Suspend Retention Choices: Decide Which State Must Be Rebuilt After Power Gating

Choose retained state by physical RAM section, not just by object size. A small record can straddle two independently controlled sections and require much more retained capacity than its byte count suggests. Decide what is worth preserving, map every byte to the selected device’s retention controls, and separately verify what startup does after wake.

Applicability: this procedure uses nRF52840 Product Specification v1.8 and System OFF. The addresses and record placement below are hypothetical allocations within the documented memory map, not permission to use those addresses in a product. No firmware, retention experiment, or power measurement was executed.

1. Classify state by the recovery decision it supports

List state needed after wake and assign an explicit treatment: reconstruct from fixed configuration, reacquire from a peripheral, reload from durable storage, or preserve in qualified retained RAM. Prefer the smallest self-contained record that avoids genuinely expensive or impossible reconstruction.

A cached calculation can often be recomputed. A peripheral configuration should be restored through its own register contract. An interrupted operation may need an identifier and progress marker rather than its entire heap graph. State that must survive complete power loss needs a separately qualified persistent medium.

Do not retain pointers merely because their bytes survive. The pointed-to objects, allocator state, synchronization objects, and device lifetimes may be rebuilt after restart. Design the retained information as data to validate and interpret, not as permission to resume arbitrary execution context.

2. Map objects to the actual section geometry

The nRF52840 v1.8 memory chapter divides RAM into nine AHB slaves. RAM0 through RAM7 each contain two 4 KiB sections; RAM8 contains six 32 KiB sections. The physical RAM also has code and data aliases, so two address representations do not imply independent storage.

Export the linked address and size of each candidate record. Compute its exclusive end, then intersect that interval with the documented physical sections. Include padding and alignment, and normalize any aliases before comparing ownership. Use the final ELF and map file rather than an intended source-level section name.

For a hypothetical 256-byte record beginning at 0x2000FF80, the exclusive end is 0x20010080. It occupies the last 128 bytes of RAM7 section 1 and the first 128 bytes of RAM8 section 0. The documented intervals are [0x2000F000, 0x20010000) and [0x20010000, 0x20018000).

Preserving this object therefore requires retention coverage for both sections: 4 KiB plus 32 KiB, or 36 KiB of physical capacity. That is a coverage calculation, not a claim that current scales linearly with byte count. A permitted relocation wholly inside one 4 KiB section could reduce the required section set, provided every other allocation and owner agrees.

3. Separate accessible RAM from retained RAM

The POWER chapter distinguishes section POWER and RETENTION settings. In System OFF, RAM is inaccessible and RETENTION determines preservation. In System ON, a powered section is accessible and retained; a section with power off but retention on preserves contents without making them accessible.

Consequently, setting an ordinary System ON power bit is not a substitute for the System OFF retention setting. Nor should a test try to read a section while its access path remains powered off. Plan the post-wake accessibility transition before attempting to validate stored bytes.

For the hypothetical boundary-crossing record, review the relevant RAM7 and RAM8 section controls independently. Do not assume section numbering, size, or implemented fields are identical across all RAM blocks merely because the register descriptions use a common format.

4. Treat wake as a new boot path

The v1.8 specification states that System OFF wake resets the system. It also warns that example startup code commonly overwrites the retained RAM power-control registers. A retained setting observed before entry is therefore not proof of the setting seen by the application after startup.

Review the actual reset handler, bootloader, runtime initialization, linker layout, stacks, and early allocation behavior. Establish a documented handoff point where the retained bytes are accessible and can be copied or validated before an unrelated initializer reuses them. A non-initialized linker section addresses only software initialization, not the physical retention selection.

Keep the early inspection procedure minimal and supported by the firmware architecture. Do not move arbitrary application code ahead of essential CPU or memory initialization. Save the exact startup implementation and linker artifact with the test record so a later toolchain or bootloader change triggers review.

5. Commit a bounded record before entering System OFF

Give the record a format version, length, generation, and integrity check appropriate to the failure model. Define the completed-record condition separately from the contents under construction. On wake, reject incompatible or incomplete state and take a known reconstruction path.

Quiesce all writers before committing the retained snapshot. Nordic specifically requires ongoing EasyDMA transactions to complete before System OFF. Use the selected peripheral’s completion contract; a CPU-side copy finishing does not establish that a DMA writer has stopped.

Retain only the sections required by the approved allocation set, but account for all owners that need them. A change that saves one section for this record can still break another subsystem using that section. Treat the mask as a shared memory-layout decision under configuration control.

6. Use controls that distinguish hardware retention from software survival

Propose a fixture that records the linked interval, requested retention controls, pre-entry record, early post-wake bytes, and post-initialization interpretation. First test a valid retained configuration, then a controlled case with one required section omitted. The omitted case removes the preservation guarantee; it does not require every byte to change.

A second control intentionally initializes the record during startup in a test build. This checks whether the observation point can distinguish physical survival from later software overwrite. A cold power cycle is another separate control and must not be accepted as a supported RAM-retention path.

Run the genuine low-power case without an active debug mode that emulates System OFF. Keep debug-assisted inspection separate and document how it changes the mode. Otherwise an apparently intact record can result from resources retained for debugging rather than the product’s sleep configuration.

7. Choose retention only after recovery works

Compare retained-section alternatives using measured whole-cycle energy and recovery behavior on the actual board. Include wake initialization and any reconstruction cost. Do not infer an optimum from section size alone or substitute a data-sheet typical current for a product measurement.

The deliverable is a state-treatment table, object-to-section map, retention/access settings, startup handoff, and positive/negative fixture results when performed. Rebuild state whose retention cost or validity cannot be justified. Retain the minimum independently validated information that makes the next boot correct.