AN2295 Freescale Semiconductor / Motorola, AN2295 Datasheet
AN2295
Related parts for AN2295
AN2295 Summary of contents
Page 1
... FLASH reprogramming using ROM routines • Simple software SCI • Use of the internal clock generator • PLL clock programming • EEPROM programming (AS/AZ HC08 Families) This product incorporates SuperFlash technology licensed from SST. © Freescale Semiconductor, Inc., 2004. All rights reserved. AN2295/D Rev. 6, 11/2004 ...
Page 2
Project Objectives HC(S)08 Embedded Application (under development or re-configuration) Project Goals Freescale Semiconductor M68HC08 MCUs use a standard monitor mode interface for FLASH programming. Configuration of monitor mode requires a specific clock and high voltage (monitor mode entry voltage V ...
Page 3
Demo Features of Bootloader Application This document describes several different M68HC(S)08 bootloader implementations which vary mainly because the target M68HC(S)08 MCUs have different features. Several features of the M68HC(S)08 Family are also demonstrated, making this document useful to a wider ...
Page 4
FC Protocol Description POWER-ON RESET QUIT Figure 2. Simplified Flow Diagram of the Bootloader Application Initial Hook-Up There are several methods to enter bootloader mode. Several other solutions use a “ certain level on certain pin” method. An example of ...
Page 5
PC TRANSMITS 0XFC CHARACTER AT PROPER DATA RATE: TIME BOTH MCU AND PC DATA RATES ARE EQUAL MCU CLOCK IS 3 TIMES FASTER MCU CLOCK IS IDLE 3 TIMES SLOWER Figure 3. Matching Different Communication Speeds Table 1 shows the ...
Page 6
FC Protocol Description If the MCU transmits to the unmatched data rate, the PC receives (and accepts) characters that are different from the $FC character. The PC accepts all characters from the mentioned set ($FF, $FE, $FC, ...
Page 7
MCU ACK IS SENT AT UNCERTAIN DATA RATE CALIBRATION UNSUCCESSFUL OR ONLY ROUGH CORRECTION DONE CALIBRATION SUCCESSFUL FROM NOW ON, THE COMMUNICATION IS AT THE CORRECTLY SPECIFIED DATA RATE ACK IS SENT AT CORRECT DATARATE Figure 4. Start-Up Communication with ...
Page 8
FC Protocol Description MCU ACK IS SENT AT SPECIFIED DATA RATE NO CALIBRATION REQUIRED ACK IS SENT AT CORRECT DATA RATE Figure 5. Start-Up Communication Without Calibration Interpreting MCU Commands After communication between the MCU and the PC is established, ...
Page 9
PC TO MCU COMMAND COMMAND ADDRESS LENGTH MCU TO PC RESPONSE * Dashed fields are not always implemented, data from the MCU may contain only an ACK character instead. Figure 6. Typical Command and Response Ident Command The indent command ...
Page 10
FC Protocol Description FC Protocol Version 1 (M68HC08) Version 1 of the protocol is for M68HC08 MCUs. In version 1, additional fields are defined as: • Start address of reprogrammable memory area — 2 bytes • End address of reprogrammable ...
Page 11
PC TO MCU COMMAND I ($49) VERSION # AND SDID OF MEM CAPS. MCU TO PC RESPONSE Figure 9. Ident Command (FC Protocol Versions 2 & 3, HCS08) Erase Command The erase command (coded as ‘E’, $45) has only an ...
Page 12
FC Protocol Description Read Command The read command (coded as ‘R’, $52) has both address and data fields. Address contains the first address to be programmed; the single byte is the length of data to be read. The start address ...
Page 13
FC Protocol, Version 1, M68HC908 Implementation This section describes features that are specific to the M68HC908 bootloader implementation. The memory allocation is heavily MCU specific, so the meaning of all variables is explained in this section in detail. Figure 14 ...
Page 14
FC Protocol, Version 1, M68HC908 Implementation Memory Allocation The bootloader code occupies the top end of FLASH memory (the highest memory address space). This placement allows an effective use of the FLASH block protection technique (see the specific MCU data ...
