Hello Community Members,

This BLOG should be used as a "guide" for examining the Memory Map configurations and Application Development.

This is a compilation of Memory Map questions and answers from several of our forum users and I thank you for your questions and answers.

The Memory Architecture consists of both RAM and ROM with external EEPROM in the BCM20732/36/37 devices.

The Memory Architecture of the BCM20732S/36S/37S consists of the RAM and ROM with Internal EEPROM.

ROM vs. RAM application assignment has caused some confusion in the past, so we eliminated this nomenclature in SDK 2.0.1.

The ROM contains:

1. Embedded BLE stack
2. L2CAP, GAP, GATT
3. BT_SIG approved profiles such as proximity, heart rate monitor, thermometer, blood pressure monitor and time
4. SMP
5. HCI
6. Drivers for I2C EEPROM, SPI EEPROM and SPI Serial flash

GATT:

1. GATT database handles are 16 bit values from 0x00 to 0xFFFF
2. This limits you to ~65K entries in the database
3. With SDK 1.1.0, GATT characteristic length/max length is a 1 byte field
4. SDK 2.0.1, it could optionally be a 2 byte field too
5. The BT spec limits characteristics to a max of 512 bytes
6. You will hit the available RAM limit long before your database gets anywhere close to this

ROM applications typically has some part of the application in the ROM and whatever user writes adds functionality to the ROM code

Application code is loaded in to NVRAM

RAM apps use LE Stack in the ROM

NVRAM:

Let's take an example from ws_upgrade.c in [uart|ota]_firmware_upgrade sample app from SDK 2.0.1

1. When you read/write/delete NV items using bleprofile_*NVRAM, these operations are performed in the section marked VS1 in the picture above.
2. The stack uses some of this for some internal book-keeping
3. When you pair, all pairing information is stored in this area too
4. So it is possible that you ran out of space when you attempted to store the 63 remaining bytes
5. You can increase the the space allocated for VS1 by changing a couple of options in <SDK>/Platforms/BCM92073?TAG_Q32/2073?_EEPROM*.btp

Note: If you increase DLConfigVSLength, you may have to also increase ConfigDSLocation (which is the same as DS1 in the picture above) so that there is no overlap (the hex file conversion step when building will fail if it detects an overlap between the two regions).

Serial FLASH:

Serial Flash images are not compressed (because SF reads has only ~3% overhead and decompressing will make it slower).

BCM20736 will not access more than ~128kbytes from the base but the API uses 24 bit addresses (serial flashes use 24 bit addresses), so the entire SF should be accessible

The virtual addresses used by the FW API for EEPROM and SF is different

0xFF000000 for EEPROM and 0xF8000000 for Serial FLASH

These offsets should be used with bleappfwu_*().

PATCHES:

Patches take up 1900 bytes (today) assuming you only want the mandatory patches (no extra features that are being patched in).

So your application space gets ~28K (today)

MEMORY ARCHITECTURE BLOCK DIAGRAM:

Let's start with a Memory Map Diagram of the BCM20732:

The 30K is shared memory (between patches and the app) and the dynamically allocated buffers also take up some of this space.

The ‘total RAM footprint ‘ line at the end of the build is only the static portion of the app + patches (includes code + initialized and uninitialized data) in our flat memory model.

So you cannot take the app start address and add the app size and then subtract from 60K to get remaining size

The 4K CM3 Mapper is for the Cortex M3 Memory Map for Interrupts Stack, etc.

Note that our Stack (YELLOW) is 30K and is DATA ONLY.

