AN4465

Application note
Serial Programming: BAM vs. BAF differences

Introduction
This document describes the differences between the Boot Assist Module (BAM) presents
on SPC56 family and the Boot Assist Flash (BAF) presents on SPC57 family.
The purpose of this document is to highlight the differences between the two modules (BAM
and BAF).

April 2014 DocID026150 Rev 1 1/10

www.st.com
Contents AN4465

Contents

1 Boot Assist Module (BAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.1 Boot modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 BAM overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 Censorship . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.4 BAM Download protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2 Boot Assist Flash (BAF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2.1 Boot modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.2 BAF Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.3 BAF Download Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

3 Differences between BAM and BAF . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3.1 Activation mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2 Serial boot protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.3 Code mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.4 Password managing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.5 Baud rate detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.6 RAM reservation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.7 Serial interface baud rate calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2/10 DocID026150 Rev 1

AN4465 Boot Assist Module (BAM)

1 Boot Assist Module (BAM)

1.1 Boot modes

The SPC56 family supports the following boot modes:
• Boot from internal flash. The device boots from the first bootable section of the Flash
main array.
• Serial Boot. The device downloads boot code from either SCI or CAN interface and
then execute it.
If booting is not possible with the selected configuration (e.g. if no valid Boot ID is found in
any of the possible boot locations) then the device enters the static mode. The device enters
power safe mode and waits for an external reset.

1.2 BAM overview

The Boot Assist Module is a block of read-only memory containing VLE code which is
executed according to the boot mode of the device. The BAM downloads code into internal
SRAM through the following serial protocols and executes it afterwards:
• CAN (with and without auto baud depending the target)
• UART (with and without auto baud depending the target)
The BAM provides the following features:
• Programmable 64-bit password protection for serial boot mode
• Serial boot loads the application boot code from a CAN or UART bus into internal
SRAM
• Censorship protection for internal flash module
The BAM code resides in 8 kilobytes of ROM mapped from address 0xFFFF_C000.
The RAM location where to download the code can be any 4 byte-aligned location in the
SRAM starting from the address 0x4000_0100.
The SPC56 detects the boot mode based on external pins and device status. The following
sequence applies:
1. to boot either from CAN or UART, the device must be forced into an Alternate Boot
Loader Mode via the FAB (Force Alternate Boot Mode) pin which must be asserted
before initiating the reset sequence. The type of alternate boot mode is selected
according to the ABS (Alternate Boot Selector) pins.
2. if FAB is not asserted, the device boots from the first flash-memory sector which
contains a valid boot signature.
3. if no flash memory sector contains a valid boot signature, the device goes into static
mode

1.3 Censorship
The internal Flash memory can be enabled or disabled it depends on the values stored in
the censorship word and serial boot control word in the shadow row of the internal Flash
memory, the Nexus port can be enabled or disabled, the password received in the serial

DocID026150 Rev 1 3/10

9
Boot Assist Module (BAM) AN4465

boot mode is compared with the fixed public password or compared to a user programmable
password in the internal Flash memory.
The censorship word is a 32-bit word of data stored in the shadow row of internal Flash
memory. This memory location is read and interpreted by hardware as part of the boot
process and is used in conjunction with the BAM configuration pin to enable/disable the
internal Flash memory and the Nexus interface. The address of the Censorship word is
0x00FF_FDE0. The censorship word consists of two fields: censorship control and serial
boot control. The censorship word is programmed during manufacturing to be
0x55AA_55AA. This results in a device that is not censored and uses a Flash-based
password for serial boot mode.
The BAM program uses the state of the SIU_CCR DISNEX bit to determine whether the
serial password received in serial boot mode, should be compared to a public password
(fixed value of the 0xFEED_FACE_CAFE_BEEF) or needs to be compared to a Flash
password - 64-bit data, stored in the shadow row of internal Flash at address
0x00FF_FDD8. If the bit is set, the BAM uses the Flash serial password, if the bit is cleared,
it uses the public password.
• A valid serial password must be always programmed, regardless the boot mode used.
This provides capability to “rescue” the part using the serial boot mode, if the Flash
content becomes corrupted for whatever reason.

