3. Embedded flash memory (FLASH)

3.1 Introduction

The flash memory interface manages CPU1 (CPU1 Cortex®-M4) AHB ICode and DCode accesses and the CPU2 (Cortex®-M0+) AHB to the flash memory. It implements the access arbitration between the two CPUs, the erase and program flash memory operations, the read and write protection, and the security mechanisms.

The flash memory interface accelerates code execution with a system of instruction prefetch and cache lines.

3.2 FLASH main features

• • Up to 1 Mbyte of flash memory single bank architecture
• • Memory organization: 1 bank
  • – main memory: up to 1 Mbyte
  • – page size: 4 Kbytes
• • 72-bit wide data read (64 bits plus 8 ECC bits)
• • 72-bit wide data write (64 bits plus 8 ECC bits)
• • Page erase (4 Kbytes), and mass erase

Flash memory interface features:

• • Flash memory read operations
• • Flash memory program/erase operations
• • Read protection activated by option (RDP)
• • Two write protection areas selected by option (WRP)
• • Two proprietary code read protection area selected by option (PCROP)
• • CPU2 Security area
• • Flash empty check
• • Program and Erase suspension feature
• • Prefetch on CPU1 ICODE and CPU2 S-bus
• • CPU1 instruction cache: 32 cache lines of 4 x 64 bits on ICode (1 Kbyte RAM)
• • CPU1 data cache: eight cache lines of 4 x 64 bits on DCode (256 bytes RAM)
• • CPU2 instruction cache: four cache lines of 1 x 64 bits on S-bus (32 bytes RAM)
• • Error code correction (ECC): eight bits for 64-bit
• • Option byte loader

3.3 FLASH functional description

3.3.1 Flash memory organization

The memory is organized as 72-bit wide memory cells (64 bits, plus 8 ECC bits) that can be used for storing both code and data constants. It includes

• • A main memory block containing up to 256 pages for STM32WB50CG, up to 128 pages for STM32WB30CE of 4 Kbytes, each page with eight rows of 512 bytes.
• • An information block containing:
  • – System memory from which the CPU1 boots in System memory boot mode. The area is reserved and contains the boot loader used to reprogram the flash memory through one of the following interfaces: USART1, I2C1 SPI1. It is programmed by STMicroelectronics when the device is manufactured, and protected against spurious write/erase operations. For further details, refer to the AN2606 available from www.st.com .
  • – 1 Kbyte (128 double words) OTP (one-time programmable) for user data. The OTP data cannot be erased and can be written only once. If only one bit is at 0, the entire double word (64 bits) cannot be written anymore, even with the value 0x0000 0000 0000 0000.
  • – Option bytes for user configuration.

The memory is based on a main area and an information block as shown in Table 3 .

Table 3. Flash memory - Single bank organization

1. Pages 128 to 255 available on STM32WB50CG only.

3.3.2 Empty check

During the OBL phase, after loading all options, the flash memory interface checks whether the first location of the main memory is programmed. The result of this check in conjunction with the boot0 and boot1 information is used to determine where the system has to boot from. It prevents the system to boot from flash main memory area when, for instance, no user code has been programmed.

The flash main memory empty check status can be read from the EMPTY bit in Flash memory access control register (FLASH_ACR) . Software can modify the flash main memory empty status by writing to the EMPTY bit.

3.3.3 Error code correction (ECC)

Data in flash memory words are 72-bit wide: eight bits are added per each double word (64 bits). The ECC mechanism supports:

• • One error detection and correction
• • Two errors detection

When one error is detected and corrected, the flag ECCC (ECC correction) is set in Flash memory ECC register (FLASH_ECCR) . If ECCCIE is set, an interrupt is generated.

When two errors are detected, a flag ECCD (ECC detection) is set in Flash memory ECC register (FLASH_ECCR) . In this case, a NMI is generated.

When an ECC error is detected, the address of the failing double word is saved in ADDR_ECC[16:0] in the FLASH_ECCR register. ADDR_ECC[2:0] are always cleared. The bus-ID of the CPU accessing the address is saved in CPUID[2:0].

While ECCC or ECCD is set, FLASH_ECCR is not updated if a new ECC error occurs. FLASH_ECCR is updated only when ECC flags are cleared.

Note: For a virgin data (0xFF FFFF FFFF FFFF FFFF), one error is detected and corrected, but two errors detection is not supported.

When an ECC error is reported, a new read at the failing address may not generate an ECC error if the data is still present in the current buffer, even if ECCC and ECCD are cleared. If this is not the desired behavior, the user must reset the cache.

3.3.4 Read access latency

To correctly read data from flash memory, the number of wait states (LATENCY) must be correctly programmed in the Flash memory access control register (FLASH_ACR) according to the frequency of the flash memory (HCLK4) clock.

Table 4 shows the correspondence between wait states and flash clock frequency.

Table 4. Number of wait states vs, flash memory clock (HCLK4) frequency

After POR on reset, the HCLK4 clock frequency is 4 MHz and 0 wait state (WS) is configured in the FLASH_ACR register.

When woken-up from Standby, the HCLK4 clock frequency is 16 MHz and 0 wait state (WS) is configured in the FLASH_ACR register.

When changing the flash memory clock frequency, the software sequences described below must be applied in order to tune the number of wait states needed to access the flash memory.

Increasing the CPU frequency

1. 1. Program the new number of wait states to the LATENCY bits in the Flash memory access control register (FLASH_ACR) .
2. 2. Check that the new number of wait states is taken into account to access the flash memory by reading back the LATENCY from the Flash memory access control register (FLASH_ACR) , and wait until the programmed new number is read.
3. 3. Modify the System clock source by writing the SW bits in the RCC_CFGR register.
4. 4. If needed, modify the CPU clock prescaler by writing the SHDHPRE bits in RCC_EXTCFGR.
5. 5. Optionally, check that the new System clock source or/and the new flash memory clock prescaler value is/are taken into account by reading the clock source status (SWS bits) in the RCC_CFGR register, or/and the AHB prescaler value (SHDHPREREF bit), in the RCC_EXTCFGR register.

Decreasing the CPU frequency

1. 1. Modify the System clock source by writing the SW bits in the RCC_CFGR register.
2. 2. If needed, modify the flash memory clock prescaler by writing the SHDHPRE bits in RCC_EXTCFGR.
3. 3. Check that the new System clock source or/and the new flash memory clock prescaler value is/are taken into account by reading the clock source status (SWS bits) in the RCC_CFGR register, or/and the AHB prescaler value (SHDHPREREF bit), in the RCC_EXTCFGR register, and wait until the programmed new system clock source or/and new flash memory clock prescaler value is/are read.
4. 4. Program the new number of wait states to the LATENCY bits in Flash memory access control register (FLASH_ACR) .
5. 5. Optionally, check that the new number of wait states is used to access the flash memory by reading back the LATENCY from the Flash memory access control register (FLASH_ACR) .

3.3.5 Adaptive real-time memory accelerator (ART Accelerator)

The proprietary Adaptive real-time (ART) memory accelerator is optimized for STM32 industry-standard Arm ^® Cortex ^® -M4 with FPU processors. It balances the inherent performance advantage of the Arm ^® Cortex ^® -M4 with FPU over flash memory technologies, which normally require the processor to wait for the flash memory at higher operating frequencies.

To release the processor full performance, the accelerator implements an instruction prefetch queue and branch cache that increases program execution speed from the 64-bit flash memory. Based on CoreMark ^® benchmark, the performance achieved thanks to the ART Accelerator ^™ is equivalent to 0 wait state program execution from flash memory at a CPU frequency up to 64 MHz.

Instruction prefetch

The CPU1 fetches the instruction over the ICode bus and the literal pool (constant/data) over the DCode bus. The prefetch block aims at increasing the efficiency of ICode bus accesses.

The CPU2 fetches the instruction and the literal pool (constant/data) over the S-bus. The prefetch block aims at increasing the efficiency of S-bus accesses.

Each flash memory read operation provides 64 bits from either two instructions of 32 bits or four instructions of 16 bits according to the program launched. This 64-bits current instruction line is saved in a current buffer. So, in case of sequential code, at least two CPU cycles are needed to execute the previous read instruction line. Prefetch on the CPU1 ICode bus or CPU2 S-bus can be used to read the next sequential instruction line from the flash memory while the current instruction line is being requested by the CPU.

Prefetch is enabled by setting the PRFTEN bit in the Flash memory access control register (FLASH_ACR) for the CPU1 or Flash memory CPU2 access control register (FLASH_C2ACR) for the CPU2. This feature is useful if at least one wait state is needed to access the flash memory.

Figure 3 shows the execution of sequential 16-bit instructions with and without prefetch when three WS are needed to access the flash memory.

Figure 3. Sequential 16-bit instructions execution

When the code is not sequential (branch), the instruction may not be present in the currently used instruction line or in the prefetched instruction line. In this case (miss), the penalty in terms of number of cycles is at least equal to the number of wait states.

If a loop is present in the current buffer, no new access is performed.

CPU1 Instruction cache memory (I-Cache)

To limit the CPU1 time lost due to jumps, it is possible to retain 32 lines of 4*64 bits (1 Kbyte) in an instruction cache memory. This feature can be enabled for the CPU1 by setting the instruction cache enable (ICEN) bit in the Flash memory access control register (FLASH_ACR) . Each time a miss occurs (requested data not present in the currently used instruction line, in the prefetched instruction line or in the instruction cache memory), the line read is copied into the instruction cache memory. If some data contained in the instruction cache memory are requested by the CPU, they are provided without inserting any delay. Once all the instruction cache memory lines have been filled, the LRU (least recently used) policy is used to determine the line to replace in the instruction memory cache. This feature is particularly useful in case of code containing loops.

The Instruction cache memory is enable after system reset.

CPU1 Data cache memory (D-Cache)

CPU1 literal pools are fetched from flash memory through the DCode bus during the execution stage of the CPU pipeline. Each CPU1 DCode bus read access fetches 64 bits that are saved in a current buffer. The CPU pipeline is consequently stalled until the requested literal pool is provided. To limit the time lost due to literal pools, accesses through the AHB databus DCode have priority over accesses through the AHB instruction bus ICode.

If some literal pools are frequently used, the CPU1 data cache memory can be enabled by setting the data cache enable (DCEN) bit in the Flash memory access control register (FLASH_ACR) . This feature works like the instruction cache memory, but the retained data size is limited to 8 lines of 4*64 bits (256 bytes).

The Data cache memory is enabled after system reset.

Note: The D-Cache is active only when data is requested by the CPU (not by DMAs). Data in option bytes block are not cacheable.

CPU2 cache memory (S-bus)

To limit the CPU2 time lost due to jumps, it is possible to retain four lines of 1*64 bits (32 bytes) in an instruction cache memory. This feature can be enabled for the CPU2 by setting the instruction cache enable (ICEN) bit in the Flash memory CPU2 access control register (FLASH_C2ACR) . Each time a miss occurs (requested data not present in the currently used instruction line, in the prefetched instruction line or in the instruction cache memory), the line read is copied into the instruction cache memory. If some data contained in the instruction cache memory are requested by the CPU, they are provided without inserting any delay. Once all the instruction cache memory lines have been filled, the LRU (least recently used) policy is used to determine the line to replace in the instruction memory cache. This feature is particularly useful in case of code containing loops.

