AnasSarkiz/usb-c-pd-brushed-motor

docs/STUSB4500-NVM.md

# A16 complete NVM readback transport

2026-10-03. Hardware/BOM/imports remain A11. firmware/stusb4500_nvm.c/.h reads all five8-byte customer sectors, compares all40 bytes with a separately approved manufacturer-tool image and latches failure. No approved binary is currently available, so this is a tested transport module, not a completed NVM manufacturing/startup gate.

The target must physically inhibit both motor power and bridge, invalidate old PD provenance, ensure stable controller power and serialize customer-mode/event access. Adapter flags are preconditions, not electrical proof. Do this before A15 startup acquisition; NVM operations can consume the initial negotiation capture time. Subsequent standby SoftReset obtains new source capabilities under inhibition.

The reference operations unlock customer access at0x95, reset/power the customer controller at0x96, select READ opcode0 at0x97, request each sector0–4, poll request-bit completion and read eight bytes at0x53. Each sector resets the customer controller afterward. Exit writes0x40/0x00 to0x96/0x97 and clears the access key. No program, erase, soft-program, program-load or erase-load opcode is present; no buffer write occurs. Header constants and both manufacturer reference implementations agree on these actual addresses. Older source comments naming0x9E/0x9F are inconsistent with their executable constants and are retained without correction.

The whole transaction has a proposed20 ms deadline with callback-enforced absolute limits and checks before/after every transfer. Each sector has a finite64-read busy ceiling. Reset hold has a proposed3 µs minimum and a finite256-query timer guard: a stopped timer fails explicitly instead of spinning forever. Completion checks reset-release/sector state before reading the buffer. Exact target timing, reset constraints, busy latency and lock behavior require physical qualification; the helper does not claim that an acknowledgement proves an electrical lock.

All errors, late/partial transfers, uncertain customer-mode writes, busy/time faults and image discrepancies latch image_matches=false. read_complete is true only after the full read and acknowledged exit operations; a partial image is diagnostic-only. The helper never retries or performs cleanup writes after an uncertain error. Customer mode can remain unlocked on failure; the target must retain inhibition and explicitly reset/reinitialize before starting over. Null expected image is rejected; no factory fallback, partial comparison mask or guessed bit decoder is supplied.

Equality proves stored bytes equal the supplied image only. The image must first be independently generated/reviewed for this board/device revision. It does not prove semantic approval, active RAM settings, fresh source identity, a PD contract or safe rail behavior. docs/pd-manufacturing-profile.json records current configuration intent: one5 V/3 A standby PDO, POWER_ONLY_ABOVE_5V=1, REQ_SRC_CURRENT=0; PDO2/3 inactive at cold start. Reserved/device-specific settings must come from the manufacturer tool. It is not a binary image. The withdrawn A1 profile remains historical. Actual provisioning/readback/analyzer evidence is pending.

Host C11 Wall/Wextra/Werror harness passes20,639 assertions: every one of40 compared bytes, all40 normal failed/late transfer positions with before/after-side-effect failures, each sector-state mismatch, stopped/busy timers, deadlines/wrap, missing expected image/callbacks and unsafe preconditions. The vectors are explicitly synthetic test memory; they are not an approved production image. All20 configured tests/372 expects, formatting and TypeScript pass. Freestanding Cortex-M0+ compilation passes; no linked firmware, programming or live NVM reading is claimed. No hardware/BOM/placement/routing change.

Primary manufacturer sources: [official NVM flasher implementation](https://github.com/usb-c/STUSB4500/blob/master/NVM_Flasher/Src/NVM/USBPD_CUST_NVM_API.c), [official constants](https://github.com/usb-c/STUSB4500/blob/master/NVM_Flasher/Src/NVM/USB_PD_defines.h), [older reference](https://github.com/usb-c/STUSB4500/blob/master/Firmware/Project/Src/USBPD_CUST_NVM_API.c), and [manufacturer GUI instructions](https://github.com/usb-c/STUSB4500/blob/master/GUI/readme.md). Byte-exact sources/hash verification are retained in evidence/STUSB4500-NVM-source-review-A16.json. The attempted community-hosted PDF redirected to HTML; that response is retained losslessly compressed and is not treated as a valid PDF or visual review. The manufacturer GUI documents a Windows environment; no generated/exported configuration image is claimed from this macOS run.

A separate current-datasheet review identified that matched RDO maximum current follows the source capability, whereas the current policy requires both fields to equal3 A. Sources advertising more than3 A would be inhibited unnecessarily. The A16 policy remains unchanged and this correction is open for the next implementation step; do not claim broader charger compatibility before it is tested.

A17 supersedes the pending RDO-current correction above: maximum now matches the stored selected source advertisement, operating remains3 A and malformed/reserved fields are rejected. See PD-RDO-CURRENT.md. NVM image/target/physical qualifications remain pending.