RL78 Safety Features © 2011 Renesas Electronics Corporation. All rights reserved.

Introduction Purpose Objective Content Learning Time
This course provides an introduction to the RL78 safety features. The capabilities and function of each feature will be explained. Objective Learn about the RL78 security features and its capabilities. Content 34 pages (including this page) Learning Time 20 minutes The purpose of this course is to provide an introduction to the RL78’s safety features. Our objectives are to learn about the capabilities and functions of each of these safety features. Total learning time is about 20 minutes, so let’s get started. © 2011 Renesas Electronics Corporation. All rights reserved.

Safety features overview
First, we’ll provide a quick overview of the variety of safety features, then explore each in more detail. © 2011 Renesas Electronics Corporation. All rights reserved.

Safety Features overview
RAM (Variable Memory) More Relief for your system by H/W Safety functions Ideal support to comply with IEC60730 Safety Standards & Class B SW requirements VDE Approval already done Libraries available Flash (Invariable Memory) Parity / Write Protection Parity: Internal reset when parity error generated on “write”, checked on “read” Write Protection : Protect area can be selected Lowest address ~ 128B/~256B/~512B SFR (Variable Memory) Two types of CRC Hardware Type1: Fast checking (512us for 64KB) for test on initialize routine Type2: Part of Flash check for test during operation Write Protection SFR write protection for Port setting, Interrupt setting, Clock setting, LVI setting, RAM Parity setting CPU (PC / Interrupt) ADC Illegal memory access detection/ Trap Instruction Illegal memory access: generate “internal reset” Trap instruction: “FF” instruction generate “internal reset” Let's start with the Flash; Renesas has implemented two different hardware CRC's (Cyclic Redundancy Checks) as a safety feature on the Flash. One is the “fast checking” or fast CRC, which is able to do a fast check during the initialization phase of the application. And the second, a software controlled CRC engine, which allows you to calculate a checksum for parts of the flash or even blocks of data to be transmitted. The entire RAM memory is secured with additional parity bits, with each 8bit RAM data location having an additional parity bit - to check if errors occur at the RAM address. Additionally write protection is implemented in the RAM area, so that special areas of the RAM can be protected against accidental re-writing. Write protection exists for some of the special function registers, especially system registers like clock setting, LVI setting, port settings or interrupt settings can be protected using an additional guard register. The ADC is able to do an internal test on the sample and hold circuit by switching reference and input voltages. The clock supports a stop detection function, using the watchdog timer window and an internal frequency check using a special timer feature. The CPU also includes safety features, such as physical memory access detection to generate an internal reset signal if incorrect memory areas are accessed by an instruction, for example if the program counter points outside the valid flash area or if a write access is done to the flash area. A Trap instruction is included that generates an internal reset if non-decodable code is fetched. All these implemented functions provide reassurance for complete system safety, and enable easier implementation of IEC60730 safety standards and class B software requirements. VDE approval is already provided where these features are used and libraries are available to support them. Multiple Input signal selectable ADC measurement sources: ANIx (external signal) AVref+ (external / internal) AVref- (external / internal) Internal Vref (1.4V typ) Temperature sensor Clock Stop Detection / Frequency check Stop detection by WWDT Frequency check by special Timer function © 2011 Renesas Electronics Corporation. All rights reserved.

VDE certification VDE certification already done
No need to re-certify* safety s/w block (Savings ~ €10K) Reduce development time (Savings ~ 3 Man Months) Following modules are available CPU register test Variable memory test Invariable memory test System clock test VDE certification of this library functionality is already completed, so there is no need for you to re-certify the safety software blocks thus reducing the development time for products when using these library modules. The following certified modules are available: CPU register test, Variable memory test, invariable memory test and system clock test. © 2011 Renesas Electronics Corporation. All rights reserved.

Safety features on Flash
(Invariable Memory) Now we’ll examine each of these features a bit more closely. We’ll start again with the Flash, or “invariable memory”. © 2011 Renesas Electronics Corporation. All rights reserved.

