STMicroelectronics STM8S bootloader Bootloader User manual

UM0560

User manual

STM8S bootloader user manual

1 Introduction

This user manual contains the bootloader specifications for STM8S devices which contain a bootloader embedded in the system memory of the device (the ROM memory). Through this firmware, the device memory can be erased and programmed using one of the standard communication interfaces present on the particular device. For each device, please refer to the corresponding datasheets to know if the bootloader is present and which peripherals are supported.

The document describes the features and operation of the STM8S integrated bootloader program. This code allows memories, including Flash program, data EEPROM, and RAM, to be written into the device using the standard serial interfaces UART1, UART2, UART3,

CAN, and SPI (only available on STM8S105xx devices).

The bootloader code is the same for all STM8S versions, including STM8S20xxx and

STM8S105xx devices. However, even though a peripheral may be present in a product, the product may not support it (for example, the SPI is not supported in STM8S20xxx devices).

In addition, different cuts support different peripherals: The bootloader code can be accessed via the UART1, UART3 and CAN peripherals in STM8S20xxx devices and via

UART2 and SPI in STM8S105xx devices.

For further information on the STM8S family features, pinout, electrical characteristics, mechanical data and ordering information, please refer to the STM8S datasheets.

December 2008 Rev 1 1/58

www.st.com

1

2

Contents

Contents

3

4

UM0560

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Bootloader introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.1

Bootloader activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Peripheral settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.1

UART1 settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.2

UART2 and UART3 settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3.3

SPI settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

3.4

CAN settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4.1

Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

4.1.1

4.1.2

4.1.3

Get command via UART1/ UART2/UART3 . . . . . . . . . . . . . . . . . . . . . . 14

Get command via SPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Get command via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

4.2

Read memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2.1

4.2.2

4.2.3

Read memory command via UART1/UART2/UART3 . . . . . . . . . . . . . . 20

Read memory command via SPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Read memory command via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4.3

Erase memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4.3.1

4.3.2

4.3.3

Erase memory command via UART1/UART2/UART3 . . . . . . . . . . . . . . 27

Erase memory command via SPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Erase memory command via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4.4

Write memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

4.4.1

4.4.2

4.4.3

Write memory command via UART1/UART2/UART3 . . . . . . . . . . . . . . 34

Write memory command via SPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Write memory command via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

4.5

Speed command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

4.5.1

Speed command via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

4.6

Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

4.6.1

4.6.2

Go command via UART1/UART2/UART3 . . . . . . . . . . . . . . . . . . . . . . . 45

Go command via SPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

2/58

7

8

5

6

UM0560 Contents

4.6.3

Go command via CAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

4.7

Sector codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Software model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Error management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Programming time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

3/58

List of tables

List of tables

UM0560

Table 1.

Table 2.

Table 3.

Table 4.

Table 5.

Table 6.

Table 7.

Table 8.

Initial checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Serial interfaces associated with STM8S devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Examples of delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

STM8S sector codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Error table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

UART1/UART2/UART3 programming times. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

SPI programming time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Table 9.

CAN programming time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Table 10.

Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

4/58

UM0560

List of figures

List of figures

Figure 1.

Bootloader activation flow chart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Figure 2.

CAN frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Figure 3.

Get command via UART1/UART2/UART3 Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Figure 4.

Get command via UART1/UART2/UART3: Device side. . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Figure 5.

Get command via SPI: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Figure 6.

Get command via SPI: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Figure 7.

Get command via CAN: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Figure 8.

Get command via CAN: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Figure 9.

Read memory command via UART1/UART2/UART3: Host side . . . . . . . . . . . . . . . . . . . . 20

Figure 10.

Read memory command via UART1/UART2/UART3: Device side . . . . . . . . . . . . . . . . . . 21

Figure 11.

Read memory command via SPI: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Figure 12.

Read memory command via SPI: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Figure 13.

Read memory command via CAN: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Figure 14.

Read memory command via CAN: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Figure 15.

Erase memory command via UART1/UART2/UART3: Host side. . . . . . . . . . . . . . . . . . . . 27

Figure 16.

Erase memory command via UART1/UART2/UART3: Device side . . . . . . . . . . . . . . . . . . 29

Figure 17.

Erase memory command via SPI: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Figure 18.

Erase memory command via SPI: Device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Figure 19.

Erase memory command via CAN: Host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Figure 20.

Erase memory command via CAN: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Figure 21.

Write memory command via UART1/UART2/UART3: Host side . . . . . . . . . . . . . . . . . . . . 34

Figure 22.

Write memory command via UART1/UART2/UART3: Device side . . . . . . . . . . . . . . . . . . 36

Figure 23.

Write memory command via SPI: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Figure 24.

Write memory command via SPI: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Figure 25.

Write memory command via CAN: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Figure 26.

Write memory command via CAN: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Figure 27.

Speed command via CAN: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Figure 28.

Speed command via CAN: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Figure 29.

Go command via UART1/UART2/UART3: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Figure 30.

Go command via UART1/UART2/UART3: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Figure 31.

Go command via SPI: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Figure 32.

Go command via SPI: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Figure 33.

Go command via CAN: Host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Figure 34.

Go command via CAN: Device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

5/58

Bootloader introduction UM0560

The main task of the bootloader is to download the application program into the internal memories through the UART1, UART2, UART3, SPI or CAN peripherals without using the

SWIM protocol and dedicated hardware. Data are provided by any device (host) capable of sending information through one of the above serial interfaces.

The bootloader permits downloading of application software into the device memories, including the program memory, using standard serial interfaces (UART1, UART2, UART3,

SPI and CAN) without dedicated hardware. It is a complementary solution to programming via the SWIM debugging interface.

The bootloader code is stored in the internal boot ROM memory. After a reset, the bootloader code checks whether the program memory is virgin or whether a specific option byte is set allowing code modifications.

If these conditions are not fulfilled, the bootloader resumes and the user application is started.

In case of a successful check the bootloader is executed.

●

●

When the bootloader procedure starts, the main tasks are:

Polling all supported serial interfaces to check which peripheral is used.

Programming code, data, option bytes and/or vector tables at the address(es) received from the host.

The STM8S reset vector is located at the beginning of the boot ROM (6000h), while the other vectors are in the Flash program memory starting at address 8004h.

The device executes the boot ROM, jumps inside the boot ROM area and after checking certain address locations (see

Table 1: Initial checking on page 9

), it starts to execute the

user code via the reset vector (8000h) in the Flash program memory.

The bootloader activation flowchart is described in

Figure 1 on page 7

.

6/58

UM0560 Bootloader introduction

Figure 1.

Bootloader activation flow chart

ROM reset

(6000h)

Disable all interrupt sources

1

3rd condition verified

2

Checks according to

Table 1

2nd condition verified

Yes (memory read out protected)

Is ROP active?

3

1st condition verified

Yes

No (memory not read out protected)

Is an external clock present?

4

No

Initializes CAN at

125 kbps

4

Configure HSI and initialize RX-UART3 pin (PD6) and

RX-UART1 pin (PDA) in GPIO mofe (pull-up state).

Configure SPI in slave mode

5

6

Received a byte/message! = SYNCHR

Wait for SYNCHR

Timeout (1 s)

SYNCHR failed

6

GET cmd

GET cmd routine

RM cmd

RM cmd routine

SYNCHR received

Send ACK byte and disable unused peripherals. Execute RASS KEYs

7

6

Is Flash virgin?

