Introduction
TMS470 32-bit RISC ARM7TDMI®-based microcontrollers provide a scalable architecture and rich peripheral set solutions for applications requiring the highest levels of performance and quality.
Programming the internal FLASH of TMS470 devices is somehow complicated by the Memory Security Module (MSM) and the FLASH module itself. That is why here I will show you some tips on how to program TMS470 devices avoiding some problems that may lead to locking the device permanently.
Programming TMS470
Here is a summary of the TMS470 devices and the presence of the MSM:
| Device | MSM |
| TMS470R1A064 | No |
| TMS470R1A128 | No |
| TMS470R1A256 | No |
| TMS470R1A288 | Yes |
| TMS470R1A384 | No |
| TMS470R1B512 | No |
| TMS470R1B768 | No |
| TMS470R1B1M | Yes |
TMS470 devices use four WORD long keys to protect FLASH from unwanted erase/write operations. You have to put these keys in the TMS470 FLASH section of the PEEDI’s target configuration (CFG) file using the PROTECTION_KEY0-PROTECTION_KEY3 parameters.
In TMS470 devices that have Memory Security Module (MSM), if the currently programmed MSM keys are different from 0xFFFFFFFF, you have to put this unlock sequence in the TMS470 INIT section of the CFG file:
[INIT_TMS470B1M]
; dummy read the four MSM keys
memory read 0x0000FFE0
memory read 0x0000FFE4
memory read 0x0000FFE8
memory read 0x0000FFEC
; unlock the device using the correct MSM keys
memory write 0xFFFFF700 0xAAAAAAAA
memory write 0xFFFFF704 0xBBBBBBBB
memory write 0xFFFFF708 0xCCCCCCCC
memory write 0xFFFFF70C 0xDDDDDDDD
Where 0xAAAAAAAA, 0xBBBBBBBB, 0xCCCCCCCC and 0xDDDDDDDD are the right MSM keys. Please see the datasheet of your TMS470 CPU to check the right addresses of the keys in FLASH memory and the addresses of the register where the keys have to be entered.
The FLASH and MSM keys are stored in the last 32 bytes of the first FLASH sector of the first bank, so be careful not to write them accidentally and keep in mind that erasing this sector sets all keys to 0xFFFFFFFF. The keys are reported every time the FLASH is programmed.
Every time PEEDI first tries to unlock FLASH using the default keys (0xFFFFFFFF), if fails it uses the keys pointed out in the target configuration file. This way you can erase and program the FLASH without the need of changing the key for each operation.
The ALLOW_ZERO_KEY TMS470 FLASH section parameter is used to protect the device from unwanted permanent locking – this may happen if MSM keys all of 0x000000000 are programmed into the FLASH. If this parameter is set to NO – the programming of MSM with value of 0x000000000 is prohibited and if detected, the programming is immediately interrupted with an error message.
If after programming the MSM and FLASH keys were modified and you did not notice them after reported by PEEDI, you can recover them by opening the file which was programmed using any HEX editor. Keep in mind that TMS devices use big-endian addressing.