Backup registers

The 32-bit backup registers (RTC_BKPxR) are reset when a tamper detection event occurs. These registers are powered-on by V_BAT when V_DD is switched off (some products do not implement this feature, like STM32L0 series and STM32L1 series. Refer to Table 4 Advanced features for RTC2 type and AN4759_Adv-RTC-features.html#id_33173__table_hqc_shf_rpb. They are not reset by a system reset, and their contents remain valid when the device operates in low-power mode.

For RTC2 type on STM32L0, STM32L4, and STM32F7 series, the 32-bit backup registers (RTC_BKPxR) are not reset if TAMPxNOERASE = 1 or if TAMPxMF = 1 in RTC_TAMPCR.

For RTC3 type, the 32-bit backup registers (TAMP_BKPxR) are not reset if TAMPxNOER = 1 or if TAMPxMSK = 1 in TAMP_CR3.

For RTC2 and RTC3, disabling the backup register reset feature allows an LPTIM event to be triggered from the tamper pin without erasing the backup registers. The application can then take benefit of the tamper input digital filtering, either to generate triggers or to generate interrupts.

Note:

The V_BAT availability, the LPTIM availability and the number of backup registers depend on the product. Refer to Table 4 Advanced features for RTC2 type and AN4759_Adv-RTC-features.html#id_33173__table_hqc_shf_rpb.

The RTC3 backup registers can be protected against nonsecure or unprivileged accesses (see Reduce power consumption).

BKPRWDPROT[7:0] and BKPWDPROT[7:0] in TAMP_SMCR (except for the STM32U3 and STM32U5 series: BKPRWSEC[7:0] and BKPWSEC[7:0] in TAMP_SECCFGR) are used to program the backup registers offset, delimiting three protection zones for the backup registers:

Zone 1: read and write secure
Zone 2: read nonsecure and write secure
Zone 3: read and write nonsecure

Secure AES boot hardware key (RTC3 only)

Note:

This section is valid only for products embedding a SAES.

The backup registers can be used to store the BHK (boot hardware key) of the SAES (secure AES). If the device supports Arm® TrustZone® security, the eight first backup registers (TAMP_BKP0R to TAMP_BKP7R) must be configured as belonging to the zone 1 (r/w secure) by setting BKPRWSEC ≥ 8 in TAMP_SECCFGR.

Once the registers are written with the key, BHKLOCK must be set to 1 in TAMP_SECCFGR to definitively block the read/write accesses to these registers (any reading returns 0 and any writing is ignored). BHKLOCK can only be cleared by hardware after a tamper event or when readout protection is disabled. In these two case, the backup registers are also erased. After BHKLOCK is set, the SAES coprocessor can use the BHK thanks to a private hardware bus (see the SAES section in the product reference manual and more precisely KEYSEL bits in the SAES control register).

Alternate function RTC outputs

The RTC has two outputs:

RTC_CALIB (RTC2)/CALIB (RTC3), used to generate an external clock
RTC_ALARM (RTC2)/TAMPALARM (RTC3), unique output resulting from the multiplexing of the RTC alarm and wakeup events (and also tamper detection events for RTC3 type)

For RTC3 type, these outputs can be associated to two pins against one pin for RTC2 type. Refer to OUT2EN in RTC_CR of RTC3 type to choose which function is output on which pin.

RTC_CALIB output

The RTC_CALIB output can be used to generate a 1 Hz or 512 Hz signal, and to measure the RTC clock deviation when compared to a more precise clock.

Setting 512 Hz as output signal

Select LSE at 32768 Hz as RTC clock source.
Set the asynchronous prescaler to the default value 128.
Enable the output calibration by setting COE = 1.
Select 512 Hz as the calibration output by setting COSEL = 0.

Setting 1 Hz as the output signal

Select LSE at 32768 Hz as the RTC clock source.
Set the asynchronous prescaler to the default value 128.
Set the synchronous prescaler to the default value 256.
Enable the output calibration by setting COE = 1.
Select 1 Hz as the calibration output by setting COSEL = 1.

Note:

Refer to figures in RTC calibration methodology.

Maximum and minimum RTC_CALIB 512 Hz output frequency

The RTC_CALIB output can also be used to generate a variable-frequency signal. Depending on the user application, this signal can play the role of a source clock for an external device, or can be connected to a buzzer to generate sound.

The signal frequency is configured using the 6 LSB bits (PREDIV_A [5:0]) of the asynchronous prescaler PREDIV_A[6:0].

Table 17. RTC_CALIB output frequency versus clock source
RTC clock source	RTC_CALIB output frequency
RTC clock source	Minimum PREDIV_A[5:0] = 111111 (div64)	Maximum PREDIV_A[5:0] = 100000^¹ (div32)
HSE_RTC = 1 MHz	15.625 kHz	30.303 kHz
LSE = 32768 Hz	512 Hz (default output frequency)	993 Hz
LSI = 32 kHz	500 Hz	969 Hz
LSI = 37 kHz	578 Hz	1.121 kHz
LSI = 40 kHz	625 Hz	1.212 kHz

¹ PREDIV_A[5] must be set to 1 to enable the RTC_CALIB output signal generation. If PREDIV_A[5] = 0, no signal is output on RTC_CALIB.

