MC9S12G

MC9S12G Family Reference Manual S12 Microcontrollers MC9S12GRMV1 Rev.1.01 May 11, 2011 freescale.com To provide the most up-to-date information, the revision of our documents on the World Wide Web will be the most current. Your printed copy may be an earlier revision. To verify you have the latest information available, refer to: http://freescale.com/ A full list of family members and options is included in the appendices. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 2 The following revision history table summarizes changes contained in this document. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 3 Revision History Date Revision Level Description • Updated Chapter 2, “Port Integration Module (S12GPIMV1)” (Reason: Spec update) • Updated Chapter 7, “Background Debug Module (S12SBDMV1)” (Reason: Typos and formatting) • Updated Chapter 15, “Digital Analog Converter (DAC_8B5V)” (Reason: Spec update) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Updated Chapter 1, “Device Overview MC9S12G-Family” (Reason: Corrected pinout diagrams) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Updated Chapter 1, “Device Overview MC9S12G-Family” (Reason: Corrected pinout diagrams, typos, formatting) • Updated Chapter 21, “16 KByte Flash Module (S12FTMRG16K1V1)” (Reason: Spec update) • Updated Chapter 22, “32 KByte Flash Module (S12FTMRG32K1V1)” (Reason: Spec update) • Updated Chapter 23, “48 KByte Flash Module (S12FTMRG48K1V1)” (Reason: Spec update) • Updated Chapter 24, “64 KByte Flash Module (S12FTMRG64K1V1)” (Reason: Spec update) • Updated Chapter 25, “96 KByte Flash Module (S12FTMRG96K1V1)” (Reason: Spec update) • Updated Chapter 26, “128 KByte Flash Module (S12FTMRG128K1V1)” (Reason: Spec update) • Updated Chapter 27, “192 KByte Flash Module (S12FTMRG192K2V1)” (Reason: Spec update) • Updated Chapter 28, “240 KByte Flash Module (S12FTMRG240K2V1)” (Reason: Spec update) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Updated Chapter 1, “Device Overview MC9S12G-Family” (Reason: Spec update) • Updated Chapter 11, “Analog-to-Digital Converter (ADC10B8CV2)” (Reason: Spec update) • Updated Chapter 12, “Analog-to-Digital Converter (ADC10B12CV2)” (Reason: Spec update) • Updated Chapter 13, “Analog-to-Digital Converter (ADC12B12CV2)” (Reason: Spec update) • Updated Chapter 13, “Analog-to-Digital Converter (ADC10B16CV2)” (Reason: Spec update) • Updated Chapter 14, “Analog-to-Digital Converter (ADC12B16CV2)” (Reason: Spec update) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) Dec, 2010 0.45 Jan, 2011 0.46 Jan, 2011 0.47 Feb, 2011 0.48 Feb, 2011 0.49 MC9S12G Family Reference Manual, Rev.1.01 4 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Revision History Date Revision Level Description • Updated Chapter 16, “Freescale’s Scalable Controller Area Network (S12MSCANV3)” (Reason: Spec update) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Updated Chapter 1, “Device Overview MC9S12G-Family” (Reason: Spec update) • Updated Chapter 8, “S12S Debug Module (S12SDBG)” (Reason: Upated application information) • Updated Chapter 12, “Analog-to-Digital Converter (ADC10B12CV2)” (Reason: Corrected spec) • Updated Chapter 13, “Analog-to-Digital Converter (ADC10B16CV2)” (Reason: Updated spec) • Updated Chapter 14, “Analog-to-Digital Converter (ADC12B16CV2)” (Reason: Updated spec) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) • Public relasease for the launch of the S12G96 and the S12G128 • Updated Chapter 1, “Device Overview MC9S12G-Family” (Reason: Typos and formatting) • Updated Appendix A, “Electrical Characteristics” (Reason: Updated electricals) Mar, 2011 0.50 Apr, 2011 0.51 Apr, 2011 Apr, 2011 0.52 1.00 May, 2011 1.01 This document contains information for all constituent modules, with the exception of the CPU. For CPU information please refer to CPU12-1 in the CPU12 & CPU12X Reference Manual MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 5 MC9S12G Family Reference Manual, Rev.1.01 6 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Chapter 12 Chapter 13 Chapter 14 Chapter 15 Chapter 16 Chapter 17 Chapter 18 Chapter 19 Chapter 20 Chapter 21 Chapter 22 Chapter 23 Chapter 24 Chapter 25 Chapter 26 Chapter 27 Chapter 28 Appendix A Appendix B Appendix C Appendix D Device Overview MC9S12G-Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27 Port Integration Module (S12GPIMV0) . . . . . . . . . . . . . . . . . . . . . . . . . . .119 5V Analog Comparator (ACMPV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215 Reference Voltage Attenuator (RVAV1) . . . . . . . . . . . . . . . . . . . . . . . . . .220 S12G Memory Map Controller (S12GMMCV1) . . . . . . . . . . . . . . . . . . . . .233 Interrupt Module (S12SINTV1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .247 Background Debug Module (S12SBDMV1) . . . . . . . . . . . . . . . . . . . . . . .255 S12S Debug Module (S12SDBG). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279 Security (S12XS9SECV2). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .321 S12 Clock, Reset and Power Management Unit (S12CPMU) . . . . . . . . .327 Analog-to-Digital Converter (ADC10B8CV2) . . . . . . . . . . . . . . . . . . . . . .375 Analog-to-Digital Converter (ADC10B12CV2) . . . . . . . . . . . . . . . . . . . . .397 Analog-to-Digital Converter (ADC10B16CV2) . . . . . . . . . . . . . . . . . . . . .421 Analog-to-Digital Converter (ADC12B16CV2) . . . . . . . . . . . . . . . . . . . . .445 Digital Analog Converter (DAC_8B5V) . . . . . . . . . . . . . . . . . . . . . . . . . . .469 Freescale’s Scalable Controller Area Network (S12MSCANV3) . . . . . .481 Pulse-Width Modulator (S12PWM8B8CV2) . . . . . . . . . . . . . . . . . . . . . . .535 Serial Communication Interface (S12SCIV5) . . . . . . . . . . . . . . . . . . . . . .565 Serial Peripheral Interface (S12SPIV5) . . . . . . . . . . . . . . . . . . . . . . . . . . .603 Timer Module (TIM16B8CV3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .631 16 KByte Flash Module (S12FTMRG16K1V1) . . . . . . . . . . . . . . . . . . . . .659 32 KByte Flash Module (S12FTMRG32K1V1) . . . . . . . . . . . . . . . . . . . . .707 48 KByte Flash Module (S12FTMRG48K1V1) . . . . . . . . . . . . . . . . . . . . .759 64 KByte Flash Module (S12FTMRG64K1V1) . . . . . . . . . . . . . . . . . . . . .811 96 KByte Flash Module (S12FTMRG96K1V1) . . . . . . . . . . . . . . . . . . . . .863 128 KByte Flash Module (S12FTMRG128K1V1) . . . . . . . . . . . . . . . . . . .915 192 KByte Flash Module (S12FTMRG192K2V1) . . . . . . . . . . . . . . . . . . .967 240 KByte Flash Module (S12FTMRG240K2V1) . . . . . . . . . . . . . . . . . .1019 Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1073 Detailed Register Address Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1120 Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1140 Package Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1142 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 7 MC9S12G Family Reference Manual, Rev.1.01 8 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 1 Device Overview MC9S12G-Family 1.1 1.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.2.1 MC9S12G-Family Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 1.2.2 Chip-Level Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.3 Module Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 1.3.1 S12 16-Bit Central Processor Unit (CPU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.3.2 On-Chip Flash with ECC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.3.3 On-Chip SRAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.3.4 Port Integration Module (PIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.3.5 Main External Oscillator (XOSCLCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.3.6 Internal RC Oscillator (IRC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.3.7 Internal Phase-Locked Loop (IPLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.3.8 System Integrity Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.3.9 Timer (TIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.3.10 Pulse Width Modulation Module (PWM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.3.11 Controller Area Network Module (MSCAN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.3.12 Serial Communication Interface Module (SCI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.3.13 Serial Peripheral Interface Module (SPI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.3.14 Analog-to-Digital Converter Module (ADC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.3.15 Reference Voltage Attenuator (RVA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.3.16 Digital-to-Analog Converter Module (DAC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.3.17 Analog Comparator (ACMP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.3.18 On-Chip Voltage Regulator (VREG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.3.19 Background Debug (BDM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.3.20 Debugger (DBG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.4 Key Performance Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 1.6 Family Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 1.6.1 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.7 Signal Description and Device Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.7.1 Pin Assignment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.7.2 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.7.3 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.8 Device Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.8.1 S12GN16 and S12GN32 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 1.8.2 S12GN48 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 1.8.3 S12G48 and S12G64 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 1.8.4 S12G96 and S12G128 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 1.8.5 S12G192 and S12G240 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.8.6 S12GA192 and S12GA240 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 1.9 System Clock Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.10 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 1.10.1 Chip Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 9 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.10.2 Low Power Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 1.12.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 1.12.2 Interrupt Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 1.12.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 COP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Autonomous Clock (ACLK) Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 ADC External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 ADC Special Conversion Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 ADC Result Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 ADC VRH/VRL Signal Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 Chapter 2 Port Integration Module (S12GPIMV0) 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 PIM Routing - External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.2.1 Package Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.2.2 Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.2.3 Signals and Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 PIM Routing - Functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 2.3.1 Pin BKGD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.2 Pins PA7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.3 Pins PB7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.4 Pins PC7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.5 Pins PD7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.6 Pins PE1-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.7 Pins PT7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.8 Pins PS7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 2.3.9 Pins PM3-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 2.3.10 Pins PP7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 2.3.11 Pins PJ7-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 2.3.12 Pins AD15-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 PIM Ports - Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 2.4.