The Instruction cache memory is enable after system reset.

CPU2 literal pools are fetched from flash memory through the S-bus during the execution stage of the CPU pipeline. Each CPU2 S-bus read access fetches 64 bits that are saved in a current buffer. The CPU pipeline is consequently stalled until the requested literal pool is provided.

No Data cache is available on Cortex ^® -M0+.

3.3.6 Flash memory program and erase operations

The embedded flash memory can be programmed using in-circuit or in-application programming.

The in-circuit programming (ICP) method is used to update the entire contents of the flash memory, using the JTAG, SWD protocol or the supported interfaces by the System boot loader, to load the user application for both the CPU1 and CPU2, into the microcontroller. ICP offers quick and efficient design iterations and eliminates unnecessary package handling or socketing of devices.

In contrast to the ICP method, in-application programming (IAP) can use any communication interface supported by the microcontroller (e.g. I/Os, UART, I ² C, SPI) to download programming data into memory. IAP allows the user to re-program the flash memory while the application is running. Nevertheless, part of the application has to have been previously programmed in the flash memory using ICP.

The contents of the flash memory are not guaranteed if a device reset occurs during a flash memory operation.

During a program/erase operation to the flash memory, any attempt to read the flash memory stalls the bus. The read operation proceeds correctly once the program/erase operation is completed.

Note: In a multi-CPU system it is good practice to use semaphores to manage flash memory program and erase operations, and prevent simultaneous operations by the CPUs.

Secure system flash memory programming

The secure CPU2 application can only be programmed by in-application programming (IAP) running on the secure CPU2. Only the secure CPU2 is able to download programming data into secure part of the memory. Secure IAP allows the user to re-program the flash memory while the application is running. Nevertheless, part of the application has to have been previously programmed in the flash memory using ICP.

The in-circuit programming (ICP) System boot loader is able to communicate with the secure CPU2 IAP, to download programming data into secure memory.

Unlocking the flash memory

After reset, write is not allowed in the Flash memory control register (FLASH_CR) or Flash memory CPU2 control register (FLASH_C2CR) to protect the flash memory against possible unwanted operations due, for example, to electric disturbances. The following sequence is used to unlock these registers:

1. 1. Write KEY1 = 0x4567 0123 in the Flash memory key register (FLASH_KEYR)
2. 2. Write KEY2 = 0xCDEF 89AB in the Flash memory key register (FLASH_KEYR) .

Any wrong sequence locks up the FLASH_CR registers until the next system reset. In the case of a wrong key sequence, a bus error is detected and a hard fault interrupt is generated.

The FLASH_CR registers can be locked again by software by setting the LOCK bit in one of these registers.

Note: The FLASH_CR register cannot be written when the BSY bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) is set. Any

attempt to write to these registers with the BSY bit set causes the AHB bus to stall until this bit is cleared.

Caution: Due to the structure of the memory (64 bits of data associated to 8 bits of ECC), interrupted operations can result in corrupted data and/or inconsistent ECC bits. The concerned address can trigger an ECC interrupt or an NMI when accessed later on. Consequently, handle write/erase operations with care, and ensure that ECC events are managed by firmware.

3.3.7 Flash main memory erase sequences

The erase operation can be performed at page level (page erase), or on the whole memory (mass erase). Mass erase does not affect the Information block (system flash, OTP and option bytes).

Flash memory page erase

The CPU1 is able to page erase only the non-secure part of the user flash. The secure CPU2 can page erase both the secure and non-secure parts of the user flash memory.

A page erase starts only when allowed by the PESD bit in the Flash memory status register (FLASH_SR) and in the Flash memory CPU2 status register (FLASH_C2SR) .

When a page is protected by PCROP or WRP it is not erased.

Table 5. Page erase overview

1. WRPERR is generated only when PER is requested by CPU2 (Cortex-M0+). There is no WRPERR when PER is requested by CPU1.

To erase a page (4 Kbytes), follow the procedure below:

1. Check that no flash memory operation is ongoing by checking the BSY bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) .

Check that flash memory program and erase operations are allowed by checking the PESD bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2

status register (FLASH_C2SR) (these checks are recommended even if status can change due to flash memory operation requests by the other CPU, to limit the risk of receiving a bus error when starting page erase).

1. 2. Check and clear all error programming flags due to a previous programming. If not, PGSERR is set.
2. 3. Check that bit CFGBSY in the FLASH_xxSR register is cleared.
3. 4. Set the PER bit and select the page to erase (PNB) in the Flash memory control register (FLASH_CR) or Flash memory CPU2 control register (FLASH_C2CR) .
4. 5. Set the STRT bit in the FLASH_xxCR register.
5. 6. Wait until bit CFGBSY is cleared.

Note: The internal oscillator HSI16 (16 MHz) is enabled automatically when STRT bit is set, and disabled automatically when STRT bit is cleared, except if the HSI16 is previously enabled with HSION in RCC_CR register.

Flash memory mass erase

A flash memory mass erase by the CPU1 is ignored and a bus error is generated.

When PCROP or WRP is enabled, any flash memory mass erase is aborted and no erase started.

Table 6. Mass erase overview

To perform a mass erase, follow the procedure below:

1. 1. Check that no flash memory operation is ongoing by checking the BSY bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) .
2. 2. Check and clear all error programming flags due to a previous programming. If not, PGSERR is set.
3. 3. Check that bit CFGBSY in the FLASH_xxSR register is cleared.
4. 4. Set the MER bit in the Flash memory control register (FLASH_CR) or Flash memory CPU2 control register (FLASH_C2CR) .
5. 5. Set the STRT bit in the FLASH_xxCR register.
6. 6. Wait until bit CFGBSY is cleared.

Note: The internal oscillator HSI16 (16 MHz) is enabled automatically when STRT bit is set, and disabled automatically when STRT bit is cleared, except if the HSI16 is previously enabled with HSION in RCC_CR register.

3.3.8 Flash main memory programming sequences

The flash memory is programmed 72 bits (a double word, 64 bits plus ECC, 8 bits) at a time.

Programming in a previously programmed double word is only allowed when programming an all 0 value. It is not allowed to program any other value in a previously programmed double word, any attempt sets PROGERR flag in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) , except when programming an already programmed double word with an all 0 value.

It is only possible to program a double word (2 x 32-bit data).

• • Any attempt to write byte (8 bits) or half-word (16 bits) sets SIZERR flag in the FLASH_xxSR register.
• • Any attempt to write a double word that is not aligned with a double word address sets PGAERR flag in the FLASH_xxSR register.

Only the secure CPU2 is able to download programming data into the secure part of the memory. A flash memory programming by the CPU1 in the secure flash memory area is ignored and a bus error is generated.

Standard programming

The flash memory programming sequence in standard mode is as follows:

1. 1. Check that no flash main memory operation is ongoing by checking the BSY bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) .

Check that flash memory program and erase operations are allowed by checking the PESD bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) (these checks are recommended even if status may change due to flash memory operation requests by the other CPU, to limit the risk of receiving a bus error when starting programming).

1. 2. Check and clear all error programming flags due to a previous programming. If not, PGSERR is set.
2. 3. Check that bit CFGBSY in the FLASH_xxSR register is cleared.
3. 4. Set the PG bit in the Flash memory control register (FLASH_CR) or Flash memory CPU2 control register (FLASH_C2CR) .
4. 5. Perform the data write operation at the desired memory address, inside main memory block or OTP area. Only double word (64 bits) can be programmed.
   1. a) Write a first word in an address aligned with double word
   2. b) Write the second word.
5. 6. Wait until bit CFGBSY is cleared.
6. 7. Check that EOP flag is set in the FLASH_xxSR register (meaning that the programming operation has succeeded), and clear it by software.
7. 8. Clear the PG bit in the FLASH_xxSR register if there are no more programming requests anymore.

Note: When the flash memory interface has received a good sequence (a double word), programming is automatically launched and BSY bit is set. The internal oscillator HSI16 (16 MHz) is enabled automatically when PG bit is set, and disabled automatically when PG bit is cleared, except if the HSI16 is previously enabled with HSION in RCC_CR register.

If the user needs to program only one word, double word must be completed with the erase value 0xFFFF FFFF, to launch automatically the programming.

ECC is calculated from the double word to program.

Fast programming

This mode allows to program a row or 64 double words (512 bytes). It reduces the page programming time by eliminating the need for verifying the flash memory locations before they are programmed, and avoids rising and falling times of high voltage for each double word. During fast programming, the clock frequency (HCLK4) must be at least 8 MHz.

Only the main memory can be programmed in fast programming mode.

Fast row programming must be performed by executing software from SRAM and disabling interrupts when not relocating the CPU interrupt vector table. A read access from the CPU requesting row programming causes a bus error. A read from any other source (the other CPU or DMA) is stalled until the row programming finishes (standard double word programming does not cause a bus error to the requesting CPU, but stalls any read until standard programming finishes).

The flash main memory programming sequence in standard mode is described below:

1. 1. Perform a mass erase. If not, PGSERR is set.
2. 2. Check that no flash main memory operation is ongoing by checking the BSY bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) .
   Check that flash memory program and erase operation is allowed by checking the PESD bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) (these checks are recommended even if status may change due to flash memory operation requests by the other CPU, to limit the risk of receiving a bus error when starting programming).
3. 3. Check and clear all error programming flags due to previous programming.
4. 4. Check that bit CFGBSY in the FLASH_xxSR register is cleared.
5. 5. Set the FSTPG bit in Flash memory control register (FLASH_CR) or Flash memory CPU2 control register (FLASH_C2CR) .
6. 6. Write the 64 double words to program a row (512 bytes).
7. 7. Wait until bit CFGBSY is cleared.
8. 8. Check that EOP flag is set in the FLASH_xxSR register (meaning that the programming operation has succeed), and clear it by software.
9. 9. Clear the FSTPG bit in the FLASH_xxSR register if there are no more programming requests anymore.

Note: When attempting to write in fast programming mode while a read operation is on going, the programming is aborted without any system notification (no error flag is set).

When the flash memory interface has received the first double word, programming is automatically launched. The BSY bit is set when the high voltage is applied for the first double word, and it is cleared when the last double word has been programmed or in case of error. The internal oscillator HSI16 (16 MHz) is enabled automatically when FSTPG bit is

set, and disabled automatically when FSTPG bit is cleared, except if the HSI16 is previously enabled with HSION in RCC_CR register.

The 64 double words must be written successively. The high voltage is kept on the flash memory for all the programming. Maximum time between two double words write requests is the time programming (around 20 µs). If a second double word arrives after this time programming, fast programming is interrupted and MISSERR is set.

High voltage must not exceed 8 ms for a full row between two erases. This is guaranteed by the sequence of 64 double words successively written with a clock system greater or equal to 8 MHz. An internal time-out counter counts 7 ms when fast programming is set and stops the programming when time-out is over. In this case the FASTERE bit is set.

If an error occurs, high voltage is stopped and next double word to programmed is not programmed. Anyway, all previous double words have been properly programmed.

Programming errors signaled by flags

Several kind of errors can be detected. In case of error, the flash memory operation (programming or erasing) is aborted.

