26.5.10.4.3 Fault Injection on Writes Example
The following is an example of pseudo code for injecting a single error on DATA[0] upon writes at address 0x1000 (Take care that no code is stored at this address, else adjust it to any free space in Flash memory).
- Erase the row at address
0x1000
CTRLB.MANW = 1
- A manual write command will be required for writing the page buffer in memoryECCCTRL.SECCNT = 0
ECCCTRL.ECCDIS = 0
FLTCTRL.FLTRST = 1
- Reset the fault injection logic (the bit is cleared automatically after reset)FFLTADR.FLTADR = 0x1000
- Configure the address where to inject the faulty bitFFLTPTR.FLT1PTR = 0x3
- Corrupt bit DATA[0]FLTCTRL.FLTMD = 0x6
- Configure single fault injection on writesFLTCTRL.FLTEN = 1
- Enable the fault injection- Write
0xA5A5A5A5
at0x1000
and0x12345678
at0x1004
- This will write in a 64-bit section of the page buffer FFLTPAR.SECOUT
contains the computed ECC bits on the 64 data bits0x12345678A5A5A5A5
, that is 0x8CDATA[0]
will be corrupted on purpose by the fault injection logic on writesCTRLA.CMD = 0x04
- Write page commandCTRLA.CMDEX = 0xA5
- Execute page writing0x12345678A5A5A5A48C
will be written in memory at0x1000
- Wait for
INTFLAG.READY = 1
- Read a 32-bit word at
0x1000
- The NVMCTRL will internally read
0x12345678A5A5A5A48C
in memory FFLTPAR.SECIN = 0x8C
- That is the value of the ECC bits read in memory, untouched by the fault injection on writes and reads in this exampleFFLTPAR.SECOUT = 0xAF
- This is the ECC computed again on the 64 bits of data read. It is different from0x8C
since the data has been corrupted on purposeINTFLAG.FLTCAP
, andINTFLAG.SERR
will be setFFLTSYN.DERRSERR = 0x1
FFLTSYN.SECSYN = 0x23
- Confirms thatDATA[0]
was the faulty bit- The data is corrected on the fly and the correct value
0xA5A5A5A5
is sent back to the host - Write
INTFLAG.FLTCAP = 1
andINTFLAG.SERR = 1
to clear the flags
At this step it is possible to disable the ECC logic and perform the same read again. If
the cache is disabled, the value read will be 0xA5A5A5A4
(confirming
that the data in Flash has really been corrupted as expected, and that it has really
been corrected by the ECC logic during the previous read). If the cache is enabled, the
previously corrected data will be read again from the cache.
The pseudo code above is illustrated in the following figure: