Author Topic: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)  (Read 2251 times)

0 Members and 1 Guest are viewing this topic.

Offline ocelotTopic starter

  • Contributor
  • Posts: 12
  • Country: gb
Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« on: December 22, 2024, 03:59:48 pm »
This was something I discovered on an STM32L152 microcontroller a while back - I told a sales rep. from a distributor, but they were not very interested.

I discovered by accident that you can flick an STM32L152 into a metastable state if you toggle the BOOT0 pin faster than 50% of some external peripheral clock speed. I never found out which clock it actually was, but it seemed to be half the core clock frequency with the stock divider chain programming.

We got it in this state by exposing the processor to 400+MHz leakage from a 5 watt radio transmitter on the same very small PCB.. The BOOT0 pin had a pulldown but no decoupling capacitor.

What then seemed to happen was that the processor would perform a sudden jump into the bootloader ROM code as the boot logic seems to have a race hazard in it exposed by rapidly toggling BOOT0.   So a device that was running could sometimes be persuaded back into bootloader mode..   We got it to "blow up" with an SWD probe attached and we were able to stop it in the bootloader ..

Another thing we found while this device was bathed in RF was that the analog pins momentarily change their impedance if you perform an ADC conversion, as the sample/hold operates, connecting a capacitor through an analog switch and so the PCB track attached changes its RF impedance.

Which causes the impedance of other RF carrying tracks coupled to it to alter slightly.

The ADC sampling  appeared in a phase jump forwards and backwards in the RF output. As the application was extremely sensitive to RF phase, we had to schedule the ADC read to another time when it was not critical.
 
 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 11930
  • Country: us
    • Personal site
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #1 on: December 22, 2024, 06:08:58 pm »
One possible scenario is that that fast clock causes a fault that causes a reset. On reset BOOT0 is sampled and can potentially invoke the bootloader.

One thing I would try is ground BOOT0 hard and apply the same clock to the neighboring pin. See if you get random resets that end up running from the flash.
Alex
 

Offline ocelotTopic starter

  • Contributor
  • Posts: 12
  • Country: gb
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #2 on: December 23, 2024, 08:17:56 pm »
Its a few years back, I no longer work for the company.

I think one of the manifestations was an address exception at a valid program memory location as the transmitter powered up, caused by a flash memory suddenly being bank switched with the smaller bootloader ROM.

I can recall that according to the reset status register, the processor had not been reset.

On the STM32L152, the Boot0 pin has different characteristics to a general GPIO pin , even a different logic threshold AFAIR - It is never usable apart from BOOT0.   

My belief is that the logic design inside does not have to really deal with debouncing this pin - it is expected to be high or low at all times . And if it starts appearing as 1,0,1,0 on each clock edge , the program memory bank switching malfunctions.


 

Online ataradov

  • Super Contributor
  • ***
  • Posts: 11930
  • Country: us
    • Personal site
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #3 on: December 23, 2024, 08:26:35 pm »
The value of the pin is supposed to be latched after a few clock cycles on reset. It should not affect the behavior after that. There is a chance that induced noise affects normal device operation, but it would not be due to switch suddenly taking place. It would be something like wrong code being executed due to flash disturbance,

This is not unheard of. Some Atmel parts are susceptible to excessive GPIO noise, which gets coupled into the internal logic. Coupled with poor hardware design (insufficient filtering and decoupling), it leads to some really unpredictable crashes.

It is impossible to tell without looking at the hardware and checking what exactly happens.
Alex
 

Offline peter-h

  • Super Contributor
  • ***
  • Posts: 4409
  • Country: gb
  • Doing electronics since the 1960s...
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #4 on: December 24, 2024, 01:29:10 pm »
This sounds like the security cracking method called "chip whispering" :)
https://www.newae.com/chipwhisperer

You can also corrupt EEPROMs in this way, despite them needing a special write sequence to enable writing. I had a customer do this, by installing one of my products too close to a piezo igniter of some megawatt size gas boiler :) He was not happy but not interested in me telling him that electronics needs to go into a metal box, cables shielded, etc, when you have this much broadband RF being radiated everywhere.
Z80 Z180 Z280 Z8 S8 8031 8051 H8/300 H8/500 80x86 90S1200 32F417
 

Offline ocelotTopic starter

  • Contributor
  • Posts: 12
  • Country: gb
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #5 on: December 24, 2024, 05:29:03 pm »
I agree that it is meant to be latched.

In the end I put a function generator on BOOT0 and varied the pulse frequency above and below the critical value - which was 16MHz on the 32MHz core clocked device. And could reproduce the crash..

Having been on the IC design side in a prior job, it is certainly possible to design and optimise logic which is constantly being switched between two logic trees such that for an instant, the output glitches low as an input changes state, even when the input is "disabled", as no longer being of interest a few cycles after reset.
This is  despite the Boolean equations not indicating this - you need to add additional logic that redundantly covers the Karnaugh maps of the logic functions, not optimize it away. This was actually all taught back in the 1980's in university courses.