1.4 BAM Download protocol

From high level perspective, the download protocol follows steps:
1. Send message and receive acknowledge message for auto baud or auto bit rate
selection (optional step depending the target and the ABS pins configuration).
2. Send 64 bits password.
3. Send start address, size of downloaded code in bytes and VLE bit.
4. Download data.
5. Execute code from start address.
Each step must be complete before the next step starts. These steps are correct if auto
baud is disabled. Otherwise, to measure the baud rate some data from host to MCU are
sent before the step 1.
The communication is done in half duplex manner and any transmission from host is
followed by the MCU transmission:
• Host sends data to MCU and starts waiting
• MCU echoes to host the data received
• Host verifies if echoes are correct:
– If data is correct, the host can continue to send data;
– If data is not correct, the host stops to transmit and MCU need to be reset.
All multi-byte data structures are sent with MSB first.

4/10 DocID026150 Rev 1

AN4465 Boot Assist Flash (BAF)

2 Boot Assist Flash (BAF)

2.1 Boot modes

Depending on the state and the content of its flash memory the device can enter one of
three different boot modes:
• Boot from internal flash. If the internal flash contains application code with a valid boot
header, the application is booted. The boot header contains flags that enable/disable
individual cores and their reset vectors
• Serial boot. If no valid boot header is found and the current lifecycle phase of the
device is less than “In Field”, an attempt is made to download the application by a serial
protocol using the UART. The downloaded code is then executed by the initial boot
core.
• Static mode. The device enters power safe mode and waits for an external reset.

2.2 BAF Overview

The MCU is booted through a collaboration of several blocks, hardware, and firmware. The
first boot phases are performed by a state machine inside the System Status and
Configuration Module (SSCM).
Finally, the SSCM sends a reset vector to the boot core (the I/O Processor (IOP) on this
device) pointing into the Boot Assist Flash (BAF).
The BAF code then checks the life cycle of the device. If it is “Failure Analysis”, BAF enters
a loop in which it will service the watch dog. BAF will not execute further since the read
access to flash boot sectors for cores may be disabled if device life cycle is “Failure
Analysis”. Otherwise it searches for a boot header and boots the application code in internal
flash.
If no boot header is found in internal flash, it downloads application code serially using the
UART module. The package pins used by UART are the same pins that can be used by
CAN module. So the external PHY can be either UART or CAN.
The BAF is located in a 16 KB block of flash that is mapped adjacent to the UTEST flash
memory block.
The BAF block base address is 0040_4000h. It is one time programmable (OTP) and is
programmed during factory test.

2.3 BAF Download Protocol

From high level perspective, the download protocol follows steps:
1. Host transmits 64 bit password to MCU.
2. Host transmits start address, size of downloaded code in bytes and VLE bit13 to MCU.
3. Host transmits a sequence of data bytes that are to be executed.
4. CPU2 executes code from start address provided in step 2.
Each step must be complete before the next step starts.

DocID026150 Rev 1 5/10

9
Boot Assist Flash (BAF) AN4465

The communication is done in half duplex manner and any transmission from host is
followed by the MCU transmission:
1. Host sends data to MCU and start waiting.
2. The MCU echoes to host the data received.
3. The host verifies if the echo is correct:
– If data is correct, the host can send the next byte of data
– If data is not correct, it is assumed the MCU has not correctly received the data
and the only practical option is for the Host to reset the MCU and start again.
All multi-byte data structures are sent with MSB first.

6/10 DocID026150 Rev 1

AN4465 Differences between BAM and BAF

3 Differences between BAM and BAF

3.1 Activation mode

The sequences to start the serial boot are different: while the BAM mode is enabled by
hardware configuration using FAB pin and ABS pins, the BAF mode is automatically
enabled only if no valid boot header is found and the lifecycle phase of the device is less
than “In Field”. This means that, to use BAM, the user needs to have the configuration pins
accessible. In this case the flash can be managed without limitation. Instead, the BAF
module allows managing the flash only in specific condition but without external hardware
configuration.

3.2 Serial boot protocol

From high level perspective, the serial boot protocols are similar except the behavior of the
device when the user sends a wrong password or not sends the password:
• BAM: If the password check fails, the device stops responding. To get the device out of
that state, the RESET signal must be asserted.
• BAF: If an incorrect password is supplied, BAF puts the device into static mode (low
power safe mode). If 64 bits of password data is not received after approximately 30s,
BAF causes a destructive reset of the MCU.

3.3 Code mode

Another difference between BAM and BAF regarding the code mode available: SPC57
family executes only VLE code. So, the bit present into the BAF protocol is used only for a
backward compatibility.

3.4 Password managing

BAF has a public fixed password (fixed value: 0xFEEDFACECAFEBEEF) not modifiable
while BAM can use a public password (fixed value: 0xFEEDFACECAFEBEEF) or can use a
64 bit Flash password, stored in the shadow row of internal Flash.