CRC functionality High speed CRC
Able to calculate the CRC over the whole code flash area Intend to use directly after reset. CPU is stopped during calculation (512us for 64 K) CRC0CTL control register Sets range (blocks of 16k) Start operation PGCRCL result register Store the result after completion Start Setup high speed CRC 512us for 64K Execute HALT The first is the high speed CRC, which is able to calculate a 16bit CRC checksum on the whole flash area. This is intended to be used directly after reset during the initialization phase of the software since software execution is stopped during the calculation; the full calculation of 64K of memory takes about 512 micro seconds. This functionality can be controlled by the CRC0CTL register, which sets the range in blocks of 16K and is also used to start the function’s operation. The PGCRCL result register stores the 16bit result after the calculation is completed. So in your software you have to enable the high speed CRC, execute the halt instruction and after waking up from the halt instruction, the high speed CRC engine generates an interrupt to continue and the result of the CRC calculations can be processed. Process result Stop © 2011 Renesas Electronics Corporation. All rights reserved.

CRC functionality General purpose CRC
Able to calculate the CRC for single bytes Partly cyclic check of code flash CRC check for other data (e.g. transmit data) Conform to CCITT algorithm (x16 + x12 + x5 + 1) Result within one clock cycle CRCIN 8-bit input register CRCD 16-bit result register The second hardware CRC is the general purpose CRC functionality. This is also a hardware CRC, but is able to calculate CRCs for single bytes. By doing this a cyclic check of parts of the code flash can be done, for example 100bytes or 1K of code in one go. This general purpose CRC can additionally be used to secure other data, for example transmitted communications data, since it uses a polynomial conforming to CCITT regulations. The result is available within one clock cycle which is much faster than using a CRC algorithm implemented entirely in software. Two registers control the CRC; the CRCIN 8bit input register and the CRCD 16bit result register. The CRC work flow is quite simple; you just put the input data into the CRCIN register and read out the result in the CRCD register. Since the calculation time of the general purpose CRC is only one clock cycle for one input byte, you can continuously input the next data value in a loop. After the whole block is calculated, the result is read from the CRCD register. © 2011 Renesas Electronics Corporation. All rights reserved.

ECC functionality A 6-bit ECC is implemented in the code flash area
32 1 During the Flash Write the data are encrypted in the ECC Encryption Logic and the resulting bits are stored in the ECC part of the flash Flash Write ECC Encryption Logic ECC bits Data bits 32 1 6 1 Flash Read ECC Decryption Logic The last flash security feature we want to explain is ECC or Error Correction Code, which is implemented over the whole RL78 flash memory but is completely hidden from the user. ECC adds a supplementary 6 bits of ECC calculated for each 32bit flash word. A single bit failure can be corrected inside the flash memory from these additional 6 bits. This functionality is implemented in all RL78 devices and always switched on, so there are no extra steps required to use this functionality. During Flash Read these bits are used by the ECC Decryption Logic to correct single bit failures on the fly 32 1 Original data Flash cells with maximum 1 bit failure over lifetime © 2011 Renesas Electronics Corporation. All rights reserved.

Safety features on RAM RAM (Variable Memory)
Now for some details on the safety features found on the RL78’s RAM. © 2011 Renesas Electronics Corporation. All rights reserved.

RAM write protection A write protection shield can be used to protect a part of the RAM Size could be controlled with GRAM1,2 bits 0 bytes 128byte 256 byte 512 byte Can be used for Function pointers Code in RAM 0xFFEFF User RAM 0xFxxxx The first feature is the RAM memory write protection, a special shield can be set for the RAM to protect a part of it against re-writing. This is controlled by the GRAM1 and GRAM0 (in the IAWCTL register) which protect 0, 128bytes, 256 bytes and up to 512bytes. This can be used to protect function pointers from overwriting during normal operation or to prevent code executing from RAM. 0-512 bytes 0xFxxxx RAM start address © 2011 Renesas Electronics Corporation. All rights reserved.