Yes

Wait for a command

EM cmd

EM cmd routine

WM cmd

WM cmd routine

8

Command received

No

6

Recover the registers reset status

SD cmd

SD cmd routine

GO cmd

GO cmd routine

Remove EM and WM routines from the RAM

Flash reset

(8000h)

Jump to host address ai15360

1.

See

Flow chart description on page 8

for explanation of points 1 to 8.

2.

Dotted routines are loaded in RAM by the host. They are removed by the go command before jumping to the Flash program memory to execute an application.

7/58

Bootloader introduction UM0560

Flow chart description

1.

Disable all interrupt sources.

2. The host can reprogram the Flash program memory and the bootloader option byte

values, as shown in

Table 1

according to the content of the first Flash program memory

location (8000h).

3. When read out protection (ROP) is equal to AAh (ROP active), the Flash program memory is read out protected. In this case, the bootloader stops and the user application starts. If ROP is not equal to AAh, the bootloader continues to be executed.

4. The CAN peripheral can only be used if an external clock (8 MHz, 16 MHz, or 24 MHz) is present. It is initialized at 125 kbps. The UART1, UART2, UART3 and SPI peripherals do not require an external clock.

5. Set the high speed internal RC oscillator (HSI) to 16 MHz and initialize the UART1,

UART2 and UART3 receiver pins in input pull-up mode in the GPIO registers. Initialize the SPI in slave mode.

synchronization byte/message (SYNCHR) within a timeout of 1 s. If a timeout occurs, either the Flash program memory is virgin in which case it waits for a synchronization byte/message in an infinite loop, or the Flash program memory is not virgin and the bootloader restores the registers’ reset status before going to the Flash program memory reset vector at 8000h.

Note: When synchronization fails and the bootloader receives a byte/message different to ‘SYNCHR’, two different situations can be distinguished according to the peripheral:

With UART1, UART2 or UART3, a device reset or power-down is necessary before synchronization can be tried again.

With CAN or SPI, the user can continue to poll the interfaces until a synchronization or a timeout occurs.

7. If the synchronization message is received by the UART1, UART2 or UART3, the bootloader detects the baud rate and initializes the UART1, UART2 or UART3

respectively and goes to step

8

below. If the

synchronization message is received by the CAN or SPI, the bootloader goes directly to step

8

below.

Note: Once one of the available interfaces receives the synchronization message, all others are disabled.

8. Waiting for commands (point C): Commands are checked in an infinite loop and executed. To exit from the bootloader, the host has to send a ‘go’ command. When this is done, the bootloader removes the EM and WM routines from the RAM memory before jumping to the address selected by the host.

8/58

UM0560 Bootloader introduction

Table 1.

Initial checking

(1)

Checks

Program memory location 8000h

Bootloader check opt_byte 487Eh

Bootloader check opt_byteN 487Fh

Actual Flash program memory status

-> Flash action

1

2

3 st nd rd

XXh! = (82h or ACh)

XXh = (82h or ACh)

XXh = (82h or ACh)

XXh

55h

XXh! = 55h

XXh

AAh

XXh! = AAh

Flash program memory virgin

-> jump to bootloader

Flash program memory already written

-> jump to bootloader

Flash program memory already written

-> jump to Flash program memory reset

1.

After interface initialization, a write protection test is performed to avoid non-authorised reading of the

Flash program memory/data EEPROM,

9/58

Peripheral settings UM0560

Note:

●

●

●

●

●

This section describes the hardware settings of the STM8S communication peripherals:

UART1

UART2

UART3

SPI

CAN

During bootloading only one peripheral is enabled; all others are disabled.

Table 2.

STM8S20xxx

STM8S105xx

Serial interfaces associated with STM8S devices

Device Serial interface

UART1, UART3

UART2, SPI

, CAN

Note:

3.2

Note:

All UART peripherals support asynchronous serial communication.

●

●

UART1 settings are:

Data frame: 1 start bit, 8 data bit, 1 parity bit even, 1 stop bit

Baud rate: The baud rate is autodetected by the bootloader. When the user sends the synchronization byte, 7Fh, the bootloader automatically detects the baud rate and sets the UART1 to the same baud rate. Maximum baud rate = 1 Mbps; minimum baud rate =

4800 bps.

Mandatory: To perform the automatic speed detection, the RX line (PA4) has to be stable in the application board.

The UART1 peripheral is accessible via pins PA4 (RX) and PA5 (TX).

UART2 and UART3 settings

All UART peripherals support asynchronous serial communication.

UART2 and UART3 settings are:

●

●

Data frame: 1 start bit, 8 data bit, no parity bit, 1 stop bit

Baud rate: The baud rate is autodetected by the bootloader. When the user sends the byte 7Fh, the bootloader automatically detects the baud rate and sets the UART2 or

UART3 to the same baud rate. Maximum baud rate = 550 kbps; minimum baud rate =

4800 bps.

Mandatory: To perform the automatic speed detection, the RX line (PD6 for UART3) has to be stable in the application board.

UART2 and UART3 peripherals are accessible via pins PD5 (TX) and PD6 (RX).

10/58

UM0560 Peripheral settings

The SPI settings are:

●

●

●

●

8 data bit, LSB first

Bit rate: Set by the host which acts as a master

Peripheral set in slave mode with NSS not used.

Data polarity: CPOL = CPOH = 0

Note: 1 Before sending a ‘token’ byte, the host has to wait for a delay of a specified period of time. If this period is not quantified, it is equal to 6 µs.

2 The SPI peripheral is accessible via pins PC5 (SCK), PC6 (MOSI), and PD7 (MISO).

To address additional devices on the same bus, the CAN protocol provides a standard identifier field (11-bit) and an optional extended identifier field (18-bit) in the frame.

Figure 2

shows the CAN frame that uses the standard identifier only.

Figure 2.

CAN frame

Inter-frame space Data frame (standard identifier)

44 + 8 * N

Inter-frame space or overload frame

Arbitration field

12

Control field

6

Data field

8 * N

ID DLC

CRC field

16

ACK field

2

7

CRC EOF ai15001

●

●

The CAN settings are:

Standard identifier (not extended)

Bit rate: At the beginning is 125 kbps; run time can be changed via the speed command to achieve a maximum bit rate of 1 Mbps.

●

●

●

●

The transmit settings (from STM8S to the host) are:

Tx mailbox0: On

Tx mailbox1 and Tx mailbox2: Off

Tx identifier: 02h

Outgoing messages contain 1 data byte.

11/58

Peripheral settings

Note:

UM0560

●

●

●

●

●

The receive settings (from the host to STM8S) are:

Synchronization byte, 7Fh, is in the RX identifier and not in the data field.

RX identifier depends on the command (00h, 03h, 11h, 21h, 31h, 43h).

Error checking: If the error field (bit [6:4] in the CESR register) is different from 000b, the message is discarded and a NACK is sent to the host.

In FIFO overrun condition, the message is discarded and a NACK is sent to the host.

Incoming messages can contain from 1 to 8 data bytes.

The CAN peripheral is accessible via pins PG0 (TX) and PG1 (RX).

12/58

UM0560

4 Bootloader set

Bootloader command set

The supported commands are listed in

Table 3

below.

Table 3.

