Removing power during ISP update resets ImageType from Plain CRC to Normal Image

[WilliamW]

I have code that performs an update on an LPC55S28 through the UART that works under all but one failure condition.  When we remove power after transferring say half the blocks of the software, the ImageType value at flash location 0x24 is changed from 0x0002 (Plain CRC Image) to 0x0000 (Normal image for unsecure boot).  This prevents the CRC check which would normally allow the processor to return to ISP mode where the software could then be successfully updated.  The problem can be corrected by pulling the ISP pin low and then updating the software but, I would prefer a software solution and/or to at least  understand the reason that this is occurring.

After removing power while updating, I returned to ISP mode by pulling the ISP pin low while applying power.  I then determined that that the values had changed by reading back the software that was written and finding that the data for locations 0x20 (ImageLength), 0x24 (ImageType) and 0x28 (OffsetToSpecificHeader) contained values that were different from what I wrote.  The remainder of the 0th block was unchanged. 

I haven't been able to find anything in the processor user manual or on the internet about this specific issue.  Can someone tell me why this is occurring and whether there is a way to successfully update the software without using the ISP pin after it occurs?

[Alice_Yang]

Hello @WilliamW 

This is stated in errata:

After testing and confirming with the ROM team, only a full error CRC image will enter ISP mode after a failed boot(for example, you can modify the last few bytes of the CRC image for testing.). When the header of the firmware is valid but the remaining part of the flash is erased, the boot fails but does not enter ISP mode.

This issue should be fixed on latest devices, I have test on date code 23111B LPC55S69 devices(I don't have LPC55S28 on my hand), this feature works well as expected.

BR

Alice

[Alice_Yang]

Hello @WilliamW 

Theoretically, when ISP0 pin is high. If no valid  image is found, the LPC55s28 will enter ISP boot mode based on DEFAULT_ISP_MODE bits defined.

Do you update image with Plain CRC Image type?  What Image type was it before update?

After removing power while updating, it did not enter ISP mode after power again? 

Could you please use a simple LED project image to test? If still have issue, please take a screenshot show the data in flash before and after updating. Show steps is better.

BR

Alice

[WilliamW]

Hi Alice,

Thanks for your quick response.  I have an image that has the ImageLength (0x00032CEC @ 0x20), ImageType (0x0000002 @ 0x24), and crcChecksum (0x9327163F @ 0x28).  I can successfully write the image, read the image to verify the values are correct, and execute the image successfully.  I am using the same data for each test.  One test is to transfer all the blocks, another is to transfer all the blocks with a bad CRC32 value, another is to perform a partial transfer by forcing the tool to terminate mid-transfer, another is to only all the tool to erase before terminating.  All of these situations work as expected and the data read back (with the exception of the erase only) is correct (given what was transferred).

The normal process is to read the data that will be written from a file which already contains the Length, Type, and CRC32.  First the transfer tool establishing communication with the device using the ISP Ping command.  Next the entire flash is erased.  Then each of the 512-byte blocks read from the file is written to its block on the device until the entire contents of the file has been transferred.  Finally the ISP Reset command is called to run the installed program.  If anything goes wrong the program just exits.  There is no clever or even interesting error handling.  When the transfer is terminated by removing power the Ping command at the beginning of the process fails and the program exits.  I use a jumper to manually pull down the ISP pin in order to restore communications with the ISP feature.

The only test that doesn't work is when I terminate the transfer by removing power from the device instead of terminating my transfer tool before the transfer is complete.  In Example A you can see what the data that should be written to the first (0th) block which was read back after a successful transfer. This data only changes when the transfer is terminated by removing power.  In Example B you can see that the data for the Length, Type, and CRC has somehow changed to zeroes.  This doesn't make any sense given that the power was removed long after the first block was successfully transferred.  This consistently occurs when I remove power with my transfer tool.  After power is removed I terminate my tool and restart it.  At that point it can no longer communicate with the ISP feature without manually pulling the ISP down while powering up again.