Page 15
Figure 15 shows interrupt vector table relocation for M68HC08 MCUs. Note that in a standard interrupt vector table, each record is 2 bytes long (each vector is a 16-bit address). This is different from the bootloader user table, for which ...
Page 16
FC Protocol, Version 1, M68HC908 Implementation S19 File Because bootloader operation must be transparent to the user S19 file, another piece of intelligence is built into the PC master code (instead of the MCU slave). The relocation works like this: ...
Page 17
M68HC08 System Limitations This section summarizes limitations that must be considered when using the bootloader with the user application. Memory Occupied One of the most important requirements is to use the smallest code possible. Typical M68HC908 implementations are between 300 ...
Page 18
FC Protocol, Version 1, M68HC908 Implementation completely dedicated to bootloader code protection unavailable to the user application code. If the value for FLPBR appears in the user S19 code, a warning is displayed. Such an occurrence should be ...
Page 19
FC Protocol, Version 2, HC9S08 Implementation This section describes features that are specific to the HC9S08 bootloader implementation. The memory allocation is heavily MCU specific so the meaning of variables is explained in this section. Figure 16 shows the memory ...
Page 20
FC Protocol, Version 2, HC9S08 Implementation FLASH Protection By setting a FLASH protection register, all address space above this address is protected from both intentional and unintentional erasing/re-writing. After the bootloader and the FLASH protection register are programmed into memory, ...
Page 21
S19 File Because bootloader operation must be transparent to the user S19 file, another piece of intelligence is built into the PC master code (instead of the MCU slave). If the record in the interrupt vector table is detected in ...
Page 22
FC Protocol, Version 2, HC9S08 Implementation INTERRUPT VECTOR TABLE RESET VECTOR (bootloader start) original interrupt vector table is empty (unused) its content is relocated RELOCATED INTERRUPT VECTOR TABLE RESET VECTOR INTERRUPT VECTOR 1 INTERRUPT VECTOR 2 INTERRUPT VECTOR 3 ... ...
Page 23
If a power-on-reset is not detected, the user code is started instead of the bootloader code. This allows the transparent operation of all other resets (such as illegal address, etc.) with only a ...
Page 24
FC Protocol, Version 3, Large M68HC08 Implementation FC Protocol, Version 3, Large M68HC08 Implementation This section describes features that are specific to the protocol version 3 of bootloader intended for large HC08s (with two of more FLASH memory ...
Page 25
Table 2. Target Implementation Comparison MCU Family MC68HC908AP AP8/AP16/ 592 AP32/AP64 MC68HC908AB/AS/AZ AB32/AS32/AZ32 640 AS60/AZ60 MC68HC908EY 384 MC68HC908 EY16 MC68HC908GP 512 MC68HC908 GP32 MC68HC908GR 320 GR4/GR8/GR16 MC68HC908GT 384 GT8/GT16 MC68HC908GZ 512 GZ8/GZ16 MC68HC908GZ 512 MC68HC908 GZ60 MC68HC908JK/JL JK1/JL1/ 384 JK3/JL3 ...
Page 26
MCU Slave Software MC68HC908KX The M68HC908KX Family has an internal clock generator (ICG) module. This allows a very effective implementation of the bootloader without a crystal. The on-chip FLASH programming routines simplify the bootloader and improve memory use. The communication ...
Page 27
RESET NOT POR SRSR RESET SOURCE TEST POR CAUSED RESET MCU CONFIG ICG, SCI INIT SEND ACK AND WAIT FOR ANSWER YES TIMEOUT EXPIRED ? NO DISABLE SCI WAIT FOR HI-LO EDGE MEASURE BREAK TRIM ICG, ENABLE SCI SEND ACK ...
Page 28
MCU Slave Software Internal Clock Generator (ICG) — Initialization The ICG is simple to initialize. Because the ICG is active and the clock monitor is disabled after reset, the only action required is the modification of the ICG multiply register. ...
Page 29
BRKDONE: PSHH PULA TSTA TXA BEQ SLOW FAST: CMP #$40 BGE OOR ASLA ADD #$80 BRA ICGDONE SLOW: CMP #$C0 BLT OOR ASLA SUB #$80 ICGDONE: STA ICGTR OOR: RTS The complete explanation of the trimming procedure can be found ...