Bootloader commands

Command Command code

Get

Read memory

Erase memory

Write memory

Speed

Go

00h

11h

43h

31h

03h

21h

Command description

Gets the version and the allowed commands supported by the current version of the bootloader

Reads up to 256 bytes of memory starting from an address specified by the host

Erases from one to all of the Flash program memory/data

EEPROM memory sectors

Writes up to 128 bytes to the RAM or the Flash program memory/data EEPROM memory starting from an address specified by the host

Allows the baud rate for CAN run-time to be changed

Jumps to an address specified by the host to execute a loaded code

When the bootloader receives a command via the UART1, UART2, UART3, CAN or SPI peripherals, the general protocol is as follows: The bootloader sends an ACK byte to the host and waits for an address and for a checksum byte, both of which are checked when received. If the address is valid and the checksum is correct, the bootloader transmits an

ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address is valid and the checksum is correct, the bootloader waits for the number of bytes to be transmitted (N bytes) and for its complemented byte (checksum). If the checksum is correct, it then carries out the command, starting from the received address. If the checksum is incorrect, it sends a NACK byte before aborting the command.

The bootloader protocol via UART1, UART2, UART3 and SPI are identical on the device side, but, differ regarding the host. A token byte is needed when sending each byte to the

host via SPI (see

Figure 5

,

Figure 11

,

Figure 17

,

Figure 23

, and

Figure 31

). The bootloader

protocol via CAN differs from all other peripherals.

●

●

●

The following sections are organised as follows:

Commands via UART1/ UART2/ UART3

Commands via SPI

Commands via CAN

13/58

Bootloader command set UM0560

4.1.1

The get command allows the host to get the version of the bootloader and the supported commands. When the bootloader receives the get command, it transmits the bootloader version and the supported command codes to the host.

Get command via UART1/ UART2/UART3

Figure 3.

Get command via UART1/UART2/UART3 Host side

Start get command

Send 00h + FFh

Wait for ACK or NACK

NACK

ACK

Receive 1 byte: Number of bytes

(version + commands)

Receive 1 byte: Bootloader version

Receive 5 bytes: Supported commands

Wait for ACK or NACK

End of get command

The host sends the bytes as follows

Byte 1:

Byte 2:

00h

FFh

- Command ID

- Complement ai15003

14/58

UM0560 Bootloader command set

Figure 4.

Get command via UART1/UART2/UART3: Device side

Start get command

Received byte = 00h+FFh?

No

Send NACK byte

Yes

Send ACK byte

Send 1 byte: Number of bytes

(version+commands)

Send 1 byte: Bootloader version

Send 5 bytes: Supported commands

Send ACK byte

End of get command ai15004

The STM8S sends the bytes as follows

Byte 1:

Byte 2:

Byte 3:

Byte 4:

Byte 5:

Byte 6:

Byte 7:

Byte 8:

Byte 9:

ACK (after the host has sent the command)

N = 5 = the number of bytes to be sent -1 (1 <= N +1 <= 256)

Bootloader version (0 < version <= 255)

00h - Get command

11h

21h

31h

43h

ACK

- Read memory command

- Go command

- Write memory command

- Erase memory command

15/58

Bootloader command set

4.1.2 Get command via SPI

Figure 5.

Get command via SPI: Host side

Start get command

Send 00h + FFh

Send token byte

NACK

Wait for ACK or NACK

ACK

Send token byte

Receive 1 byte (05h): Number of bytes

Send token byte

Receive 1 byte: Bootloader version

Send token byte

Receive 1 byte (00h): Get command ID

Send token byte

Receive 1 byte (11h): Read command ID

Send token byte

Receive 1 byte (21h): Go command ID

Send token byte

Receive 1 byte (31h): Write command ID

Send token byte

Receive 1 byte (43h): Erase command ID

Send token byte

End of get command

Wait for ACK or NACK ai15033b

UM0560

16/58

UM0560 Bootloader command set

The host sends the bytes as follows

Byte 1:

Byte 2:

00h

FFh

- Command ID

- Complement

Byte 3 (token): XYh; host waits for ACK or NACK

Byte 4 (token): XYh; host waits for 05h

...

Byte 4 (token): XYh; host waits for ACK or NACK.

Figure 6.

Get command via SPI: Device side

Start get command

Received byte = 00h+FFh?

No

Send NACK byte

Yes

Send ACK byte

Send 1 byte: Number of bytes

(version+commands)

Send 1 byte: Bootloader version

Send 5 bytes: Supported commands

Send ACK byte

End of get command ai15034

The STM8S sends the bytes as follows

Byte 1:

Byte 2:

Byte 3:

Byte 4:

Byte 5:

Byte 6:

Byte 7:

Byte 8:

Byte 9:

ACK

N = 5 = the number of bytes to be sent -1 (1 <= N +1 <= 256)

Bootloader version (0 < version <= 255)

00h - Get command

11h

21h

31h

43h

ACK

- Read memory command

- Go command

- Write memory command

- Erase memory command

17/58

Bootloader command set

4.1.3 Get command via CAN

Figure 7.

Get command via CAN: Host side

Start get command

Send message with std ID = 00h

Wait for ACK or NACK

NACK

ACK

Receive 1 message: number of bytes

(version + commands)

Receive 1 message: Bootloader version

Receive 1 message: Get command

Receive 1 message: Speed command

Receive 1 message: Read command

Receive 1 message: Go command

Receive 1 message: Write command

Receive 1 message: Erase command

Wait for ACK or NACK

End of get command ai15029

The host sends the messages as follows

Command message: Std ID = 00h, data length code (DLC) = ‘not important’.

UM0560

18/58

UM0560 Bootloader command set

Figure 8.

Get command via CAN: Device side

Start get command

Received message with ID = 00h?

No

Yes

Send ACK message

Send 1 message: Number of bytes

(version + commands)

Send 1 message: Bootloader version

Send 6 messages: Supported commands

Send ACK message

End of get command

Send NACK message ai15030

The STM8S sends the messages as follows

Message 1: Std ID = 02h, DLC = 1, data = ACK

Message 2: Std ID = 02h, DLC = 1 data = N = 6 = the number of bytes to be sent -1

(1 <= N +1 <= 256)

Message 3: Std ID = 02h, DLC = 1, data = bootloader version (0 < version <= 255)

Message 4: Std ID = 02h, DLC = 1, data = 00h - Get command

Message 5: Std ID = 02h, DLC = 1, data = 03h

Message 6: Std ID = 02h, DLC = 1, data = 11h

- Speed command

- Read memory command

Message 7: Std ID= 02h, DLC = 1, data = 21h

Message 8: Std ID = 02h, DLC = 1, data = 31h

Message 9: Std ID= 02h, DLC = 1, data = 43h

Message 10: Std ID = 02h, DLC = 1, data = ACK

- Go command

- Write memory command

- Erase memory command

19/58

Bootloader command set

4.2

4.2.1

UM0560

Read memory command

The read memory command is used to read the memory (RAM, Flash program memory/data EEPROM or registers). When the bootloader receives the read memory command, it transmits the needed data ((N + 1) bytes) to the host, starting from the received address.

Read memory command via UART1/UART2/UART3

Figure 9.

Read memory command via UART1/UART2/UART3: Host side

Start read memory

Send 11h+EEh

Wait for ACK or NACK

NACK

ACK

Send the start address (4 bytes) with checksum

Wait for ACK or NACK

NACK

ACK

Send the number of bytes to be read (1 byte) and a checksum (1 byte)

Wait for ACK or NACK

NACK

ACK

Receive data from the bootloader

End of read memory ai15005

1.

The valid addresses are RAM, Flash program memory/data EEPROM and register addresses (see product datasheet). If the bootloader receives an invalid address, an ‘add error’ occurs (see

Table 6: Error table on page 55

).