RAM parity check Adds 1 parity bit to each 8 bit data
Able to generate a reset or just a flag in case of parity error 8 1 RAM Write During RAM Write the parity is calculated and stored as an additional bit Data bits Parity Bit 8 1 1 RAM Read During RAM read the parity is checked and in case of an error a reset will be generated Parity check logic The second feature is the RAM parity check; the entire RAM memory has an additional parity bit for each 8bit data word. In the case of a parity error the parity check function can generate a reset or set a flag. Each time RAM is written, the parity value will be calculated and stored in addition to the 8 data bits. For a read the parity is compared with the data read and, if everything is OK nothing else will happen. However if a parity error occurs an internal flag is set or (if enabled) a reset signal is generated. Reset 8 1 © 2011 Renesas Electronics Corporation. All rights reserved.

Safety features on SFR SFR (Variable Memory)
Now we’ll look at the Safety features applicable to the RL78’s Special Function Registers. © 2011 Renesas Electronics Corporation. All rights reserved.

SFR write protection A SFR write protection can be used to secure sensitive hardware configurations Following three guard bits are available GPORT (Port control registers) Guard PMxx, PUxx, PIMxx, POMxx, PMCxx, ADPC and PIOR registers GINT (Interrupt control registers) Guard IFxx, MKxx, PRxx, EGPx and EGNx registers GCSC (chip state control registers) Guard CMC, CSC, OSTS, CKC, PERx, OSMC, LVIM, LVIS and RPECTL registers After reset all guards are inactive Start open SFR access change SFR close SFR access SFR write protection can be used to secure sensitive hardware configurations. For example in case of port direction registers, it is important that the direction of the port cannot be switched from input to output by accident to avoid any hardware damage in the system. This can be achieved by using the Special Function Register write protection functionality. Using additional guard registers the port mode register, pull-up registers, port input mode, port output mode, port mode control, and ADPC or AD converter control registers can be guarded. Additionally all interrupt control registers can be secured using this guard bit which is called GINT. There is also the GCSC “Chip State Control Register”; which allows setting a guard over the clock control functionality and the low voltage detector setting. All the guards are inactive immediately after Reset, so you can directly write to these registers. If you need to access the SFR later, access has to be opened up using the guard register, then the SFR can be modified and finally access is closed again using the guard register. Stop © 2011 Renesas Electronics Corporation. All rights reserved.

Safety features on ADC ADC
Now we’ll look at the safety features on the ADC, particularly checking the sample-and-hold circuit. © 2011 Renesas Electronics Corporation. All rights reserved.

AD converter Diagnostics
Test of the sample and hold circuit by switching the internal references against Vdd and GND. Controlled by the ADTES register It is possible to test the sample-and-hold circuit, thanks to the AD converter diagnostics feature, by switching the internal references between VDD and ground. This is controlled using an additional AD test register which allows input selection of the reference voltage - the internal reference or ground level - directly to the sample-and-hold circuit. Thus it is possible to see if the sample-and-hold is stuck at VDD or the maximum reference voltage or ground level, or somewhere in between. © 2011 Renesas Electronics Corporation. All rights reserved.

Safety features on Clock
Now onto safety features found on the clock circuit. © 2011 Renesas Electronics Corporation. All rights reserved.

Window Watchdog Timer Function
Detection of an inadvertent program loop (runaway) RESET generation Watchdog functionality is set by option byte Watchdog timer interval interrupt Enable/Disable Window Watchdog Timer operation Select overflow time Select window size Window Watchdog timer operation in HALT/STOP mode Watchdog Timer Enable Register (WDTE) Writing ACH to WDTE clears the watchdog timer and starts counting again First is the Window Watchdog Timer; which is mainly used to detect an inadvertent loop or software runaway. In these cases the watchdog timer does not get reset by the software and so a reset will be generated by the watchdog timer to return the application to a defined state. The watchdog timer functionality is set by an option byte, which for security reasons cannot be changed by the application. Inside the option byte the overflow time, window size and watchdog enable can be selected. The only software register available for the watchdog time is the WDTE watchdog timer re-trigger register. Writing the “magic word” AC’H to this register resets the watchdog timer to start counting again. © 2011 Renesas Electronics Corporation. All rights reserved.

