RACCOON ISP RACCOON ISP. Author: Gilles Labarre Date: February, Ref: RACCOON Rev: 0.0. Doc Control. 1. Overview. 1.1 Document. 1.

Transcription

1 ISP Author: Gilles Labarre Date: February,22 20 Ref: Rev: 0.0 ISP Form Ref. ES - Rev: 1.0 Doc Control Rev. Pages Purpose of Modifications Originator Date 0.0 All Draft proposal Author February,22, 0.1 All Draft proposal Author February,25, 1. Overview 1.1 Document This document describes the external specification for the implementation of ISP, taking in account the specificities of the FLASH memory used and the external compatibility constraints. 1.2 Objectives MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

2 ISP 2. FLASH MEMORY 2.1 Overview The FLASH memory contains 16K or 32K bytes of program memory organized respectively in 128 or 256 pages of 128 bytes. This memory is both parallel and serial In-System Programmable (ISP). ISP allows devices to alter their own program memory in the actual end product under software control. A default serial loader (bootloader) program allows ISP of the FLASH. FLASH memory FM0: containing 16/32 Kbytes of program memory organized in page of 128 bytes, ROM memory RM1: 2 Kbytes for Bootloader and Application Program Interface (API). The programming does not require 12v external programming voltage. The necessary high programming voltage is generated on-chip using the standard V CC pins of the microcontroller. 2.2 FLASH Memory Architecture The FLASH memory is composed of 4 arrays (see Figure 1): 1. The User array 2. The ROW array 3. The Hardware security array 4. The Column latches array Hardware Security Byte 3FFFh or 7FFFh 16/32 Kbytes FLASH memory USER Array FM0 ROW Column Latches 2 Kbytes ROM RM1 FFFFh F8h h FM0 Figure 1. FLASH memory architecture Boot ROM. The Boot ROM is placed in add space from F8h to FFFFh separated From the FM0 space(see Figure 1) 2 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

3 2.2.2 FM0 array The size of this block is 16/32 Kbytes organized in 128/256 pages of 128 bytes. ISP ROW array The ROW is one extra page (128 bytes).this space contain datas used by the boot loader Hardware security array The 4 MSB of this byte can be read/write by software.the 4 LSB can be read by software, they can be writed by hardware in parallel programming mode Column latches array The column latch is the buffer containing data to program into the three previous arrays. 2.3 Specification The CPU interfaces to the FLASH memory through the FCON register (see Figure 2). This register is used to: Map the memory arrays Launch the programming Get the status of the FLASH memory (busy/not busy) Mapping of the memory arrays Two bits of the FCON register (FMOD1:0) are used to access to the FLASH memory arrays (User, ROW, Hardware Security).See Table 1 for bit configuration. MOVC instruction is used for Read operations in FLASH memory arrays MOV instruction is used for Write operation FMOD1 FMOD0 Adressable space 0 0 User (h-3fff or 7FFFh) 0 1 ROW (FF80h-FFFFh) 1 0 Hardware Byte (FFFFh) 1 1 reserved Table 1. Adressed space vs Selection bits FM0 Array In the Reset configuration, only the User array FM0 is Read access with MOVC instruction Column Latch Array FPS bit in FCON register enables access to the column latches. As soon as this bit is set, column latches are accessible (read/write) with MOV instruction. MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