20/58

UM0560 Bootloader command set

The host sends the bytes to the STM8S as follows

Bytes 1-2: 11h+EEh

Bytes 3-6: The start address

Byte 3 = MSB

Byte 6 = LSB

Byte 7:

Byte 8:

Byte 9:

Checksum = XOR (byte 3, byte 4, byte 5, byte 6)

The number of bytes to be read (0 < N <= 255)

Checksum

≠ byte 8.

Figure 10.

Read memory command via UART1/UART2/UART3: Device side

Start read memory

Received byte =

11h+EEh

Yes

Send ACK byte

No

Receive the start address (4 bytes) with checksum

Address valid & checksum OK?

Yes

Send ACK byte

No

Receive the number of bytes to be read (1 byte) and the checksum byte

Checksum OK?

No

Yes

Send ACK byte

Send data to the host

End of read memory

Send NACK byte ai15006

21/58

Bootloader command set

4.2.2 Read memory command via SPI

Figure 11.

Read memory command via SPI: Host side

Start read memory

Send 11h+EEh

Start token byte

Wait for ACK or NACK

ACK

NACK

Send the start address (4 bytes) with checksum

Start token byte

Wait for ACK or NACK

NACK

ACK

Send the number of bytes (N) to be read

(1 byte) and a checksum (1 byte)

Start token byte

Wait for ACK or NACK

ACK

Start token byte

NACK

Receive 1 byte from STM8A

UM0560

No

N+1 bytes received?

Yes

End of read memory ai15035

1.

The valid addresses are RAM, Flash program memory/data EEPROM and register addresses (see product datasheet). If the bootloader receives an invalid address, an ‘add error’ occurs (see

Table 6: Error table on page 55

).

22/58

UM0560 Bootloader command set

The host sends the bytes to the STM8S as follows

Byte 1:

Byte 2:

Byte 3 (token):

Bytes 4 to 7:

11h

EEh

- Command ID

- Complement

XYh; host waits for ACK or NACK

The start address

Byte 4 = MSB

Byte 7 = LSB

Byte 8:

Byte 9 (token):

Checksum = XOR (byte 4, byte 5, byte 6, byte 7)

XYh; host waits for ACK or NACK

Byte 10: The number of bytes to be read (0 < N <= 255)

Byte 11:

Byte 12 (token):

Checksum

= Complement of byte 10

XYh; host waits for the 1 st

data byte

Byte 12+N (token): XYh; host waits for the N+1 th

data byte

23/58

Bootloader command set

Figure 12.

Read memory command via SPI: Device side

Start read memory

Received byte =

11h+EEh?

Yes

Send ACK byte

No

Receive the start address (4 bytes) with checksum

Address valid & checksum OK?

Yes

Send ACK byte

No

Receive the number of bytes to be read (1 byte) and the checksum byte

Checksum OK?

No

Yes

Send ACK byte

Send data to the host

End of read memory

Send NACK byte ai15036

UM0560

24/58

UM0560

4.2.3

Bootloader command set

Read memory command via CAN

The CAN message sent by the host is as follows:

●

●

The ID contains the command type (11h)

The data field contains a destination address (4 bytes, byte 1 is the MSB and byte 4 is

LSB of the address) and the ‘number of bytes’ (N) to be read.

Figure 13.

Read memory command via CAN: Host side

Start read memory

Send read message (std ID = 11h)

NACK

Wait for ACK or NACK

ACK

Receive (N+1) messages from bootloader

End of read memory ai15008

1.

The valid addresses are RAM, Flash program memory/data EEPROM and register addresses (see product datasheet). If the bootloader receives an invalid address, an ‘add error’ occurs (see

Table 6: Error table on page 55

).

The host sends the messages as follows

Command message: Std ID = 11h, DLC = 05h, data = MSB, XXh, YYh, LSB, N

(where 0 < N <= 255).

Figure 14.

Read memory command via CAN: Device side

Start read memory

Received message with std ID = 11h?

No

Yes

Send ACK message

Send (N+1) messages to the host

End of read memory

Send NACK message ai15008

25/58

Bootloader command set

Note:

The STM8S sends the messages as follows

ACK message: Std ID = 02h, DLC = 1, data = ACK

Data message 1: Std ID = 02h, DLC = 1, data = XXh

Data message 2: Std ID = 02h, DLC = 1, data = XXh

…

Data message (N+1): Std ID = 02h, DLC = 1, data = XXh

The bootloader sends as many data messages as bytes which can be read.

4.3

UM0560

Erase memory command

The erase memory command allows the host to erase sectors of the Flash program memory/data EEPROM memory.

The bootloader receives the erase command message, when the ID contains the command type (43h) and the data field contains the sectors to be erased (see

Table 5: STM8S sector codes on page 50

). A sector is 1 Kbyte, therefore, the granularity with the erase command is

8 blocks. If the host wants to erase one byte, the write command (write 00h) can be used.

Erase memory command specifications:

1.

The bootloader receives one byte which contains the number (N) of sectors to be erased. N is device dependent.

2. The bootloader receives (N + 1) bytes, where each byte contains a sector code (see ).

26/58

UM0560

4.3.1

Bootloader command set

Erase memory command via UART1/UART2/UART3

Figure 15.

Erase memory command via UART1/UART2/UART3: Host side

Start erase memory

Send 43h+BCh

Send FFh

Send 00h

Yes

Wait for ACK or NACK

ACK

Total erase?

NACK

No

Send the number of sectors to be erased (1 byte)

Send the sector codes

Send checksum

Wait for ACK or NACK

End of erase memory ai15009

1.

Memory erased =130 Kbytes for devices with 128 Kbytes of Flash program memory and 2 Kbytes of Data

EEPROM and 33 Kbytes for devices with 32 Kbytes of Flash program memory and 1 Kbyte of Data

EEPROM.

2.

A sector is 8 blocks i.e. 1 Kbyte for any device. Therefore, the granularity of the erase command is

1 Kbyte.

Warning: If the host sends an erase command that includes some correct sector code and one or more forbidden sector codes, the command fails.

27/58

Bootloader command set

Note:

UM0560

The host sends the bytes as follows

Byte 1:

Byte 2:

43h

BCh

- Command ID

- Complement

Byte 3: FFh or number of sectors to be erased (0 <= N <= M); if N > M, a cmd_error occurs in the bootloader, afterwhich the bootloader receives N + 1 data bytes and the checksum (i.e. the host completes the command).

N is product dependent.

M = (size of the Flash program memory in Kbyte) + (size of Data EEPROM in Kbyte) -1.

For instance :

For STM8S20xxB, M = 129 as Flash program memory is 128 Kbytes and Data EEPROM memory is 2 Kbytes (128 + 2 -1).

For STM8S105x6, M = 32 as Flash program memory is 32Kbytes and Data EEPROM is

1Kbyte (32 + 1 - 1).

Byte 4 or N+1 bytes: 00h or (N+1 bytes and then checksum: XOR(N, N+1 bytes)).

28/58

UM0560 Bootloader command set

Figure 16.

Erase memory command via UART1/UART2/UART3: Device side

Start erase memory

Received bytes =

43h+BCh?

No

Yes

Send ACK byte

Receive the number of sectors to be erased (1 byte)

00h received?

Yes

Start total erase

No

Yes

FFh received?

No

Receive the sector codes

Receive the checksum

Checksum

OK?

