NVMC — Non-volatile memory controller

The non-volatile memory controller (NVMC) is used for writing and erasing of the internal flash memory and the user information configuration register (UICR).

The NVMC is a split security peripheral. This means that when the NVMC is configured as non-secure, only a subset of the registers is available from the non-secure code. See SPU — System protection unit and Registers for more details.

When the NVMC is configured to be a secure peripheral, only secure code has access.

Before a write can be performed, the NVMC must be enabled for writing in CONFIG.WEN. Similarly, before an erase can be performed, the NVMC must be enabled for erasing in CONFIG.EEN, see CONFIG. The user must make sure that writing and erasing are not enabled at the same time. Failing to do so may result in unpredictable behavior.

Writing to flash

When writing is enabled, in CONFIG register for secure region, or in CONFIGNS register for non-secure region, flash is written by writing a full 32-bit word to a word-aligned address in flash.

Secure code has access to both secure and non-secure regions, by using the appropriate configuration of CONFIG and CONFIGNS registers. Non-secure code, in constrast, has access to non-secure regions only. Thus, non-secure code only needs CONFIGNS.

The NVMC is only able to write 0 to erased bits in flash, that is bits set to 1. It cannot write a bit back to 1.

As illustrated in Memory, flash is divided into multiple pages. The same address in flash can only be written n_WRITE number of times before a page erase must be performed.

Only full 32-bit words can be written to flash using the NVMC interface. To write less than 32 bits to flash, write the data as a word, and set all the bits that should remain unchanged in the word to 1. The restriction about the number of writes (see above) still applies in this case.

The time it takes to write a word to flash is specified by t_WRITE. If CPU executes code from flash while the NVMC is writing to flash, the CPU will be stalled.

Only word-aligned writes are allowed. Byte or half-word-aligned writes will result in a bus fault.

Erasing a secure page in flash

When secure region erase is enabled (in CONFIG register), a flash page can be erased by writing 0xFFFFFFFF into the first 32-bit word in a flash page.

Page erase is only applicable to the code area in the flash and does not work with UICR.

After erasing a flash page, all bits in the page are set to 1. The time it takes to erase a page is specified by t_ERASEPAGE. The CPU is stalled if the CPU executes code from the flash while the NVMC performs the erase operation.

See Partial erase of a page in flash for information on splitting the erase time in smaller chunks.

Erasing a non-secure page in flash

When non-secure region erase is enabled, a non-secure flash page can be erased by writing 0xFFFFFFFF into the first 32-bit word of the flash page.

Page erase is only applicable to the code area in the flash and does not work with UICR.

Writing to user information configuration registers (UICR)

User information configuration registers (UICR) are written in the same way as flash. After UICR has been written, the new UICR configuration will only take effect after a reset.

UICR is only accessible by secure code. Any write from non-secure code will be faulted.

To lock the chip after uploading non-secure code, do the follolwing steps:

Block access to secure code by setting UICR register to protected.
Use the register WRITEUICRNS, via non-secure debugger, to set APPROTECT (APPROTECT is automatically written to 0x00000000 by the NVMC).

UICR can only be written n_WRITE number of times before an erase must be performed using ERASEALL.

The time it takes to write a word to the UICR is specified by t_WRITE. The CPU is stalled if the CPU executes code from the flash while the NVMC is writing to the UICR.

Erase all

When erase is enabled, the whole flash and UICR can be erased in one operation by using the ERASEALL register. ERASEALL will not erase the factory information configuration registers (FICR).

This functionality can be blocked by some configuration of the UICR protection bits, see the table NVMC protection.

The time it takes to perform an ERASEALL command is specified by t_ERASEALL. The CPU is stalled if the CPU executes code from the flash while the NVMC performs the erase operation.

NVMC protection mechanisms

This chapter describes the different protection mechanisms for the non-volatile memory.

NVMC blocking

NVM integrity is assured through use of multiple levels of protection. Protection mechanisms can be configured to allow or block certain operations.

The table below shows the different status of protection bits, and which operations are allowed or blocked.

Table 1. NVMC protection
Protection bit status			NVMC protection
SECUREAPPROTECT	APPROTECT	ERASEPROTECT	CTRL-AP ERASEALL	NVMC ERASEALL
0	0	0	Available	Available
1	X	0	Available	Blocked
X	1	0	Available	Blocked
X	X	1	Blocked	Blocked
1 - Enabled, 0 - Disabled, X - Don't care

Uploading code with secure debugging blocked

Non-secure code can program non-secure flash regions. To perform these operations, the NVMC has the following non-secure registers: CONFIGNS, READY, and READYNEXT.

CONFIGNS works as the CONFIG register but it is used only for non-secure transactions. Both page erase and writing inside the flash require a write transaction (see Erasing a secure page in flash or Erasing a non-secure page in flash). Because of this, the SPU — System protection unit will guarantee that the non-secure code cannot write inside a secure page, since the transaction will never reach the NVMC controller.

NVMC power failure protection

NVMC power failure protection is possible through the use of a power-fail comparator that is monitoring power supply.

If the power-fail comparator is enabled, and the power supply voltage is below V_POF threshold, the power-fail comparator will prevent the NVMC from performing erase or write operations in non-volatile memory (NVM).

If a power failure warning is present at the start of an NVM write or erase operation, the NVMC will block the operation and a bus error will be signalled. If a power failure warning occurs during an ongoing NVM write operation, the NVMC will try to finish the operation. And if the power failure warning persists, consecutive NVM write operations will be blocked by the NVMC, and a bus error will be signalled.

Cache

An instruction cache (I-Cache) can be enabled for the ICODE bus in the NVMC.