4 ISP Programming of the memory arrays The four LSB bits (FPL3:0) in FCON register (see Figure 3) are used to launch the programming of the column latches in the array selected by FMOD1:0 bits (see Table 2). The FPS bit must be reset before programming to froze MOV on external memory. The programming is launched by writing the sequence 0x5 followed by 0xA.During this sequence, the IT are disabled. Command FMOD1 FMOD0 Operation programming 0 0 Write the column latches in user array programming 0 1 Write the column latches in ROW array programming 1 0 programming 1 1 Erase the column latches Table 2. Programming arrays Status of the FLASH memory Write the 4 MSB bits of column latches in the 4 MSB bits of the Hardware Security array The bit FBUSY in FCON register is used to indicate the status of programming (set when programming is in progress) FLASH Parallel Programming The three lock bits in Hardware byte are programmed according to Table, will provide different level of protection for the on-chip code and data located in RM1 and FM2. The only way to write these bits is the parallel programming mode.. Program Lock Bits Protection description Security level LB0 LB1 LB2 1 U U U 2 P U U No program lock features enabled. MOVC instruction executed from external program memory returns data. MOVC instruction executed from external program memory are disabled from fetching code bytes from internal memory, EA is sampled and latched on reset, and further parallel programming of the FLASH is disabled. 3 U P U Same as 2, also verify through parallel programming interface is disabled. 4 U U P Same as 3, also external execution is disabled. Table 3. Program Lock bits U: unprogrammed P: programmed WARNING: Security level 2 and 3 should only be programmed after FLASH and Core verification. These security bits protect the code from access through the parallel programming interface. They are set by default to level 4. 4 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

5 ISP 2.4 Operation Write in Column Latches A physical write of the FLASH is done in two steps: 1. write data in the column latches 2. transfer of all data latches in a FLASH memory row (programming). The number of data written in the page may vary from 1 to 128 (the page size). When programming, only data loaded in the column latch are programmed (a ninth bit is used to achieve this feature). This provides the capability to program the whole memory by bytes, by page or by a number of bytes in a page. Indeed, each ninth bit is set when the corresponding byte in a row and all these ninth bits are reset after the writing of the complete FLASH row. Data is written by byte in the column latches as if it was in an external RAM memory. Out of the 16 address bits of the data pointer, the 9 MSB are used for page selection and 7 are used for byte selection. Between two FLASH programming, all addresses in the column latches must remain in the same page, thus the 9 MSB must be unchanged. The following procedure is used to write in the columns latches: Map the program space (Set bit FPS of FCON register). Load DPTR with the address to write Store A register with the data to be written Execute a A If needed,loop the three last instructions until the end of a 128 bytes pages It s possible to erase all column latches, after a bad write of data. The following procedure is used to erase the columns latches: Map the program space (Set bit FPS of FCON register). Launch the programming by writing the data sequence (0x56 followed by 0xA6) to the FCON register Program FLASH FM0 It consists on the following actions: Write one or more bytes in a same page in the column latches. If the bytes are not in the same page, the last page address is latched and the others are discarded. Disable the interrupts and clear FPS. Launch the programming by writing the data sequence (0x50 followed by 0xA0) to the FCON register. The end of the programming indicated by the FBUSY flag cleared. Enable the interrupts Write data in ROW It consists on the following actions: Write one or more bytes in a same page in the column latches. If the bytes are not in the same page, the last page address is latched and the others are discarded. Disable the interrupts and clear FPS. MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

6 ISP Launch the programming by writing the data sequence (0x52 followed by 0xA2) to the FCON register. The end of the programming indicated by the FBUSY flag cleared. Enable the interrupts Read data in ROW It consists on the following actions: Disable interrupt Map the ROW space (see Table 1). MOVC Map the user space Enable interrupt Write Hardware byte It consists on the following actions: Write byte in the column latches at address FFFFh (only the 4 MSB can be write by software). Disable the interrupts and clear FPS. Launch the programming by writing the data sequence (0x54 followed by 0xA4) to the FCON register. The end of the programming indicated by the FBUSY flag cleared. Enable the interrupts Read Hardware byte It consists on the following actions: Disable interrupt Map the Hardware byte space (see Table 1). MOVC + <base-reg> (A =0 and base reg = DPTR = FFFFh) Map the user space Enable interrupt 6 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