RTC_ALARM (RTC2)/TAMPALRM (RTC3) output

The alarm, wakeup and tamper flags can be routed to the RTC outputs (one output for RTC2 type, three for RTC3 type) thanks to OSEL[1:0] in RTC_CR.

For RTC2 type

OSEL[1:0] = 01 roots alarm A to the RTC_ALARM output.
OSEL[1:0] = 10 roots alarm B to the RTC_ALARM output.
OSEL[1:0] = 11 roots wakeup flag to the RTC_ALARM output.

Once OSEL[1:0] is fixed, the output reflects the selected flag stored in RTC_ISR.

For RTC3 type

The OSEL[1:0] selection follows the same principle as for RTC2 but, when TAMPOE = 1 in RTC_CR, tamper flags are ORed with the flag already selected (alarm A, alarm B or wakeup) before the OR result to be rooted to the TAMPALRM output.

If TAMPOE = 1 and OSEL[1:0] = 00, TAMPALRM output reflects only the tamper flags.

For both RTC2 and RTC3 types, the output pin polarity is selected with POL in RTC_CR. When POL = 1, the opposite state of the flag concerned is output on RTC_ALARM (RTC2)/TAMPALRM (RTC3). The pin can also be configured as open drain or push-pull with the ALARMOUTTYPE (RTC2)/TAMPALRM_TYPE (RTC3) bit of the same register (0 for push-pull, 1 for open-drain).

For RTC3, an internal pull-up can be added to the output pin by setting TAMPALRM_PU = 1 in RTC_CR.

RTC safety aspects

RTC register write protection

To protect the RTC registers against possible unintentional write accesses after reset, the RTC registers are initially locked after a Backup domain reset. These registers must be unlocked to update the current calendar time and date.

The write access to the RTC registers is enabled by writing a key in RTC_WPR, only with the following sequence:

Write 0xCA in RTC_WPR.
Write 0x53 in RTC_WPR.

Any other write access sequence to RTC_WPR activates the write-protection mechanism for the RTC registers.

Enter/exit initialization mode

The RTC can operate in two modes:

Initialization mode (counters stopped)
Free-running mode (counters running)

The calendar cannot be updated while the counters are running. The RTC must consequently be switched to the Initialization mode before updating the time and date. When operating in this mode, the counters are stopped and they start counting from the new value when the RTC enters Free-running mode.

The INIT bit in RTC_ISR (RTC2)/RTC_ICSR (RTC3) enables the user to switch from one mode to another. The INITF bit in the same register can be used to check the RTC current mode.

The RTC must be in Initialization mode to program the time and date registers (RTC_TR and RTC_DR) and the prescalers register (RTC_PRER). This is done by setting INIT = 1 and waiting until INITF flag is set.

To return to the Free-running mode and restart counting, the RTC must exit the Initialization mode (done by resetting INIT = 0).

Only a power-on reset can reset the calendar on MCUs without the VBAT pin. A system reset does not affect the calendar but resets the shadow registers (APB registers clocked by the APB bus clock) that are read by the application. These registers are updated again when RSF = 1 in RTC_ISR (RTC2)/RTC_ICSR (RTC3).

After a system reset, the application can use the INITS status flag in RTC_ISR (RTC2)/RTC_ICSR (RTC3) to check if the calendar is already initialized. This flag is reset when the calendar year field is set to 0x00 (power-on reset value), meaning that the calendar must be initialized. The calendar can also be reset by setting BDRST = 1 in the RCC, even when V_BAT is present.

The LSE clock initialization is not always needed after a system reset. It is recommended to check LSERDY in RCC_BDCR and to initialize LSE only if this flag is not already set.

RTC clock synchronization

When the application reads the calendar, it accesses shadow registers that contain a copy of the real calendar time and date clocked by the RTC clock (RTCCLK). There is a shadow register associated to RTC_TR, RTC_DR and RTC_SSR. RSF is set in RTC_ISR (RTC2)/RTC_ICSR (RTC3) each time the calendar time and date shadow registers are updated with the real calendar value. The copy is performed every RTCCLK cycle, synchronized with the APB bus clock (APB bus by which the RTC is accessed). After a system reset or after exiting the Initialization mode, the application must wait for the RSF bit to be set before reading the calendar shadow registers.

When the system is woken up from low-power modes (SYSCLK was off, consequently, the APB clock was off too), the application must first clear RSF, and then wait until RSF is set again before reading the calendar registers. This ensures that the value read by the application is the current calendar value, and not the value before entering the low-power mode.

By setting BYPSHAD = 1 in RTC_CR, the calendar values are taken directly from the calendar counters instead of reading the shadow register. In this case, it is not mandatory to wait for the synchronization time, but the calendar registers consistency must be checked by the software. The user must read the required calendar field values. The read operation must then be performed again. The results of the two read sequences are compared. If the results match, the read result is correct. If the values differ, repeat the process until the results match.

Note:

After setting BYPSHAD = 0, the shadow registers may be incorrect until the next synchronization. In this case, the software must clear RSF = 0, wait for the synchronization (RSF must be set), and finally read the shadow registers.