The Patches Section (Features,Updates, etc) is combined with the User App but:

1. The Patches_Init Code is overlayed and can be used by the App after the Patches are loaded
2. The App_Init/BLE_SET_CONFIG is also overlayed by the Dynamic Allocation

Static variables that are NOT initialized end up in the data area:

1. The ‘Data ONLY’ area in yellow is the data area allocated by the BLE stack that’s in the ROM
2. So nothing new goes in here
3. All application data (RW and ZI) and application code (Code + RO) goes into the same region in the RAM

SDK 2.0 Hello_Sensor Example App:

As an example, we take the Hello_Senor App and using the SDK Console Window, we see the Patches Start/End Addresses:

The Patches and Application Start Addresses are listed below:

As you can see, there is overlap between Patches and Beginning of Application

So after the Patches are finished loaded, a portion of the RAM is available for the Application

Here is what is happening:

1. Patches start at where the ROM finished 0x00204568
2. Patches end at 0x00204AFC, but the Application starts at 0x00204974 even before the Patches end
3. So there is an overlap.
4. Once the application ends at 0x00204C28, but dynamic allocation starts even before this.
5. The reason is that in the order in which we boot, The Patches get copied in first and they will get initialized.
6. Then the section of the code where there in Patch initialization, that will get reused and we will put the application on top of it and overlay the application.
7. Once the Patch Init code is running, we can replace that section with the application code.
8. We are re-using the RAM from the Boot Loader and Reusing the application initialization code also for dynamic allocation
9. Once we have initialized, we don/t need that code anymore.
10. The ROM boots and copies in ALL of the patches
11. And then it will run the Patch Init Code and installs all of the MANDATORY patches
12. Once that copy is done, you don’t need that Patch Init Code
13. The ROM will copy the Application on top of it.
14. Overwrite the Patch Init Code with Application Code
15. Application Code will be 1.7K of code or less.
16. The App calls the App Init Function and will say, available RAM is here
17. Then the ROM starts Dynamic Allocation from here
18. What goes in?
19. Buffer,xx, Stack Buffer Tools, and Data
20. Call Back Registrations
21. Dump the Stack on the Peripheral UART and reset

Question – How much memory do you have?

1. There is a function call CFG_MM_MemFreeBytes
2. This is a pointer that keeps moving at every step
3. When ROM finishes Initialization, available RAM is pointing to this
4. When PATCHES finish Initialization, available RAM is pointing to this
5. When the App finishes the Initialization, available RAM points to this area
6. We can find how much we need by making 2 calls to RAM:
7. By using init.c, we can take a snap shot of what this function returns and this will tell you where nm is at this point of time
8. At the end of your Application Create Function, you take another snapshot of this guy and the difference between these 2 is your dynamic allocation

Notes:

The NVRAM has a lot of headers.

Serial FLASH is similar 0 – 4K

Questions:

Q: In the first diagram it suggests that the maximum size of an app should be 26K?

A: 26K is a good approximation because it really depends on what (HW/drivers/features) the app initializes and uses.  cfa_mm_MemFreeBytes() is the ultimate authority on the amount of RAM available

Q: Is there any way to estimate the amount needed for 'dynamic allocation' in that first diagram?

A: Not really, this is allocated for OS buffers, TX and RX buffers, stack buffer pools, thread stacks, callback registrations etc.

Q: If I end up with a total ram footprint of 26K , I am nervous that I might get overruns?

A: Yes

Q: What is the maximum stack size?

A: The app thread stack size is 1K (1024 bytes).

Q: What is the amount of space available for global and static variables?

A: The app code + globals (initialized and zero-initialized) all share the same space. So allocating more globals will reduce space for app code and vice-versa.

Q: Are there any built in functions of the stack that can be turned off to save space, for example if I disable the battery status profile does that cut down on the footprint?

A: No, here's why

Disabling battery monitor will not give you more space because its in the ROM.

This BLOG should get you going and I will be adding more later.

Additions:

The CPU core is an ARM Cortex M3 which supports unaligned accesses (so no exceptions will be thrown).

However, there is a performance penalty - the instruction will take multiple cycles to complete and the pipeline will stall (see ARM documentation). Load/Store multiple instructions do not support unaligned accesses.

Thanks

JT

This BLOG is a short introduction for configuring the TAG3 board for use with the Serial FLASH.

This information is taken from our TAG3 document Manual :  The specified document was not found. and our Quick Start Guide The specified document was not found.