7 ISP 2.5 Registers FCON (S:D1h) FLASH control register FPL 3 FPL 2 FPL 1 FPL 0 FPS FMOD1 FMOD0 FBUSY Bit Number Bit Mnemonic Description 7-4 FPL3:0 3 FPS 2-1 FMOD1:0 0 FBUSY Programming Launch command bits Write 5uh followed by Auh to launch the programming. u = bit configuration according to FLASH space selected FLASH Map Program Space Set to map the FLASH space during MOV (write) or MOVC (read) instructions (Write in the column latches) Clear to map the data space during MOV FLASH Mode see Table 1 FLASH Busy Set by hardware when programming is in progress. Clear by hardware when programming is done. Can not be cleared by software Reset Value = b Figure 2. FCON register AUR1 (S:A2h) Auxiliary Register ENBOOT - GF3 - - DPS Bit Number Bit Mnemonic Description ENBOOT 4-3 GF DPS Reserved The value read from these bits are indeterminate. Do not set these bits. Enable Boot FLASH Set this bit to map the boot between F8h -FFFFh Clear this bit to disable boot. Reserved The value read from this bit is indeterminate. Do not set this bit. General Flag This bit is a general purpose user flag Reserved The value read from these bits are indeterminate. Do not set these bits. Data Pointer Selection This bit is a general purpose user flag 0 - DPTR0 selected. 1 - DPTR1 selected. Reset Value: xxxx x0x0b Figure 3. AUR1 Register MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

8 ISP 3. BOOT PROCESS 3.1 Overview Two blocs are used (see Figure 4): FLASH memory FM0: containing 16/32 Kbytes of program memory organized in page of 128 bytes, ROM memory RM1: 2 Kbytes for default boot loader and In Application Programming routines(api). Boot FLASH include API routines: program byte or page, verify byte or page, program security lock bit, etc. Indeed, TEMIC provides the binary code of the default FLASH boot loader. FM0 supports both, hardware and Software programming When the microcontroller programs its own FM0, all of the low level details are handled by the default boot loader located in FM0. A User Boot Loader program can be located in FM0 at the address [SBV]h.It can call the API routines contained in RM1. The user program simply calls the common entry point in RM1with appropriate parameters to accomplish the desired operation. 8 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

9 3.2 FLASH Memory Architecture ISP Hardware Security Byte 3FFFh or 7FFFh ROW Column Latches API and Default boot loader FFFFh F8h [SBV]h Eventually: User Bootloader h APPLICATION PROGRAM 16/32 Kbytes FLASH memory FM0 BOOT LOADER 2 Kbytes ROM memory RM1 Figure 4. FLASH memory architecture MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

10 ISP 3.3 Hardware Boot Process At the falling edge of reset (unless the hardware conditions on PSEN, EA and ALE are set as described below), the reads the BLJB bit in the HSB byte. If this bit is set, it jumps to h and if not, it jumps to F8h. The default boot loader can also be executed by holding PSEN LOW, EA HIGH, and ALE HIGH (or not connected) at the falling edge of RESET. This allows an application to be built that will normally execute the end user s code but can be manually forced into default ISP operation. RESET If BLJB=0 then Bit ENBOOT (AUR1) is set else Bit ENBOOT (AUR1) is reset Hardware Hardware condition? yes FCON = F0h FCON = h BLJB=1 ENBOOT=0 BLJB!= 0? h USER APPLICATION BLJB=0 ENBOOT=1 F8h Software Boot Loader in RM1 Figure 5. Hardware Boot Process Algorithm 10 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

11 3.4 Registers The FLASH memory uses several registers for his management: ISP Hardware registers can be accessed through the parallel programming modes which are handled by the parallel programmer.the high nibble of register HSB can be accessed (Write and read) through serial programming. The HSB register include one Fuse bit (Boot Loader Jump Bit), which can be read and modified using API or the parallel programming mode. It is an hardware bit. Software registers are in a special page of the FLASH memory which can be accessed through the API or with the parallel programming modes. This page, called ROW :"Extra FLASH Memory", is not in the internal FLASH program memory addressing space. The ISP functions are assumed by: FCON register, Boot registers (Boot Status Byte and Boot Vector Address), which can be read and modified by using of the API or the parallel programming mode They are stored in ROW space. One Fuse bit (Boot Loader Jump Bit), which can be read and modified using API or the parallel programming mode. It is an hardware bit Hardware register The only hardware register of the is called Hardware Security Byte (HSB). Table 4. Hardware Security Byte (HSB) BLJB OSC SIZE - LB2 LB1 LB0 Bit Number Bit Mnemonic Description BLJB 5 OSC 2 Mode Set to force 2 mode ( 6 clocks per instruction ) Clear to force 1 mode, Standard Mode. (Default ) Boot Loader Jump Bit Set this bit to start the user s application on next reset at address h Clear this bit to start the boot loader at address F8h (default). Oscillator Bit Set to allow OSCA. ( Default ) Clear to allow OSB. 4 SIZE 3 - Reserved FLASH size selection To select 16K/32K 2-0 LB2-0 User Memory Lock Bits See Table 5 Default value after erasing chip: FFh NOTE: Only the 4 MSB bits can be access by software. The 4 LSB bits can only be access by parallel mode. Figure 6. Hardware byte MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

12 ISP Boot Loader Jump Bit (BLJB): One bit of the HSB, the BLJB bit, is used to force the boot address: When this bit is set the boot address is h. When this bit is reset the boot address is F8h. By default, this bit is cleared and the ISP is enabled. User memory lock bits : The three lock bits provide different levels of protection for the on-chip code and data, when programmed according to Table 5. Table 5. Program Lock bits Security level Program Lock Bits LB0 LB1 LB2 1 U U U No program lock features enabled. 2 P U U 3 P U Protection description MOVC instruction executed from external program memory is disabled from fetching code bytes from internal memory, EA is sampled and latched on reset, and further parallel programming of the FLASH is disabled.isp and software programming with API are still allowed. Same as 2, also verify through parallel programming interface is disabled and serial programming ISP is disabled. 4 P Same as 3, also external execution is disabled. U: unprogrammed or "one" level. P: programmed or "zero" level. :do not care WARNING: Security level 2 and 3 should only be programmed after FLASH and code verification. These security bits protect the code from access through the parallel programming interface. They are set by default to level 4. The code access through the ISP is still possible and is controlled by the "software security bits" which are stored in the extra FLASH memory accessed by the ISP firmware. Default values The default value of the HSB provides parts ready to be programmed with ISP: OSC : Set to allow OSCA Oscillator. SIZE : FLASH Size selection (16K/32K). This bit must not be accessed with parallel and serial programming modes (Hidden for the customer) BLJB : Cleared to force ISP operation. 2 : Set to force 1 mode ( Standard Mode ). Only valid with OSCA selection. LB2-0: Security levels to protect the code from a parallel access with maximum security Software registers Several registers are used, in factory and by parallel programmers, to make copies of hardware registers contents. These values are used by TEMIC Semiconductors ISP. These registers are in the "Extra FLASH Memory" part of the FLASH memory. This block is also called "AF" or etra Array FLASH. They are accessed in the following ways: Commands issued by the parallel memory programmer. Commands issued by the ISP software. 12 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

13 ISP Calls of API issued by the application software. The software registers are described in Table 6. Table 6. Software registers Mnemonic Default value Address BSB Boot Status Byte FFh h SBV Software Boot Vector FCh 01h SSB Software Security Byte FFh 05h Copy of the Manufacturer Code 58h 30h TEMIC Copy of the Device ID #1: Family Code D7h 31h C51 2, Electrically Erasable Copy of the Device ID #2: memories F7h 60h 32Kb size and type FBh 60h 16Kb Copy of the Device ID #3: name and FFh 61h 32Kb revision 0 revision EFh 61h 16Kb revision 0 Read and Write of these registers are done using APIs. Boot Status Byte Register (BSB) This boot register is in the ROW space at address h. The WinISP application, after programming the part, reset the BSB register in order to allow the application to boot at h after Reset. Software Boot Vector register (SBV) This byte contain the high address of the Boot Loader. The default value equals FCh (no user boot loader) ADD7 ADD6 ADD5 ADD4 ADD3 ADD 2 ADD 1 ADD 0 Bit Number Bit Mnemonic Description 7-0 ADD7:0 Address high of user boot loader location Default value after reset: FCh Figure 7. SBV register SSB: The content of the Software Security Byte (SSB) is described in Table 7 and Table 8 To guarantee code protection from a parallel access, the HSB must also be at the required level. MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

14 ISP Table 7. Software Security Byte (SSB) LB1 LB0 Bit Number Bit Mnemonic Description LB2 1 LB1 0 LB0 Reserved Do not clear this bit. Reserved Do not clear this bit. Reserved Do not clear this bit. Reserved Do not clear this bit. Reserved Do not clear this bit. User Memory Lock Bits See Table 8 User Memory Lock Bits See Table 8 User Memory Lock Bits See Table 8 The two lock bits provide different levels of protection for the on-chip code, when programmed according to Table 8. Table 8. Program Lock bits of the SSB Security level Program Lock Bits LB0 LB1 LB2 1 U U U No program lock features enabled. Protection description 2 P U U ISP programming of the FLASH is disabled. 3 P U Same as 2, also verify through ISP programming interface is disabled. U: unprogrammed or "one" level. P: programmed or "zero" level. :do not care WARNING: Security level 2 and 3 should only be programmed after FLASH and code verification. 14 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

15 3.5 Software boot process ISP At the Hardware Boot address F8h, the boot software first reads : - FCON register : If FCON equals h, the Hardware conditions were set. Execution of TEMIC BootLoader starts else, the Boot Software then checks: - Boot Status Byte. If the BSB is set to zero, power-up execution starts at location h, which is the normal start address of the user s application code. When the Boot Status Byte is set : - Software Boot Vector is used as the high byte of the execution address.the low byte is set to h. The factory default setting is FCh, corresponding to the default ROM Boot Loader. A custom boot loader can be written with the Boot Vector set to the Custom boot loader address. If the factory default setting for the Boot Vector (FCh) is changed, it will no longer point to the ISP default FLASH boot loader code. It can be restored: With the default ISP activated with hardware conditions on PSEN, EA and ALE. With a customized loader (in the end user application) which provides features for erasing and reprogramming of the Boot Vector and BSB. Through the parallel programming method. After programming the FLASH, the Boot Status Byte should be programmed to zero in order to allow execution of the user s application code beginning at address h. MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

16 ISP RESET If BLJB=0 then Bit ENBOOT (AUR1) is set else Bit ENBOOT (AUR1) is reset Hardware Hardware condition? yes FCON = F0h FCON = h BLJB=1 ENBOOT=0 BLJB!= 0? BLJB=0 ENBOOT=1 F8h Force to Oscillator A FCON = h? yes = hardware boot conditions Software yes BSB = h? PC=h USER APPLICATION SBV = FCh? yes USER BOOT LOADER PC= [SBV]h TEMIC BOOT LOADER Figure 8. Boot loader process (Hard and Soft) 16 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

17 4. In-System Programming (ISP) ISP The In-System Programming (ISP) is performed without removing the microcontroller from the system. The In-System Programming (ISP) facility consists of a serie of internal hardware resources coupled with internal firmware to facilitate remote programming of the through the serial port. The TEMIC Semiconductors In-System Programming (ISP) facility has made in-circuit programming in an embedded application possible with a minimum of additional expense in components and circuit board area. The ISP function through UART uses four pins: TxD, RxD, V SS,V CC. Only a small connector needs to be available to interface the application to an external circuit in order to use this feature. Using the In-System Programming (ISP) The ISP feature allows a wide range of baud rates in the user application. It is also adaptable to a wide range of oscillator frequencies. The ISP feature requires that an initial character (an uppercase U) be sent to the to establish the baud rate As can be configured with OscA (up to 40MHz) or OscB (32KHz oscillator) at reset, the firs execution executed by the Bootloader is the forcing to OscA. The Autobaud is accomplished by measuring the bit-time of a single bit in a received character. This information is then used to program the baud rate in terms of timer counts based on the oscillator frequency. The ISP firmware provides auto-echo of received characters.. Once baud rate initialization has been performed, the Bootloader will only accept Intel Hex-type records. Intel Hex records consist of ASCII characters used to represent hexadecimal values and are summarized below: :NNAAAARRDD..DDCC<crlf> will accept up to 16 (10h) data bytes. The AAAA string represents the address of the first byte in the record. If there are zero bytes in the record, this field is often set to. The RR string indicates the record type. A record type of is a data record. A record type of 01 indicates the end-of-file mark. In this application, additional record types will be added to indicate either commands or data for the ISP facility. The DD string represents the data bytes. The maximum number of data bytes in a record is limited to 16 (decimal). The CC string represents the checksum byte. ISP commands are summarized in Table 9. As a record is received by the, the information in the record is stored internally and a checksum calculation is performed and compared to CC. The operation indicated by the record type is not performed until the entire record has been received. Should an error occur in the checksum, the will send an out the serial port indicating a checksum error. If the checksum calculation is found to match the checksum in the record, then the command will be executed. In most cases, successful reception of the record will be indicated by transmitting a. character out the serial port (displaying the contents of the internal program memory is an exception). In the case of a Data Record (record type ), an additional check is made. A. character will NOT be sent unless the record checksum matched the calculated checksum and all of the bytes in the record were successfully programmed. For a data record, an indicates that the checksum failed to match, an R character indicates that one of the bytes did not properly program, an "P" character indicates that programming was locked with Software Security Bit level. For a Read record, an "L" character indicates that readin was locked with Software Security Bit level.. MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