• • PROGERR: Programming error

In standard programming: PROGERR is set if the word to write with values different from all 0 has not been previously erased, except if the value to program is all 0. If any other error (SIZERR, PAGERR, PGSERR, WRPERR) occurs the PROGERR may not be set even if there is a word re-programming without erase error.

• • SIZERR: Size programming error

In standard programming or in fast programming: only double word can be programmed, and only 32-bit data can be written. SIZERR is set if a byte or an half-word is written.

• • PGAERR: Alignment programming error

PGAERR is set if one of the following conditions occurs:

• – Alignment programming errors are individually checked per CPU. No checks are available for simultaneous multi-CPU programming. HSEM or other software mechanisms shall be used to prevent simultaneous multi CPU programming.
• – In standard programming: the first word to be programmed is not aligned with a double word address, or the second word does not belong to the same double word address.
• – In fast programming: the data to program does not belong to the same row than the previous programmed double words, or the address to program is not greater than the previous one.

• • PGSERR: Programming sequence error

PGSERR is set if one of the following conditions occurs:

• – In the standard programming sequence or the fast programming sequence: data is written when PG and FSTPG are cleared.
• – In the standard programming sequence or the fast programming sequence: MER and PER are not cleared when PG or FSTPG is set.
• – In the fast programming sequence: the Mass erase is not performed before setting the FSTPG bit.
• – In the mass erase sequence: PG, FSTPG, and PER are not cleared when MER is set.

• – In the page erase sequence: PG, FSTPG, and MER are not cleared when PER is set.
• – PGSERR is set also if PROGERR, SIZERR, PGAERR, WRPERR, MISSERR, FASTERR, or PGSERR is set due to a previous programming error.
• – In the fast programming sequence: if the row to be programmed is on a page different from the one previously erased. If a mass erase has been done it is allowed to program rows on higher order pages, but not on lower order.
• • WRPERR: Write protection error
  WRPERR is set if one of the following conditions occurs:
  • – Attempt to program or erase in a write protected area (WRP) or in a PCROP area.
  • – Attempt to perform a mass erase when one page or more is protected by WRP or PCROP.
  • – The debug features are connected or the boot is executed from SRAM or from system flash when the read protection (RDP) is set to Level 1.
  • – Attempt to modify the option bytes when the read protection (RDP) is set to Level 2, except when requested by the secure CPU2.
• • MISSERR: Fast programming data miss error
  In fast programming: all the data must be written successively. MISSERR is set if the previous data programming is finished and the next data to program is not written yet.
• • FASTERR: Fast programming error
  In fast programming: FASTERR is set if one of the following conditions occurs:
  • – When FSTPG bit is set for more than 7 µs, which generates a time-out detection.
  • – When the row fast programming has been interrupted by a MISSERR, PGAERR, WRPERR or SIZERR.

If an error occurs during a program or erase operation, one of the following error flags is set in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) :

• • PROGERR, SIZERR, PGAERR, PGSERR, MISSERR (program error flags)
• • WRPERR (protection error flag)

In this case, if the error interrupt enable bit ERRIE is set in the Flash memory control register (FLASH_CR) or in the Flash memory CPU2 control register (FLASH_C2CR) , an interrupt is generated and the operation error flag OPERR is set in the FLASH_xxSR register.

Note: If several successive errors are detected (for example, in case of DMA transfer to the flash memory), the error flags cannot be cleared until the end of the successive write request.

Programming errors causing a bus error

Some error conditions, listed below, do not generate an error flag but a bus error instead.

• • AHB write to any page when RDP level 1 and boot is performed from system flash memory or SRAM1
• • AHB write when flash memory is powered down
• • Read or write from flash memory through the debugger
• • Reading from flash memory when fast row programming is ongoing, from the source which requested the fast row programming.
• • Requesting a new programming request, when the previous one has not finished.
• • FLASH_CR register write between the two accesses of a double word programming.
• • FLASH_CR register write when PESDx is active (set).
• • Writing a wrong key in FLASH_KEYR or FLASH_OPTKEYR register
• • Any subsequent write to FLASH_KEYR or FLASH_OPTKEYR after unlocking the respective feature

PGSERR and PGAERR in a page-based row programming

When performing a fast programming Table 7 describes how PGSERR and PGAERR are handled.

Table 7. Errors in page-based row programming

When after a system reset neither MER nor PER is performed, any programming attempt causes PGAERR and PGSERR errors.

Programming and caches

If a flash memory write access impacts data in the data cache, the flash memory write access modifies the data in the memory and the data in the cache.

If an erase operation in flash memory also concerns data in the data or instruction cache, the user has to ensure that these data are rewritten before they are accessed during code execution. Upon an erase operation the cache content is invalidated.

Note: The I/D cache must be flushed only when it is disabled (I/DCEN = 0).

3.4 FLASH option bytes

3.4.1 Option bytes description

The option bytes are configured by the end user depending on the application requirements. As a configuration example, the watchdog may be selected in hardware or software mode (refer to Section 3.4.2: Option bytes programming ).

A double word is split up in option bytes as indicated in Table 8 .

Table 8. Option bytes format

The organization of these bytes in the information block is shown in Table 9 . The option bytes can be read from the memory locations listed in Table 9 or from the Option byte registers:

• • Flash memory option register (FLASH_OPTR)
• • Flash memory PCROP zone A start address register (FLASH_PCROP1ASR)
• • Flash memory PCROP zone A end address register (FLASH_PCROP1AER)
• • Flash memory PCROP zone B start address register (FLASH_PCROP1BSR)
• • Flash memory PCROP zone B end address register (FLASH_PCROP1BER)
• • Flash memory WRP area A address register (FLASH_WRP1AR)
• • Flash memory WRP area B address register (FLASH_WRP1BR)
• • Flash memory IPCG mailbox data buffer address register (FLASH_IPCCBR)
• • Secure flash memory start address register (FLASH_SFR)
• • Flash memory secure SRAM2 start address and CPU2 reset vector register (FLASH_SRRVR)

Table 9. Option bytes organization

Table 9. Option bytes organization (continued)

1. The upper 32-bits of the double-word address contain the inverted data from the lower 32 bits.

2. The value 0x0BC0DE1D is written during production, when option bytes are configured.

User and read protection option bytes

Flash memory address: 0x1FFF 8000

Reset value: 0x3FFF F1AA (ST production value)

Bits 31:29 AGC_TRIM[2:0] : Automatic gain control trimming.

Default value 0b001.

Bit 28 Reserved, must be kept at reset value.

Bit 27 nBOOT0 : nBOOT0 option bit

0: nBOOT0 = 0

1: nBOOT0 = 1

Bit 26 nSWBOOT0 : Software BOOT0

0: BOOT0 taken from the option bit nBOOT0

1: BOOT0 taken from PH3/BOOT0 pin

Bit 25 SRAM2_RST : SRAM2 and PKA RAM erase when system reset

0: SRAM2 and PKA RAM erased when a system reset occurs

1: SRAM2 and non-secure PKA RAM not erased when a system reset occurs

Bit 24 SRAM2_PE : SRAM2 parity check enable

0: SRAM2 parity check enabled

1: SRAM2 parity check disabled

Bit 23 nBOOT1 : Boot configuration

Together with the BOOT0 pin or option bit nBOOT0 (depending on nSWBOOT0 option bit configuration), this bit selects boot mode from the flash main memory, SRAM1 or the System memory. Refer to Section 2.3: Boot configuration .

Bits 22:20 Reserved, must be kept at reset value.

Bit 19 WWDG_SW : Window watchdog selection

• 0: Hardware window watchdog
• 1: Software window watchdog

Bit 18 IWDG_STDBY : Independent watchdog counter freeze in Standby mode

• 0: Independent watchdog counter is frozen in Standby mode
• 1: Independent watchdog counter is running in Standby mode

Bit 17 IWDG_STOP : Independent watchdog counter freeze in Stop mode

• 0: Independent watchdog counter is frozen in Stop mode
• 1: Independent watchdog counter is running in Stop mode

Bit 16 IWDG_SW : Independent watchdog selection

• 0: Hardware independent watchdog
• 1: Software independent watchdog

Bit 15 Reserved, must be kept at reset value.

Bit 14 nRST_SHDW

• 0: Reset generated when entering the Shutdown mode
• 1: No reset generated when entering the Shutdown mode

Bit 13 nRST_STDBY

• 0: Reset generated when entering the Standby mode
• 1: No reset generated when entering the Standby mode

Bit 12 nRST_STOP

• 0: Reset generated when entering the Stop mode
• 1: No reset generated when entering the Stop mode

Bits 11:9 BOR_LEV[2:0] : BOR reset Level

These bits contain the VDD supply level threshold that activates/releases the reset.

• 000: BOR Level 0. Reset level threshold is ~ 1.7 V
• 001: BOR Level 1. Reset level threshold is ~ 2.0 V
• 010: BOR Level 2. Reset level threshold is ~ 2.2 V
• 011: BOR Level 3. Reset level threshold is ~ 2.5 V
• 100: BOR Level 4. Reset level threshold is ~ 2.8 V

Bit 8 ESE : System security enabled flag.

• 0: Security disabled
• 1: Security enabled

Bits 7:0 RDP[7:0] : Read protection level

• 0xAA: Level 0, read protection not active
• 0xCC: Level 2, chip read protection active
• Others: Level 1, memories read protection active

PCROP1A start address option bytes

Flash memory address: 0x1FFF 8008

Reset value: 0xFFFF FFFF, (ST production value)

Bits 31:9 Reserved, must be kept at reset value.

Bits 8:0 PCROP1A_STR[8:0] : PCROP1A area start offset

PCROP1A_STR contains the first 2 Kbytes page of the PCROP1A area. Note that bit 8 is reserved on STM32WB30CE devices.

PCROP1A end address option bytes

Flash memory address: 0x1FFF 8010

Reset value: 0x0000 0000 (ST production value)

Bit 31 PCROP_RDP : PCROP area preserved when RDP level is decreased

This bit is set only. It is reset after a full mass erase due to a change of RDP from Level 1 to Level 0.

0: PCROP area is not erased when the RDP level is decreased from Level 1 to Level 0.

1: PCROP area is erased when the RDP level is decreased from Level 1 to Level 0 (full mass erase).

Bits 30:9 Reserved, must be kept at reset value.

Bits 8:0 PCROP1A_END : PCROP1A area end offset

PCROP1A_END contains the last 2 Kbytes page of the PCROP1A area. Note that bit 8 is reserved on STM32WB30CE devices.

WRP Area A address option bytes

Flash memory address: 0x1FFF 8018

Reset value: 0x0000 00FF (ST production value)

Bits 31:24 Reserved, must be kept at reset value.

Bits 23:16 WRP1A_END[7:0] : WRP area “A” end offset

WRPA1_END contains the last 4 Kbytes page of the WRP area “A”. Note that bit 23 is reserved on STM32WB30CE devices.

Bits 15:8 Reserved, must be kept at reset value.

Bits 7:0 WRP1A_STRT[7:0] : WRP area “A” start offset

WRPA1_STRT contains the first 4 Kbytes page of the WRP area “A”. Note that bit 7 is reserved on STM32WB30CE devices.

