MSP430F67791A: UniFlash Flash Write Check Failed on Information Memory

Your capture of data shows only the first segment (D) being erased.

It also shows you trying to write to segment A. That is protected by the LOCKA bit which might cause trouble here as well.

I checked the chipinfo database (as included with the mspdebug source) and it correctly describes the information memory segmentation.

Hi David,

Thank you for the response.

I have tried various tests, and these show that even without attempting a write to segment A at 0x1980 (which, as you say is protected by a separate lock), the problem still exists. For example, when attempting to write to addresses 0x1800 (128 bytes) and 0x1900 (128 bytes), the write to 0x1900 fails.

As per Table 6-9 in the MSP430F67791A datasheet, these are segments D and B, respectively:

I believe the root cause of this issue is that only the 1st segment specified in the TI-TXT file is erased for the Information Memory, not the subsequent segments. This theory matches with the commands that I see on the UART link and with the resulting read of memory after the write attempt, i.e., only a single erase command is sent, in this case for address 0x1800. No subsequent erase commands are sent - in this case, no erase command is sent for the segment at 0x1900 before trying to write data to that segment, resulting in a failed write.

Best Regards,

Eric

I've performed some more testing that also shows unexpected behaviour from UniFlash when in BSL (Bootloader - UART) mode:

• I used UniFlash in JTAG mode (always seems to work ok) to program a test application in Program Flash and also test values in the Information Memory (all 512 bytes).
• I created a TI-TXT file that contained new values for Segment B (0x1900, 128 bytes) and used UniFlash in BSL mode to program Segment B.
• I tried this using 2 separate test options:
  • "Erase necessary segments only"
  • "Erase Information Memory"
• Each test option used the same Password file (the same application was in the program flash for each test).
• Each test option used the same Information Memory file (128 bytes at 0x1900), containing the new data to program.

Results (Erase necessary segments only)

The BSL UART commands show that UniFlash sent a command to "Erase Segment" with address 0xFFE0, but that's the password address, which is very strange. The MSP430 responds with "Operation Successful". Then UniFlash sent a command to "Erase Segment" with address 0x1900 (expected for segment B), and the MSP430 also responds with "Operation Successful".

After writing the data to address 0x1900, the trace of the UART shows that UniFlash checks the CRC of the password area "segment" (this is strange) and also the CRC of the Information Memory B segment (this is expected). The CRC test of the password "segment" failed and the CRC test of Segment B passed.

See below for details of the UART data showing the BSL commands and responses:

[FROM MSP430]
00                                 ACK

[TO MSP430]
80
21 00
11                                 RX password
E0 C0 DE C0 FF FF FF FF ...        32 byte password
33 68

[FROM MSP430]
00                                 ACK
80
02 00
3B                                 BSL Core Response (message)
00                                 Operation Successful
60 C4

[TO MSP430]
80
01 00
19                                 TX BSL Version
E8 62

[FROM MSP430]
00
80
05 00
3A                                 BSL Core Response
00 07 05 04                        BSL Version Number
AD 61

[TO MSP430]
80
04 00
12                                 Erase Segment (L, M, H)
E0 FF 00                           Address = 0x00FFE0 - why erase password area???
C1 D1

[FROM MSP430]
00
80
02 00
3B                                 BSL Core Response (message)
00                                 Operation Successful
60 C4

[TO MSP430]
80
04 00
12                                 Erase Segment (L, M, H)
00 19 00                           Address = 0x001900 (correct)
E4 CB

[FROM MSP430]
00
80
02 00
3B                                 BSL Core Response (message)
00                                 Operation Successful
60 C4

[TO MSP430]
80
84 00
10                                 RX Data Block
00 19 00                           Address = 0x001900
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F
8F 6B

[FROM MSP430]
00
80
02 00
3B                                 BSL Core Response (message)
00                                 Operation Successful
60 C4

[TO MSP430]
80
06 00
16                                 CRC Check
E0 FF 00                           Address = 0x00FFE0 - why do this???
20 00                              0x0020 (32 bytes)
3C EF

[FROM MSP430]
00
80
03 00
3A                                 BSL Core Response (CRC Value)
F8 75                              CRC = 0x75F8 (not as expected, so UniFlash fails)
A2 7A

[TO MSP430]
80
06 00
16                                 CRC Check
00 19 00                           Address = 0x001900
80 00                              0x0080 (128 bytes)
3D 6A

[FROM MSP430]
00
80
03 00
3A                                 BSL Core Response (CRC Value)
00 18                              CRC = 0x1800
C1 5D

Conclusion (Erase necessary segments only)

The UniFlash operation fails. Although it correctly programs Segment B when using the option "Erase necessary segments only", it fails the overall operation because it has decided to send a command to "Erase Segment" at the password address (0xFFE0), and perform a CRC test at this address too, which is quite strange. The area that is erased is the segment/sector that the provided address is "within", in this case the entire segment/sector that address 0xFFE0 resides within. In any case, that "Erase Segment" command seems wrong to me?