On one occasion in Philips Semiconductors, we managed to reverse engineer a small section of a chip from another part of Philips which had a similar issue. On presenting the partial schematic to their designers, they were slightly surprised at how we had worked out the logic design from its misbehaviour.
« Last Edit: December 24, 2024, 05:34:31 pm by ocelot »
 

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 473
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #6 on: December 26, 2024, 04:42:22 am »
How many V/M field strength did this happen at ?
 
The following users thanked this post: thm_w

Offline peter-h

  • Super Contributor
  • ***
  • Posts: 4409
  • Country: gb
  • Doing electronics since the 1960s...
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #7 on: December 26, 2024, 03:20:13 pm »
You can never tell the V/M because that is a purely artificial set-up thing in an EMC test lab, so you can stick a CE mark on it. In real life, you never know if the product is getting 1V/m or 100V/m. That is why any product which actually needs to work needs to be built rock-solid EMC-wise; meeting ENxxxxxx is completely worthless.
Z80 Z180 Z280 Z8 S8 8031 8051 H8/300 H8/500 80x86 90S1200 32F417
 

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 473
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #8 on: December 26, 2024, 06:48:06 pm »
You can never tell the V/M because that is a purely artificial set-up thing in an EMC test lab, so you can stick a CE mark on it. In real life, you never know if the product is getting 1V/m or 100V/m. That is why any product which actually needs to work needs to be built rock-solid EMC-wise; meeting ENxxxxxx is completely worthless.
Peter, that is entirely incorrect and inaccurate.
Let the op answer the question before you pop in with total BS. If you have absolutely and totally NFI then say nothing, or please prefix with "I have no idea about this stuff but my opinion is...."


« Last Edit: December 26, 2024, 06:49:41 pm by glenenglish »
 
The following users thanked this post: Siwastaja

Offline peter-h

  • Super Contributor
  • ***
  • Posts: 4409
  • Country: gb
  • Doing electronics since the 1960s...
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #9 on: December 27, 2024, 03:15:57 am »
Hmmm... I've been in this business, manufacturing and selling CPU based industrial products, since approximately 1978.

The above "total BS" statement could come from an EMC test lab :)

Otherwise, susceptibility is hugely dependent on variables like wiring type, PCB layout, protection components, etc.
Z80 Z180 Z280 Z8 S8 8031 8051 H8/300 H8/500 80x86 90S1200 32F417
 

Offline thm_w

  • Super Contributor
  • ***
  • Posts: 7613
  • Country: ca
  • Non-expert
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #10 on: December 27, 2024, 10:40:24 pm »
And the pulldown resistance was?
The commonly recommended value is 10k, but since you are in a noisy RF environment, either would make sense to go lower, or better yet shield the STM32 from the RF noise.

Interesting but not a bug in my mind.

Near field probe would give you an idea of the strength in that area:
« Last Edit: December 27, 2024, 10:44:08 pm by thm_w »
Profile -> Modify profile -> Look and Layout ->  Don't show users' signatures
 

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 473
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #11 on: December 28, 2024, 01:00:14 am »
you can make a reasonable guess to the field with suitable knowledge.

in the near field , the wave impedance is not 377 ohms (120 pi) so you must use some corrections between E and H.
IE you cant measure H field and then infer E field without appropriate wave impedance corrections in the near field. IE cant use a loop probe (H field) to infer E field without more info. In the far field, you can do this .

A simple estimate is probably good enough knowing the power into the antenna, type/site efficiency  of antenna, distance, frequency.....

Yes, something like 1k resistor would be more appropriate for the Boot0 pin. maybe 470 ohms . But by the time the fields are that high, you most likely need to take care of other circuit wires.....
 
The following users thanked this post: hans, thm_w

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 473
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #12 on: December 28, 2024, 07:40:30 am »
@ ocelot

Is the board a 4 layer / multilayer  with continuous ground and power pins direct via to planes ?
 

Offline peter-h

  • Super Contributor
  • ***
  • Posts: 4409
  • Country: gb
  • Doing electronics since the 1960s...
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #13 on: December 28, 2024, 09:42:33 am »
Nobody is going to be there holding that probe when the product is in the field and next to some other gear :)

I use 1k on BOOT0 and BOOT1 (32F417). That is what ST use on their development boards.

A 5W transmitter on the same PCB is going some... this needs shielding.
« Last Edit: December 28, 2024, 09:44:34 am by peter-h »
Z80 Z180 Z280 Z8 S8 8031 8051 H8/300 H8/500 80x86 90S1200 32F417
 

Offline ocelotTopic starter

  • Contributor
  • Posts: 12
  • Country: gb
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #14 on: December 28, 2024, 03:20:07 pm »
Yes, it was a small 4 layer PCB, everything was squeezed on the board, I seem to remember it was about 50mm x 25mm.
Intended to go in a product that had to work 100% for 48 hours after waiting for up to 10 years. 

It also featured a custom real time scheduler whose closest relative was an Earliest Deadline First scheduler - there were interleaved patterns of radio transmission, some of which had to be made exactly on time or dropped completely, others had to fill in idle time ..