WRP Area B address option bytes

Flash memory address: 0x1FFF 8020

Reset value: 0x0000 00FF (ST production value)

Bits 31:24 Reserved, must be kept at reset value.

Bits 23:16 WRP1B_END[7:0] : WRP area “B” end offset

WRPB1_END contains the last 4 Kbytes page of the WRP area “B”. Note that bit 23 is reserved on STM32WB30CE devices.

Bits 15:8 Reserved, must be kept at reset value.

Bits 7:0 WRP1B_STRT[7:0] : WRP area “B” start offset

WRPB1_STRT contains the first 4 Kbytes page of the WRP area “B”. Note that bit 7 is reserved on STM32WB30CE devices.

PCROP1B start address option bytes

Flash memory address: 0x1FFF 8028

Reset value: 0xFFFF FFFF (ST production value)

Bits 31:9 Reserved, must be kept at reset value.

Bits 8:0 PCROP1B_STRT[8:0] : PCROP1B area start offset

PCROP1B_STRT contains the first 2 Kbytes page of the PCROP1B area. Note that bit 8 is reserved on STM32WB30CE devices.

Flash memory address: 0x1FFF 8030

Reset value: 0x0000 0000 (ST production value)

Bits 31:9 Reserved, must be kept at reset value.

PCROP1B_END contains the last 2 Kbytes page of the PCROP1B area. Note that bit 8 is reserved on STM32WB30CE devices.

Flash memory address: 0x1FFF 8068

Reset value: 0x0000 0000 (ST production value)

Bits 31:14 Reserved, must be kept at reset value.

IPCCDBA contains the first double-word offset of the IPCC mailbox data buffer area in SRAM2.

Flash memory address: 0x1FFF 8070

Reset value: 0xFFFF FEXX (ST production value)

Bits 31:13 Reserved, must be kept at reset value.

Bit 12 DDS : Disable CPU2 debug access

0: CPU2 debug access enabled.

1: CPU2 debug access disabled.

Bits 11:9 Reserved, must be kept at reset value.

Bit 8 FSD : Flash security disable

FSD = 1: System and flash non-secure

FSD = 0: System and flash secure. SFSA[7:0] contains the start address of the first 4 Kbytes page of the secure flash area.

Bits 7:0 SFSA[7:0] : Secure flash start address

System and flash secure. SFSA[7:0] contains the start address of the first 4 Kbytes page of the secure flash area.

Secure SRAM2 start address and CPU2 reset vector option bytes

Flash memory address: 0x1FFF 8078

Reset value: 0xXXXX XXXX (ST production value)

Bit 31 C2OPT : CPU2 boot reset vector memory selection.

0: SBRV offset addresses SRAM1 or SRAM2, from start address 0x2000 0000 (SBRV value must be kept within the SRAM area).

1: SBRV offset addresses flash memory, from start address 0x0800 0000.

Bit 30 NBRSD : Non-backup SRAM2b security disable

NBRSD = 1: SRAM2b is non-secure

NBRSD = 0: SRAM2b is secure. SNBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure non-backup SRAM2b area.

Bits 29:25 SNBRSA : Secure non-backup SRAM2b start address

NBRSD = 0: SRAM2b is secure. SNBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure non-backup SRAM2b area.

Bit 24 Reserved, must be kept at reset value.

Bit 23 BRSD : Backup SRAM2a security disable

BRSD = 1: SRAM2a is non-secure

BRSD = 0: SRAM2a is secure. SBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure backup SRAM2a area.

Bits 22:18 SBRSA : Secure backup SRAM2a start address

BRSD = 0: SRAM2a is secure. SBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure backup SRAM2a area.

Bits 17:0 SBRV[17:0] : CPU2 boot reset vector

Contains the word aligned CPU2 boot reset start address offset within the selected memory area by C2OPT.

3.4.2 Option bytes programming

After reset, the options related bits in the Flash memory control register (FLASH_CR) and Flash memory CPU2 control register (FLASH_C2CR) are write-protected. To run any operation on the option bytes page, the option lock bit OPTLOCK in the Flash memory control register (FLASH_CR) must be cleared. The following sequence is used to unlock this register:

1. 1. Unlock the FLASH_CR with the LOCK clearing sequence (refer to Unlocking the flash memory )
2. 2. Write OPTKEY1= 0x08192A3B in the Flash memory option key register (FLASH_OPTKEYR)
3. 3. Write OPTKEY2 = 0x4C5D6E7F in the Flash memory option key register (FLASH_OPTKEYR)

Any wrong sequence locks up the flash memory option registers until the next system reset. In the case of a wrong key sequence, a bus error is detected and a hard fault interrupt is generated.

The user options can be protected against unwanted erase/program operations by setting the OPTLOCK bit by software.

Note: If LOCK is set by software, OPTLOCK is automatically set as well.

Note: In a multi-CPU system it is good practice to use semaphores to manage option programming, and prevent simultaneous option programming by the CPUs.

Modifying user options

The option bytes are programmed differently from a main memory user address.

To modify the value of user options follow the procedure below:

1. 1. Clear OPTLOCK option lock bit with the clearing sequence described above
2. 2. Write the desired options value in the options registers.
3. 3. Check that no flash memory operation is on going by checking the BSY bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) .

Check that flash program and erase operation is allowed by checking the PESD bit in the Flash memory status register (FLASH_SR) or Flash memory CPU2 status register (FLASH_C2SR) (these checks are recommended even if status may change due to flash operation requests by the other CPU, to limit the risk of receiving a bus error when modifying user options).

1. 4. Set the Options start bit OPTSTRT in the Flash memory control register (FLASH_CR) .
2. 5. Wait for the BSY bit to be cleared.

Note: Any modification of the value of one option is automatically performed by erasing user option bytes pages first, and then programming all the option bytes with the values contained in the flash memory option registers.

Secure user options

The secure option bytes Secure flash memory start address register (FLASH_SFR) and Flash memory secure SRAM2 start address and CPU2 reset vector register (FLASH_SRRVR) can only be written by the secure CPU2.

Option byte loading

After the BSY bit is cleared, all new options are updated into the flash memory, but not applied to the system. A read from the option registers returns the last loaded option byte values, the new options have effect on the system only after they are loaded.

Option bytes loading is performed in two cases:

• – when OBL_LAUNCH bit is set in the Flash memory control register (FLASH_CR)
• – after a power reset (BOR reset or exit from Standby/Shutdown modes)

Option byte loader performs a read of the options block and stores the data into internal option registers. These internal registers configure the system and can be read by software. Setting OBL_LAUNCH generates a reset so the option byte loading is performed under system reset.

Each option bit has also its complement in the same double word. During option loading, a verification of the option bit and its complement allows to check the loading has correctly taken place.

During option byte loading, the options are read by double word. ECC on option words is not taken into account during OBL, but only during direct SW read of option area.

If the word and its complement are matching, the option word/byte is copied into the option register.

If the comparison between the word and its complement fails, a status bit OPTVERR is set. Mismatch values are forced into the option registers:

• – for USR OPT option, the value of mismatch is all options at '1', except for BOR_LEV that is "000" (lowest threshold)
• – for WRP option, the value of mismatch is the default value "No protection"
• – for RDP option, the value of mismatch is the default value "Level 1"
• – for PCROP, the value of mismatch is "all memory protected"
• – for FSD and SFSA option, the value of mismatch is "all memories (Flash, SRAM2a and SRAM2b) secured"
• – for BRSD, SBRSA, NBRSD and SNBRASA options, the value of mismatch is "SRAM2 memory part secured"
• – for DDS option, the value of mismatch is "CPU2 debug disabled"
• – for C2OPT and SBRV options, the value of mismatch is "CPU2 boot from start address of last Flash page (safe boot)"
• – for OPTVAL option, the value of mismatch is "not valid".

If the OPTVAL option indicates "not valid" all memories (Flash, SRAM2a and SRAM2b) are secure.

Table 10. Option loading control

Table 10. Option loading control (continued)

On system reset rising, internal option registers are copied into option registers that can be read and written by software:

• • FLASH_OPTR
• • FLASH_PCROPxySR (x = 1 and y = A or B)
• • FLASH_PCROPxyER (x = 1 and y = A or B)
• • FLASH_WRPxyR (x = 1 and y = A or B)
• • FLASH_IPCCDBA
• • FLASH_SFR
• • FLASH_SRRVA

These registers are also used to modify options. If these registers are not modified by user, they reflect the options states of the system. See Modifying user options for more details.

3.5 FLASH UID64

A 64-bit unique device identification (UID64) is stored in the flash memory, and can be accessed by the CPUs.

Table 11. UID64 organization

The UID64 is programmed at device production, and provides a unique code for each device

• • the 24-bit ST company ID returns 0x00 80 E1
• • the 8-bit device ID returns 0x26 for STM32WB50CG revision Y and STM32WB30CE revision A, 0x27 for STM32WB50CG/STM32WB30CE revision X, as indicated in DBGMCU_IDCODE
• • the 32-bit unique device number is a sequential number, different for each individual device.

3.6 Flash memory protection

The flash main memory can be protected against external accesses with the Read protection (RDP). The pages can also be protected against unwanted write (WRP) due to loss of program counter context. The write-protection WRP granularity is 4 Kbytes. Apart from the RDP and WRP, flash memory can also be protected against read and write from third parties (PCROP). The PCROP granularity is 2 Kbytes.

Part of the flash main memory can be secured. It grants exclusive access to this part of the memory to the CPU2.

3.6.1 Read protection (RDP)

The read protection is activated by setting the RDP option byte and then, by applying a system reset to reload the new RDP option byte. The read protection protects the flash main memory, the option bytes, the backup registers (RTC_BKPxR in the RTC) and the SRAM2.

Note: If the read protection is set while the debugger is still connected (or was connected since the last power on) through JTAG/SWD, apply a POR (power-on reset) instead of a system reset. If the read protection is programmed through software, do not set the OBL_LAUNCH bit (FLASH_CR register), but perform a POR to reload the option byte. This can be done with a transition to Standby (or Shutdown) mode, followed by a wake-up.

There are three levels of read protection from no protection (Level 0) to maximum protection or no debug (Level 2).

The flash memory is protected when the RDP option byte and its complement contain the pair of values shown in Table 12 .

Table 12. Flash memory read protection status

The System memory area is read accessible whatever the protection level. It is never accessible for program/erase operation.

Level 0: No protection

Read, program and erase operations into the flash main memory area are possible. The option bytes, the SRAM2 and the backup registers are also accessible by all operations.

Level 1: Read protection

This is the default protection level when RDP option byte is erased. It is defined as well when RDP value is at any value different from 0xAA and 0xCC, or even if the complement is not correct.

• • User mode: Code executing in user mode ( Boot flash ) can access flash main memory, option bytes, SRAM2 and backup registers with all operations.
• • Debug, boot RAM and boot loader modes: In debug mode or when code is running from boot RAM or boot loader, the flash main memory, the backup registers (RTC_BKPxR in the RTC) and the SRAM2 are totally inaccessible. In these modes, a read or write access to the flash memory generates a bus error and a hard fault interrupt.