Example A: First block after normal and terminated transfers without removing power:

ReadMemory 0 512
000 | 00, 00, 03, 20, 81, 01, 00, 00, 19, 02, 00, 00, FF, 4E, 01, 00,
010 | 0D, 4F, 01, 00, 15, 4F, 01, 00, 1D, 4F, 01, 00, 25, 4F, 01, 00,
020 | EC, 2C, 03, 00, 02, 00, 00, 00, 3F, 16, 27, 93, 25, 02, 00, 00,
030 | 27, 02, 00, 00, 00, 00, 00, 00, 29, 02, 00, 00, 2B, 02, 00, 00,
040 | C9, 34, 01, 00, D1, 34, 01, 00, D9, 34, 01, 00, E1, 34, 01, 00,
050 | E9, 34, 01, 00, F1, 34, 01, 00, F9, 34, 01, 00, 01, 35, 01, 00,
060 | 09, 35, 01, 00, F9, 6E, 00, 00, 11, 35, 01, 00, 19, 35, 01, 00,
070 | 21, 35, 01, 00, 29, 35, 01, 00, 31, 35, 01, 00, 39, 35, 01, 00,
080 | 41, 35, 01, 00, 49, 35, 01, 00, 51, 35, 01, 00, 59, 35, 01, 00,
090 | 61, 35, 01, 00, 69, 35, 01, 00, 71, 35, 01, 00, 79, 35, 01, 00,
0A0 | 81, 35, 01, 00, 89, 35, 01, 00, 91, 35, 01, 00, 99, 35, 01, 00,
0B0 | A1, 35, 01, 00, A9, 35, 01, 00, B1, 35, 01, 00, B9, 35, 01, 00,
0C0 | C1, 35, 01, 00, C9, 35, 01, 00, D1, 35, 01, 00, D9, 35, 01, 00,
0D0 | E1, 35, 01, 00, E9, 35, 01, 00, F1, 35, 01, 00, F9, 35, 01, 00,
0E0 | 01, 36, 01, 00, 09, 36, 01, 00, 11, 36, 01, 00, 19, 36, 01, 00,
0F0 | 21, 36, 01, 00, 29, 36, 01, 00, 31, 36, 01, 00, 39, 36, 01, 00,
100 | 41, 36, 01, 00, 49, 36, 01, 00, 51, 36, 01, 00, 59, 36, 01, 00,
110 | 61, 36, 01, 00, 69, 36, 01, 00, 71, 36, 01, 00, 79, 36, 01, 00,
120 | 81, 36, 01, 00, 89, 36, 01, 00, 91, 36, 01, 00, 99, 36, 01, 00,
130 | 7C, 17, 03, 00, 00, 00, 00, 20, 70, 15, 00, 00, 7C, 17, 03, 00,
140 | 00, 00, 00, 04, 00, 00, 00, 00, 7C, 17, 03, 00, 00, 00, 10, 40,
150 | 00, 00, 00, 00, 7C, 17, 03, 00, 00, 00, 04, 20, 00, 00, 00, 00,
160 | 70, 15, 00, 20, 0C, 6C, 00, 00, 00, 00, 00, 04, 00, 00, 00, 00,
170 | 00, 00, 10, 40, 00, 00, 00, 00, 00, 00, 04, 20, 00, 00, 00, 00,
180 | 72, B6, 13, 4B, 13, 4A, 17, 48, 03, 60, 19, 68, 81, F3, 08, 88,
190 | 82, F3, 0A, 88, 10, F0, 36, FE, 0F, 4B, 07, E0, 03, F1, 0C, 04,
1A0 | 9A, 68, 59, 68, 18, 68, 00, F0, 1F, F8, 23, 46, 0B, 4A, 93, 42,
1B0 | F4, D3, 06, E0, 1C, 46, 59, 68, 54, F8, 08, 0B, 00, F0, 23, F8,
1C0 | 23, 46, 07, 4A, 93, 42, F5, D3, 62, B6, 15, F0, EC, FA, FE, E7,
1D0 | 00, 00, 00, 00, 00, 00, 02, 20, 30, 01, 00, 00, 60, 01, 00, 00,
1E0 | 80, 01, 00, 00, 08, ED, 00, E0, 00, 23, 93, 42, 0A, D2, 10, B4,
1F0 | 50, F8, 04, 4B, 41, F8, 04, 4B, 04, 33, 93, 42, F8, D3, 5D, F8,
512 bytes match of 512

Example B: First block after terminating the transfer by removing power 10s of blocks later:

