TMS470 32-bit RISC ARM7TDMI®-based microcontrollers provide a scalable architecture
and rich peripheral set solutions for applications requiring the highest levels of
performance and quality.
Programming the internal FLASH of TMS470 devices is somehow complicated by the
Memory Security Module (MSM) and the FLASH module itself. That is why here I will
show you some tips on how to program TMS470 devices avoiding some problems that
may lead to locking the device permanently.
Here is a summary of the TMS470 devices and the presence of the MSM:
TMS470 devices use four WORD long keys to protect FLASH from unwanted erase/write operations.
You have to put these keys in the TMS470 FLASH section of the PEEDI's target configuration
(CFG) file using the PROTECTION_KEY0-PROTECTION_KEY3 parameters.
In TMS470 devices that have Memory Security Module (MSM), if the currently programmed MSM
keys are different from 0xFFFFFFFF, you have to put this unlock sequence in the TMS470
INIT section of the CFG file:
Where 0xAAAAAAAA, 0xBBBBBBBB, 0xCCCCCCCC and 0xDDDDDDDD are the right MSM keys.
Please see the datasheet of your TMS470 CPU to check the right addresses of the
keys in FLASH memory and the addresses of the register where the keys have to be
; dummy read the four MSM keys
memory read 0x0000FFE0
memory read 0x0000FFE4
memory read 0x0000FFE8
memory read 0x0000FFEC
; unlock the device using the correct MSM keys
memory write 0xFFFFF700 0xAAAAAAAA
memory write 0xFFFFF704 0xBBBBBBBB
memory write 0xFFFFF708 0xCCCCCCCC
memory write 0xFFFFF70C 0xDDDDDDDD
The FLASH and MSM keys are stored in the last 32 bytes of the first FLASH sector
of the first bank, so be careful not to write them accidentally and keep in mind
that erasing this sector sets all keys to 0xFFFFFFFF. The keys are reported every
time the FLASH is programmed.
Every time PEEDI first tries to unlock FLASH using the default keys (0xFFFFFFFF),
if fails it uses the keys pointed out in the target configuration file. This way
you can erase and program the FLASH without the need of changing the key for each operation.
The ALLOW_ZERO_KEY TMS470 FLASH section parameter is used to protect the device from unwanted
permanent locking - this may happen if MSM keys all of 0x000000000 are programmed into
the FLASH. If this parameter is set to NO - the programming of MSM with value of
0x000000000 is prohibited and if detected, the programming is immediately interrupted
with an error message.
If after programming the MSM and FLASH keys were modified and you did not notice
them after reported by PEEDI, you can recover them by opening the file which was
programmed using any HEX editor. Keep in mind that TMS devices use big-endian addressing.