Caution: In case the Level 1 is configured and no PCROP areas are defined, it is mandatory to set PCROP_RDP bit to 1 (full mass erase when the RDP level is decreased from Level 1 to Level 0). In case the Level 1 is configured and a PCROP area is defined, if user code needs to be protected by RDP but not by PCROP, it must not be placed in a page containing a PCROP area.

Level 2: No debug

In this level, the protection Level 1 is guaranteed. In addition, the CPU1 and CPU2 debug port, the boot from RAM (boot RAM mode) and the boot from System memory (boot loader mode) are no more available. In user execution mode (boot FLASH mode), all operations are allowed on the flash main memory. On the contrary, only read and secure write operations can be performed on the option bytes. Option bytes, can only be programmed and erased by a secure CPU2.

The Level 2 cannot be removed from the non-secure application side: it is an irreversible operation. When attempting to modify the options bytes, the protection error flag WRPERR is set in the FLASH_xxxSR register and an interrupt can be generated.

Note: The debug feature is also disabled under reset.

Note: STMicroelectronics is not able to perform analysis on defective parts on which the Level 2 protection has been set.

Changing the Read protection level

It is easy to move from Level 0 to Level 1 by changing the value of the RDP byte to any value (except 0xCC). By programming the 0xCC value in the RDP byte, it is possible to go to level 2 either directly from Level 0 or from Level 1. Once in Level 2 it is no more possible to modify the Read protection level.

When the RDP is reprogrammed to the value 0xAA to move from Level 1 to Level 0, a mass erase of the flash main memory is performed if PCROP_RDP is set in the Flash memory PCROP zone A end address register (FLASH_PCROP1AER) . The backup registers (RTC_BKPxR in the RTC), the SRAM2 and the PKA SRAM are also erased. The user options (except PCROP protection) are set to their previous values copied from FLASH_OPTR, FLASH_WRPxyR (x = 1 and y = A or B). PCROP is disabled. The OTP area is not affected by mass erase and remains unchanged.

If the bit PCROP_RDP is cleared in the FLASH_PCROP1AER, the full mass erase is replaced by a partial mass erase that is successive page erases, except for the pages protected by PCROP. This is done in order to keep the PCROP code. Only when the flash

memory is erased, options are re-programmed with their previous values. This is also true for FLASH_PCROPxySR and FLASH_PCROPxyER registers (x = 1 and y = A or B).

A requested mass erase performs a partial mass erase (a sequence of page erases), except for the pages protected by CPU2 security (SFSA). This is done to keep the CPU2 secure code.

Table 13. RDP regression from Level 1 to Level 0 and memory erase

Note: Partial mass erase is performed only when Level 1 is active and Level 0 requested. When the protection level is increased (0→1, 1→2, 0→2) there is no mass erase.

To validate the protection level change, the option bytes must be reloaded through the OBL_LAUNCH bit in flash memory control register.

graph TD
    L1(("Level 1
RDP ≠ 0xAA
RDP ≠ 0xCC
default"))
    L0(("Level 0
RDP = 0xAA"))
    L2(("Level 2
RDP = 0xCC"))

    L1 -- "Write options including
RDP = 0xAA" --> L0
    L1 -- "Write options including
RDP = 0xCC" --> L2
    L0 -- "Write options including
RDP ≠ 0xCC and RDP ≠ 0xAA" --> L1
    L0 -- "Write options including
RDP = 0xCC" --> L2
    L2 -- "Write options including
RDP = 0xCC" --> L1
    
    L1 -- "RDP ≠ 0xAA and RDP ≠ 0xCC
Other options modified" --> L1
    L0 -- "RDP = 0xAA
Other option(s) modified" --> L0
  

1. When the protection Level 2 is active, the Debug port, the boot from RAM and the boot from system memory are disabled.

2. The system memory is only read-accessible, whatever the protection level (0, 1 or 2) and execution mode.

1. 3. The flash non secure main memory is erased when the RDP option byte is programmed with all level of protections disabled (0xAA). The flash secure main memory is also erased when the SFSA option byte is programmed to be non-secure and at the same time the RDP option byte is programmed with all level protections disabled (0xAA).
2. 4. The backup registers are erased when RDP changes from Level 1 to Level 0.
3. 5. The SRAM2 is erased when RDP changes from Level 1 to Level 0.

3.6.2 Proprietary code readout protection (PCROP)

Two parts of the flash memory can be protected against read and write from third parties.

The protected area is execute-only: it can only be reached by the STM32 CPUs, with an instruction code, while all other accesses (DMA, debug and CPU data read, write and erase) are strictly prohibited. The PCROP areas have a 2 Kbytes granularity. An additional option bit (PCROP_RDP) makes it possible to select if the PCROP area is erased or not when the RDP protection is changed from Level 1 to Level 0 (refer to Changing the Read protection level ).

Each PCROP area is defined by a start page offset and an end page offset into the flash memory. These offsets are defined in the PCROP address registers Flash memory PCROP zone A start address register (FLASH_PCROP1ASR) , Flash memory PCROP zone A end address register (FLASH_PCROP1AER) , Flash memory PCROP zone B start address register (FLASH_PCROP1BSR) and Flash memory PCROP zone B end address register (FLASH_PCROP1BER) .

A PCROP area is defined from the address Flash memory Base address + [PCROPxy_STRT x 0x800] (included) to the address: Flash memory Base address + [(PCROPxy_END+1) x 0x800] (excluded). The minimum PCROP area size is two PCROP pages (4 Kbytes) \( PCROPxy\_END = PCROPxy\_STRT + 1 \) .

When \( PCROPxy\_END = PCROPxy\_STRT \) the full flash memory is PCROP protected.

For example, to protect by PCROP from the address 0x0806 2F80 (included) to the address 0x0807 0004 (included):

• • if boot in flash memory is selected, one of the FLASH_PCROPxySR and FLASH_PCROPxyER registers ( \( x = 1 \) and \( y = A \) or \( B \) ) must be programmed with:
  • – \( PCROPxy\_STRT = 0xC5 \) (PCROP area first address 0x0806 2800)
  • – \( PCROPxy\_END = 0xE0 \) (PCROP area last address 0x0807 07FF)

Any data read access performed through a PCROP protected area triggers the RDERR flag error.

Any PCROP protected address is also write protected and any write access to one of these addresses triggers WRPERR.

Any PCROP area is also erase protected. Consequently, any erase to a page in this zone is impossible (including the page containing the start address and the end address of this zone). Moreover, a software mass erase cannot be performed if one zone is PCROP protected.

In the previous example, due to erase by page, all pages from page 0xC5 to 0xE0 are protected in case of page erase, all addresses from 0x0806 2800 to 0x0807 07FF cannot be erased.

Deactivation of PCROP can only occur when the RDP is changing from Level 1 to Level 0. If the user options modification tries to clear PCROP or to decrease the PCROP areas, the

options programming is launched but PCROP areas stays unchanged. On the contrary, it is possible to increase the PCROP areas.

When option bit PCROP_RDP is cleared, and when the RDP is changing from Level 1 to Level 0, Full mass erase is replaced by Partial mass erase to preserve the PCROP area (refer to Changing the Read protection level ). In this case, PCROPxy_STRT and PCROPxy_END (x = 1 and y = A or B) are not erased.

Table 15: PCROP protection

Note: It is recommended to align PCROP areas with page granularity when using PCROP_RDP, or to leave free the rest of the page where PCROP zones start or end.

3.6.3 Write protection (WRP)

The user area in flash memory can be protected against unwanted write operations. Two write-protected (WRP) areas can be defined, with page (4 Kbytes) granularity. Each area is defined by a start page offset and an end page offset related to the physical flash memory base address. These offsets are defined in the WRP address registers Flash memory WRP area A address register (FLASH_WRP1AR) and Flash memory WRP area B address register (FLASH_WRP1BR) .

The WRP “y” area (y = A, B) is defined from the address Flash memory Base address + [WRP1y_STRT x 0x1000] (included) to the address Flash memory Base address + [(WRP1y_END+1) x 0x1000] (excluded). The minimum WRP area size is one WRP page (4 Kbytes), WRP1y_END = WRP1y_STRT .

For example, to protect by WRP from the address 0x0806 2000 (included) to the address 0x0807 1FFF (included):

• • If boot in flash memory is selected, FLASH_WRP1AR register must be programmed with:
  • – WRP1A_STRT = 0x62.
  • – WRP1A_END = 0x71.

WRP1B_STRT and WRP1B_END in FLASH_WRP1BR can be used instead (area “B” in flash memory).

When WRP is active, it cannot be erased or programmed. Consequently, a software mass erase cannot be performed if one area is write-protected.

If an erase/program operation to a write-protected part of the flash memory is attempted, the write protection error flag (WRPERR) is set in the FLASH_SR register. This flag is also set for any write access to:

• – OTP area
• – part of the flash memory that can never be written like the ICP
• – PCROP area.

Note: When the flash memory read protection level is selected (RDP level = 1), it is not possible to program or erase the memory if the CPU debug features are connected (JTAG or single wire) or boot code is being executed from RAM or system flash memory, even if WRP is not activated. Any attempt generates an hard fault (BusFault).

Table 16: WRP protection

Note: To validate the WRP options, the option bytes must be reloaded through the OBL_LAUNCH bit in flash memory control register.

3.6.4 CPU2 security (ESE)

All or a part of the flash memory and the SRAM2a and SRAM2b can be made secure, exclusively accessible by the CPU2, protected against execution, read and write from third parties. Only the CPU2 can execute, read and write in these areas. It can only be reached by the CPU2, while all other accesses (CPU1 and DMA) are strictly prohibited.

Changing the CPU2 security mode

CPU2 security start address can be modified by the secure CPU2 by loading a new user option SFSA.

CPU2 secure flash memory area

The CPU2 secure flash memory area has sector (4 Kbytes) granularity and is defined by the secure flash memory start page offset user option (SFSA) into the flash memory. This offset is controlled from the SFSA field in the Secure flash memory start address register (FLASH_SFR) .

The CPU2 secure flash memory area is defined as follows: Flash memory Base address + [SFSA x 0x1000] (included) to the last flash memory address: When CPU2 security is enabled, the minimum CPU2 secure area size is one sector (4 Kbytes).

For example, a CPU2 secure area from the address 0x080E 7000 (included) to the address 0x080F FFFF (included):

• • FLASH_SFR registers must be programmed with:
  • – SFSA= 0x0E7.

A flag (ESE) is available from the Flash memory option register (FLASH_OPTR) informing that CPU2 security is enabled.

Any CPU1 access to a CPU2 security area triggers RDERR or WRPERR flag error.

CPU2 secure SRAM2 areas

The CPU2 secure SRAM2a and SRAM2b areas have a 1 Kbyte granularity and are defined by the secure backup RAM (SRAM2a) start address user options (BRSD and SBRSA) and the secure non-backup RAM (SRAM2b) start address user options (NBRSD and SNBRSA) into the flash memory. These offset are controlled by the SBRSA and SNBRSA fields in the

Flash memory secure SRAM2 start address and CPU2 reset vector register (FLASH_SRRVR).

The CPU2 secure SRAM2a area is defined as Backup SRAM2a Base address + [SBRSA x 0x0400] (included) to the last SRAM2a address.