No

Yes

Erase the corresponding sectors

Send ACK byte

Send NACK byte

End of erase memory ai15010

1.

For safety reasons no erase routine is placed into ROM. The ‘erase the corresponding sectors’ routine (see

Figure 16

) is performed in RAM. The user, therefore has to download the erase routine in RAM before

sending an erase command.

29/58

Bootloader command set

4.3.2 Erase memory command via SPI

Figure 17.

Erase memory command via SPI: Host side

Start erase memory

Send 43h+BCh

Send token byte

Send FFh

Send 00h

Yes

Wait for ACK or NACK

ACK

Total erase?

NACK

No

Send the number of sectors

(N) to be erased (1 byte)

Send the sector code

Send checksum

Delay

Send token byte

30/58

UM0560

Wait for ACK or NACK

End of erase memory ai15037

1.

When using the erase command via SPI, it is necessary to wait for a brief time interval (see ‘delay’ in

Figure 17

above) before sending the last token byte. This delay interval depends on the SPI baud rate and

on the number of sectors to be erased. Delay = 13 * (N + 1)[ms], where 0

<= N <= 32. N = 32 in the case of tatal erase.

The host sends the bytes as follows

Byte 1:

Byte 2:

Byte 3 (token):

Byte 4:

43h

BCh

- Command ID

- Complement

XYh; host waits for ACK or NACK

FFh or number of sectors to be erased (0 <= N <= 32);

If N >32 a ‘cmd_error’ occurs.

Byte 5 or N+1 bytes: 00h or (N+1 bytes and then checksum: XOR (N, N+1 bytes))

Last byte (token): XYh; host waits for ACK or NACK.

UM0560

Figure 18.

Erase memory command via SPI: Device side

Start erase memory

Received bytes =

43h+BCh?

No

Yes

Send ACK byte

Receive the number of sectors to be erased (1 byte)

Bootloader command set

00h received?

Yes

Start total erase

No

Yes

FFh received?

No

Receive the sector codes

Receive the checksum

Checksum

OK?

No

Yes

Erase the corresponding sectors

Send ACK byte

End of erase memory

Send NACK byte ai15038

31/58

Bootloader command set

4.3.3 Erase memory command via CAN

Figure 19.

Erase memory command via CAN: Host side

Start erase memory

Yes

Has the user to perform a total erase?

No

Send a message with std

ID = 43h and data byte 1

= FFh. The bootloader takes no account of other data in the message

Send a message with std

ID = 43h and data field containing sector codes

UM0560

Wait for 2 ACK or 1 NACK

End of erase memory ai15011

1.

Memory erased =130 Kbytes for devices with 128 Kbytes of Flash program memory and 2 Kbytes of Data

EEPROM and 33 Kbytes for devices with 32 Kbytes of Flash program memory and 1 Kbyte of Data

EEPROM.

2.

A sector is 8 blocks i.e. 1 Kbyte for any devices. Therefore, the granularity of the erase command is

1 Kbyte.

Warning: If the host sends an erase command that includes some correct sector code and one or more forbidden sector codes, the command fails.

The host sends the message as follows

Total erase message: Std ID = 43h, DLC = 01h, data = FFh.

Erase sector by sector message: Std ID = 43h, DLC = 01h to 08h, data = see product datasheet.

32/58

UM0560

Figure 20.

Erase memory command via CAN: Device side

Start erase memory

Bootloader command set

Received message with std ID =

43h?

Yes

No

Send ACK message

Start total erase

Yes

Is byte 1 of the data field = FFh?

No

Erase memory sector by sector according to data contained in the messages data field

Send ACK message

Send NACK message

End of erase memory ai15012

1.

For safety reasons no erase routine is placed into ROM. The ‘erase memory sector by sector according to data contained in the messages data field’ (see

Figure 20

) is performed in RAM. The user, therefore has to download the erase routine in RAM before sending an erase command.

33/58

Bootloader command set

4.4

4.4.1

UM0560

Write memory command

The write memory command allows the host to write data to any memory address (RAM,

Flash program memory/data EEPROM or registers) starting from the received address.

Incoming data are always written in RAM before being loaded in the memory locations decided by the host. The bootloader then checks whether the host wants to write in RAM or in the Flash program memory/data EEPROM.

The maximum length of the block to be written for the STM8S is 128 data bytes. To write the data in the Flash program memory/data EEPROM memory locations, the bootloader performs two different write operations:

1.

WordWrite/FastWordWrite: Writes a byte in the Flash program memory/data EEPROM.

It is used when the number of bytes (N) sent from the host is less than 128. In this case the bootloader performs the operation N times.

2. BlockWrite: Writes a block in the Flash program memory/data EEPROM. It is used when the number of bytes (N) sent from the host is 128 and the destination address is an integer module of 128. In other words, to use this operation, the block sent from the host has to be aligned with a memory block.

Write memory command via UART1/UART2/UART3

Figure 21.

Write memory command via UART1/UART2/UART3: Host side

Start write memory

Send 31h+CEh

Wait for ACK or NACK

NACK

ACK

Send the start address (4 bytes) and checksum

Wait for ACK or NACK

NACK

ACK

Send the number of bytes to be written

(1 byte), the data (N + 1) bytes) and checksum

Wait for ACK or NACK

End of write memory ai15013

1.

See product datasheet for valid addresses. If the start address is invalid, an add_error occurs (see

Table 6:

Error table on page 55

).

34/58

UM0560 Bootloader command set

The host sends the bytes as follows

Byte 1:

Byte 2:

Bytes 3-6:

31h

CEh

- Command ID

- Complement

The start address

Byte 3 = MSB

Byte 7:

Byte 8:

Byte 6 = LSB

Checksum = XOR (byte 3, byte 4, byte 5, byte 6)

The number of bytes to be received (0 < N <= 127); if N > 127 a cmd_error occurs in the bootloader.

N+1 data bytes: Max 128 bytes

Checksum byte: XOR (N, N+1 databytes).

35/58

Bootloader command set

Figure 22.

Write memory command via UART1/UART2/UART3: Device side

Start write memory

UM0560

Received byte =

31h+CEh?

Yes

Send ACK byte

No

Receive the start address (4 bytes) and checksum

Address valid and checksum OK?

Yes

Send ACK byte

No

Receive the number of bytes to be written

(1 byte), the data (N + 1 bytes) and the checksum

Write the received data to RAM memory starting from the 00h location

Flash/data

EEPROM address ?

Yes

No

Write the received data to

RAM from the start address

Write the received data to the memory from the start address

No

Checksum ok?

Yes

Send NACK byte

Send ACK byte

End of write memory ai15014

1.

For safety reasons no write routine is placed into ROM. The ‘write the received data to RAM from the start address’ (see

Figure 22

) is performed in RAM. The user, therefore has to download the write routine in

RAM before sending a write command.

36/58

UM0560

4.4.2 Write memory command via SPI

Figure 23.

Write memory command via SPI: Host side

Start write memory

Send 31h+CEh

Send token byte

Bootloader command set

Wait for ACK or NACK

NACK

ACK

Send the start address (4 bytes) and checksum

Send token byte

Wait for ACK or NACK

NACK

ACK

Send the number of bytes to be written

(1 byte), the data (N+1 byte) and checksum

Delay

Send 'token' byte

Wait for ACK or NACK

End of write memory ai15039

37/58

Bootloader command set UM0560

The ‘delay’ is calculated as follows:

Delay = 8.45 * (N + 1) [ms]

Where 0

<= N <= 127.

Table 4.

