 Hello and welcome to this presentation of the embedded flash memory which is included in all products of the STM32U5 microcontroller series. This table summarizes the features of the flash memory existing in STM32U5. Depending on the product, the flash size can be up to 4 megabytes. It also embeds a one-time programming area of 512 bytes. The flash read data bus width is 128 bit. STM32U5 always supports a dual bank architecture. The swap bank option in the user option bytes is used to swap bank 1 and bank 2 addresses. Note that read while write capability, or RWW, is therefore always supported by the STM32U5. The page size which provides the minimum erase granularity is 8 kilobytes. STM32U5 has an increased endurance of up to 100 kilocycles on 256 kilobytes per bank. It also supports a read-prefetch unit that increases the efficiency of Cortex M33C AHB bus. Finally, STM32U5 implements a flexible life cycle scheme with readout protection, RDP, including support for product decommissioning even from level 2 using passwords. Each program erase operation can degrade the flash memory cell. After an accumulation of program erase cycles, memory cells can become non-functional causing memory errors. Injurance is the maximum number of erase programming sequences that the flash memory can support without affecting its reliability. 256 kilobytes, 32 pages, per bank feature an increased endurance of 100 kilocycles that can be used for data storage that usually needs more intensive cycling capability than code storage. Any flash page can be chosen to be cycled more than 10,000 times up to 100,000 times. It is the application's responsibility to limit the size of the flash area cycled more than 10,000 times to 256 kilobytes per bank. Data in flash memory are 137 bits wide, 9 bits are added per each quad-word of 128 bits. The ECC mechanism supports one error detection and correction, two error detection when one error is detected and corrected. The ECC flag, ECC correction, is set in the flash ECC register. An interrupt can be generated when two errors are detected. The ECCD flag, ECC detection, is set in the flash ECC register. In this case, an NMI is generated. The address and bank number at which the error has been detected are captured in status registers for further investigation. To correctly read data from the flash memory, the number of white states, latency, must be correctly programmed according to the frequency of the CPU clock, HCLK, and the internal voltage range of the device, V-core. The table below shows the correspondence between white states and CPU clock frequency. LPM, the flash memory supports a low-power read mode when setting the LPM bit in the flash access control register, flash ACR. The Cortex M33 fetches instructions and literal pool constants over the CBUS and through the instruction cache if it is enabled. The pre-fetch block increases the efficiency of CBUS accesses when the instruction cache is enabled by reducing the cache refill latency. Pre-fetch is efficient in the case of sequential code. Pre-fetch in the flash memory allows the next sequential instruction line to be read from the flash memory while the current instruction line is being filled in instruction cache and executed by the CPU. Pre-fetch is enabled by setting the PRFTN bit in the flash access control register, flash ACR. PRFTN must be set only if at least one weight state is needed to access the flash memory. Note that pre-fetch tends to increase the code execution performance at the cost of extra flash memory accesses. It may impact power consumption when activated, but power efficiency is better thanks to the increased performance. Here are some performance metrics expressed in CoreMark per megahertz. Performance when iCache is off and pre-fetch is off is 2.2. Performance when iCache is off and pre-fetch is on is 2.7. This illustrates the performance increase thanks to pre-fetch in the case of a cache miss. As CoreMark code is entirely in iCache, no cache miss after the first iteration, pre-fetch has no impact on the CoreMark score when iCache is enabled. The flash memory consumption can be reduced when the code is not executed from flash. After reset, both banks are in normal mode. In order to reduce power consumption, each bank can be independently put in power down mode by setting the PDR EQX bit. Any access to a bank in power down mode automatically wakes up the bank. It takes at least 5 microseconds to wake up the bank. A power down bank saves 45 microamperes. Power down flash in sleep mode saves 90 microamperes. Activating the low power read mode by setting the LPM bit in the flash access control register flash ACR saves 50 microamperes at the expense of an increased latency. Read, program and erase operations are supported in all voltage ranges. When trust zone is enabled, the non-secure software is only permitted to access the non-secure part of the flash. Erase can be performed with a page granularity for one bank or both banks. In the latter case, this is called a mass erase. The flash controller implements two programming modes. Single quadward, called normal mode. Eight quadwards representing 128 bytes, called burst mode. In both cases, the ECC code is calculated and added to the data so that 137 bits are actually programmed. Programming 1 megabyte at 160 megahertz takes 7.7 seconds in normal mode, 3.1 seconds in burst mode. The contents of the flash memory currently being accessed are not guaranteed if a reset occurs during a flash memory program or erase operation. The status of the flash memory can be recovered from the flash operation status register when a system reset occurs during a flash memory program or erase operation. It is the software's responsibility to check the flash memory status and to take corrective actions. This slide provides some metrics regarding flash program and erase operations. The time to program a quadward plus ECC code is 48 microseconds when burst mode is used. The time to fully erase the two banks is 390 milliseconds. The time to erase one page assuming 10 kilo endurance cycles is 1.5 millisecond. An internal algorithm manages the erase sequence and the erase time increases when the number of endurance cycles increases. An additional 0.2 millisecond is typically required when erasing a page with 100 kilo cycles. The internal 16 MHz oscillator, HSI 16, is automatically enabled when an erase or programming sequence starts and automatically disabled when this sequence completes except if the HSI 16 was previously enabled. When trust zone security is active, a part of the flash memory can be protected against non-secure read and write accesses. Deactivation of trust zone is only possible when the readout protection or RDP is changed from level 1 to level 0. Up to two different non-volatile secure areas can be defined by option bytes and can be read or written only by a secure access. When area per bank with a page granularity, each of them supports a secure hide protection area starting at the same start page offset and ending at a programmable end page offset. The contents of the secure hide protection area is marked as non-accessible after the corresponding HDP-ACC-DIS bit is set to 1. This is used to prevent subsequent access to a part of the flash and is used to isolate the secure boot code and data from both secure and non-secure application codes. Any flash page can be set as secure non-secure thanks to dedicated secure registers in the flash interface. Flash SECBB1RX with X equals 1 to 8 and flash SECBB2RX with X equals 1 to 8. At reset, these registers are cleared, non-secure. A page which already belongs to a secure watermark area will be secure whatever its block-based bit configuration. In each security domain, the privileged level of each flash page is programmable, either unprivileged or privileged, by means of flash PRIBB1RX with X equals 1 to 8 and flash PRIBB2RX with X equals 1 to 8 registers. Four quadrants of isolated worlds are thus obtained. Secure privilege, secure non-privilege, non-secure privilege, non-secure non-privilege. Regarding the RDP state machine, STM32U5 implements a new feature, OEM1, OEM2 lock activation. Two 64-bit keys, OEM1 key and OEM2 key can be defined in order to lock the RDP regression from level 1 or to allow the regression from level 2. Each 64-bit key is coded on two registers. OEM1 key and OEM2 key cannot be read through these registers. In order to regress from RDP level 1 to RDP level 0, the debugger has to provide the correct OEM1 key value. In order to regress from RDP level 1 to RDP level 0.5, the debugger has to provide the correct OEM2 key value. In order to regress from RDP level 2 to RDP level 1, the debugger has to provide the correct OEM2 key value. When these keys are not provisioned, the STM32U5 only implements the legacy transitions. When the RDP is set to level 2 and the OEM2 key is not provisioned, JTAG and SWD are definitely disabled. If the OEM2 key is provisioned, the JTAG and SWD remain enabled under reset only to obtain device identification and provide the OEM2 key to request RDP regression. Refer to the security training for more information about the device lifecycle. For write protection areas are supported, two per bank. Program and erase operations are prohibited in write protection areas. Consequently, a software mass erase cannot be performed if one area is write protected. Each area is defined by a start page offset and an end page offset related to the physical flash bank base address. Each write protection area can be independently locked. In this case, it is not possible to modify the area settings and the unlock can be done only thanks to RDP regression to level 0. The write protection attribute is orthogonal to the secure and HDP settings. Thank you for following this online training.