18 ISP RECORD TYPE Table 9. Intel-Hex Records Used by In-System Programming COMMAND/DATA FUNCTION Data Record :nnaaaadd...ddcc Where: Nn = number of bytes (hex) in record aaaa = memory address of first byte in record dd...dd = data bytes cc = checksum Example: :0580AF5F67F060B6 End of File (EOF), no operation :xxxxxx01cc Where: xxxxxx = required field, but value is a don t care cc = checksum Example: :01FF Specify Oscillator Frequency (Not required, left for Philips compatibility) :01xxxx02ddcc Where: xxxx = required field, but value is a don t care dd = required field, but value is a don t care cc = checksum Example: :010210ED 18 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

19 ISP Table 9. Intel-Hex Records Used by In-System Programming Miscellaneous Write Functions :nnxxxx03ffssddcc Where: nn = number of bytes (hex) in record xxxx = required field, but value is a don t care 03 = Write Function ff = subfunction code ss = selection code dd = data input (as needed) cc = checksum Subfunction Code = 01 (Erase Block) ff=01 ss = block number in bits 7:5, Bits 4:0 = zeros Example: :020301A05A erase block 5 Subfunction Code = 04 (Reset Boot Vector and Status Byte) ff=04 ss = don t care dd = don t care Example: :020345F8 Reset boot vector (FCh) and status byte (FFh) Subfunction Code = 05 (Program Software Security Bits) ff=05 ss = program software security bit 1 (Level 2 inhibit writing to FLASH) ss = 01 program software security bit 2 (Level 3 inhibit FLASH verify) ss = 02 program security bit 3 (No effect, left for Philips compatibity; disable external memory is already set in the default hardware security byte) Example: : F6 program security bit 2 Subfunction Code = 06 (Program Status Byte, Boot Vector,2 bit,osc bit or BLJB fuse bit) ff=06 ss = program Status byte ss = 01 program Boot vector ss = 02 program 2 bit ss = 03 program Osc bit ss = 04 program BLJB Example: : F5 program boot vector with Subfunction Code = 07 (Full chip erase) ff=07 ss = don t care dd = don t care Example: :0307F5 program boot vector with Display Device Data or Blank Check Record type 04 causes the contents of the entire FLASH array to be sent out the serial port in a formatted display. This display consists of an address and the contents of 16 bytes starting with that address. No display of the device contents will occur if security bit 2 has been programmed. The dumping of the device data to the serial port is terminated by the reception of any character. General Format of Function 04 :05xxxx04sssseeeeffcc Where: 05 = number of bytes (hex) in record xxxx = required field, but value is a don t care 04 = Display Device Data or Blank Check function code ssss = starting address eeee = ending address ff = subfunction = display data 01 = blank check cc = checksum Example: : FFF69 (display 40 4FFF) MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

20 ISP Table 9. Intel-Hex Records Used by In-System Programming Miscellaneous Read Functions General Format of Function 05 :02xxxx05ffsscc Where: 02 = number of bytes (hex) in record xxxx = required field, but value is a don t care 05 05= Miscellaneous Read function code ffss = subfunction and selection code = read copy of the signature byte manufacturer id (58H) 01 = read copy of the signature byte device ID# 1 (Family code) 02 = read copy of the signature byte device ID # 2 (Memories size and type) 03 = read copy of the signature byte device ID # 3 (Product name and revision) 07 = read the software security bits 0701 = read BSB 0702 = read BV 0704 = read HSB cc = checksum Example: :020501F0 read copy of the signature byte device id # In-Application Programming Method Several Application Program Interface (API) calls are available for use by an application program to permit selective erasing and programming of FLASH pages. All calls are made through a common interface, PGM_MTP. The programming functions are selected by setting up the microcontroller s registers before making a call to PGM_MTP at FFF0h. Results are returned in the registers. The API calls are shown in Table 10. A set of Philips compatible API calls is provided. When several bytes have to be programmed, it is highly recommanded to use the TEMIC Semiconductors API PROGRAM DATA PAGE call. Indeed, this API call writes up to 128 bytes in a single command. 20 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

21 ISP API call PROGRAM DATA BYTE Table 10. API calls Parameter R1 = 02h DPTR = address of byte to program ACC = byte to program ACC = if pass,! if fail R0 = osc freq (integer Not required) R1 = 09h DPTR0 = address of the first byte to program in the FLASH memory DPTR1 = address in RAM of the first data to program (second data pointer) PROGRAM DATA PAGE ACC = number of bytes to program ACC = if pass,! if fail Remark: number of bytes to program is limited such as the FLASH write remains in a single 128bytes page. Hence, when ACC is 128, valid values of DPL are h, or, 80h. R1 = 01h DPH = block number in bits 7:5, bits 4:0 = 0 ERASE BLOCK DPL = h None Remark: Command for Philips compatibility, as no erase is needed; the ISP firmware write FFh in the corresponding block. R1 = 04h ERASE BOOT VECTOR DPH = h DPL = don t care none R1 = 05h DPH = h PROGRAM SOFTWARE DPL = h security bit # 1 (inhibit writing to FLASH) SECURITY BIT 01h security bit # 2 (inhibit FLASH verify) 10h - allows ISP writing to FLASH (see Note 1) 11h - allows ISP FLASH verify (see Note 1) none R1 = 06h PROGRAM BOOT STATUS DPH = h BYTE DPL = h program status byte ACC = status byte ACC = status byte R1 = 06h DPH = h DPL = 01h program boot vector PROGRAM BOOT VECTOR ACC = boot vector ACC = boot vector MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

22 ISP API call PROGRAM 2 MODE PROGRAM OSC MODE Table 10. API calls Parameter R1 = 06h DPH = h DPL = 02h program 2 mode at reset ACC = value ( or 01h) ACC = boot vector R1 = 06h DPH = h DPL = 03h program OscA/OscB at reset ACC = value ( or 01h) ACC = boot vector R1 = 06h DPH = h PROGRAM BLJB DPL = 04h program FSBt ACC = value ( or 01h) ACC = boot vector R1 = 0Ch LOCK MEMORY AREA DPTR0 = address of the first byte to lock in the FLASH memory DPTR1 = none R1 = 0Ch UNLOCK MEMORY AREA DPTR0 = address of the first byte to lock in the FLASH memory DPTR1 = none R1 = 03h DPTR = address of byte to read READ DEVICE DATA ACC = value of byte read READ copy of the MANUFACTURER ID READ copy of the device ID #1 R1 = h DPH = h DPL = h (manufacturer ID) ACC = value of byte read R1 = h DPH = h DPL = 01h (device ID # 1) ACC = value of byte read 22 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

23 ISP READ copy of the device ID #2 READ copy of the device ID #3 Table 10. API calls R1 = h DPH = h DPL = 02h (device ID # 2) ACC = value of byte read R1 = h DPH = h DPL = 03h (device ID # 2) ACC = value of byte read R1 = 07h READ SOFTWARE DPH = h SECURITY BITS DPL = h (Software security bits) ACC = value of byte read R1 = 07h READ HARDWARE DPH = h SECURITY BITS DPL = 04h (Hardtware security bits) ACC = value of byte read R1 = 07h READ BOOT STATUS DPH = h BYTE DPL = 01h (status byte) ACC = value of byte read R1 = 07h READ BOOT VECTOR DPH = h DPL = 02h (boot vector) ACC = value of byte read R1 = 08h FULL CHIP ERASE DPH = don t care DPL = don t care none Note1: These functions can only be called by user s code. The standard boot loader cannot decrease the security level. MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