Page 30
MCU Slave Software RESET NOT POR SRSR RESET SOURCE TEST POR CAUSED RESET MCU CONFIG ... SEND ACK AND WAIT FOR ANSWER YES TIMEOUT EXPIRED ? NO ... WAIT FOR HI-LO EDGE MEASURE BREAK CALIBRATE SOFT-SCI SEND ACK 1 WAIT ...
Page 31
Software-SCI Transmit Char Routine A detailed description of the software-SCI transmit and receive subroutines is provided in this section. They both are based on a 16-bit timer, and the output-compare event is polled in the background loop. SHIFT-OUT TRANSMIT CHAR ...
Page 32
MCU Slave Software ;******************************************************************************************* SCITX: PSHH PSHX BCLR 7,TSC LDHX ONEBIT STHX TMOD BSET 4,TSC BCLR 5,TSC TXDCLR MOV #9,BITS BRA SCITX1 SCITX2: LSRA BCC DATALOW TXDSET SKIP2 DATALOW: TXDCLR BCLR 7,TSC SCITX1: BRCLR 7,TSC,SCITX1 DBNZ BITS,SCITX2 SCISTOP: TXDSET BCLR ...
Page 33
Software-SCI Receive Char Routine The software-SCI receive routine is similar to software-SCI transmit. When the 16-bit output-compare event is polled, the value of the receive pin is scanned. No provisions are made for stop-bit checking, framing check, noise detection, etc., ...
Page 34
MCU Slave Software ;******************************************************************************************* SCIRX: BRRXDLO SCIRX SCIRXNOEDGE: PSHH PSHX BCLR 7,TSC LDX ONEBIT LDA ONEBIT+1 LSRX RORA STX TMODH STA TMODL BSET 4,TSC SCIRX1: BRRXDHI SCIRX1 BCLR 5,TSC MOV #9,BITS SCIRX2: BRCLR 7,TSC,SCIRX2 LSRA BRRXDLO RXDLOW ORA #$80 RXDLOW: ...
Page 35
SKIP1 MACRO DC.B $21 ENDM SKIP2 MACRO DC.B $65 ENDM BRRXDLO MACRO IFNE RXDISIRQ IFNE SCIRXINV BIH \1 ; branch if RXD low ELSE BIL \1 ; branch if RXD low ENDIF ELSE ; RXD uses normal I/O pin IFNE ...
Page 36
MCU Slave Software MC68HC908GP MC68HC908GP MCUs have no on-chip FLASH programming routines available. Therefore, all FLASH programming must be done by the bootloader, as demonstrated in this section. MC68HC908GP MCUs are primarily targeted for use with a low-cost 32.768 kHz ...
Page 37
RESET NOT POR SRSR RESET SOURCE TEST POR CAUSED RESET MCU CONFIG ICG, SCI INIT SEND ACK AND WAIT FOR ANSWER YES ACK RECEIVED BEFORE TIMEOUT NO SEND ACK 1 WAIT FOR COMMAND 2 NO IDENT? YES SEND IDENT DATA ...
Page 38
MCU Slave Software FLASH Programming Routines The main code is similar to the previous implementation with the calibration phase omitted. The FLASH programming by the bootloader is shown in CPY_PRG — copies the selected routine into RAM • ERASE_ALG — ...
Page 39
WR_ALG: LDA #%00000001 STA FLCR LDA FLBPR LDHX ADRS STA X D_US #T10US LDA #%00001001 STA FLCR D_US #T5US LDHX #DAT TXS LDHX ADRS MOV LEN,POM WR_ALG_L1: PULA STA X AIX #1 D_US #T30US DBNZ POM,WR_ALG_L1 LDA #%00001000 STA FLCR ...
Page 40
MCU Slave Software For improved readability, two timing macros (D_US and D_MS) are used in the code (shown in ;******************************************************************************************* D_MS: MACRO LDA \1 ; [2] || \@L2: CLRX ; [1] || \@L1: NOP ; [1] | DBNZX \@L1 ; ...