1.  The TAG3 board contains a Serial FLASH device and can be configured with a few resistor modifications and additions:

See the TAG3 Board below:

2.  TAG3 Board Assembly displaying the resistor installation/modifications for the on board Serial FLASH:

3.  The table below defines the resistors to configure the Serial FLASH:

4.  You will need to place the SW4 switches 5,6,7,8 in the OFF position (They are actually show in the ON Position in this photo):

5.  In the SDK you will need to modify your Make Target to include NV=SFLASH:

Note: In this case we have used COM Port 21 as observed in our Windows Device Manager:

5.  Using the Recovery Procedure from the The specified document was not found. document, your recovering console message should look like the following:

A few extra notes about Serial FLASH:

You will need to use the same Macronix Serial Flash that is supported by the ROM and ships on the TAG3 board.  Please see the schematic snippet below:

The Macronix MX25U4033 device works as well if you needed a second option.

Please see the notes below:

MX25U4033: https://www.macronix.com/en-us/products/NOR-Flash/Serial-NOR-Flash/Pages/spec.aspx?p=MX25U4033E&m=Serial%20NOR%20Flash&n…  (good for new designs)

MX25U4035: https://www.macronix.com/en-us/products/NOR-Flash/Serial-NOR-Flash/Pages/spec.aspx?p=MX25U4035&m=Serial%20NOR%20Flash&n=…  (not recommended for new designs)

Regarding the two different Flash PNs, here’s a document from the Macronix website that compares the two:

https://www.macronix.com/Lists/ApplicationNote/Attachments/1872/AN126V1_MX25U4035%20to%204033E.pdf

                                   

• Code Overview
  
  • iBeacon and SDK 2.1 Code Overview
  • WICED Smart BCM2073X Coding Tips from user maxsong...
  • WICED Smart Training videos, compliments of Macnica North America...
  • BCM92073X BLE Profile Configuration

• General Questions
  
  • BCM20732 questions
  • How to get started (coming from arduino)
  • What is difference between being connected versus paired?
  • Wiced Smart Software Runtime -- Lots of Questions
  • About BCM20737S
  • BCM20737s: NFC Reader or only TAG?

• Hardware Design between 2073X and External MCU

• Reference Design/Schematics
  
  • New iBeacon BCM20737 Reference Design
  • Experts Interview Video: Michael L. - IBCN BCM20737 Schematic Review
  • BCM20737TAG Board - Gerbers and Schematics

• Layout
  
  • BCM20732 layout options
  • BCM20737S input capacitors and placement
  • BCM20732S layout
  • Are pullup resistors always needed on 20732 SCL and SCA pins?
  • Exact Location of internal PIFA Antenna on BCM20737S
  • 20732S XTAL (32KHz)

• General
  
  • WICED Smart Video BLOG: SDK 2.1 Smart Designer Tool Walk-Thru
  • WICED Smart BCM92073X GATT DB Operation
  • Lots of questions.. L2CAP/GATT/GAP, etc
  • Multiple Notifications in an App...?
  • Support for very large characteristics

• Other
  • How to change the GATT database after init (bleapp_set_cfg) ?
  • Is pairing/encryption mandatory to allow a peer to write in GATT

• Advertising
  
  • Customizing Advertising on WICED Smart
  • Best way to rewrite advertisement data
  • Connectable vs. nonconnectable Advertisements.
  • How to change advertisement interval after init?
  • Advertising during connection
  • bleprofile_notifyAdvPacketTransmissions doesn't work.

• Callback to modify single advertisments?
• About the bleprofile_GenerateScanRspData function?
• How to register callback for ADV events ?

