Write-protect boot and program memory

[kgng97ccs]

Environment: PIC18LF46K22, MPLAB 8.92, CCS v5.115

I am trying to resolve an issue I am facing. I am using a bootloader and a serial loaded application on the PIC18LF46K22.

Bootloader: #fuses WRTB, NOWRT
Application: #fuses WRTB, WRT

The compiled application .lst file shows that the fuses are configured correctly:
Word 6: A000 (WRTB write-protected, WRT0 to WRT3 write-protected).

However, I found that after I bootloaded the application and read back the Config registers using read_program_memory() in my application runtime, I found WRT0 to WRT3 blocks are not write-protected.
Word 6: A00F (WRTB write-protected, WRT0 to WRT3 not write-protected).

What I want to do is to write-protect the boot memory in the bootloader, so that I can still load the application in bootload mode (#fuses WRTB, NOWRT). However, I want to write-protect the entire program memory and boot memory once my application has been loaded (#fuses WRT, WRTB). The next time I enter bootload mode I want the fuses to revert to WRTB and NOWDT, so that I can bootload a new application again.

How can I achieve this?

[Ttelmah]

What you do, is code protect, write protect and read protect the bootloader.
Then enable code protection for all the memory. Understand that code
protection prevents _external_ read and writing The bootloader can
still write to code protected memory, unless EBTR bits are set.
Understand that with the CP bits set the memory is already protected
from external reading and writing.
Once any proaction fuse is set, it cannot be turned off without a full
chip erase. They would be pointless if you could turn them off from the
bootloader or code.

[kgng97ccs]

Thank you, Ttelmah.

My main concern is not about prevention from external reading and writing, but I have observed some cases of corruption of program memory during runtime. The device can be exposed to extremely low temperatures (-45°C) and being battery-operated, it is possible that the battery voltage drops at such low temperatures. The PIC (PIC18LF46K22-I/MV) is running off a 3-V LDO supplied by a 3.6-V, 1.6-Ah lithium primary cell. The battery is rated to -60°C.

These are the current fuses in my application:

[Ttelmah]

OK. The first thing is to make sure that the bootloader write code cannot
be called when the temperature is outside the allowed range. Is it possible
to have temperature sensing in the project?. Remember there are things
like diodes that can give a rough guide to temperature. So long as your
bootloader code cannot write unless the temperature and supply are
acceptable, this removes the problems with writes.
The article you point to is dealing with mainly high temperatures not low,
however brownout is vital on any battery driven application, and obviously
becomes more likely at low temperatures. Also having a POR delay is
always good practice, but won't affect the system once running, so is
unlikely to affect a running system.
Have you considered the RF part of that article?. I've seen RF problems
becoming more and more common on the modern lower voltage PICs.
If the system is getting to -45C, then this is outside the operating range
for the processor. -40C is it's minimum. You might talk to Microchip, on
some chips they do offer a M range device, but they don't list it for this
device.

[kgng97ccs]

Thank you, Telmah.

In the field, the bootloader mode is unlikely to happen in normal use, as that would require a combination of MCU reset and external button press. There is a temperature sensor on board, and I may try to activate it to see if it helps too. Loading of the application is via UART, which is not accessible to the user.

Thank you for pointing out the RF portion, which didn't occur to me until now. There is an NFC interface on the device, and the power generated by the NFC reader may affect the MCU. This interface is used daily frequently by the user.

Thank you for sharing your insights and information on the M range devices.

[Ttelmah]

On your fuses, you should enable BROWNOUT, and PUT. Set the brownout at
a voltage the battery should never get to, which will stop the device if
it does fall this low.

[temtronic]

brrrrrrrrrrrrrrrrrrrr -40C or -40F ??? yes, it's the same COLD !
-17*C here in southern Ontario, cat went out for ONE quick coffee, he's back warming up..

I'm real curious where the project is, North Pole or an environmental chamber ?

Along with PIC 'parameters', passives (R and C ) will change, found that out with some R-C timing. Also insect EVERY solder joint, flex the board, check again,Cold 'shrinks' things, might get an 'open'.

Really impressed about a battery good to -60C !

[Ttelmah]

Yes. The lowest normal battery temperature I know of is about -40C. Very
impressed if he has one that goes below this. The ones we use are
Manganese Dioxide Lithium, and are rated to -40C. On all of these though
you have to degrade the actual rating of the battery, both on capacity and
slightly on voltage.
I suspect he might be using the Tadiran batteries. They offer models that go
down to -100C. Lithium Thionyl Chloride. Salt also do models using a similar
technology that go down to very low temperatures (-55C).

[kgng97ccs]

Thank you, Ttelmah and Temtronic. We will enable the BROWNOUT and PUT and continue to observe. This product is a cold-chain temperature logger. It uses a lithium thionyl chloride (Li-SOCl2) battery rated to -60°C. All PCB components are rated to -40°C or lower.

[temtronic]

brrr, I'm still cold from the previous posts ! OK, interesting product, similar to this... https://www.omega.ca/en/data-acquisition/data-loggers/temperature-and-humidity-data-loggers/p/OM-21-Logger?srsltid=AfmBOoo5v4aZ5tqyzxwuUScCcGnU5b-JCGwmcJ3Ar2cdVO2ywY9azNEt

hay, Google found it for me......so now I have a better appreciation for the 'tight' specs you have to work with...

I'm still cold though
Spring in 55 days here in Ontario......

[Ttelmah]

If you are working at -45, then you need the parts to go beyond this on their
specs. -40, is not adequate. Many parts will work slightly above their high
temperature ratings, but often parts are at their limit at the bottom end of
the temperature range. Semiconductors in particular need significant
changes in the doping concentrations if they are to carry on working
reliably. Data corruption in particular is a standard failure mode for EEPROMs
and flash memory at low temperatures. It's like specifying a resistor, where
you want to handle 1/2W, and putting in a 0.4W rated part. It may well work
in some cases at room temperature, but as soon as the temperature rises
you will see failures. The same applies the other way with the low
temperatures. If you need to support -45C, you need parts supporting
this temperature or lower.
You really need to go through your parts list and get military specced parts
for everything. On the PIC, talk to Microchip. They may well suggest an
alternative chip where they do support this range.

[kgng97ccs]

Thank you, Ttelmah and Temtronic. When we designed this product, we actually did not intend for it to be used below -40°C, so we did not choose components rated to -45°C. For now, we will do our best to work with what we have first and consider changes only in the future.

[Ttelmah]

Is it possible you could keep the board temperature slightly above the
ambient?. If the electronics is running, it will generate some heat. If there
is at least some insulation round the assembly, you could keep the board
above the rated minimum.
There is an old story about cold war atomic bombs, where they planned to
keep chickens in the underground assembly to keep the kit above the
minimum temperature it'd support......

[temtronic]

or... use the battery to power a small heater to keep it all warm ! Same tech as every EV does !!

Big issue for me is can the battery actually power the device ,at that temperature, for whatever required time ??
Say it has to work for 10 days ,@ -35. Can the battery reliably supply the electrons ???