See Memory for the location of flash.

A cache hit is an instruction fetch from the cache, and it has a 0 wait-state delay. The number of wait-states for a cache miss, where the instruction is not available in the cache and needs to be fetched from flash, depends on the processor frequency, see CPU parameter W_FLASHCACHE.

Enabling the cache can increase the CPU performance, and reduce power consumption by reducing the number of wait cycles and the number of flash accesses. This will depend on the cache hit rate. Cache draws current when enabled. If the reduction in average current due to reduced flash accesses is larger than the cache power requirement, the average current to execute the program code will be reduced.

When disabled, the cache does not draw current and its content is not retained.

It is possible to enable cache profiling to analyze the performance of the cache for your program using the register ICACHECNF. When profiling is enabled, registers IHIT and IMISS are incremented for every instruction cache hit or miss respectively.

Registers

Table 2. Instances
Base address	Domain	Peripheral	Instance	Secure mapping	DMA security	Description	Configuration
0x50039000 0x40039000	APPLICATION	NVMC	NVMC : S NVMC : NS	SPLIT	NA	Non-volatile memory controller	NVMC built-in cache not supported (ICACHECNF, IHIT and IMISS registers).
0x41080000	NETWORK	NVMC	NVMC	NS	NA	Non-Volatile Memory Controller	NVMC TrustZone registers (WRITEUICRNS and CONFIGNS) not supported.

Table 3. Register overview
Register	Offset	Security	Description
READY	0x400	NS	Ready flag
READYNEXT	0x408	NS	Ready flag
CONFIG	0x504	S	Configuration register
ERASEALL	0x50C	S	Register for erasing all non-volatile user memory
ERASEPAGEPARTIALCFG	0x51C	S	Register for partial erase configuration
ICACHECNF	0x540	S	I-code cache configuration register
IHIT	0x548	S	I-code cache hit counter
IMISS	0x54C	S	I-code cache miss counter
CONFIGNS	0x584	NS	Non-secure configuration register
WRITEUICRNS	0x588	NS	Non-secure APPROTECT enable register

READY

Address offset: 0x400

Ready flag

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	READY										NVMC is ready or busy
			Busy	0								NVMC is busy (ongoing write or erase operation)
			Ready	1								NVMC is ready

READYNEXT

Address offset: 0x408

Ready flag

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000001				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1
ID	R/W	Field	Value ID	Value								Description
A	R	READYNEXT										NVMC can accept a new write operation
			Busy	0								NVMC cannot accept any write operation
			Ready	1								NVMC is ready

CONFIG

Address offset: 0x504

Configuration register

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	WEN										Program memory access mode. It is strongly recommended to only activate erase and write modes when they are actively used. Enabling write or erase will invalidate the cache and keep it invalidated. Using other values than those defined may result in unpredictable behavior.
			Ren	0								Read only access
			Wen	1								Write enabled
			Een	2								Erase enabled
			PEen	4								Partial erase enabled

ERASEALL

Address offset: 0x50C

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																			A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	ERASEALL										Erase all non-volatile memory including UICR registers. Before the non-volatile memory can be erased, erasing must be enabled by setting CONFIG.WEN=Een.
			NoOperation	0								No operation
			Erase	1								Start chip erase

ERASEPAGEPARTIALCFG

Address offset: 0x51C

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																													A	A	A	A	A	A	A
Reset 0x0000000A				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	1	0	1	0
ID	R/W	Field	Value ID	Value								Description
A	RW	DURATION										Duration of the partial erase in milliseconds The user must ensure that the total erase time is long enough for a complete erase of the flash page

ICACHECNF

Address offset: 0x540

I-code cache configuration register

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																											B								A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	CACHEEN										Cache enable
			Disabled	0								Disable cache. Invalidates all cache entries.
			Enabled	1								Enable cache
B	RW	CACHEPROFEN										Cache profiling enable
			Disabled	0								Disable cache profiling
			Enabled	1								Enable cache profiling

IHIT

Address offset: 0x548

I-code cache hit counter

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	HITS										Number of cache hits Write zero to clear

IMISS

Address offset: 0x54C

I-code cache miss counter

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	MISSES										Number of cache misses Write zero to clear

CONFIGNS

Address offset: 0x584

Non-secure configuration register

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID																																		A	A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	RW	WEN										Program memory access mode. It is strongly recommended to only activate erase and write modes when they are actively used. Enabling write or erase will invalidate the cache and keep it invalidated. Using other values than those defined may result in unpredictable behavior.
			Ren	0								Read only access
			Wen	1								Write enabled
			Een	2								Erase enabled

WRITEUICRNS

Address offset: 0x588

Non-secure APPROTECT enable register

Bit number				31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
ID				B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B	B				A
Reset 0x00000000				0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
ID	R/W	Field	Value ID	Value								Description
A	W	SET										Allow non-secure code to set APPROTECT
			Set	1								Set value
B	W	KEY										Key to write in order to validate the write operation
			Keyvalid	0xAFBE5A7								Key value

Electrical specification

Flash programming

Symbol	Description	Min.	Typ.	Max.	Units
n_WRITE	Number of times a 32-bit word can be written before erase			2
n_ENDURANCE	Erase cycles per page	10000
t_WRITE	Time to write one 32-bit word			43¹	µs
t_ERASEPAGE	Time to erase one page			87.5¹	ms
t_ERASEALL	Time to erase all flash			173¹	ms
t_{ERASEPAGEPARTIAL,setup}	Setup time for one partial erase	..	..	..	ms

Cache size

Symbol	Description				Min.	Typ.	Max.	Units
Size_ICODE	I-Code cache size					2048²		Bytes