• Scanning
  
  • Scan sometimes stops working
  • Scheduling of scan window and connection window

• Additional master/slave questions on BCM20736/7 family
• Re: How best to implement bulk data transport
• smp_bond_result 04
• Connection Event Callback API
• Connection Event Callback API (follow-on)
• Connection Interval and Connection Slave Latency
• When does bleprofile_sendNotification() actually send?
• Check if bleprofile_sendNotification() was successful
• Slow reconnection
• Sometimes connection not bonding

• Adding and removing master nodes to a whitelist running on a peripheral device

• General
  
  • BCM2073XS GPIO Basics
  • Can someone tutor me on GPIO usage?
  • GPIO Headers
  • BCM20732S PIN information
  • BCM2073xS (BCM20737S) GPIO bonding

• Interrupts
  • Access_tag_interrupt_handler
  • How to identify GPIO interrupt source pin?
  • Buttons in hello_sensor.c
  • How can I wake BCM20737S up by using GPIO interrupt?
  • How to disable interrupt?
  • GPIO in high impedance mode
  • Wake up on GPIO interrupt

• General
  
  • Information: Debug the BCM20732 Tag over HCI-UART using a COM port via USB on the PC
  • How to debug the board step by step?
  • Information: BCM20732S debug/trace capabilities through the HCI UART port
  • How do I interpret the extra tracing data ?
  • Testing Master and Slave Roles
  • How can I use ble_trace() for application debug?
  • How to get debug traces ?
  • WICED Sense debug with UART
  • How to disable 20737S SDK trace, BLE_TRACE_DISABLE?

• J-Link
  • WICED Smart J-Link Debugger
  • WICED Smart - Debugging Support Using a J-Link Probe Application Note

• BCM92073X TAG Power Supply Configurations
• Power level granularity in blecm_setTxPowerInConnection() and blecm_setTxPowerInADV()
• Current Draw and Advertising Timing on the WICED Sense (BCM20737S)
• how to reduce the power consumption when use puart ?
• BCM20737S Current Consumption Voltage Condition and more...
• [BC20636S] Power consumption advantages when using external oscillator

• BLE RF Testing Specification Introduction
• BLE RF Testing Setup Procedures

• General
  
  • WICED Smart Video BLOG: Experts Interview - Sleep Deep_Sleep and Advertising
  • Sleep Deep_Sleep Explanation and Techniques
  • WICED Smart Sleep/Deep-Sleep Explanation and Techniques Design Guide
  • BCM20736S Sleep Example Firmware
  • Questions sleep and deep sleep modes on BCM20737
  • GPIO Interrupt State after Deep Sleep

• Entering Sleep
  
  • How to enter HIDOFF?  How to detect if the request is not honored?
  • Putting '20732S into sleep or deep sleep mode
  • BCM20736S HIDOFF problem
  • Problem with sleep mode
  • Sleep Mode on 20736S

• Waking From Sleep
  • Boot Time of WICED Smart Tag Board (BCM20737)
  • GPIO state in deep sleep
  • For wake on GPIO interrupts, please look under GPIO->Interrupt
    

• WICED™ Smart Hardware Interfaces
• BCM20736S I2C, PUART and SPI comms
• SPI1 access or send command to flash in application level.

• Memory:
  • BCM20732 Memory Map Architecture
  • BCM92073X TAG Memory and Programming Configurations
  • WICED Smart BCM92073X I2C EEPROM Emulation Porting Guide
  • WICED Smart BCM92073X EEPROM and SFLASH Layout
  • WICED Smart BCM92073X NVRAM Access
  • Memory size limits on 20732?
  • BCM20732S NVRAM Size
  • nvram: number of locations to write to
  • BCM20736S I2C, PUART and SPI comms
  • It seems that I can not read the data is stored in NVRAM before the last power off.
  • Layout of VS1 in the EEPROM
  • Re: Accessing the 512 kb (64 kB) EEPROM in the 20737S module

• PWM:
  • LED with PWM
  • Different Frequencies for PWM
  • How many PWM channels available in BCM20732S ?
  • BCM92073x periodic interrupt rate
  • How to turn on LED

• ADC:
  • BCM20732S ADC Configuration
  • Questions related to the ADC implementation on the BCM2073XS...
  • ADC on BCM20732

• UART:
  • Information: Programming your BCM20732S-based board from an onboard UART header
  • UART does not receive
  • UART Routines
  • BCM20732S based boards sometimes develop UART failure
  • Spec for uploading firmware to the BCM20732S via HCI UART?
  • puart_write() crashing on BCM20736?
  • Peripheral UART missing bytes
  • Problem with UART watermarks
  • PUART RTS/CTS Hardware Flow Control
  • What are the PUART FIFO Rx interrupt threshold settings?
  • Need clarification on PUART RTS/CTS flow control support

• I2C:
  • I2C Discussion
  • BCM20736S recovery problem - SDA high does not enter recovery mode
  • How can I use i2c in BCM20737S?