It had to schedule phase shift keyed transmissions on the 406MHz distress frequency - phase accuracy and stability essential for satellite ranging the transmission from the beacon, and GMSK 162MHz AIS transmissions - stick to your time slot or else.. And in between activate an AM 121MHz homing beacon - phase stability between transmissions had to look like crystal controlled.


And once the BOOT0 PCB error was fixed with a capacitor by the pin, that was no longer a problem - the reflected impedance blip from the ADC was measurable though.
 

Offline peter-h

  • Super Contributor
  • ***
  • Posts: 4409
  • Country: gb
  • Doing electronics since the 1960s...
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #15 on: December 28, 2024, 05:11:11 pm »
OK, an ELT / PLB / EPIRB.

But why reinvent the wheel when everybody else is already dealing with on-board RF in this way (mobile phones, etc)



and that is only 400mW max power.

The problem is that you never quite know just how close you are to the CPU circuit falling over due to EMC.
Z80 Z180 Z280 Z8 S8 8031 8051 H8/300 H8/500 80x86 90S1200 32F417
 

Offline thm_w

  • Super Contributor
  • ***
  • Posts: 7613
  • Country: ca
  • Non-expert
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #16 on: December 30, 2024, 09:50:36 pm »
Nobody is going to be there holding that probe when the product is in the field and next to some other gear :)

Thats what metal shielding (which you pointed out) and EMI testing is for.
The probe was to detect self generated on board interference.

And once the BOOT0 PCB error was fixed with a capacitor by the pin, that was no longer a problem - the reflected impedance blip from the ADC was measurable though.

ok still no mention of the pull down resistance.
Profile -> Modify profile -> Look and Layout ->  Don't show users' signatures
 

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 473
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #17 on: December 30, 2024, 10:17:29 pm »
@ ocelot. Suggest you build, buy  or borrow a TEM cell . This is an excellent method of testing EM immunity in a methodical and reproducable way.
https://www.tekbox.com/tem_cells/

they are quite affordable. for your apps, get the 2nd big one, TBTC2 that's a good size for what you are working on.

As a side bar, I would be testing up to 50V/M minimum .  this is approx a 5W 440 MHz portable radio at 20cm, give or take. ideally go to 80 V/M (10cm) if you think this is likely. work through a range of orientations. 440MHz portable radios often have quarter wave antennas (17cm long)  so they're not too far from the truth with ERP.  Lower frequency (~ 150 MHz) portable radio/antennas can vary over 12dB depending on their environment... hence use the TEM cell....  I found quite alot of equipment fine at 400 MHz but sensitive at 70 MHz..

However the surprises come with trace and board resonances, which is why you need to sweep over a large frequency range ,  the DUT in a TEM cell etc.

One of the reasons cellphones have lots of shielding is the proximity of the receiver antenna to the electronics. 

Peter-h you are not an RF person by any stretch so why do you keep posting on this providing misleading information ?

you say "The problem is that you never quite know just how close you are to the CPU circuit falling over due to EMC."

no, wrong.  You do testing.  That's what we do.
« Last Edit: December 30, 2024, 10:22:17 pm by glenenglish »
 

Offline peter-h

  • Super Contributor
  • ***
  • Posts: 4409
  • Country: gb
  • Doing electronics since the 1960s...
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #18 on: December 30, 2024, 10:40:50 pm »
Quote
no, wrong.  You do testing.  That's what we do.

I was right - you are an EMC lab! ;)

Actually, no, your testing checks that it works. It doesn't check how close it is to falling over. These sorts of products need to be heavily over-engineered.

Quote
One of the reasons cellphones have lots of shielding is the proximity of the receiver antenna to the electronics.

I think you mean the transmitter antenna ;)
Z80 Z180 Z280 Z8 S8 8031 8051 H8/300 H8/500 80x86 90S1200 32F417
 

Offline glenenglish

  • Frequent Contributor
  • **
  • Posts: 473
  • Country: au
  • RF engineer. AI6UM / VK1XX . Aviation pilot. MTBr
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #19 on: December 30, 2024, 10:42:52 pm »
No, I really did mean the receiving antenna.
No, I am not an EMC lab. Of stuff we build, we do precompliance in house.
No, "These sorts of products need to be heavily over-engineered." no- that just leads to a uncompetetive device in the market.
 

Offline thm_w

  • Super Contributor
  • ***
  • Posts: 7613
  • Country: ca
  • Non-expert
Re: Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)
« Reply #20 on: December 30, 2024, 10:50:04 pm »
Actually, no, your testing checks that it works. It doesn't check how close it is to falling over. These sorts of products need to be heavily over-engineered.

Thats why we test above the normal levels in the environment, and avoid "squeaking by" to allow manufacturing tolerances.

Often you'll have various class/group limits, so you can choose to go for the lower, higher one (though it would probably already be specified for you). And nothing stops you from testing to higher standards if you want to, you just ask the test house and pay for another sweep.
Profile -> Modify profile -> Look and Layout ->  Don't show users' signatures
 
The following users thanked this post: Siwastaja, glenenglish


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf