9. Embedded Flash memory

The Flash controller implements the erase and programs Flash memory operation. The Flash controller also implements the read and write protection.

9.1 Flash main features

Flash memory features:

• • Up to 256 Kbytes of flash memory single bank architecture.
• • Memory organization: 1 bank
  • – main memory: up to 256 Kbytes
  • – page size: 2 Kbytes
• • 32-bit wide data read
• • 32-bit wide data write
• • Page erase (2 Kbytes) and mass erase.

Flash controller features:

• • Flash memory read operations
• • Flash memory write operations: single data write or 4x32-bits burst write (to reduce programming time by 4)
• • Flash memory erase operations
• • Flash readout protection and disable of debug access
• • Page write protect mechanism

9.2 Description

The flash memory is organized as follows:

• • Main memory block containing 128 pages of 2 Kbytes. Each page is made of 8 rows of 256 bytes (64 words).

Erasing the whole flash results in every bit cell of the flash memory.

In parallel, the flash controller manages 1 Kbyte of OTP (one-time programmable) memory for user data. The OTP data cannot be erased. The OTP data area can no longer be written only as soon as the last word (address 0x1000_1BFC) is different from 0xFFFF_FFFF and a system reset occurred.

The flash memory is mapped on the AHB-Lite bus with the range described below.

Table 19. Flash memory section address

1. Depends on Flash size. See Table 22. Flash size information.

9.3 Flash controller register map

Refer to Table 3. STM32WB07xC and STM32WB06xC memory map and peripheral register boundary addresses for the flash controller base address location in the STM32WB07xC and STM32WB06xC.

Table 20. Flash APB registers

1. Acronym meaning: RW: read and write RC: read and write to clear RO: read only.

9.4 Flash controller registers

9.4.1 Command register (COMMAND)

Address offset: 0x00

Reset value: 0x0000 0000

Table 21. Command list available for customer

1. Each address can be programmed only twice without erase operation in between.

Status bit behavior versus commands:

• • Writing to the COMMAND register starts the action that is performed on the Flash
• • The CMDSTART flag goes and stays high until it is cleared
• • When the command has finished the CMDDONE flag goes high
• • When a MASS READ command was given and when CMDDONE is high, the READOK flag can be checked or the LFSRVAL register can be read (contains the signature of the mass read)

The sequences to use the different commands are described in Section 9.5: Programmer model .

9.4.2 Configuration register (CONFIG)

Address offset: 0x04

Reset value: 0x0000 0018

The flash memory can be read in one system clock cycle (the best for power consumption) when the system clock is 32 MHz maximum.

9.4.3 Interrupt status register (IRQSTAT)

The interrupt status register shows the masked version of the interrupt raw register.

Address offset: 0x08

Reset value: 0x0000 0000

The CMDDONE and CMDSTART bits are updated a few clock cycles after the requested command has been started by writing to the COMMAND register.

Note: Clearing a bit by writing in IRQSTAT (respectively IRQRAW) register also cleared the same bit in IRQRAW (respectively IRQSTAT) register as they are referring to a common condition/event.

9.4.4 Interrupt mask register (IRQMASK)

The mask bit in IRQMASK masks the condition in the status register IRQSTAT and prevents the generation from the interrupt.

Address offset: 0x0C

Reset value: 0x0000 003F

9.4.5 Raw status register (IRQRAW)

The raw status register shows the unmasked condition of interrupt events.

Address offset: 0x10

Reset value: 0x0000 0001

The CMDDONE and CMDSTART bits are updated a few clock cycles after the requested command has been started by writing to the COMMAND register.

9.4.6 SIZE register

Address offset: 0x14

Reset value: 0x000- ---- (depends on the device)

Table 22. Flash size information

1. Value seen in FLASH_SIZE bit field.

9.4.7 Address register (ADDRESS)

Address offset: 0x18

Reset value: 0x0000 0000

Address to provide to the Flash is not the AHB device mapping address but the address respecting Flash component format.

The main Flash is composed of 128 pages containing 8 rows each with 64 words = 256 bytes by row.

To program the ADDRESS register, the formula is the following:

• XADDR[9:0] = AHB address bit [17:8]
• YADDR[5:0] = AHB address bit [7:2]

Example 1: To program a word (32-bit) at AHB address 0x1005_0454:

• XADDR[9:0] = AHB address bit [17:8] = 0x104
• YADDR[5:0] = AHB address bit [7:2] = 0x15
• ADDRESS register = 0x4115

9.4.8 Linear feedback shift register (LFSRVAL)

The LFSRVAL register contains the signature issued by a MASSREAD command.

The LFSRVAL register is initialized with all ones when the MASS READ command is written to the COMMAND register. Then every read value is put through the LFSR.

The final signature can be read in this register once the CMDDONE information is set.

Address offset: 0x24

Reset value: 0xFFFF FFFF

9.4.9 Main flash page protection registers (PAGEPROTx)

The PAGEPROTx register allows protecting from accidental write a contiguous set of pages called segment in the following description. A maximum of four segments can be defined.

An example of usage is available in Section 9.5.7: Write page protection example.

PAGEPROT0

Address offset: 0x34

Reset value: 0x0000 0000

PAGEPROT01

Address offset: 0x38

Reset value: 0x0000 0000

9.4.10 Data registers (DATA0-DATA3)

The DATA0 register needs to be written with:

• The desired value written to the Flash location (for single write or mass write).
• The desired compare value for a (mass) read operation, the flag READOK indicates if there was a match or not. For mass read, all read values must match for READOK.

The DATA1-DATA3 registers need to be written only for burst write.

DATA0

Address offset: 0x40

Reset value: 0xFFFF FFFF

DATA1

Address offset: 0x44

Reset value: 0xFFFF FFFF

DATA2

Address offset: 0x48

Reset value: 0xFFFF FFFF

DATA3

Address offset: 0x4C

Reset value: 0xFFFF FFFF

9.5 Programmer model

The STM32WB07xC and STM32WB06xC embed up to 256 Kbytes (65536 x 32-bit) of internal flash memory. A flash interface implements instruction access and data access based on the AHB protocol. It implements the logic necessary to carry out the flash memory operations (program/erase) controlled through the flash registers.

9.5.1 General information

Writing to flash memory only allows clearing bits from '1' to '0'. This means any write from '0' to '1' implies erasing before performing a write.

Flash memory is composed of 128 pages containing 8 rows of 64 words (128 x 8 x 64 = 65536 words). Each word is 32-bit = 4 bytes long which means 256 Kbytes of flash memory.

The address inside the the Flash controller ADDRESS register is built as follows: ADDRESS[15:0] = XADR[9:0] & YADR[5:0] with:

• • XADR[9:3] = page address
• • XADR[2:0] = row address
• • YADR[5:0] = word address (one word = four bytes)

Note: One specific address can be written only twice between two erase actions even if each writing only clears bit 1.

9.5.2 Read function examples

There are two possible read accesses:

• • Read one single word: simple read as if SRAM memory: read the desired Flash address and get read data on the bus
• • MASSREAD command: read the full Flash memory and compare with expected content

There are two ways of using MASSREAD:

• • Full Flash contains a fixed 32-bit pattern: indicate the expected pattern (value to be compared with each read value inside Flash) in the Flash controller DATA register and check the READOK flag in the Flash controller interrupt register once the command is completed
• • Otherwise: request a MASSREAD command without specifying any expected read value and check the LFSRVAL register once the command is completed. This LFSRVAL register contains a signature of the memory read

MASSREAD sequence:

• • Write in the Flash controller DATA register the expected value (if MASSREAD is used in combination with the READOK flag)
• • Write the MASSREAD command (0x55) in the Flash controller COMMAND register
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command has been taken into account and is under execution

• • Clear the CMDSTART flag by writing CMDSTART to '1' in the Flash controller IRQSTAT register
• • Then, wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command is completed
• • Check the READOK flag (expected high) in the IRQSTAT register or the LFSRVAL register value to ensure Flash memory content is the expected result
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the Flash controller IRQSTAT register.

9.5.3 Erase function examples

The flash memory controller allows the erasing of one page.

ERASE sequence (erase one page):

• • Write the page address to be erased by writing in the flash controller ADDRESS register the following value:
  • – ADDRESS[15:9] = XADR[9:3] = page address to erase
  • – ADDRESS[8:0] = 9'b0 (row and word addresses at zero)
• • Write the ERASE command (0x11) in the flash controller COMMAND register
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating command is taken into account and under execution
• • Clear the CMDSTART flag by writing CMDSTART to '1' in the flash controller IRQSTAT register
• • Wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command is completed
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the flash controller IRQSTAT register
• • After this command, the erased page contains bits set to '1' only.

MASSERASE sequence (erase whole main flash memory):

• • Write the MASSERASE command (0x22) in the flash controller COMMAND register.
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command has been taken into account and is under execution.
• • Clear the CMDSTART flag by writing CMDSTART to '1' in the flash controller IRQSTAT register.
• • Wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command is completed.
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the flash controller IRQSTAT register.
• • After this command, the full main flash contains only bits set to '1'.

9.5.4 Write function examples

The Flash controller allows writing one word (WRITE), up to 4 words (BURSWRITE) or the full main Flash memory (with a single fixed word).

Note: As a write can only program to '0' on bits already set to '1', it is necessary to erase the page and request that the bits are set to '1' (instead of '0') in order to re-write to '0'.

WRITE sequence:

• • Indicate the location to write by filling the Flash controller ADDRESS register with the targeted address (page, row and word number)
• • Write the value to program in the Flash controller DATA register
• • Write the WRITE command (0x33) in the Flash controller COMMAND register
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command has been taken into account and is under execution
• • Clear the CMDSTART flag by writing CMDSTART to '1' in the Flash controller IRQSTAT register
• • Wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command is completed
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the Flash controller IRQSTAT register.

BURSTWRITE sequence:

• • Indicate the location to write by filling the Flash controller ADDRESS register with the targeted address of the first data to write (page, row and word number). DATA0 is written at ADDRESS, DATA1 at ADDRESS+1, etc.
• • Write the values to program in the Flash controller DATA0-3 registers. To write less than four words, write 0xFFFFFFFF in the unused DATA1-3 registers
• • Write the BURSTWRITE command (0xCC) in the Flash controller COMMAND register
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command has been taken into account and is under execution
• • Clear the CMDSTART flag by writing CMDSTART to '1' in the Flash controller IRQSTAT register
• • Wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command is completed
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the Flash controller IRQSTAT register.

9.5.5 Enabling protection example

The device offers three levels of protection to prevent application cloning and/or altering of application code. The different levels are described in Table 23. System memory protection . It is important to note that disabling of SWD access is an irreversible operation.

Table 23. System memory protection

In order to activate the desired level of protection, the following KEYWRITE sequence should be used:

• • Write DATA0 (LSB key) and DATA1 (MSB key) registers with the value to program
• • Write 0xC7EF584D to DATA2 and 0xB3A21096 to DATA3
• • Write the KEYWRITE command (0xFF) in the Flash controller COMMAND register
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command has been taken into account and is under execution
• • Clear the CMDSTART flag by writing CMDSTART to '1' in the Flash controller IRQSTAT register
• • Wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode), indicating that the command is completed
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the Flash controller IRQSTAT register.

The keys are activated (and Flash and RAM banks are protected) after a reset.

Note: The secure bootloader capability offers a further security level for preventing unwanted control from external users.

When the secure bootloader capability is enabled, the flash and RAM contents are readable. The GO command of the bootloader is disabled and all the other bootloader commands are available. Only signed firmware can be executed.

For more information about the secure bootloader capability refer to the AN6140: How to use the secure bootloader on STM32WB0 MCUs.

9.5.6 OTP function example

OTPWRITE sequence:

• • Write DATA0 register with the value to program (no burst write feature is available as only few bytes to be written once only)
• • Write ADDRESS register according to the following rule:
  • – ADDRESS[15:9] = do not care (page number frozen by hardware on this command)
  • – ADDRESS[8:6] = 0, 1, 2 or 3
  • – ADDRESS[5:0] = full area possible (from 0x00 to 0x3F)
• • Write the OTPWRITE command (0xEE) in the Flash controller COMMAND register
• • Wait for the CMDSTART flag in the IRQSTAT register (polling mode or interrupt mode) indicating that the command has been taken into account and is under execution
• • Clear the CMDSTART flag by writing CMDSTART to '1' in the Flash controller IRQSTAT register

• • Wait for the CMDDONE flag in the IRQSTAT register (polling mode or interrupt mode), indicating that the command is completed
• • Clear the CMDDONE flag by writing CMDDONE to '1' in the FlashController IRQSTAT register.

Note: The OTP locations are following Flash memory rules, that is, a second write only flips bit from 1 to 0. If the user wishes to lock the OTP values and prevent any further modification in the OTP area, they must write the last OTP word (address 0x10001BFC) with a value different from 0xFFFFFFFF and perform system reset. The operation of locking the OTP area is irreversible.

9.5.7 Write page protection example

Example to write protect against accidental programming knowing the Flash starts at address 0x1004_0000 and contains 128 pages of 2 Kbytes (pages 0 to 127)

• • the address ranges 0x1004C000-0x1004FFFF

Starting page: 0xC000 / 0x800 = 0x18

• • SEG0[14:8] = 0x18 (OFFSET = 0x18)

Number of pages: (0x10000 - 0xC000) / 0x800 = 0x8

• • SEG0[6:0] = 0x8 (SIZE = 0x8)
• • and the address ranges 0x1005E000-0x1005FFFF

Starting page: 0x1E000 / 0x800 = 0x3C

• • SEG1[14:8] = 0x3C (OFFSET = 0x3C)

Number of pages: (0x20000 - 0x1E000) / 0x800 = 0x4

Conclusion: program the PAGEPROT0 = 0x3C041808.