System Control Block (SCB)

The System Control Block is where ARM put everything that didn't fit naturally into the NVIC, the MPU, or the FPU. It controls system-wide behaviour: reset, sleep mode entry, exception priority for the architectural exceptions, fault enable/status, vector table relocation. About 60 bytes of MMIO at 0xE000_ED00, but density-of-meaning is extreme — every bit matters and most have surprising side effects.

This page walks the SCB register-by-register. The companion pages — NVIC registers and FPU — cover the adjacent register blocks.

CPUID — read-only identification

CPUID at offset 0x00 returns the core's implementer, variant, architecture, part number, and revision. Useful for runtime feature detection.

uint32_t cpuid = SCB->CPUID;
uint32_t partno = (cpuid >> 4) & 0xFFF;     // 0xC60 = M0, 0xC20 = M0+, 0xC23 = M3, 0xC24 = M4, 0xC27 = M7, 0xD20 = M23, 0xD21 = M33, 0xD22 = M55, 0xD23 = M85

ICSR — Interrupt Control and State Register

ICSR at offset 0x04. Mixes status (read-only fields) and control (write-1-to-set / write-1-to-clear). The mix-and-match is the source of many bugs.

The classic RTOS pattern uses PENDSVSET to request a context switch from anywhere:

SCB->ICSR = SCB_ICSR_PENDSVSET_Msk;   /* trigger context switch via PendSV */

PendSV runs at the lowest priority (after every other pending IRQ has finished), making it the safe place to switch contexts.

VTOR — Vector Table Offset Register

Covered in detail on the vector table page. Offset 0x08.

AIRCR — Application Interrupt and Reset Control Register

AIRCR at offset 0x0C. Holds PRIGROUP, the endianness indicator, and the system-reset command.

The VECTKEY requirement means every write must specify both the new bits and the magic value:

/* Set PRIGROUP = 3 (4 preempt bits / 4 sub bits on a 4-bit-prio part) */
SCB->AIRCR = (0x05FA << 16) | (3 << 8);
 
/* System reset — board-level reset, retains debug connection on most parts */
SCB->AIRCR = (0x05FA << 16) | SCB_AIRCR_SYSRESETREQ_Msk;
while (1) { }   /* wait for reset to take effect */

SYSRESETREQ resets the core and all peripherals except the SWD/JTAG debug logic, RTC backup domain, and (on some vendors) the watchdog. It's the standard programmatic reset path.

SCR — System Control Register

SCR at offset 0x10. Configures sleep behaviour.

SLEEPDEEP is the bridge from "WFI" (which is otherwise just "clock-gate the core until next IRQ") to the vendor's deep sleep mode (Stop, Standby, whatever the marketing name is). The peripheral-specific configuration — which clocks to keep on, which to gate off — is in vendor MMIO outside the SCB. See low-power modes for the full taxonomy.

SLEEPONEXIT is for interrupt-driven applications. The thread mode does nothing useful — only ISRs do work. Set SLEEPONEXIT once, then never run any code outside ISRs.

SCB->SCR |= SCB_SCR_SLEEPONEXIT_Msk;
SCB->SCR |= SCB_SCR_SLEEPDEEP_Msk;    /* if you want deep sleep on every WFI */

CCR — Configuration and Control Register

CCR at offset 0x14. A bag of orthogonal control bits with high impact.

The big ones to know:

• DIV_0_TRP — turn this on. Silent divide-by-zero returning 0 hides bugs; trapping makes them visible.
• UNALIGN_TRP — controversial. On v7-M, halfword and word accesses to unaligned addresses are allowed by default but slow. Trapping forces clean code, but may break legacy drivers that hand-roll unaligned access. Turn it on for new code.
• BFHFNMIGN — fault-tolerance bit. With BFHFNMIGN = 1, a bus fault inside HardFault doesn't escalate to a lockup. Useful for fault-handler code that probes possibly-bad memory.

SCB->CCR |= SCB_CCR_DIV_0_TRP_Msk
         |  SCB_CCR_UNALIGN_TRP_Msk;
__DSB();

SHPR1, SHPR2, SHPR3 — System Handler Priority

Three registers at offsets 0x18, 0x1C, 0x20. They hold the 8-bit priority bytes for the architectural exceptions 4..15.

The priority encoding is the same as IPR — upper __NVIC_PRIO_BITS bits implemented, lower bits zero. CMSIS gives NVIC_SetPriority() overloads that accept the negative IRQ numbers (-1 = SysTick, -2 = PendSV, etc.) and route to SHPR.

The standard RTOS pattern:

NVIC_SetPriority(PendSV_IRQn, 0xFF);  /* lowest urgency — context switch */
NVIC_SetPriority(SysTick_IRQn, 0xFF); /* lowest urgency — RTOS tick */
NVIC_SetPriority(SVCall_IRQn, 0);     /* highest urgency — kernel entry */

SHCSR — System Handler Control and State Register

SHCSR at offset 0x24. Enables individual fault handlers and reports their state.

The most important bits are MEMFAULTENA, BUSFAULTENA, USGFAULTENA. By default, all fault classes escalate to HardFault, which makes triage hard ("HardFault — was it bus, mem, usage, or fault-on-fault?"). Enable each fault separately to get distinct handlers:

SCB->SHCSR |= SCB_SHCSR_MEMFAULTENA_Msk
           |  SCB_SHCSR_BUSFAULTENA_Msk
           |  SCB_SHCSR_USGFAULTENA_Msk;

Now MemMgmt faults call MemManage_Handler, BusFault calls BusFault_Handler, UsageFault calls UsageFault_Handler. The handler can read CFSR for the per-class detail.

CFSR — Configurable Fault Status Register

CFSR at offset 0x28. Three 8-bit subfields packed into a word:

MMFSR bits:

BFSR bits:

UFSR bits:

A fault handler should read CFSR, then write the bits back (CFSR is W1C) to clear them:

void HardFault_Handler_C(uint32_t *stack) {
    uint32_t cfsr = SCB->CFSR;
    uint32_t hfsr = SCB->HFSR;
    uint32_t mmfar = SCB->MMFAR;
    uint32_t bfar  = SCB->BFAR;
    /* log everything, then... */
    SCB->CFSR = cfsr;   /* clear by writing 1s back */
    SCB->HFSR = hfsr;
}

HFSR — HardFault Status Register

HFSR at offset 0x2C. Why a HardFault triggered.

If FORCED = 1, read CFSR to find the original fault class. If VECTTBL = 1, the vector fetch faulted — usually a bad VTOR.

MMFAR / BFAR — Fault Address Registers

MMFAR at offset 0x34, BFAR at offset 0x38. The faulting address for MemManage and BusFault respectively. Valid only if the corresponding MMARVALID / BFARVALID bit in CFSR is set.

if (SCB->CFSR & SCB_CFSR_MMARVALID_Msk) {
    printf("MemMgmt fault address: 0x%08X\n", SCB->MMFAR);
}

AFSR — Auxiliary Fault Status Register

AFSR at offset 0x3C. Implementation-defined. Vendors use it to expose bus-matrix-level fault info (which AHB master, which slave). Read the silicon's TRM for the encoding.

Cross-references

• NVIC registers — adjacent register block
• NVIC priority — PRIGROUP details
• Vector table & VTOR
• Exception model — what each fault means
• Fault decoder tool — paste in CFSR/HFSR/MMFAR/BFAR, get a diagnosis
• Stack frame inspector — decode the stacked registers on entry
• ARMv7-M ARM section B3.2; ARMv8-M ARM section D1.2