As an example, for a CPU2 secure SRAM2a area from the address 0x2003 5000 (included) to the address 0x2003 7FFF (included) FLASH_SRRVR registers must be programmed with SBRSA = 0x14.

Any CPU1 read access returns no data, and a write access to a CPU2 security SRAM2a area is discarded and triggers a bus error.

When BRSD is set to 1 the SRAM2a is non-secure.

The CPU2 secure non-backup SRAM2b area is defined as Non-backup SRAM2b base address + [SNBRSA x 0x0400] (included) to the last SRAM2b address.

As an example, for a CPU2 secure SRAM2b area from the address 0x2003 EC00 (included) to the address 0x2003 FFFF (included) FLASH_SRRVR registers must be programmed with SNBRSA = 0x1B.

Any CPU1 read access returns no data, and a write access to a CPU2 security SRAM2b area is discarded and triggers a bus error.

When NBRSD is set to 1 the SRAM2b is non-secure.

CPU2 debug access

Debug access to the CPU2 is disabled, as indicated by the DDS filed in the Secure flash memory start address register (FLASH_SFR) . The debugger has no access to the CPU2 and the secure peripherals and memory areas.

3.7 FLASH program/erase suspension

Flash memory program and erase operations can be suspended by setting the PES bit in the Flash memory access control register (FLASH_ACR) or Flash memory CPU2 access control register (FLASH_C2ACR) . This feature is useful when executing time critical sections by a CPU. It makes it possible to suspend any new program or erase operation from being started, preventing CPU instruction and data fetches from being blocked.

When at least one PES bit is set:

• • Any ongoing program or erase operation is completed.
  • – The maximum latency for a flash memory program erase suspension is the maximum time for one program or erase operation to complete (see the device datasheet for more information on the program and erase timing).
• • All new requested program and erase operations are not started, but suspended.
  • – PESD bits in the Flash memory status register (FLASH_SR) and Flash memory CPU2 status register (FLASH_C2SR) are set as soon as any PES is set, no matter if a program/erase is currently suspended. This allows a CPU to test PESD prior to requesting a program or an erase operation.

When all PES bits are reset to 0:

• • A suspended program or erase operation is started.
  • – The PESD bit in both the Flash memory status register (FLASH_SR) and in the Flash memory CPU2 status register (FLASH_C2SR) are cleared.

3.8 FLASH interrupts

Table 17. Flash memory interrupt requests

1. EOP is set only if EOPIE is set.

2. OPERR is set only if ERRIE is set.

Note: The flash interface provides only a single interrupt line to both CPUs. It is good practice to manage flash operations between the CPUs using a semaphore. To avoid receiving unwanted flash operation interrupts, the CPU must mask the flash interrupt in the NVIC or SYSCFG pre-mask.

3.9 Register access protection

The user options registers can be protected by security.

The FLASH secure registers (FSD, SFSA, BRSD, SBRSA, NBRSD, SNBRSA, SBRV, C2OPT, and DDS) are secure and can be written only by the secure CPU2 and read by any CPU, secure and non-secure. When the CPU1 tries to write, the write is discarded.

3.10 FLASH registers

3.10.1 Flash memory access control register (FLASH_ACR)

Address offset: 0x000

Reset value: 0x0000 0600

Bits 31:17 Reserved, must be kept at reset value.

Bit 16 EMPTY : Flash memory user area empty.

When read indicates whether the first location of the user flash memory is erased or has a programmed value.

0: Read: User flash memory programmed

1: Read: User flash memory empty

When written this bit is overwritten with the written value.

Bit 15 PES : CPU1 program / erase suspend request

0: Flash memory program and erase operations granted.

1: Any new flash memory program and erase operation is suspended until this bit and the same bit in Flash memory CPU2 access control register (FLASH_C2ACR) are cleared. The PESD bit in both the Flash memory status register (FLASH_SR) and Flash memory CPU2 status register (FLASH_C2SR) is set when at least one PES bit in FLASH_ACR or FLASH_C2ACR is set.

Bits 14:13 Reserved, must be kept at reset value.

Bit 12 DCRST : CPU1 Data cache reset

0: CPU1 Data cache is not reset

1: CPU1 Data cache is reset

This bit can be written only when the data cache is disabled.

Bit 11 ICRST : CPU1 Instruction cache reset

0: CPU1 Instruction cache is not reset

1: CPU1 Instruction cache is reset

This bit can be written only when the instruction cache is disabled.

Bit 10 DCEN : CPU1 Data cache enable

0: CPU1 Data cache is disabled

1: CPU1 Data cache is enabled

Bit 9 ICEN : CPU1 Instruction cache enable

0: CPU1 Instruction cache is disabled

1: CPU1 Instruction cache is enabled

Bit 8 PRFTEN : CPU1 Prefetch enable

0: CPU1 Prefetch disabled

1: CPU1 Prefetch enabled

Bits 7:3 Reserved, must be kept at reset value.

Bits 2:0 LATENCY[2:0] : Latency

These bits represent the ratio of the flash memory HCLK clock period to the flash memory access time.

000: Zero wait states

001: One wait state

010: Two wait states

011: Three wait states

Others: Reserved

3.10.2 Flash memory key register (FLASH_KEYR)

Address offset: 0x008

Reset value: 0x0000 0000

Bits 31:0 KEY[31:0] : Flash memory key

The following values must be written consecutively to unlock the Flash memory control register (FLASH_CR) and Flash memory CPU2 control register (FLASH_C2CR) , thus enabling programming/erasing operations:

KEY1: 0x4567 0123

KEY2: 0xCDEF 89AB

3.10.3 Flash memory option key register (FLASH_OPTKEYR)

Address offset: 0x00C

Reset value: 0x0000 0000

Bits 31:0 OPTKEY[31:0] : Option byte key

The following values must be written consecutively to unlock the flash memory option registers, enabling option byte programming/erasing operations:

KEY1: 0x0819 2A3B

KEY2: 0x4C5D 6E7F

3.10.4 Flash memory status register (FLASH_SR)

Address offset: 0x010

Reset value: 0x000X 0000

Bits 31:20 Reserved, must be kept at reset value.

Bit 19 PESD : Programming/erase operation suspended

This bit is set and reset by hardware.

Set when at least one PES bit in either Flash memory access control register (FLASH_ACR) or Flash memory CPU2 access control register (FLASH_C2ACR) is set.

Cleared when both PES bits in FLASH_ACR and FLASH_C2ACR are cleared.

When set, new program or erase operations are not started.

Bit 18 CFGBSY : Programming or erase configuration busy

This flag is set and reset by hardware:

• - set when first word is sent for program, or when setting STRT for erase

• - reset when operation completes or is interrupted by an error.

When set to 1, any other operation launch through Flash memory control register (FLASH_CR) is impossible and must be postponed (a programming or erase operation is ongoing). When reset to 0, programming and erase settings in Flash memory control register (FLASH_CR) can be modified.

Bit 17 Reserved, must be kept at reset value.

Bit 16 BSY : Busy

Indicates that a flash memory operation requested by Flash memory control register (FLASH_CR) is in progress. This bit is set at the beginning of a flash memory operation, and reset when the operation finishes or when an error occurs.

Bit 15 OPTVERR : Option and Engineering bits loading validity error

Set by hardware when the options and engineering bits read may not be the one configured by the user or production. If options and engineering bits have not been properly loaded, OPTVERR is set again after each system reset. Option bytes that fail loading are forced to a safe value, see Section 3.4.2: Option bytes programming .

Cleared by writing 1.

Bit 14 RDERR : PCROP read error

Set by hardware when an address to be read through the D-bus belongs to a read protected area of the flash memory (PCROP protection). An interrupt is generated if RDERRIE is set in FLASH_CR.

Cleared by writing 1.

Bit 13 OPTNV : User option OPTVAL indication

This bit is set and reset by hardware.

0: The OBL user option OPTVAL indicates “valid”.

1: The OBL user option OPTVAL indicates “not valid”.

Bits 12:10 Reserved, must be kept at reset value.

Set by hardware when a fast programming sequence (activated by FSTPG) is interrupted due to an error (alignment, size, write protection or data miss). The corresponding status bit (PGAERR, SIZERR, WRPERR or MISSERR) is set at the same time.

Cleared by writing 1.

In fast programming mode, 64 double words (512 bytes) must be sent to flash memory successively, and the new data must be sent to the logic control before the current data is fully programmed. MISSERR is set by hardware when the new data is not present in time.

Cleared by writing 1.

Set by hardware when a write access to the flash memory is performed by the code while PG or FSTPG have not been set previously. Set also by hardware when PROGERR, SIZERR, PGAERR, WRPERR, MISSERR or FASTERR is set due to a previous programming error.

Cleared by writing 1.

Set by hardware when the size of the access is a byte or half-word during a program or a fast program sequence. Only double word programming is allowed (consequently: word access).

Cleared by writing 1.

Set by hardware when the data to program cannot be contained in the same double word (64-bit) flash memory in case of standard programming, or if there is a change of page during fast programming.

Cleared by writing 1.

Set by hardware when an address to be erased/programmed belongs to a write-protected part (by WRP, PCROP or RDP Level 1) of the flash memory.

Cleared by writing 1.

Set by hardware when a double-word address to be programmed contains a value different from 0xFFFF FFFF FFFF FFFF before programming, except if the data to write is 0x0000 0000 0000 0000.

Cleared by writing 1.

Set by hardware when a flash memory operation (program / erase) completes unsuccessfully.

This bit is set only if error interrupts are enabled (ERRIE = 1).

Cleared by writing '1'.

Set by hardware when one or more flash memory operation (programming / erase) has been completed successfully.

This bit is set only if the end of operation interrupts are enabled (EOPIE = 1).

Cleared by writing 1.

3.10.5 Flash memory control register (FLASH_CR)

Address offset: 0x014

Reset value: 0xC000 0000

Access: no wait state when no flash memory operation is on going, word, half-word and byte access.

This register must not be modified when CFGBSY in Flash memory status register (FLASH_SR) is set. This would result in:

• • a bus error, if CFGBSY is set due to a double-word programming sequence and the write to FLASH_CR is performed after the first word is sent for programming and before the second.
• • a bus stall, if CFGBSY is set for any other reason
  • – When the PESD bit in Flash memory status register (FLASH_SR) is cleared, the register write access is stalled until the CFGBSY bit is cleared. (by the other CPU)
  • – When the PESD bit in Flash memory status register (FLASH_SR) is set and a program or an erase operation is ongoing, the register write access causes a bus error.
  • – When the PESD bit in Flash memory status register (FLASH_SR) is set, but there is no ongoing programming or erase operation, the register write access is completed. The requested program or erase operation is suspended, the BSY/CFGBSY asserted and remains 1, until suspend is deactivated. Consequently, PESD bit goes back to 0 and the suspended operation completes.

Bit 31 LOCK: FLASH_CR lock

This bit is set only. When set, the FLASH_CR register is locked. It is cleared by hardware after detecting the unlock sequence.

In case of an unsuccessful unlock operation, this bit remains set until the next system reset.

Bit 30 OPTLOCK: Options lock

This bit is set only. When set, all bits concerning in FLASH_CR register and so option page are locked. This bit is cleared by hardware after detecting the unlock sequence. The LOCK bit must be cleared before doing the unlock sequence for OPTLOCK bit.