Examples of delay

Write command

128 bytes aligned with a memory block

128 bytes not aligned with a memory block

Delay (ms)

8.45

1082

The host sends the bytes as follows

Byte 1:

Byte 2:

Byte 3 (token):

Bytes 4 to 7:

Byte 8:

Byte 9 (token):

Byte 10:

31h

CEh

- Command ID

- Complement

XY; host waits for ACK or NACK

The start address

Byte 4 = MSB

Byte 7 = LSB

Checksum = XOR (byte 3, byte 4, byte 5, byte 6)

XY; host waits for ACK or NACK

The number of bytes to be received (0 < N <= 127);

If N > 127 a cmd_error occurs in the bootloader.

N+1 data bytes: Max 128 bytes

Checksum byte: XOR (N, N+1 databytes).

before sending the token byte, the host must wait for the bootloader to finish writing all data into the memory.

Last byte (token): XYh; host waits for ACK or NACK.

38/58

UM0560 Bootloader command set

Figure 24.

Write memory command via SPI: Device side

Start write memory

Received byte =

31h+CEh?

Yes

Send ACK byte

No

Receive the start address (4 bytes) and checksum

Address valid and checksum OK?

Yes

Send ACK byte

No

Receive the number of bytes to be written

(1 byte), the data (N + 1 byte) and the checksum

Write the received data to RAM memory starting from the 00h location

Flash/data

EEPROM address?

Yes

No

Write the received data to the memory from the start address

Write the received data to

RAM from the start address

No

Checksum ok?

Yes

Send ACK byte

Send NACK byte

End of write memory ai15040

1.

For safety reasons no write routine is placed into ROM. The ‘write the received data to RAM from the start address’ (see

Figure 22

) is performed in RAM. The user, therefore has to download the write routine in

RAM before sending a write command.

39/58

Bootloader command set

4.4.3 Write memory command via CAN

Figure 25.

Write memory command via CAN: Host side

Start write memory

Send write message (std ID = 31h)

Wait for ACK or NACK

NACK

ACK

Send the data messages. At same time, the host checks whether it received a NACK message from the STM8A

If NACK message received

Send message with checksum

UM0560

Wait for ACK or NACK

End of write memory ai15015

1.

See product datasheet for valid addresses. If the bootloader receives an invalid address, an add_error occurs (see

Table 6: Error table on page 55

).

40/58

UM0560 Bootloader command set

The host sends the messages as follows

Command message: Std ID = 31h, DLC = 05h, data = MSB, XXh, YYh, LSB, N, 0 < N <=

127). If N > 127 a cmd_error occurs in the bootloader.

Data message_1: Std ID = 04h, DLC_1 = 1 to 8, data = byte_11, … byte_18

Data message_2: Std ID = 04h, DLC_2 = 1 to 8, data = byte_21, … byte_28

Data message_3: Std ID = 04h, DLC_3 = 1 to 8, data = byte_31, … byte_38

…

Data message_M: Std ID = 04h, DLC_M = 1 to 8, data = byte_m1, …, byte_M8

Checksum message: Std ID = 04h, DLC = 1, data = XOR (N, N+1 data bytes)

Note: 1 DLC_1 + DLC_2 + ... DLC_M = 128 maximum

2 The bootloader does not check the standard ID of the data and checksum messages.

Therefore, an ID from 0h to FFh can be used. It is recommended to use 04h.

41/58

Bootloader command set

Figure 26.

Write memory command via CAN: Device side

Start write memory

Received message with std ID =

31h?

Yes

No

Start address and number of bytes (N) valid?

Yes

Send ACK message

Receive the 'data messages' and temporarily write the data to RAM starting from the 00h location

Receive the 'checksum message'

If a message is corrupted

Address in Flash/data

EEPROM?

No

Yes

Write the received data to RAM from the start address

Write the received data to the memory from the start address

UM0560

No

Checksum ok?

Yes

Send ACK message

Send NACK message

End of write memory ai15016

1.

For safety reasons no write routine is placed into ROM. The ‘write the received data to the Flash program

memory/data EEPROM from the start address’ (see

Figure 26

) is performed in RAM. The user, therefore

has to download the write routine in RAM before sending a write command.

2.

See product datasheet for valid addresses. If the bootloader receives an invalid address, an add_error occurs (see

Table 6: Error table on page 55

).

42/58

UM0560 Bootloader command set

4.5.1

The speed command allows the baud rate for CAN run-time to be changed. It can be used only if the CAN is the peripheral being used.

Speed command via CAN

Figure 27.

Speed command via CAN: Host side

Start speed command

Send speed message (std ID = 03h)

Wait for ACK or NACK

ACK

Changes the CAN baud rate according to command sent

NACK

Wait for ACK

End of speed ai15031b

1.

After setting the new baud rate, the bootloader sends the ACK message. Therefore, the host sets its baud rate while waiting for the ACK.

The host sends the message as follows

●

●

●

●

Command message: Std ID = 03h, DLC = 01h, data = XXh where XXh assumes the following values depending on the baud rate to be set:

01h -> baud rate = 125 kbps

02h -> baud rate = 250 kbps

03h -> baud rate = 500 kbps

04h -> baud rate = 1 Mkbps

43/58

Bootloader command set

Figure 28.

Speed command via CAN: Device side

Start speed command

Received a message with std ID = 03h and with valid data?

Yes

Send ACK message

(old baud rate)

No

Changes the CAN baud rate according to received data (new baud rate)

Send ACK message

(new baud rate)

Send NACK message

(old baud rate)

End of speed command ai15032b

UM0560

44/58

UM0560 Bootloader command set

4.6.1

The go command is used to execute the downloaded code or any other code by branching to an address specified by the host.

Go command via UART1/UART2/UART3

Figure 29.

Go command via UART1/UART2/UART3: Host side

Start Go

Send 21h+DEh

Wait for ACK or NACK

NACK

ACK

Send the start address (4 bytes) and checksum

Wait for ACK or NACK

End of Go ai15017

1.

The valid addresses are RAM, Flash program memory/data EEPROM and register addresses (see product datasheet). If the bootloader receives an invalid address, an ‘add error’ occurs (see

Table 6: Error table on page 55

).

The host sends the bytes as follows

Byte 1:

Byte 2:

Bytes 3-6:

Byte 7:

21h

DEh

- Command ID

- Complement

The start address

Byte 3 = MSB

Byte 6 = LSB

Checksum = XOR (byte 3, byte 4, byte 5, byte 6).

45/58

Bootloader command set

Figure 30.

Go command via UART1/UART2/UART3: Device side

Start Go

Received bytes =

21h+DEh?

No

Yes

Send ACK byte

Receive the start address (4 bytes) and checksum

Address valid and checksum OK?

No

Yes

Send ACK byte

Send NACK byte

End of Go ai15018b

UM0560

46/58

UM0560

4.6.2 Go command via SPI

Figure 31.

Go command via SPI: Host side

Start Go

Send 21h+DEh

Send token byte

Bootloader command set

Wait for ACK or NACK

NACK

ACK

Send the start address (4 bytes) and checksum

Send token byte

Wait for ACK or NACK

End of Go ai15041

1.

The valid addresses are RAM, Flash program memory/data EEPROM and register addresses (see product datasheet). If the bootloader receives an invalid address, an ‘add error’ occurs (see

Table 6: Error table on page 55

).