24 ISP 5. Changes refering to COYOTE 5.1 Registers Hardware register In the hardware register, the new bits are : - 2 (bit.7) - BLJB (bit.6) - Osc (bit.5) The bit BLLB (as ROM space replace the FLASH area) is removed and replaced with bit SIZE Software register In AUR1 register, a new bit is implemented: - ENBOOT bit 5.2 Commands New: - Program 2,Osc,BLJB bits - Read HSB - Erase Blocks Changes: - Read Bootloader version - Read of SSB 5.3 APIs New API : - Program Osc Hardware bit ---> New selection box in WinISP - Program 2 Hardware bit ---> New selection box in WinISP - Program BLJB Hardware bit ---> New selection box in WinISP - Read Hardware Byte (replace the reading of the copy of the HB done in AF) ---> - Full chip erase - Erase Blocks ---> new WinISP Function Changes : - Read Bootloader version ---> WinISP command changed vs Device - Erase SBV and BSB in place of Reset SBV only - Change of SSB LB1 address (bit 1 in place of bit 4 in Coyote) ---> WinISP Read decoding to change - Returned character= "P" or "L" if respectively Programming or Reading are locked with the SSB ----> WinISP has to decode Next version : Lock of memory space - Program ID 5.4 Bootloader - Branch address=f8h in place of FC03h and FCh - A first test is done to check if the Boot was or not with hardware conditions : FCON test. 24 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

25 ISP Reco rd Command APi called R1 DPTR DPH DPL ACC Program data nn aaaa dd cc End of File 01 FF Oscillator frequency 01 xxxx 02 dd cc dd : = Temic Frq: Philips Program data Byte 02 Program data page 09 byte address value D0=target adr; D1=source adr. C o R a bytes nb C a MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20

26 ISP Reco rd Command APi called R1 DPTR DPH DPL ACC C o R a C a Miscellaneous Write nn xxxx 03 ff ss dd cc 01 cc cc cc cc 01 C0 cc dd=table[6] ss=table[5] Erase Block 0 (0-8k) Erase Block 1 (8-16k) Erase Block 2 (16-32k) Erase Block 3 (32-48k) Erase Block 4 (48-64k) C0 tab[5] table[6] 03 table [4] 04 cc 05 cc cc cc USER CALL USER CALL 06 dd cc dd cc Erase SBV Erase SBV,BSB Program SSB 1 Program SSB 2 Program SSB 3 reset security 1 reset security 2 Program BSB(AF) Program SBV value value 0A 80 dd cc 0A 40 dd cc 0A 20 dd cc Program 2 (HSB) Program BLJB Program Osc 0A 0A 0A val(80,) val(80,) val(80,) 0C cc 0C 01 cc Lock Memory Area Unlock Memory Area 0C 0C cc 07 cc Full chip erase Full chip erase 08 NO NO API 04 Display /Blank Check 05 xxxx O4 ssss eeee ff cc ssss : start eeee : end ff= : Display data ff=01 : Blank check read device data read device data address address Miscellaneous read 02 xxxx 05 ff ss cc read Manuf ID(AF) read Product ID read ID read Product ID read SSB(AF) read SSB(AF) read SB read BV read HSB(copy) diff. value 08 0F read Bootloader version read Bootloader version 08 0F 0B read HSB 0B 0E Read Bootloader ID 0E 26 TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION MHS February,22 20

27 ISP Reco rd Command APi called R1 DPTR DPH DPL ACC C o R a C a 06 Direct load of Baud Rate 02 xxxx 06 hh ll cc high byte low byte Figure 9. ISP Commands /API synthesis MHS TEMIC SEMICONDUCTORS PROPRIETARY INFORMATION February,22 20