In case of an unsuccessful unlock operation, this bit remains set until the next reset.

Bits 29:28 Reserved, must be kept at reset value.

Bit 27 OBL_LAUNCH: Forces the option byte loading

When set to 1, this bit forces the option byte reloading. This bit is cleared only when the option byte loading is complete. It cannot be written if OPTLOCK is set.

0: Option byte loading complete

1: Option byte loading requested

Bit 26 RDERRIE: PCROP read error interrupt enable

This bit enables the interrupt generation when the RDERR bit in the FLASH_SR is set to 1.

0: PCROP read error interrupt disabled

1: PCROP read error interrupt enabled

Bit 25 ERRIE : Error interrupt enable

This bit enables the interrupt generation when the OPERR bit in the FLASH_SR is set to 1.

0: OPERR error interrupt disabled

1: OPERR error interrupt enabled

Bit 24 EOPIE : End of operation interrupt enable

This bit enables the interrupt generation when the EOP bit in the FLASH_SR is set to 1.

0: EOP Interrupt disabled

1: EOP Interrupt enabled

Bits 23:19 Reserved, must be kept at reset value.

Bit 18 FSTPG : Fast programming

0: Fast programming disabled

1: Fast programming enabled

Bit 17 OPTSTRT : Options modification start

This bit triggers an options operation when set.

This bit is set only by software, and is cleared when the BSY bit is cleared in FLASH_SR.

Bit 16 STRT : Start

This bit triggers an erase operation when set. If MER and PER bits are reset and the STRT bit is set, an unpredictable behavior may occur without generating any error flag. This condition must be forbidden.

This bit is set only by software, and is cleared when the BSY bit is cleared in FLASH_SR.

Starting operations by the CPU1, involving secure flash memory pages are rejected and a bus error is generated.

Bits 15:11 Reserved, must be kept at reset value.

Bits 10:3 PNB[7:0] : Page number selection

These bits select the page to erase:

0x00: page 0

0x01: page 1

...

0x7F: page 127

... (STM32WB50CG only)

0xFF: page 255 (STM32WB50CG only)

Bit 2 MER : Mass erase

This bit triggers the mass erase (all user pages) when set.

Bit 1 PER : Page erase

0: page erase disabled

1: page erase enabled

Bit 0 PG : Programming

0: Flash memory programming disabled

1: Flash memory programming enabled

3.10.6 Flash memory ECC register (FLASH_ECCR)

Address offset: 0x018

Reset value: 0x0000 0000

Access: no wait state when no flash memory operation is on going, word, half-word and byte access.

Bit 31 ECCD : ECC detection

Set by hardware when two ECC errors have been detected. When this bit is set, an NMI is generated.

Cleared by writing 1.

Bit 30 ECCC : ECC correction

Set by hardware when one ECC error has been detected and corrected. An interrupt is generated if ECCIE is set.

Cleared by writing 1.

Bit 29 Reserved, must be kept at reset value.

Bits 28:26 CPUID[2:0] : CPU identification

Set by hardware, indicates the Bus-ID of the CPU access causing the ECC failure.

0x0: value for CPUID for CPU1 bus-ID

0x1: value for CPUID for CPU2 bus-ID

Bit 25 Reserved, must be kept at reset value.

Bit 24 ECCIE : ECC correction interrupt enable

0: ECCC interrupt disabled

1: ECCC interrupt enabled

Bits 23:21 Reserved, must be kept at reset value.

Bit 20 SYSF_ECC : System flash memory ECC fail

This bit indicates that the ECC error correction or double ECC error detection is located in the system flash memory.

Bits 19:17 Reserved, must be kept at reset value.

Bits 16:0 ADDR_ECC[16:0] : ECC fail double-word address

These bits indicate that double word address is concerned by the ECC error correction or causes the double ECC error detection.

3.10.7 Flash memory option register (FLASH_OPTR)

Address offset: 0x020

Reset value: 0bxxx1 xxxx x111 xxxx 1xxx xxx1 xxxx xxxx (the option bits are loaded with values from flash memory at reset release)

Access: no wait state when no flash memory operation is ongoing, word, half-word and byte access.

Bits 31:29 AGC_TRIM[2:0] : Radio automatic gain control trimming

Default value 0b001

Bit 28 Reserved, must be kept at reset value.

Bit 27 nBOOT0 : nBOOT0 option bit

If nSWBOOT0 bit configuration select BOOT0 is taken from bit nBOOT0, together with bit nBOOT1, selects boot from the user flash memory, SRAM1, or system flash memory. Refer to Section 2.3: Boot configuration .

0: nBOOT0 = 0

1: nBOOT0 = 1

Bit 26 nSWBOOT0 : Software BOOT0 selection

0: BOOT0 taken from the option bit nBOOT0

1: BOOT0 taken from PH3/BOOT0 pin

Bit 25 SRAM2_RST : SRAM2 and PKA RAM Erase when system reset

0: SRAM2 and PKA RAM erased when a system reset occurs

1: SRAM2 and non-secure PKA RAM not erased when a system reset occurs

Bit 24 SRAM2_PE : SRAM2 parity check enable

0: SRAM2 parity check enabled

1: SRAM2 parity check disabled

Bit 23 nBOOT1 : Boot configuration

Together with the BOOT0 pin or option bit nBOOT0 (depending on nSWBOOT0 option bit configuration), this bit selects boot mode from the user flash memory, SRAM1 or the System memory. Refer to Section 2.3: Boot configuration .

Bits 22:20 Reserved, must be kept at reset value.

Bit 19 WWDOG_SW : Window watchdog selection

0: Hardware window watchdog

1: Software window watchdog

Bit 18 IWDG_STDBY : Independent watchdog counter freeze in Standby mode

0: Independent watchdog counter is frozen in Standby mode

1: Independent watchdog counter is running in Standby mode

Bit 17 IWDG_STOP : Independent watchdog counter freeze in Stop mode

0: Independent watchdog counter is frozen in Stop mode

1: Independent watchdog counter is running in Stop mode

Bit 16 IWDG_SW : Independent watchdog selection

0: Hardware independent watchdog

1: Software independent watchdog

Bit 15 Reserved, must be kept at reset value.

• 0: Reset generated when entering the Shutdown mode
• 1: No reset generated when entering the Shutdown mode

• 0: Reset generated when entering the Standby mode
• 1: No reset generated when entering the Standby mode

• 0: Reset generated when entering the Stop mode
• 1: No reset generated when entering the Stop mode

These bits contain the \( V_{DD} \) supply level threshold that activates/releases the reset.

• 000: BOR Level 0. Reset level threshold is ~ 1.7 V
• 001: BOR Level 1. Reset level threshold is ~ 2.0 V
• 010: BOR Level 2. Reset level threshold is ~ 2.2 V
• 011: BOR Level 3. Reset level threshold is ~ 2.5 V
• 100: BOR Level 4. Reset level threshold is ~ 2.8 V

Indicates whether the system security is enabled user flash memory FSD = 0.

• 0: Security disabled
• 1: Security enabled

• 0xAA: Level 0, read protection not active
• 0xCC: Level 2, chip read protection active
• Others: Level 1, memories read protection active

Note: Take care about PCROP_RDP configuration in Level 1. Refer to Level 1: Read protection for more details.

3.10.8 Flash memory PCROP zone A start address register (FLASH_PCROP1ASR)

Address offset: 0x024

Reset value: 'b1111 1111 1111 1111 1111 111X XXXX XXXX

Access: no wait state when no flash memory operation is on going, word, half-word access

Bits 31:9 Reserved, must be kept at reset value.

PCROP1A_STR contains the first 2 Kbytes page of the PCROP1A area. Note that bit 8 is reserved on STM32WB30CE.

3.10.9 Flash memory PCROP zone A end address register (FLASH_PCROP1AER)

Address offset: 0x028

Reset value: 'bX111 1111 1111 1111 1111 1111 XXXX XXXX

Access: no wait state when no flash memory operation is on going, word, half-word access.
PCROP_RDP bit can be accessed with byte access

Bit 31 PCROP_RDP : PCROP area preserved when RDP level decreased

This bit is set only. It is reset after a full mass erase due to a change of RDP from Level 1 to Level 0.

0: PCROP area is not erased when the RDP level is decreased from Level 1 to Level 0.

1: PCROP area is erased when the RDP level is decreased from Level 1 to Level 0 (full mass erase).

Bits 30:9 Reserved, must be kept at reset value.

Bits 8:0 PCROP1A_END[8:0] : PCROP1A area end offset

PCROP1A_END contains the last 2 Kbytes page of the PCROP1A area. Note that bit 8 is reserved on STM32WB30CE devices.

3.10.10 Flash memory WRP area A address register (FLASH_WRP1AR)

Address offset: 0x02C

Reset value: 0xFFXX FFXX

Access: no wait state when no flash memory operation is on going, word, half-word and byte access.

Bits 31:24 Reserved, must be kept at reset value.

Bits 23:16 WRP1A_END[7:0] : WRP first area "A" end offset

Contains the last 4 Kbytes page of the WRP first area. Note that bit 23 is reserved on STM32WB30CE devices.

Bits 15:8 Reserved, must be kept at reset value.

Bits 7:0 WRP1A_STRT[7:0] : WRP first area ‘‘A’’ start offset

Contains the first 4 Kbytes page of the WRP first area. Note that bit 7 is reserved on STM32WB30CE devices.

3.10.11 Flash memory WRP area B address register (FLASH_WRP1BR)

Address offset: 0x030

Reset value: 0xFFXX FFXX

Access: no wait state when no flash memory operation is on going, word, half-word and byte access.

Bits 31:24 Reserved, must be kept at reset value.

Bits 23:16 WRP1B_END[7:0] : WRP second area ‘‘B’’ end offset

WRP1B_END contains the last 4 Kbytes page of the WRP second area. Note that bit 23 is reserved on STM32WB30CE devices.

Bits 15:8 Reserved, must be kept at reset value.

Bits 7:0 WRP1B_STRT[7:0] : WRP second area ‘‘B’’ start offset

WRP1B_STRT contains the first 4 Kbytes page of the WRP second area. Note that bit 7 is reserved on STM32WB30CE devices.

3.10.12 Flash memory PCROP zone B start address register (FLASH_PCROP1BSR)

Address offset: 0x034

Reset value: ‘b1111 1111 1111 1111 1111 111X XXXX XXXX

Access: no wait state when no flash memory operation is on going, word, half-word access.

Bits 31:9 Reserved, must be kept at reset value.

Bits 8:0 PCROP1B_STRT[8:0] : PCROP1B area start offset

Contains the first 2 Kbytes page of the PCROP1B area. Note that bit 8 is reserved on STM32WB30CE devices.

3.10.13 Flash memory PCROP zone B end address register (FLASH_PCROP1BER)

Address offset: 0x038

Reset value: 'b1111 1111 1111 1111 1111 111X XXXX XXXX

Access: no wait state when no flash memory operation is on going, word, half-word access.

Bits 31:9 Reserved, must be kept at reset value.

Bits 8:0 PCROP1B_END[8:0] : PCROP1B area end offset

Contains the last 2 Kbytes page of the PCROP1B area. Note that bit 8 is reserved on STM32WB30CE devices.