• SPI:
  • SPI on BCM920732TAG
  • Spi Debug
  • SPI flow control

• Timer in 2073x
• BCM20737S Timer Module

• Software/Usage
  
  • appFineTimer
  • FineTimer
  • What is the best way to set an application timer to fire?
  • how to config RTC use external 32.768?
  • Re: How to use real time tick clock?
  • rtc_sample bricks our BCM20736S-based board
  • Turning off the timers in BCM20736S
  • Hello_client/blecen Timer Callback Questions

• Watchdog Timer
  • How can I get bcm20732s reset reason?
  • Increasing/Disabling the watchdog timer

• Crystal
  • Explanation of Crystal Warmup Issue
  • Crystal warm-up work-around video...
  • 32kHz Crystal Spec?
  • Internal vs. External Oscillator

• RTC
  • rtc_RtcTime2Sec() returns wrong seconds when RtcTime.year is 2016
  • How to use real time tick clock?
  • rtc_sample bricks our BCM20736S-based board
  • how to config RTC use external 32.768?

• Watchdog Timer
  • Increasing/Disabling the watchdog timer
  • How can I get bcm20732s reset reason?

• Hardware Timer
  • How to use 100us interval timer?
  • Hardware Timer (hw_timer.h) usage
  • HW Timer in 2073x
  • Timer in 2073x
  • Wiced Sense hardware timer example
  • Wiced Sense hardware timer example (part 2)

• WICED Smart BCM92073X OTA Firmware Upgrade (1)
• WICED Smart BCM92073X OTA Firmware Upgrade (2)
• How to do OTA: Step by Step with PDF
• SOTAFU for Android and iOS
• Why error occur when I open WsOtaUpgrade.exe?
• Why error occur when I open WsOtaUpgrade.exe? (continued)
• Issue with using Windows OTA upgrade app

• How to recover BCM20736S on custom board?

Security:

• Encryption API
• How to operate RSA in BCM20737S & BCM20737S document
• Update on RSA and/or app note for BCM20737?
• BCM20736S and RSA
• RSA Document
• BCM20737S: LE security mode1 level3/4 supported?

• Programming manufacturing data during production
• Do I need to register separately with the Bluetooth SIG to use the Bluetooth logo in my product?

• BD_ADDR - how do you get one?
• BD_ADDR: Changing BCM20737 Board Address for Production
• Changing BD_ADDR from the application
• Video Link : 1216

• Programming the TAG2/TAG3 Board using command line tools
• BCM20732S refuses to program
• cgs.exe and ChipLoad.exe

• WICED Smart BCM92073X Generate Your Own UUID

• Broadcom BCM20732S/BCM20736S/BCM20737S Regulatory Approvals
• Certification from Bluetooth SIG
• 20732S regulatory certification
• More questions regarding FCC certification on the BCM2073XS Product
• FCC Certification Flow for Broadcom module products
• FCC approval for BCM20736S

The following WICED Smart BCM2073X Coding Tips were a contribution from one of our BLE power users, maxsong

A special thanks go out to Max for sharing this material he generated with the community.

WICED Smart BCM92073X EEPROM and SFLASH Layout

WICED Smart BCM92073X OTA Firmware Upgrade (1 of 2)

WICED Smart BCM92073X OTA Firmware Upgrade (2 of 2)

WICED Smart BCM92073X I2C EEPROM Emulation Porting Guide

WICED Smart BCM92073X NVRAM Access

Generate Your Own UUID

Creating a GATT Database 

WICED Smart BCM92073X GATT DB Operation