Page 41
MC68HC908GT MC68HC908EY The code for MC68HC908GT and MC68HC908EY MCUs is similar to the for the memory maps and ROM routine locations. One minor difference is that MC68HC908GT Family cannot use the CGMXCLK clock as the SCI module source. Thus the ...
Page 42
MCU Slave Software The master side of the bootloader must be informed that the single-wire communication is used. This can be done by calling the hc08sprg.exe software. Use the following extended calling convention: hc08sprg.exe 1:S filename.s19 where 1 specifies which ...
Page 43
Because the memory map is not contiguous, FC protocol version 3 must be used (it allows the “holes” in the memory map, i.e., several separate memory blocks). MC9S08GB/GT MC9S08GB/GT devices are the first members of the HCS08 Family. Because of ...
Page 44
PC Bootloader Master Software PC Bootloader Master Software This section provides a detailed description of the bootloader host computer master software, which is downloadable as a zip file from the Freescale Semiconductor website, http://www.freescale.com. All code is written in C ...
Page 45
START ENOUGH NO X(0) ARGUMENTS ? YES INIT UART NO X(1) OK? YES OPEN S19 FILE NO X(2) OK? YES WAIT (HOOK) FOR MCU RESET NO X(3) OK? YES File Structure The following file structure is set up: • 8-Bit ...
Page 46
PC Bootloader Master Software 8-Bit MCU Image Operations To perform the necessary operations with the code, the master software keeps a binary image of the memory. Also, the information about whether an actual byte programmed into the ...
Page 47
UART Manipulations seriallinux.c serialw32. functions are defined: int init_uart(char* nm); int close_uart(void); int send_break10(void); int flush_uart(int out, int in); int wb(const void* data, unsigned len); int rb(void* dest, unsigned len); int init_uart(char* nm) The pair closing of the ...
Page 48
PC Bootloader Master Software Initial Hook (Waiting for MCU Reset) Immediately after all initializations are done in the PC, a loop is started to wait for communication from the MCU. The int hook_reset(void) communication with the MCU. Checking ACK int ...
Page 49
Main Programming Loop The core of the bootloader’s programming capabilities is implemented in the function prg_area(unsigned start, unsigned end) split the data into blocks of appropriate size (minimum erase/write block sizes). Then the erase block and write block routines are ...
Page 50
Bootloading Procedure Demonstration Developer’s Serial Bootloader for M68HC08 and HCS08 MCUs, Rev Figure 30. Bootloader Invocation Freescale Semiconductor ...
Page 51
The bootloader now expects the ACK command to be received from the MCU bootloader-enabled application. Then turn the power on for serial board and if all connections are OK, the MCU begins communication with the PC. The calibration procedure does ...
Page 52
Bootloading Procedure Demonstration Confirm by pressing ‘y’ and the bootloading (FLASH reprogramming) will continue. The user application will be then started. Developer’s Serial Bootloader for M68HC08 and HCS08 MCUs, Rev Figure 32. Bootloading Completed Freescale Semiconductor ...
Page 53
Memory Boundary Overlap Example If the user tries to bootload an application that will not fit in the actual MCU memory, a warning is displayed. The user may decide to continue, but some memory locations would likely be programmed incorrectly ...
Page 54
... References For additional information, refer to these documents from the Freescale Semiconductor website, http://www.freescale.com 1. AN2295SW: Contains all of the software files for this application note in a zip file. 2. HCS08RMv1/D: HCS08 Family Reference Manual Volume 1 3. AN1831/D: Using MC68HC908 On-Chip FLASH Programming Routines 4 ...
Page 55
Developer’s Serial Bootloader for M68HC08 and HCS08 MCUs, Rev. 6 Freescale Semiconductor Notes 55 ...
Page 56
... P.O. Box 5405 Denver, Colorado 80217 1-800-441-2447 or 303-675-2140 Fax: 303-675-2150 LDCForFreescaleSemiconductor@hibbertgroup.com AN2295/D Rev. 6, 11/2004 Information in this document is provided solely to enable system and software implementers to use Freescale Semiconductor products. There are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. ...