3.10.14 Flash memory IPCC mailbox data buffer address register (FLASH_IPCCBR)

Address offset: 0x03C

Reset value: 'b1111 1111 1111 1111 11XX XXXX XXXX XXXX

Bits 31:14 Reserved, must be kept at reset value.

Bits 13:0 IPCCDBA[13:0] : IPCC mailbox data buffer base address offset

Contains the first double-word offset of the IPCC mailbox data buffer area in SRAM2.

3.10.15 Flash memory CPU2 access control register (FLASH_C2ACR)

Address offset: 0x05C

Reset value: 0x0000 0600

Bits 31:16 Reserved, must be kept at reset value.

Bit 15 PES : CPU2 program / erase suspend request

0: Flash memory program and erase operations granted.

1: Any new flash memory program and erase operation is suspended until this bit and the same bit in Flash memory access control register (FLASH_ACR) are cleared. The PESD bit in both the Flash memory status register (FLASH_SR) and Flash memory CPU2 status register (FLASH_C2SR) is set when at least one PES bit in FLASH_ACR or FLASH_C2ACR is set.

Bits 14:12 Reserved, must be kept at reset value.

Bit 11 ICRST : CPU2 Instruction cache reset

0: CPU2 Instruction cache is not reset

1: CPU2 Instruction cache is reset

This bit can be written only when the instruction cache is disabled.

Bit 10 Reserved, must be kept at reset value.

Bit 9 ICEN : CPU2 Instruction cache enable

0: CPU2 Instruction cache is disabled

1: CPU2 Instruction cache is enabled

Bit 8 PRFTEN : CPU2 Prefetch enable.

0: CPU2 prefetch is disabled

1: CPU2 prefetch is enabled

Bits 7:0 Reserved, must be kept at reset value.

3.10.16 Flash memory CPU2 status register (FLASH_C2SR)

Address offset: 0x060

Reset value: 0x000X 0000

Access: no wait state, word, half-word and byte access.

Bits 31:20 Reserved, must be kept at reset value.

Bit 19 PESD : Programming / erase operation suspended.

This bit is set and reset by hardware.

Set when at least one PES bit in either Flash memory access control register (FLASH_ACR) or Flash memory CPU2 access control register (FLASH_C2ACR) is set.

Cleared when both PES bits in FLASH_ACR and FLASH_C2ACR are cleared.

When set new program or erase operations are not started.

Bit 18 CFGBSY : Programming or erase configuration busy

This flag is set and reset by hardware:

• - set when the first word is sent for program, or when setting STRT for erase
• - reset when operation completes or is interrupted by an error.

When set to 1, any other operation through Flash memory CPU2 control register (FLASH_C2CR) is impossible and must be postponed (a programming or erase operation is ongoing). When reset to 0, programming and erase settings in Flash memory CPU2 control register (FLASH_C2CR) can be modified.

Bit 17 Reserved, must be kept at reset value.

Bit 16 BSY : Busy

This bit indicates that a flash memory operation requested by Flash memory CPU2 control register (FLASH_C2CR) is in progress. This is set on the beginning of a flash memory operation and reset when the operation finishes or when an error occurs.

Bit 15 Reserved, must be kept at reset value.

Bit 14 RDERR : PCROP read error

Set by hardware when an address to be read through the D-bus belongs to a read protected area of the flash memory (PCROP protection). An interrupt is generated if RDERRIE is set in FLASH_CR.

Cleared by writing 1.

Bits 13:10 Reserved, must be kept at reset value.

Bit 9 FASTERR : Fast programming error

Set by hardware when a fast programming sequence (activated by FSTPG) is interrupted due to an error (alignment, size, write protection or data miss). The corresponding status bit (PGAERR, SIZERR, WRPERR or MISSERR) is set at the same time.

Cleared by writing 1.

Bit 8 MISSERR : Fast programming data miss error

In fast programming mode, 64 double words (512 bytes) must be sent to the flash memory successively, and the new data must be sent to the flash memory logic control before the current data is fully programmed. MISSERR is set by hardware when the new data is not present in time.

Cleared by writing 1.

Bit 7 PGSERR : Programming sequence error

Set by hardware when a write access to the flash memory is performed by the code while PG or FSTPG have not been set previously. Set also by hardware when PROGERR, SIZERR, PGAERR, WRPERR, MISSERR or FASTERR is set due to a previous programming error.

Cleared by writing 1.

Bit 6 SIZERR : Size error

Set by hardware when the size of the access is a byte or half-word during a program or a fast program sequence. Only double word programming is allowed (consequently: word access).

Cleared by writing 1.

Bit 5 PGAERR : Programming alignment error

Set by hardware when the data to program cannot be contained in the same double word (64-bit) flash memory in case of standard programming, or if there is a change of page during fast programming.

Cleared by writing 1.

Bit 4 WRPERR : Write protection error

Set by hardware when an address to be erased/programmed belongs to a write-protected part (by WRP, PCROP or RDP Level 1) of the flash memory.
Cleared by writing 1.

Bit 3 PROGERR : Programming error

Set by hardware when a double-word address to be programmed contains a value different from 0xFFFF FFFF before programming, except if the data to write is 0x0000 0000 0000 0000.
Cleared by writing 1.

Bit 2 Reserved, must be kept at reset value.

Bit 1 OPERR : Operation error

Set by hardware when a flash memory operation (program / erase) completes unsuccessfully.
This bit is set only if error interrupts are enabled (ERRIE = 1).
Cleared by writing ‘1’.

Bit 0 EOP : End of operation

Set by hardware when one or more flash memory operation (programming / erase) completes successfully.
This bit is set only if the end of operation interrupts are enabled (EOPIE = 1).
Cleared by writing 1.

3.10.17 Flash memory CPU2 control register (FLASH_C2CR)

Address offset: 0x064

Reset value: 0xC000 0000

Access: no wait state when no flash memory operation is on going, word, half-word and byte access

This register cannot be modified when CFGBSY in Flash memory CPU2 status register (FLASH_C2SR) is set.

• • When the PESD bit in Flash memory CPU2 status register (FLASH_C2SR) is cleared, the register write access is stalled until the CFGBSY bit is cleared (by the other CPU).
• • When the PESD bit in Flash memory CPU2 status register (FLASH_C2SR) is set, the register write access causes a bus error.
• • When the PESD bit in Flash memory CPU2 status register (FLASH_C2SR) is set, but there is no ongoing programming or erase operation, the register write access is completed. The requested program or erase operation is suspended, the BSY/CFGBSY asserted and remains 1 until suspend has been deactivated. Consequently, PESD bit goes back to 0 and the suspended operation completes.

Bits 31:27 Reserved, must be kept at reset value.

Bit 26 RDERRIE : PCROP read error interrupt enable

This bit enables the interrupt generation when the RDERR bit in the FLASH_SR is set to 1.

0: PCROP read error interrupt disabled

1: PCROP read error interrupt enabled

Bit 25 ERRIE : Error interrupt enable

This bit enables the interrupt generation when the OPERR bit in the FLASH_SR is set to 1.

0: OPERR error interrupt disabled

1: OPERR error interrupt enabled

Bit 24 EOPIE : End of operation interrupt enable

This bit enables the interrupt generation when the EOP bit in the FLASH_SR is set to 1.

0: EOP Interrupt disabled

1: EOP Interrupt enabled

Bits 23:19 Reserved, must be kept at reset value.

Bit 18 FSTPG : Fast programming

0: Fast programming disabled

1: Fast programming enabled

Bit 17 Reserved, must be kept at reset value.

Bit 16 STRT : Start

This bit triggers an erase operation when set. If MER and PER bits are reset and the STRT bit is set, an unpredictable behavior may occur without generating any error flag. This condition must be forbidden.

This bit is set only by software, and is cleared when the BSY bit is cleared in FLASH_SR.

Starting operations by the CPU1, involving secure flash memory pages is rejected and a bus error generated.

Bits 15:11 Reserved, must be kept at reset value.

Bits 10:3 PNB[7:0] : Page number selection

These bits select the page to erase:

0x00: page 0

0x01: page 1

...

... (STM32WB50CG only)

0xFF: page 255 (STM32WB50CG only)

Bit 2 MER : Mass erase

This bit triggers the mass erase (all user pages) when set.

Bit 1 PER : Page erase

0: Page erase disabled

1: Page erase enabled

Bit 0 PG : Programming

0: Flash programming disabled

1: Flash programming enabled

3.10.18 Secure flash memory start address register (FLASH_SFR)

Address offset: 0x080

Reset value: 0b1111 1111 1111 1111 1111 1110 xxxx xxxx

This register provides write access security and can only be written by the CPU2. A write access from the CPU1 is ignored and a bus error generated. On any read access the register value is returned.

Written values are only taken into account after OBL.

Bits 31:13 Reserved, must be kept at reset value.

Bit 12 DDS : Disable CPU2 debug access

• 0: CPU2 debug access enabled
• 1: CPU2 debug access disabled

Bits 11:9 Reserved, must be kept at reset value.

Bit 8 FSD : Flash memory security disabled.

• 1: System and flash memory non-secure
• 0: System and flash memory secure (the secure area of the flash memory is given by SFSA)

Bits 7:0 SFSA[7:0] : Secure flash memory start address

SFSA[7:0] contain the start address of the first 4 Kbytes page of the secure flash memory area.

3.10.19 Flash memory secure SRAM2 start address and CPU2 reset vector register (FLASH_SRRVR)

Address offset: 0x084

Reset value: 0bxxxx xxx1 xxxx xxxx xxxx xxxx xxxx xxxx

This register provides write access security and can only be written by the CPU2. A write access from the CPU1 is ignored and a bus error generated. On any read access the register value is returned.

Written values are only taken into account after OBL.

Bit 31 C2OPT : CPU2 boot reset vector memory selection.

0: SBRV offset addresses SRAM1 or SRAM2, from start address 0x2000 0000. SBRV value must be kept within the SRAM area.

1: SBRV offset addresses flash memory, from start address 0x0800 0000.

Bit 30 NBRSD : Non-backup SRAM2b security disable.

NBRSD = 1: SRAM2b is non-secure

NBRSD = 0: SRAM2b is secure. SNBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure non-backup SRAM2b area.

Bits 29:25 SNBRSA[4:0] : Secure non-backup SRAM2b start address

NBRSD = 0: SRAM2b is secure. SNBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure non-backup SRAM2b area.

Bit 24 Reserved, must be kept at reset value.

Bit 23 BRSD : Backup SRAM2a security disable.

BRSD = 1: SRAM2a is non-secure

BRSD = 0: SRAM2a is secure. SBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure backup SRAM2a area.

Bits 22:18 SBRSA[4:0] : Secure backup SRAM2a start address

BRSD = 0: SRAM2a is secure. SBRSA[4:0] contains the start address of the first 1 Kbyte page of the secure backup SRAM2a area.

Bits 17:0 SBRV[17:0] : CPU2 boot reset vector

Contains the word aligned CPU2 boot reset start address offset within the selected memory area by C2OPT.

3.10.20 FLASH register map

Table 18. Flash interface register map and reset values

Table 18. Flash interface register map and reset values (continued)