3.5 Baud rate detection

SPC57 family does not support baud rate detection option, instead the BAM has the option
to use the baud rate detection.

3.6 RAM reservation

SPC57 family does not need RAM reservation for executing BAF. The BAM protocol, on the
contrary, requires the reservation of a part of RAM (from 0x4000_0000 to 0x4000_0100).
This RAM cannot be overwritten during the download phase.

DocID026150 Rev 1 7/10

9
Differences between BAM and BAF AN4465

3.7 Serial interface baud rate calculation

UART and CAN baud rate depending by external clock but with different formulas.
• BAM module formulas:
– UART baud rate = fsys / 833.33
– CAN baud rate = fsys / 40
• BAF module formulas:
– UART baud rate = fsys / 80
– CAN baud rate = fsys / 40

8/10 DocID026150 Rev 1

AN4465 Revision history

4 Revision history

Table 1. Document revision history

Date Revision Changes

09-Apr-2014 1 Initial release.

DocID026150 Rev 1 9/10

9
 AN4465

Please Read Carefully:

Information in this document is provided solely in connection with ST products. STMicroelectronics NV and its subsidiaries (“ST”) reserve the
right to make changes, corrections, modifications or improvements, to this document, and the products and services described herein at any
time, without notice.
All ST products are sold pursuant to ST’s terms and conditions of sale.
Purchasers are solely responsible for the choice, selection and use of the ST products and services described herein, and ST assumes no
liability whatsoever relating to the choice, selection or use of the ST products and services described herein.
No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted under this document. If any part of this
document refers to any third party products or services it shall not be deemed a license grant by ST for the use of such third party products
or services, or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoever of such
third party products or services or any intellectual property contained therein.

UNLESS OTHERWISE SET FORTH IN ST’S TERMS AND CONDITIONS OF SALE ST DISCLAIMS ANY EXPRESS OR IMPLIED
WARRANTY WITH RESPECT TO THE USE AND/OR SALE OF ST PRODUCTS INCLUDING WITHOUT LIMITATION IMPLIED
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE (AND THEIR EQUIVALENTS UNDER THE LAWS
OF ANY JURISDICTION), OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT.
ST PRODUCTS ARE NOT DESIGNED OR AUTHORIZED FOR USE IN: (A) SAFETY CRITICAL APPLICATIONS SUCH AS LIFE
SUPPORTING, ACTIVE IMPLANTED DEVICES OR SYSTEMS WITH PRODUCT FUNCTIONAL SAFETY REQUIREMENTS; (B)
AERONAUTIC APPLICATIONS; (C) AUTOMOTIVE APPLICATIONS OR ENVIRONMENTS, AND/OR (D) AEROSPACE APPLICATIONS
OR ENVIRONMENTS. WHERE ST PRODUCTS ARE NOT DESIGNED FOR SUCH USE, THE PURCHASER SHALL USE PRODUCTS AT
PURCHASER’S SOLE RISK, EVEN IF ST HAS BEEN INFORMED IN WRITING OF SUCH USAGE, UNLESS A PRODUCT IS
EXPRESSLY DESIGNATED BY ST AS BEING INTENDED FOR “AUTOMOTIVE, AUTOMOTIVE SAFETY OR MEDICAL” INDUSTRY
DOMAINS ACCORDING TO ST PRODUCT DESIGN SPECIFICATIONS. PRODUCTS FORMALLY ESCC, QML OR JAN QUALIFIED ARE
DEEMED SUITABLE FOR USE IN AEROSPACE BY THE CORRESPONDING GOVERNMENTAL AGENCY.

Resale of ST products with provisions different from the statements and/or technical features set forth in this document shall immediately void
any warranty granted by ST for the ST product or service described herein and shall not create or extend in any manner whatsoever, any
liability of ST.
ST and the ST logo are trademarks or registered trademarks of ST in various countries.
Information in this document supersedes and replaces all information previously supplied.
The ST logo is a registered trademark of STMicroelectronics. All other names are the property of their respective owners.

© 2014 STMicroelectronics - All rights reserved

STMicroelectronics group of companies

Australia - Belgium - Brazil - Canada - China - Czech Republic - Finland - France - Germany - Hong Kong - India - Israel - Italy - Japan -
Malaysia - Malta - Morocco - Philippines - Singapore - Spain - Sweden - Switzerland - United Kingdom - United States of America
www.st.com

10/10 DocID026150 Rev 1