000 | 00, 00, 03, 20, 81, 01, 00, 00, 19, 02, 00, 00, FF, 4E, 01, 00,
010 | 0D, 4F, 01, 00, 15, 4F, 01, 00, 1D, 4F, 01, 00, 25, 4F, 01, 00,
020 | 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 25, 02, 00, 00,
030 | 27, 02, 00, 00, 00, 00, 00, 00, 29, 02, 00, 00, 2B, 02, 00, 00,
040 | C9, 34, 01, 00, D1, 34, 01, 00, D9, 34, 01, 00, E1, 34, 01, 00,
050 | E9, 34, 01, 00, F1, 34, 01, 00, F9, 34, 01, 00, 01, 35, 01, 00,
060 | 09, 35, 01, 00, F9, 6E, 00, 00, 11, 35, 01, 00, 19, 35, 01, 00,
070 | 21, 35, 01, 00, 29, 35, 01, 00, 31, 35, 01, 00, 39, 35, 01, 00,
080 | 41, 35, 01, 00, 49, 35, 01, 00, 51, 35, 01, 00, 59, 35, 01, 00,
090 | 61, 35, 01, 00, 69, 35, 01, 00, 71, 35, 01, 00, 79, 35, 01, 00,
0A0 | 81, 35, 01, 00, 89, 35, 01, 00, 91, 35, 01, 00, 99, 35, 01, 00,
0B0 | A1, 35, 01, 00, A9, 35, 01, 00, B1, 35, 01, 00, B9, 35, 01, 00,
0C0 | C1, 35, 01, 00, C9, 35, 01, 00, D1, 35, 01, 00, D9, 35, 01, 00,
0D0 | E1, 35, 01, 00, E9, 35, 01, 00, F1, 35, 01, 00, F9, 35, 01, 00,
0E0 | 01, 36, 01, 00, 09, 36, 01, 00, 11, 36, 01, 00, 19, 36, 01, 00,
0F0 | 21, 36, 01, 00, 29, 36, 01, 00, 31, 36, 01, 00, 39, 36, 01, 00,
100 | 41, 36, 01, 00, 49, 36, 01, 00, 51, 36, 01, 00, 59, 36, 01, 00,
110 | 61, 36, 01, 00, 69, 36, 01, 00, 71, 36, 01, 00, 79, 36, 01, 00,
120 | 81, 36, 01, 00, 89, 36, 01, 00, 91, 36, 01, 00, 99, 36, 01, 00,
130 | 7C, 17, 03, 00, 00, 00, 00, 20, 70, 15, 00, 00, 7C, 17, 03, 00,
140 | 00, 00, 00, 04, 00, 00, 00, 00, 7C, 17, 03, 00, 00, 00, 10, 40,
150 | 00, 00, 00, 00, 7C, 17, 03, 00, 00, 00, 04, 20, 00, 00, 00, 00,
160 | 70, 15, 00, 20, 0C, 6C, 00, 00, 00, 00, 00, 04, 00, 00, 00, 00,
170 | 00, 00, 10, 40, 00, 00, 00, 00, 00, 00, 04, 20, 00, 00, 00, 00,
180 | 72, B6, 13, 4B, 13, 4A, 17, 48, 03, 60, 19, 68, 81, F3, 08, 88,
190 | 82, F3, 0A, 88, 10, F0, 36, FE, 0F, 4B, 07, E0, 03, F1, 0C, 04,
1A0 | 9A, 68, 59, 68, 18, 68, 00, F0, 1F, F8, 23, 46, 0B, 4A, 93, 42,
1B0 | F4, D3, 06, E0, 1C, 46, 59, 68, 54, F8, 08, 0B, 00, F0, 23, F8,
1C0 | 23, 46, 07, 4A, 93, 42, F5, D3, 62, B6, 15, F0, EC, FA, FE, E7,
1D0 | 00, 00, 00, 00, 00, 00, 02, 20, 30, 01, 00, 00, 60, 01, 00, 00,
1E0 | 80, 01, 00, 00, 08, ED, 00, E0, 00, 23, 93, 42, 0A, D2, 10, B4,
1F0 | 50, F8, 04, 4B, 41, F8, 04, 4B, 04, 33, 93, 42, F8, D3, 5D, F8,
Byte read at 020 read 00 should be EC
Byte read at 021 read 00 should be 2C
Byte read at 022 read 00 should be 03
Byte read at 024 read 00 should be 02
Byte read at 028 read 00 should be 3F
Byte read at 029 read 00 should be 16
Byte read at 02A read 00 should be 27
Byte read at 02B read 00 should be 93
504 bytes match of 512

Thanks for your help,

William

[Alice_Yang]

Hello @WilliamW 

I have tried to reproduce on my side. Will check with our internal about the BOOT ROM. Then reply you after get answer. thanks.

BR

Alice