFF | 1 K | USART1 | Section 28.8.15: USART register map on page 985 | |
| 0x4001 3400 - 4001 37FF | 1 K | Reserved | - | |
| 0x4001 3000 - 4001 33FF | 1 K | SPI1 | Section 29.6.8: SPI register map on page 1021 | |
| 0x4001 2C00 - 4001 2FFF | 1 K | TIM1 | Section 19.4.30: TIM1 register map on page 629 | |
| 0x4001 0400 - 4001 2BFF | 10 K | Reserved | - | |
| 0x4001 0200 - 4001 03FF | 1 K | Reserved | - | |
| 0x4001 0100 - 4001 01FF | 1 K | SYSCFG | Section 9.2.17: SYSCFG register map on page 284 | |
| 0x4001 0030 - 4001 00FF | 1 K | Reserved | - | |
| 0x4001 0000 - 4001 002F | 1 K | SYSCFG | Section 9.2.17: SYSCFG register map on page 284 |
| Bus | Boundary address | Size (bytes) | Peripheral | Peripheral register map |
|---|---|---|---|---|
| APB1 | 0x4000 9800 - 4000 FFFF | 26 K | Reserved | - |
| 0x4000 9400 - 04000 97FF | 1 K | LPTIM2 | Section 22.7.9: LPTIM register map on page 777 | |
| 0x4000 8000 - 04000 93FF | 5 K | Reserved | - | |
| 0x4000 7C00 - 04000 7FFF | 1 K | LPTIM1 | Section 22.7.9: LPTIM register map on page 777 | |
| 0x4000 5800 - 04000 7BFF | 9 K | Reserved | - | |
| 0x4000 5400 - 04000 57FF | 1 K | I2C1 | Section 27.7.12: I2C register map on page 898 | |
| 0x4000 3400 - 04000 53FF | 8 K | Reserved | - | |
| 0x4000 3000 - 0x4000 33FF | 1 K | IWDG | Section 25.4.6: IWDG register map on page 828 | |
| 0x4000 2C00 - 0x4000 2FFF | 1 K | WWDG | Section 26.5.4: WWDG register map on page 834 | |
| 0x4000 2800 - 0x4000 2BFF | 1 K | RTC and TAMP | Section 24.6.21: RTC register map on page 818 | |
| 0x4000 0400 - 0x4000 27FF | 9 K | Reserved | - | |
| 0x4000 0000 - 0x4000 03FF | 1 K | TIM2 | Section 20.4.25: TIMx register map on page 700 | |
| AHB4 | 0x2003 8000 - 0x2003 FFFF | 32 K | SRAM2b | - |
| 0x2003 0000 - 0x2003 7FFF | 32 K | SRAM2a | - | |
| AHB1 | 0x2001 0000 - 0x2002 FFFF | - | Reserved | - |
| 0x2000 0000 - 0x2000 FFFF | 64 K | SRAM1 (1) | - | |
| AHB4 | 0x1FFF 8000 - 0x1FFF 807F | 128 | Flash memory options | Section 3.10.20: FLASH register map on page 116 |
| 0x1FFF 7000 - 0x1FFF 73FF | 1 K | Flash memory OTP | - | |
| 0x1FFF 0000 - 0x1FFF 6FFF | 28 K | Flash memory Boot loader | - | |
| 0x1000 0000 - 0x1000 FFFF | 64 K | SRAM2a/b CPU1 mirror | - | |
| 0x0800 0000 - 0x080 FFFF | 1 M (2) | User Flash memory | - | |
| (3) | 0x0000 0000 - 0x000 FFFF | 1 M (2) | CPUUn Boot area | - |
1. 64 KB for STM32WB50CG, 32 KB for STM32WB30CE.
2. 1 MB for STM32WB50CG, 512 KB for STM32WB30CE.
3. Bus depends upon selected CPUUn Boot area.
2.2.3 Bit banding
The CPU1 map includes two bit-band regions. These regions map each word in an alias region of memory to a bit in a bit-band region of memory. writing to a word in the alias region has the same effect as a read-modify-write operation on the targeted bit in the bit-band region.
The AHB1, APB1, APB2 peripheral registers and the SRAM1, SRAM2a and SRAM2b are mapped to a bit-band region, hence single bit-band write and read operations are allowed. The operations are only available for CPU1 accesses, and not form other bus masters (e.g. DMA)
The peripheral bit-band alias is located from address 0x4200 0000 to 0x42FF FFFF
The SRAM bit-band alias is located from address 0x2200 0000 to 0x227F FFFF
A mapping formula shows how to reference each word in the alias region to a corresponding bit in the bit-band region. The mapping formula is:
- \( \text{bit\_word\_addr} = \text{bit\_band\_base} + (\text{byte\_offset} * 32) + (\text{bit\_number} * 4) \) , where:
- – \( \text{bit\_word\_addr} \) is the address of the word in the alias memory region that maps to the targeted bit.
- – \( \text{bit\_band\_base} \) is the starting address of the alias region
- – \( \text{byte\_offset} \) is the number of the byte in the bit\_band region that contains the targeted bit
- – \( \text{bit\_number} \) is the bit position (0-7) of the targeted bit
Example
The following example shows how to map bit [2] of the byte located at SRAM1 address 0x2000 0300 to the alias region.
Writing to address 0x2200 6008 has the same effect as a read-modify-write operation on bit [2] of the byte at SRAM1 address 0x2000 0300.
Reading address 0x2200 6008 returns the value 0x01 or 0x00 of bit [2] of the byte at SRAM1 address 0x2000 0300.
For more information on bit-band, refer to the Cortex®-M4 programming manual.
2.3 Boot configuration
Three different CPU1 boot modes can be selected through the BOOT0 pin and nBOOT1 bit in the User options, as shown in Table 2 .
Table 2. Boot modes
| nBOOT1 FLASH_OPTR[23] | nBOOT0 FLASH_OPTR[27] | BOOT0 pin PH3 | nSWBOOT0 FLASH_OPTR[26] | Main flash empty (1) | Boot memory space alias |
|---|---|---|---|---|---|
| x | x | 0 | 1 | 0 | Main flash memory is selected as boot area |
| x | x | 0 | 1 | 1 | System memory is selected as boot area |
Table 2. Boot modes (continued)
| nBOOT1 FLASH_OPTR[23] | nBOOT0 FLASH_OPTR[27] | BOOT0 pin PH3 | nSWBOOT0 FLASH_OPTR[26] | Main flash empty (1) | Boot memory space alias |
|---|---|---|---|---|---|
| x | 1 | x | 0 | x | Main flash memory is selected as boot area |
| 0 | x | 1 | 1 | x | Embedded SRAM1 is selected as boot area |
| 0 | 0 | x | 0 | x | |
| 1 | x | 1 | 1 | x | System memory is selected as boot area |
| 1 | 0 | x | 0 | x |
- 1. A flash empty check mechanism is implemented to force the boot from system flash if the first flash memory location is not programmed (0xFFFF FFFF) and if the boot selection was configured to boot from the main flash.
The values on both BOOT0 and BOOT1 are latched after a reset. It is up to the user to provide the correct value for the required boot mode.
The BOOT0 and BOOT1 are also re-sampled when exiting Standby mode. Consequently they must be kept in the required boot mode. After the startup delay, the CPU1 fetches the top-of-stack from address 0x0000 0000, then starts code execution from the boot memory at 0x0000 0004.
Depending on the selected boot mode, main flash, system flash, or SRAM1 memories are accessible as follows:
- • Boot from main flash memory: the main flash memory is aliased in the CPU1 boot memory space at address 0x0000 0000, and is accessible even from its physical address 0x0800 0000. In other words, the flash memory content can be accessed starting from address 0x0000 0000 or 0x0800 0000.
- • Boot from system flash memory: the system flash memory is aliased in the CPU1 boot memory space at address 0x0000 0000, and is also still accessible from its physical address 0x1FFF 0000.
- • Boot from SRAM: the memory is aliased in the CPU1 boot memory space at address 0x0000 0000, and is accessible even from its physical address 0x2000 0000.
Empty check
An internal empty check flag (the EMPTY bit of the FLASH access control register (FLASH_ACR)) is available for easy programming of virgin devices by the boot loader. This flag is used when BOOT0 pin is defining main flash as the target boot area. When the flag is set, the device is considered as empty, and the system memory (boot loader) is selected instead of the main flash as a boot area, to allow user to program the memory. Therefore, some of the GPIOs are reconfigured from the high-Z state. Refer to AN2606 for more details concerning the bootloader and GPIO configuration in system memory boot mode. It is possible to disable this feature by configuring the option bytes to force boot from the main flash memory (nSWBOOT0 = 0, nBOOT0 = 1).
This empty check flag is updated only during the loading of option bytes: it is set when the content of the address 0x0800 0000 is read as 0xFFFF FFFF, otherwise it is cleared. A power reset or setting the OBL_LAUNCH bit in FLASH_CR register is needed to clear this flag after programming of a virgin device, to execute user code after System reset. The EMPTY bit can be written directly by software.
CPU1 physical remap
Following CPU1 boot the application software can modify the memory map at address 0x0000 0000. This modification is performed by programming the SYSCFG memory remap register (SYSCFG_MEMRMP) in the SYSCFG controller.
The following memories can be remapped:
- • Main flash memory
- • System flash memory
- • SRAM
Embedded boot loader
The embedded boot loader is located in the system flash memory, programmed by ST during production. It is used to program the flash memory using one of the following device interfaces:
- • USART1 on pins PA9 and PA10
- • I2C1 on pins PB6 and PB7.
- • SPI1 on pins PA4, PA5, PA6 and PA7
2.4 CPU2 boot
Following a device reset the CPU2 will only boot after CPU1 has set the C2BOOT bit in the PWR control register 4 (PWR_CR4) . The C2BOOT value is retained in Standby mode and the CPU2 will boot accordingly when exit from Standby.
The CPU2 will boot from its boot reset vector as defined by the flash user option C2OPT and SBRV.
The CPU2 may boot from anywhere in user flash or SRAM1/SRAM2a/SRAM2b.
CPU2 safe boot
When, after a reset, the User options are not valid and the BOOT0 and BOOT1 select CPU1 to boot from main flash memory, the CPU2 boots from a safe boot vector in main flash memory at address 0x080F F000.
The safe boot can be used to restore the last known user options from a copied image.
2.5 CPU2 SRAM fetch disable
CPU2 execution from SRAM can be disabled by the C2RFD bit in SYSCFG register. Disabling CPU2 execution from SRAM improves robustness of the CPU2 software.