Why the STM32L152 Boot0 pin needs a pulldown (and a capacitor)  - Page 1
Forum section: electronics / general

author: ocelot
author_rank: Contributor
timestamp: December 22, 2024, 03:59:48 pm
content: This was something I discovered on an STM32L152 microcontroller a while back - I told a sales rep. from a distributor, but they were not very interested.I discovered by accident that you can flick an STM32L152 into a metastable state if you toggle the BOOT0 pin faster than 50% of some external peripheral clock speed. I never found out which clock it actually was, but it seemed to be half the core clock frequency with the stock divider chain programming.We got it in this state by exposing the processor to 400+MHz leakage from a 5 watt radio transmitter on the same very small PCB.. The BOOT0 pin had a pulldown but no decoupling capacitor.What then seemed to happen was that the processor would perform a sudden jump into the bootloader ROM code as the boot logic seems to have a race hazard in it exposed by rapidly toggling BOOT0. So a device that was running could sometimes be persuaded back into bootloader mode.. We got it to "blow up" with an SWD probe attached and we were able to stop it in the bootloader ..Another thing we found while this device was bathed in RF was that the analog pins momentarily change their impedance if you perform an ADC conversion, as the sample/hold operates, connecting a capacitor through an analog switch and so the PCB track attached changes its RF impedance.Which causes the impedance of other RF carrying tracks coupled to it to alter slightly.The ADC sampling appeared in a phase jump forwards and backwards in the RF output. As the application was extremely sensitive to RF phase, we had to schedule the ADC read to another time when it was not critical.

author: ataradov
author_rank: Super Contributor
timestamp: December 22, 2024, 06:08:58 pm
content: One possible scenario is that that fast clock causes a fault that causes a reset. On reset BOOT0 is sampled and can potentially invoke the bootloader.One thing I would try is ground BOOT0 hard and apply the same clock to the neighboring pin. See if you get random resets that end up running from the flash.

author: ocelot
author_rank: Contributor
timestamp: December 23, 2024, 08:17:56 pm
content: Its a few years back, I no longer work for the company.I think one of the manifestations was an address exception at a valid program memory location as the transmitter powered up, caused by a flash memory suddenly being bank switched with the smaller bootloader ROM.I can recall that according to the reset status register, the processor had not been reset.On the STM32L152, the Boot0 pin has different characteristics to a general GPIO pin , even a different logic threshold AFAIR - It is never usable apart from BOOT0.My belief is that the logic design inside does not have to really deal with debouncing this pin - it is expected to be high or low at all times . And if it starts appearing as 1,0,1,0 on each clock edge , the program memory bank switching malfunctions.

author: ataradov
author_rank: Super Contributor
timestamp: December 23, 2024, 08:26:35 pm
content: The value of the pin is supposed to be latched after a few clock cycles on reset. It should not affect the behavior after that. There is a chance that induced noise affects normal device operation, but it would not be due to switch suddenly taking place. It would be something like wrong code being executed due to flash disturbance,This is not unheard of. Some Atmel parts are susceptible to excessive GPIO noise, which gets coupled into the internal logic. Coupled with poor hardware design (insufficient filtering and decoupling), it leads to some really unpredictable crashes.It is impossible to tell without looking at the hardware and checking what exactly happens.

author: peter-h
author_rank: Super Contributor
timestamp: December 24, 2024, 01:29:10 pm
content: This sounds like the security cracking method called "chip whispering"https://www.newae.com/chipwhispererYou can also corrupt EEPROMs in this way, despite them needing a special write sequence to enable writing. I had a customer do this, by installing one of my products too close to a piezo igniter of some megawatt size gas boilerHe was not happy but not interested in me telling him that electronics needs to go into a metal box, cables shielded, etc, when you have this much broadband RF being radiated everywhere.