The host sends the bytes as follows

Byte 1:

Byte 2:

Byte 3 (token):

Bytes 4 to 7:

Byte 8:

Byte 9 (token):

21h

DEh

- Command ID

- Complement

XYh; host waits for ACK or NACK

The start address

Byte 4 = MSB

Byte 7 = LSB

Checksum = XOR (byte 3, byte 4, byte 5, byte 6)

XYh; host waits for ACK or NACK.

47/58

Bootloader command set

Figure 32.

Go command via SPI: Device side

Start go command

Received bytes

21h + DEh?

Yes

Send ACK byte

No

Receive the start address (4 bytes) and checksum

Address valid and checksum ok?

No

Yes

Send ACK byte

Remove EM and WM routines from the RAM

Jump to address

Send NACK byte

End of go ai15042

UM0560

48/58

UM0560

4.6.3 Go command via CAN

Figure 33.

Go command via CAN: Host side

Start go command

Send go message (std ID = 21h)

Bootloader command set

Wait for ACK or NACK

End of go ai15019

1.

See product datasheet for valid addresses.

The host sends the bytes as follows

Go command message: Std ID = 21h, DLC = 04h, data = MSB, XXh, YYh, LSB

Figure 34.

Go command via CAN: Device side

Start go command

Received message with std ID = 21h and with a valid address?

Yes

Send ACK message

No

Send NACK message

Jump to address

End of go ai15020

49/58

Bootloader command set UM0560

50/58

Table 5.

STM8S sector codes

Sector code

Flash program memory/ data EEPROM

(STM8S20xxx devices)

15h

16h

17h

18h

19h

1Ah

1Bh

1Ch

1Dh

1Eh

0Fh

10h

11h

12h

13h

14h

07h

08h

09h

0Ah

0Bh

0Ch

0Dh

0Eh

00h

01h

02h

03h

04h

05h

06h

BC00h -> BFFFh

C000h -> C3FFh

C400h -> C7FFh

C800h -> CBFFh

CC00h -> CFFFh

D000h -> D3FFh

D400h -> D7FFh

D800h -> DBFFh

DC00h -> DFFFh

E000h -> E3FFh

E400h -> E7FFh

E800h -> EBFFh

EC00h -> EFFFh

F000h -> F3FFh

F400h -> F7FFh

F800h -> FBFFh

8000h -> 83FFh

8400h -> 87FFh

8800h -> 8BFFh

8C00h -> 8FFFh

9000h -> 93FFh

9400h -> 97FFh

9800h -> 9BFFh

9C00h -> 9FFFh

A000h -> A3FFh

A400h -> A7FFh

A800h -> ABFFh

AC00h -> AFFFh

B000h -> B3FFh

B400h -> B7FFh

B800h -> BBFFh

Flash program memory/ data EEPROM

(STM8S105xx devices)

BC00h -> BFFFh

C000h -> C3FFh

C400h -> C7FFh

C800h -> CBFFh

CC00h -> CFFFh

D000h -> D3FFh

D400h -> D7FFh

D800h -> DBFFh

DC00h -> DFFFh

E000h -> E3FFh

E400h -> E7FFh

E800h -> EBFFh

EC00h -> EFFFh

F000h -> F3FFh

F400h -> F7FFh

F800h -> FBFFh

8000h -> 83FFh

8400h -> 87FFh

8800h -> 8BFFh

8C00h -> 8FFFh

9000h -> 93FFh

9400h -> 97FFh

9800h -> 9BFFh

9C00h -> 9FFFh

A000h -> A3FFh

A400h -> A7FFh

A800h -> ABFFh

AC00h -> AFFFh

B000h -> B3FFh

B400h -> B7FFh

B800h -> BBFFh

UM0560 Bootloader command set

Table 5.

STM8S sector codes (continued)

Sector code

Flash program memory/ data EEPROM

(STM8S20xxx devices)

32h

33h

34h

35h

36h

37h

2Ch

2Dh

2Eh

2Fh

30h

31h

38h

39h

3Ah

3Bh

3Ch

3Dh

3Eh

3Fh

26h

27h

28h

29h

2Ah

2Bh

1Fh

20h

21h

22h

23h

24h

25h

FC00h -> FFFFh

10000h -> 103FFh

10400h -> 107FFh

10800h -> 10BFFh

10C00h -> 10FFFh

11000h -> 113FFh

11400h -> 117FFh

11800h -> 11BFFh

11C00h -> 11FFFh

12000h -> 123FFh

12400h -> 127FFh

12800h -> 12BFFh

12C00h -> 12FFFh

13000h -> 133FFh

13400h -> 137FFh

13800h -> 13BFFh

13C00h -> 13FFFh

14000h -> 143FFh

14400h -> 147FFh

14800h -> 14BFFh

14C00h -> 14FFFh

15000h -> 153FFh

15400h -> 157FFh

15800h -> 15BFFh

15C00h -> 15FFFh

16000h -> 163FFh

16400h -> 167FFh

16800h -> 16BFFh

16C00h -> 16FFFh

17000h -> 173FFh

17400h -> 177FFh

17800h -> 17BFFh

17C00h -> 17FFFh

Flash program memory/ data EEPROM

(STM8S105xx devices)

FC00h -> FFFFh

4000h -> 43FFh

51/58

Bootloader command set

Table 5.

STM8S sector codes (continued)

Sector code

Flash program memory/ data EEPROM

(STM8S20xxx devices)

53h

54h

55h

56h

57h

58h

4Dh

4Eh

4Fh

50h

51h

52h

59h

5Ah

5Bh

5Ch

5Dh

5Eh

5Fh

60h

47h

48h

49h

4Ah

4Bh

4Ch

40h

41h

42h

43h

44h

45h

46h

18000h -> 183FFh

18400h -> 187FFh

18800h -> 18BFFh

18C00h -> 18FFFh

19000h -> 193FFh

19400h -> 197FFh

19800h -> 19BFFh

19C00h -> 19FFFh

1A000h -> 1A3FFh

1A400h -> 1A7FFh

1A800h -> 1ABFFh

1AC00h -> 1AFFFh

1B000h -> 1B3FFh

1B400h -> 1B7FFh

1B800h -> 1BBFFh

1BC00h -> 1BFFFh

1C000h -> 1C3FFh

1C400h -> 1C7FFh

1C800h -> 1CBFFh

1CC00h -> 1CFFFh

1D000h -> 1D3FFh

1D400h -> 1D7FFh

1D800h -> 1DBFFh

1DC00h -> 1DFFFh

1E000h -> 1E3FFh

1E400h -> 1E7FFh

1E800h -> 1EBFFh

1EC00h -> 1EFFFh

1F000h -> 1F3FFh

1F400h -> 1F7FFh

1F800h -> 1FBFFh

1FC00h -> 1FFFFh

20000h -> 203FFh

UM0560

Flash program memory/ data EEPROM

(STM8S105xx devices)

52/58

UM0560 Bootloader command set

Table 5.