Results (Erase Information Memory)

The BSL UART commands show that UniFlash sent a command to "Erase Segment" with address 0x1800, but that's not the correct address for the provided Information Memory segment (0x1900, 128 bytes). This command will only erase the segment at 0x1800 (128-bytes), and not the segment in question (0x1900). Therefore, when the write check is performed, it fails, as per my original post.

See below for details of the UART data showing the BSL commands and responses:

[FROM MSP430]
00                                 ACK

[TO MSP430]
80
21 00
11                                 RX password
E0 C0 DE C0 FF FF FF FF ...        32 byte password
33 68

[FROM MSP430]
00                                 ACK
80
02 00
3B                                 BSL Core Response (message)
00                                 Operation Successful
60 C4

[TO MSP430]
80
01 00
19                                 TX BSL Version
E8 62

[FROM MSP430]
00
80
05 00
3A                                 BSL Core Response
00 07 05 04                        BSL Version Number
AD 61

[TO MSP430]
80
04 00
12                                 Erase Segment (L, M, H)
00 18 00                           Address = 0x001800 (should be 0x1900)
D5 F8

[FROM MSP430]
00
80
02 00
3B                                 BSL Core Response (message)
00                                 Operation Successful
60 C4

[TO MSP430]
80
84 00
10                                RX Data Block
00 19 00                          Address = 0x001900
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F 60 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 7B 7C 7D 7E 7F
8F 6B

[FROM MSP430]
00
80
02 00
3B                                BSL Core Response (message)
01                                Flash write check failed
41 D4

Conclusion (Erase Information Memory)

The UniFlash operation fails. This is because the "Erase Segment" command is only provided for the segment at 0x1800, and not the segment at 0x1900. This can be seen if we read the entire Information Memory at 0x1800 (512 bytes), as shown below:

The picture above shows:

• Left hand side = before BSL program operation
  • The originally programmed Information Memory at 0x1800 (512 bytes), using test values.
• Right hand side = after BSL program operation
  • The segment at 0x1800 has been erased
  • The segment at 0x1900 shows an attempt to re-program the data, but it clearly fails because the segment was not erased

Overall Conclusion

Using the "Erase necessary segments only" option in UniFlash when programming an Information Memory segment using BSL mode actually programs the required segment, but fails overall because the Program Flash segment that contains the password data is also erased (which is clearly incorrect, in my opinion).

Using the "Erase Information Memory" option in UniFlash when programming an Information Memory segment using BSL mode would probably only ever pass if the first segment in memory at 0x1800 (128 bytes) was programmed (Segment D) because only one "Erase Segment" command is sent, for address 0x1800.

Hopefully this additional information will help TI to investigate and analyze this issue further.

Or perhaps I've missed something in the setup or usage or UniFlash that would solve our problem?

Best Regards,

Eric

I also tried writing to addresses 0x1880 (segment C) and 0x1900 (segment B) using the "Erase necessary segments only" option. The result was that the password area was again erased i.e., "Erase segment" with address 0xFFE0, and although an "Erase Segment" command was sent for the first of the Information Memory segments (0x1880) and the write passed, because the second Information Memory segment (0x1900) was not erased, the write to that area failed.

So for this example test case:

• The Program Flash segment/sector that address 0xFFE0 is within should not have been provided with an "Erase Segment" command.
• The second Information Memory segment that was written to (0x1900) was not provided with an "Erase Segment" command and therefore the write command failed.

Hi,

Thanks for showing the detailed test results. 

So, for my understanding, it should send command to erase all 4 sectors of the information memory instead of only send one command when using "Erase Information Memory" mode. 

I will move this issue to Uniflash tool team and check if they have any comments on this topic. 

Best regards,

Cash Hao

Hi Cash,

Thanks for your response.

Yes, I believe that's the root cause of the issue that I have seen.

There are 4 segments of Information Memory in that particular microcontroller, and if one of those segments needs to be updated/written to, then that segment needs to be erased first before it is written to. And that does not seem to be happening - at least not all the segments that I have tested.

Best Regards,

Eric

Hi Cash,

Do you know if there have been any updates from the UniFlash tool team on this topic?

Best Regards,

Eric