The word program is doing specific work in a request. It does not mean the code, and it does not mean the file. It means something a production line can act on: put this into a blank device and get a unit that behaves like the one that came out of it.

On an RX62T that requires four artefacts, and only one of them is the array. The other three live in the same flash or in the customer’s head, and the failure that follows from omitting them is not a failed burn — it is a unit that works, and then behaves differently from the original under a condition nobody tested.

R5F562TABDFF#V3 is one of the larger-memory order codes in the group, QFP-type package, with a version suffix that identifies a shipping configuration. Its peripheral set is the motor-control one: two twelve-bit converter units, a six-channel timer, a thirty-two-bit general timer, and the output-enable logic that makes an inverter safe when the core stops.

What the top of the map contains

The third row is the one that gets skipped, and it is the one that decides whether a rebuilt unit survives a brown-out, a stuck loop or a watchdog reset the way the original did. It sits in the same flash, immediately below the vectors, and a full read returns it as ordinary data — which is precisely why it gets mistaken for part of the code and never examined.

What the configuration actually changes

Three fields do most of the work, and each has a symptom that appears weeks after delivery.

The watchdog configuration decides whether a watchdog runs, how long its period is, and whether it can be disabled by software. A rebuild with the watchdog off runs perfectly on a bench and fails in the field, because the original design’s fault recovery depended on the reset happening. This is the most common omission and the hardest to argue about after the fact.

The protection setting decides whether the programming interface will read the device at all. Copying it into a replacement reproduces the original’s behaviour exactly, including the part where the next recovery is harder. Leaving it off makes the replacement easier to service and different from the original. Both choices are defensible; making it by accident is not.

The reset and supervision settings decide how the device behaves while the supply is rising and falling. A design with a slow supply ramp and a conservative supervision threshold will start reliably; the same code on a rebuilt unit with a different threshold will occasionally not start at all, and the symptom will look like a firmware bug for as long as it takes somebody to compare the configuration bytes.

Why reading it first saves a session

There is a practical reason to read the option area before the array, beyond completeness.

It predicts whether the array will answer. A device whose protection state is set will complete the handshake and return a uniform value; knowing that in advance is the difference between diagnosing a protected device in a minute and diagnosing a dead fixture over an hour.

It also reveals the boot configuration. Some designs start into a loader rather than into the application, and a listing that assumes the reset vector points at the application will analyse the wrong code first.

And it records the clock supervision settings, which constrain the code: a design that supervises its oscillator will contain a startup sequence that waits for stability, and that sequence is a landmark for finding the beginning of the application.

What a burnable bundle contains

Four items, each of which answers a question the others cannot.

The full image with addresses, in the format the customer’s programmer accepts, including the top-of-map regions rather than stopping below them.

A configuration summary: protection state, watchdog behaviour, reset pin function, supervision thresholds — in words, with the raw values alongside so that a disagreement can be settled.

A clock statement. This is not in the flash at all: the design assumes a crystal or an internal oscillator at a specific frequency, and the code’s timing constants are meaningless without it. Two lines of text prevent a whole class of after-sales argument.

And a map: which address ranges are code, which are constant tables, which are the vectors, and which are configuration. A customer who receives four files without a map will eventually burn the wrong one into the wrong region.

The failure that follows from omitting the configuration

It is worth describing in one paragraph, because it is the reason this page exists.

A unit is rebuilt from a correct image with default configuration. It boots, it runs, it drives the motor, and it passes the functional test. Three months later, in a cabinet where the supply dips on a contactor closure, the original units reset and recover while the rebuilt ones latch into a state that requires a power cycle. Nothing in the code is different. The difference is a supervision threshold nobody copied, and finding it takes a comparison of two configuration dumps that nobody kept.

That is the entire argument for treating the option area as part of the program rather than as an implementation detail.

For the flash read that produces the array in the first place, R5F562T6EDFF flash covers the protection matrix. For a data store that also lives in the same flash, R5F562TAEDFF EEPROM explains the emulation scheme. And for the clock question that the bundle has to state explicitly, R5F562T6DDFF program takes it apart.

FAQ

Is the option area part of the hex file? On a full read, yes, as ordinary data. It is still a separate concept and it should be reported separately, because it configures behaviour rather than containing it.

Can a rebuild use default configuration? It can, and it will behave like a different product. Whether that matters depends on what the original was protecting against.

Does copying the protection setting make the replacement harder to service? Yes, and deliberately. That is why the choice should be the customer’s rather than the supplier’s default.

The short version

A program is four artefacts. Read the top of the map before the array, report the configuration in words as well as bytes, state the clock the code assumes, and provide a map so nobody burns the wrong region. The array gets a unit to boot; the other three get it to behave like the one it replaced.

Comments are closed.