author: ocelot
author_rank: Contributor
timestamp: December 24, 2024, 05:29:03 pm
content: I agree that it ismeant to be latched.In the end I put a function generator on BOOT0 and varied the pulse frequency above and below the critical value - which was 16MHz on the 32MHz core clocked device. And could reproduce the crash..Having been on the IC design side in a prior job, it is certainly possible to design and optimise logic which is constantly being switched between two logic trees such that for an instant, the output glitches low as an input changes state, even when the input is "disabled", as no longer being of interest a few cycles after reset.This is despite the Boolean equations not indicating this - you need to add additional logic that redundantly covers the Karnaugh maps of the logic functions, not optimize it away. This was actually all taught back in the 1980's in university courses.On one occasion in Philips Semiconductors, we managed to reverse engineer a small section of a chip from another part of Philips which had a similar issue. On presenting the partial schematic to their designers, they were slightly surprised at how we had worked out the logic design from its misbehaviour.

author: glenenglish
author_rank: Frequent Contributor
timestamp: December 26, 2024, 04:42:22 am
content: How many V/M field strength did this happen at ?

author: peter-h
author_rank: Super Contributor
timestamp: December 26, 2024, 03:20:13 pm
content: You can never tell the V/M because that is a purely artificial set-up thing in an EMC test lab, so you can stick a CE mark on it. In real life, you never know if the product is getting 1V/m or 100V/m. That is why any product which actually needs to work needs to be built rock-solid EMC-wise; meeting ENxxxxxx is completely worthless.

author: glenenglish
author_rank: Frequent Contributor
timestamp: December 26, 2024, 06:48:06 pm
content: Quote from: peter-h on December 26, 2024, 03:20:13 pmPeter, that is entirely incorrect and inaccurate.Let the op answer the question before you pop in with total BS. If you have absolutely and totally NFI then say nothing, or please prefix with "I have no idea about this stuff but my opinion is...."

author: peter-h
author_rank: Super Contributor
timestamp: December 27, 2024, 03:15:57 am
content: Hmmm... I've been in this business, manufacturing and selling CPU based industrial products, since approximately 1978.The above "total BS" statement could come from an EMC test labOtherwise, susceptibility is hugely dependent on variables like wiring type, PCB layout, protection components, etc.

author: thm_w
author_rank: Super Contributor
timestamp: December 27, 2024, 10:40:24 pm
content: And the pulldown resistance was?The commonly recommended value is 10k, but since you are in a noisy RF environment, either would make sense to go lower, or better yet shield the STM32 from the RF noise.Interesting but not a bug in my mind.Near field probe would give you an idea of the strength in that area:

author: glenenglish
author_rank: Frequent Contributor
timestamp: December 28, 2024, 01:00:14 am
content: you can make a reasonable guess to the field with suitable knowledge.in the near field , the wave impedance is not 377 ohms (120 pi) so you must use some corrections between E and H.IE you cant measure H field and then infer E field without appropriate wave impedance corrections in the near field. IE cant use a loop probe (H field) to infer E field without more info. In the far field, you can do this .A simple estimate is probably good enough knowing the power into the antenna, type/site efficiency of antenna, distance, frequency.....Yes, something like 1k resistor would be more appropriate for the Boot0 pin. maybe 470 ohms . But by the time the fields are that high, you most likely need to take care of other circuit wires.....

author: glenenglish
author_rank: Frequent Contributor
timestamp: December 28, 2024, 07:40:30 am
content: @ ocelotIs the board a 4 layer / multilayer with continuous ground and power pins direct via to planes ?

author: peter-h
author_rank: Super Contributor
timestamp: December 28, 2024, 09:42:33 am
content: Nobody is going to be there holding that probe when the product is in the field and next to some other gearI use 1k on BOOT0 and BOOT1 (32F417). That is what ST use on their development boards.A 5W transmitter on the same PCB is going some... this needs shielding.

author: ocelot
author_rank: Contributor
timestamp: December 28, 2024, 03:20:07 pm
content: Yes, it was a small 4 layer PCB, everything was squeezed on the board, I seem to remember it was about 50mm x 25mm.Intended to go in a product that had to work 100% for 48 hours after waiting for up to 10 years.It also featured a custom real time scheduler whose closest relative was an Earliest Deadline First scheduler - there were interleaved patterns of radio transmission, some of which had to be made exactly on time or dropped completely, others had to fill in idle time ..It had to schedule phase shift keyed transmissions on the 406MHz distress frequency - phase accuracy and stability essential for satellite ranging the transmission from the beacon, and GMSK 162MHz AIS transmissions - stick to your time slot or else.. And in between activate an AM 121MHz homing beacon - phase stability between transmissions had to look like crystal controlled.And once the BOOT0 PCB error was fixed with a capacitor by the pin, that was no longer a problem - the reflected impedance blip from the ADC was measurable though.

author: peter-h
author_rank: Super Contributor
timestamp: December 28, 2024, 05:11:11 pm
content: OK, an ELT / PLB / EPIRB.But why reinvent the wheel when everybody else is already dealing with on-board RF in this way (mobile phones, etc)and that is only 400mW max power.The problem is that you never quite know just how close you are to the CPU circuit falling over due to EMC.

author: thm_w
author_rank: Super Contributor
timestamp: December 30, 2024, 09:50:36 pm
content: Quote from: peter-h on December 28, 2024, 09:42:33 amThats what metal shielding (which you pointed out) and EMI testing is for.The probe was to detect self generated on board interference.Quote from: ocelot on December 28, 2024, 03:20:07 pmok still no mention of the pull down resistance.

author: glenenglish
author_rank: Frequent Contributor
timestamp: December 30, 2024, 10:17:29 pm
content: @ ocelot. Suggest you build, buy or borrow a TEM cell . This is an excellent method of testing EM immunity in a methodical and reproducable way.https://www.tekbox.com/tem_cells/they are quite affordable. for your apps, get the 2nd big one, TBTC2 that's a good size for what you are working on.As a side bar, I would be testing up to 50V/M minimum . this is approx a 5W 440 MHz portable radio at 20cm, give or take. ideally go to 80 V/M (10cm) if you think this is likely. work through a range of orientations. 440MHz portable radios often have quarter wave antennas (17cm long) so they're not too far from the truth with ERP. Lower frequency (~ 150 MHz) portable radio/antennas can vary over 12dB depending on their environment... hence use the TEM cell.... I found quite alot of equipment fine at 400 MHz but sensitive at 70 MHz..However the surprises come with trace and board resonances, which is why you need to sweep over a large frequency range , the DUT in a TEM cell etc.One of the reasons cellphones have lots of shielding is the proximity of the receiver antenna to the electronics.Peter-h you are not an RF person by any stretch so why do you keep posting on this providing misleading information ?you say "The problem is that you never quite know just how close you are to the CPU circuit falling over due to EMC."no, wrong. You do testing. That's what we do.

author: peter-h
author_rank: Super Contributor
timestamp: December 30, 2024, 10:40:50 pm
content: QuoteI was right - you are an EMC lab!Actually, no, your testing checks that it works. It doesn't check how close it is to falling over. These sorts of products need to beheavilyover-engineered.QuoteI think you mean the transmitter antenna

author: glenenglish
author_rank: Frequent Contributor
timestamp: December 30, 2024, 10:42:52 pm
content: No, I really did mean the receiving antenna.No, I am not an EMC lab. Of stuff we build, we do precompliance in house.No, "These sorts of products need to be heavily over-engineered." no- that just leads to a uncompetetive device in the market.

author: thm_w
author_rank: Super Contributor
timestamp: December 30, 2024, 10:50:04 pm
content: Quote from: peter-h on December 30, 2024, 10:40:50 pmThats why we test above the normal levels in the environment, and avoid "squeaking by" to allow manufacturing tolerances.Often you'll have various class/group limits, so you can choose to go for the lower, higher one (though it would probably already be specified for you). And nothing stops you from testing to higher standards if you want to, you just ask the test house and pay for another sweep.