STM8S sector codes (continued)

Sector code

Flash program memory/ data EEPROM

(STM8S20xxx devices)

74h

75h

76h

77h

78h

79h

6Eh

6Fh

70h

71h

72h

73h

7Ah

7Bh

7Ch

7Dh

7Eh

7Fh

80h

81h

68h

69h

6Ah

6Bh

6Ch

6Dh

61h

62h

63h

64h

65h

66h

67h

20400h -> 207FFh

20800h -> 20BFFh

20C00h -> 20FFFh

21000h -> 213FFh

21400h -> 217FFh

21800h -> 21BFFh

21C00h -> 21FFFh

22000h -> 223FFh

22400h -> 227FFh

22800h -> 22BFFh

22C00h -> 22FFFh

22000h -> 223FFh

22400h -> 227FFh

23800h -> 23BFFh

23C00h -> 23FFFh

24000h -> 243FFh

24400h -> 247FFh

24800h -> 24BFFh

24C00h -> 24FFFh

25000h -> 253FFh

25400h -> 257FFh

25800h -> 25BFFh

25C00h -> 25FFFh

26000h -> 263FFh

26400h -> 267FFh

26800h -> 26BFFh

26C00h -> 26FFFh

27000h -> 273FFh

27400h -> 277FFh

27800h -> 27BFFh

27C00h -> 27FFFh

4000h -> 43FFh

4400h -> 47FFh

Flash program memory/ data EEPROM

(STM8S105xx devices)

53/58

Software model UM0560

Note:

The boot code has been designed with the same logical protocol for exchanging command frames between host and any STM8S device.

The boot code can download up to 128 bytes at a time. The first 130 bytes of RAM (from

00h) store data coming from the serial interface, thus allowing the boot to use the stack. The

25 bytes following the first 130 bytes are used for the bootloader’s variables.

Note: Unused (empty) bootloader ROM is filled with an opcode that is not allowed (71h). If, for any reason (i.e. noise), the core starts to execute in the 71h area, an illegal opcode is returned and consequently a reset. This prevents the bootloader falling into an infinite loop with no reset in the event that it jumps in the ‘empty’ locations. Thus normal execution can resume.

Caution:

To erase or program the Flash program memory, the respective routines must be downloaded in RAM starting at 00A0h. This is imperative because the routines are consecutive with no empty memory locations between them.

●

●

The routines are included in the following files:

STM8S20xxx devices: E_W_ROUTINEs_128K.s19

STM8S105xx devices: E_W_ROUTINEs_32K.s19

●

●

To execute any of the commands (get, read, erase, write, speed, and go), the bootloader uses part of the RAM memory. Therefore, it is forbidden to run write commands (with the exception of write commands that are useful for downloading routines to erase and program the Flash program memory) with destination addresses in the following RAM memory locations:

STM8S20xxx devices: 0h to 01FFh

STM8S105xx devices: 0h to 01CFh

54/58

UM0560 Error management

Table 6

describes the error type and the bootloader behavior.

Table 6.

Error

cmd_error add_error

Error table

Description Bootloader actions

If a denied command is received

If a parity error occurs during command transmission

If an error occurs during the command execution

See

Table 3: Bootloader commands on page 13

Sends NACK byte and goes back to command checking

If a received command contains a denied destination address (for information on valid address ranges, refer to the product datasheet)

Sends NACK byte and goes back to command checking

55/58

Programming time UM0560

●

●

●

The programming time depends on the baud rate of the peripheral.

UART1/UART2/UART3: 128 kbps, 256 kbps, and 500 kbps

SPI: 125 kbps, 250 kbps, 500 kbps, and 1 Mbps

CAN: 125 kbps, 250 kbps, 500 kbps, and 1 Mbps

Note: 1 The programming time of the SPI is measured based on 32 Kbytes instead of 48 Kbytes because the boot code via the SPI is implemented on the STM8S 32 Kbyte device only.

2 After a go command, the bootloader removes the erase and write routines from the RAM memory before jumping to the host address. It takes about 150 µs to remove these routines.

Table 7

,

Table 8

, and

Table 9

show the programming times for the UART1/UART2/UART3,

SPI, and CAN respectively.

Table 7.

UART1/UART2/UART3 programming times

Baud rate (bps)

Time to load Kbytes/block/bytes in the Flash program memory

128000 256000

48 Kbytes

1 block

1 byte

7.73 s

20.13 ms

7.52 ms

5.34 s

13.53 ms

6.93 ms

Table 8.

SPI programming time

Baud rate

Time to load Kbytes/block/bytes in the Flash program memory

32 Kbytes

1 block

1 byte

125 kbps

4.46 s

17.44 ms

8.52 ms

250 kbps

3.34 s

13.04 ms

8.12 ms

500 kbps

2.81 s

11.01 ms

7.93 ms

500000

4.08 s

10.65 ms

6.65 ms

1 Mbps

2.55 s

9.95 ms

7.84 ms

Table 9.

CAN programming time

Baud rate

Time to load Kbytes/block/bytes in the Flash program memory

48 Kbytes

1 block

1 byte

125 kbps

9.50 s

24.73 ms

9.23 ms

250 kbps

6.40 s

16.66 ms

8.53 ms

500 kbps

4.85 s

12.63 ms

7.91 ms

1 Mbps

4.07 s

10.60 ms

7.68 ms

56/58

UM0560

Table 10.

Document revision history

Date Revision

15-Dec-2008 1 Initial release

Changes

Revision history

57/58

UM0560

Please Read Carefully:

Information in this document is provided solely in connection with ST products. STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, modifications or improvements, to this document, and the products and services described herein at any time, without notice.

All ST products are sold pursuant to ST’s terms and conditions of sale.

Purchasers are solely responsible for the choice, selection and use of the ST products and services described herein, and ST assumes no liability whatsoever relating to the choice, selection or use of the ST products and services described herein.

No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted under this document. If any part of this document refers to any third party products or services it shall not be deemed a license grant by ST for the use of such third party products or services, or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoever of such third party products or services or any intellectual property contained therein.

UNLESS OTHERWISE SET FORTH IN ST’S TERMS AND CONDITIONS OF SALE ST DISCLAIMS ANY EXPRESS OR IMPLIED

WARRANTY WITH RESPECT TO THE USE AND/OR SALE OF ST PRODUCTS INCLUDING WITHOUT LIMITATION IMPLIED

WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE (AND THEIR EQUIVALENTS UNDER THE LAWS

OF ANY JURISDICTION), OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT.

UNLESS EXPRESSLY APPROVED IN WRITING BY AN AUTHORIZED ST REPRESENTATIVE, ST PRODUCTS ARE NOT

RECOMMENDED, AUTHORIZED OR WARRANTED FOR USE IN MILITARY, AIR CRAFT, SPACE, LIFE SAVING, OR LIFE SUSTAINING

APPLICATIONS, NOR IN PRODUCTS OR SYSTEMS WHERE FAILURE OR MALFUNCTION MAY RESULT IN PERSONAL INJURY,

DEATH, OR SEVERE PROPERTY OR ENVIRONMENTAL DAMAGE. ST PRODUCTS WHICH ARE NOT SPECIFIED AS "AUTOMOTIVE

GRADE" MAY ONLY BE USED IN AUTOMOTIVE APPLICATIONS AT USER’S OWN RISK.

Resale of ST products with provisions different from the statements and/or technical features set forth in this document shall immediately void any warranty granted by ST for the ST product or service described herein and shall not create or extend in any manner whatsoever, any liability of ST.

ST and the ST logo are trademarks or registered trademarks of ST in various countries.

Information in this document supersedes and replaces all information previously supplied.

The ST logo is a registered trademark of STMicroelectronics. All other names are the property of their respective owners.

© 2008 STMicroelectronics - All rights reserved

STMicroelectronics group of companies

Australia - Belgium - Brazil - Canada - China - Czech Republic - Finland - France - Germany - Hong Kong - India - Israel - Italy - Japan -

Malaysia - Malta - Morocco - Singapore - Spain - Sweden - Switzerland - United Kingdom - United States of America

www.st.com

58/58