Window Watchdog Timer Block Diagram
Here is a block diagram of the Window Watchdog Timer. On the left side is the clock input controller followed by the 17bit counter. The input clock signal always comes from the internal low speed oscillator “FIL” KHz. Setting up the watchdog timer is done using the option byte; the two registers available to the application software are the Window Check Register and the Watchdog Timer Re-Trigger Register. If an overflow occurs, the window is not open, or an invalid write attempt is made to the watchdog timer re-trigger register. Then the internal reset signal is immediately generated. Additional functionality provides the option of generating an interval timer interrupt if 75% of the overflow time of the watchdog timer has elapsed, which could be used to get a pre-warning in Stop Mode to wake up the device to re-trigger the watchdog timer. © 2011 Renesas Electronics Corporation. All rights reserved.

Writing of magic word into WDTE reset register
Window Watchdog Timer 100% 75% 50% closed Writing of magic word into WDTE reset register Total Window Size RESET! Over- flow *: example shown for 50% window opening (0%) open * Here is a timing diagram of the window watchdog timer operation. The green area marked in the middle is the watchdog timer’s open window, in this example it is opened half of the time i.e. 50%. If the watchdog timer is re-triggered within this window area, nothing unusual happens. However an internal reset signal will be generated if the overflow is reached or if the re-triggering is done too early - when the window is not yet open or if a value other than the “magic word” is written . The watchdog timer triggers a hard reset, if the watchdog timer counter overflows if, the magic word is written into WDTE register when window is closed if a wrong value is written into WDTE if the WDTE register is accessed by a 1-bit manipulation instruction © 2011 Renesas Electronics Corporation. All rights reserved.

Frequency check function
Internal main system clock can be checked based on an ext. or internal reference signal Reference signals 32kHz fSUB signal 15kHz int. low speed osc. TI05 timer input The reference signal will be captured based on the main system clock Now we’ll look at the RL78’s frequency check functionality. With this it is possible to check the speed of the internal main system clock based on an internal or external reference signal. Implementation requires some software to be written but the hardware support makes this easy. The 32 KHz sub-system clock signal, a 15 KHz signal from the internal low speed oscillator or an external signal from the timer input can be used as the reference signal. The principle is that the reference signal is captured based on the main system clock, thus the number of main system clocks is counted over a specific gate time defined from the internal low speed oscillator FIL. If this number is outside a valid range then you know the main system clock is either too fast or too slow. fil n x fmck © 2011 Renesas Electronics Corporation. All rights reserved.

Safety functions for CPU
(PC / Interrupt) Now on to the safety functions related to the CPU. Specifically, the trap instruction and the Invalid Memory Access functionality. © 2011 Renesas Electronics Corporation. All rights reserved.

Trap function TRAP function Supervise the executed instruction code
Generate Reset if invalid instruction (0xFF) is fetched as 1st opcode “FF” is erased state of flash memory. If program-counter jumps to erased area, CPU execute trap instruction at soon. opcode 1st 2nd 3rd 4th 5th Trap (RESET) FF xx First the trap function which supervises instruction code execution and generates a reset if an invalid instruction is fetched as the first op-code. The only combination where there is no following instruction is 0xFF, which is also the state of erased flash memory, so that if the PC points to an area where no code is located or has been erased, the Trap instruction will directly generate an internal reset. © 2011 Renesas Electronics Corporation. All rights reserved.

Invalid Memory access Invalid memory access (IAWEN register)
Supervise the valid address range Generate Reset in case fetch, read or write is outside the valid area. Covers complete addressable range Fetch Read Write Code Flash Normal Illegal access Data Flash RAM General Register SFR 2nd SFR Mirror Area Other Area Now to the invalid memory access. This is controlled by the IAWEN bit in the IAWCTL Invalid memory access detection control register and is used to supervise valid address ranges of the RL78 products. A reset is generated if a fetch, read or write is done outside the valid area. This functionality covers the complete address range - not only code flash but also RAM memory and special function registers - from 0 to 0xFFFFF. The table shows which conditions will generate an illegal access and therefor the reset signal. For example, in the code flash area only fetches and reads are possible, So if the software tries to write to the code flash area an illegal access will be triggered and a reset generated. Likewise the special function registers cannot be fetched, since only read and write is allowed. Even other areas such as a reserved area (where there is no memory) neither fetch, read nor write is possible and therefore an illegal access, combined with a reset, is directly triggered. © 2011 Renesas Electronics Corporation. All rights reserved.

Reset The RESF register allows to detect the Reset-source
Block Diagram The RESF register allows the application to detect the source of a Reset. So after a reset occurs we can check what the source was for this reset signal. Several signals will set these flags and other reset signals will release these flags. One which sets a flag is the watchdog timer reset signal; if a watchdog timer reset occurs the WDTRF flag is set and a reset generated. Next is the reset due to an illegal instruction execution or Trap; which sets the trap flag and generates an internal reset. Then there is a reset generated by the RAM parity error - this sets the RPERF flag; and the IAWRF flag is set by an illegal memory access. Finally if a reset is generated for the low voltage detector a special “LVIRF” flag is set before the reset signal is generated. However in this case the reset is generated for the whole system instead of just the low voltage detector. Some signals clear these registers; the easiest way to clear the RESF register is to read from it, which is typically done after reset release to check the reason for the last reset. Additionally a hardware reset from the external reset pin will clear all the flags inside the RESF register. Finally, there is also a power-on-clear if the supply voltage was below 1.5volt all the flags in the RESF register will be cleared. Using this functionality you can check if just the watchdog caused the last reset, In which case it's not necessary to re- initialize the whole memory because the supply voltage was still in the permitted range and the values in the RAM are still valid. © 2011 Renesas Electronics Corporation. All rights reserved.

Option Byte Option byte is used to set different system settings
Option byte area is located from 000C0H to 000C3H (010C0H to 010C3H in boot cluster 1, only necessary if boot swap is used ) 000C0H/010C0H: Enable/Disable watchdog timer operation Enable/Disable watchdog timer operation in HALT/STOP mode Interval time setting Select window time Use of watchdog timer interval interrupt 000C1H/010C1H: LVI voltage setting Enable LVI operation for power-up 000C2H/010C2H: Flash operation mode Oscillator speed selection 000C3H: Enable/Disable on-chip debug function Flash memory handling in case of failure in on-chip debug security ID authentication 0xyyyyy 0x02000 Boot cluster1 The option byte is used to set different system settings and is located in the code flash memory area of the device. Option bytes are located in both boot blocks; in boot cluster zero this is address 0xC0 to 0xC3 and in boot cluster one it is 0x10C0 to 0x10C3. The option bytes in boot cluster one are only required if the boot swap function is used, otherwise the option bytes in boot cluster zero are sufficient. The different option bytes map to different functionalities; for example 0xC0 is mainly used to control the watchdog timer, the option byte at address 0xC1 enables the low voltage detector settings, 0xC2 selects the flash operation mode and the oscillator speed, and 0xC3 controls the on-chip debug functionality. We'll go into more details on the setting of the individual option bytes in the following slides. Option byte 0x010C0 0x01000 Boot cluster 0 Option byte 0x000C0 0x00000 © 2011 Renesas Electronics Corporation. All rights reserved.

Option Byte User option area 000C0H/010C0H
WDT interval interrupt setting WDT window open period setting WDT operation setting On this slide is an explanation of the option byte located at address 0xC0 (or 0x10C0 depending on the boot cluster) which is mainly used to control the Watchdog Timer. The first bit, bit 7 “WDTINIT” selects whether the interval timer should be used in combination with the watchdog timer or not. If this bit is set to one, an additional interval interrupt is generated when 75% of the overflow time is reached. The second two bits, bits 5 and 6 are used to set up the window period of the timer: 50, 75 or 100% - where 100% open means that no window functionality is implemented. The next bit “4” called WDTON enables the watchdog timer operation, and the following three bits “WDCS0-3” selects the watchdog timer overflow time based on the internal 15 KHz oscillator. Here you have to be careful because although the typical frequency will be 15 KHz, calculation of the software’s re-trigger loops time should be made taking into account the maximum frequency of KHz (due to the tolerance range). Based on this maximum frequency, watchdog times from 3.71 ms up to about 4 seconds can be implemented. Finally we have the WDSTBYON flag which controls the watchdog timer operation in Stop or Halt modes. If it is set to zero the counter operation is stopped in Stop or Halt mode and if it is set to one the watchdog timer still runs even in stop or halt mode. WDT overflow time setting WDT operation setting in HALT/STOP mode © 2011 Renesas Electronics Corporation. All rights reserved.

Detection voltage of the falling edge
Option Byte - User option area 000C1H/010C1H LVD voltage setting LVD mode setting LVD voltage setting Detection voltage of the falling edge VPOC2 VPOC1 VPOC0 LVIS1 LVIS0 1.63V 1 … x 4.06V 1.53V (LVD is OFF) Next the option byte at address 0xC1 (or 0x10C1) is used to set the Low Voltage Detector settings and is split into two groups. One group selects the LVD threshold voltage defined by the VPOC and the LVIS bits covering a voltage range from 1.63 to 4.06V. If VPOC2 is set the LVD is completely switched off and only the power-on-clear circuit is active, enabling the micro at a supply voltage of 1.53volts. The second group are the LVIMDS mode bits, which select the different low voltage detector interrupt and reset modes . LVD mode setting mode LVIMDS1 LVIMDS0 interrupt mode 1 interrupt & reset mode reset mode © 2011 Renesas Electronics Corporation. All rights reserved.

Option Byte - User option area 000C2H/010C2H Flash operation setting
Frequency setting The option byte at address 0xC2 (or 0x10C2) sets the flash operation mode and the frequency of the internal oscillator. Writing 0x00 to these bits selects the low voltage main mode, 0x10 selects low speed main mode and 0x11 high speed main mode with operation up to 32 MHz. The frequency select bits set the speed of the internal oscillator, in a range from 1MHz to a maximum of 32 MHz - for more details please refer to the RL78 clock generator course. © 2011 Renesas Electronics Corporation. All rights reserved.

Option Byte User option byte area 000C3H/010C3H
On-chip debug operation setting Erasure operation setting With the last option byte we can control the on-chip debug setting in the RL78. There are two bits; the first is the OCDENSET bit, when set on-chip debugging is possible and if cleared to zero on-chip debugging is switched off by default. When it is enabled you can choose if the entire memory should be erased or not if an incorrect ID code is used, with the OCDERSD bit. © 2011 Renesas Electronics Corporation. All rights reserved.

RL78 Safety Features © 2011 Renesas Electronics Corporation. All rights reserved.

Similar presentations

Presentation on theme: "RL78 Safety Features © 2011 Renesas Electronics Corporation. All rights reserved."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

RL78 Safety Features © 2011 Renesas Electronics Corporation. All rights reserved.

Similar presentations

Presentation on theme: "RL78 Safety Features © 2011 Renesas Electronics Corporation. All rights reserved."— Presentation transcript:

Similar presentations

About project

Feedback