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 2.4.2 Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 2.4.3 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 PIM Ports - Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 2.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 2.5.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 2.5.3 Pin Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 MC9S12G Family Reference Manual, Rev.1.01 10 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 2.2 2.3 2.4 2.5 2.6 2.5.4 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 2.6.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 2.6.2 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 2.6.3 Enabling IRQ edge-sensitive mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 2.6.4 ADC External Triggers ETRIG3-0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 2.6.5 Emulation of Smaller Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 Chapter 3 5V Analog Comparator (ACMPV1) 3.1 3.2 3.3 3.4 3.5 3.6 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 External Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 3.6.1 Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 3.6.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 3.7 Chapter 4 Reference Voltage Attenuator (RVAV1) 4.1 4.2 4.3 4.4 4.5 4.6 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 External Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 4.6.1 Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 4.6.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 4.7 Chapter 5 S12G Memory Map Controller (S12GMMCV1) 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 5.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 5.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 5.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 5.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 5.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 11 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 5.2 5.3 5.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 5.4.1 MCU Operating Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 5.4.2 Memory Map Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 5.4.3 Unimplemented and Reserved Address Ranges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 5.4.4 Prioritization of Memory Accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.4.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Chapter 6 Interrupt Module (S12SINTV1) 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 6.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 6.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 6.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 6.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 6.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 6.4.1 S12S Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 6.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 6.4.3 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 6.4.4 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 6.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 6.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 6.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 6.2 6.3 6.4 6.5 Chapter 7 Background Debug Module (S12SBDMV1) 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 7.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 7.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 7.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 7.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258 7.3.3 Family ID Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 7.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 7.4.2 Enabling and Activating BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 7.4.3 BDM Hardware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 7.4.4 Standard BDM Firmware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 7.4.5 BDM Command Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 7.2 7.3 7.4 MC9S12G Family Reference Manual, Rev.1.01 12 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 7.4.6 7.4.7 7.4.8 7.4.9 7.4.10 7.4.11 BDM Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 Serial Interface Hardware Handshake Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 SYNC — Request Timed Reference Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 Instruction Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 Serial Communication Time Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 Chapter 8 S12S Debug Module (S12SDBG) 8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 8.1.1 Glossary Of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 8.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 8.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 8.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 8.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 8.4.1 S12SDBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 8.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 8.4.3 Match Modes (Forced or Tagged) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304 8.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 8.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.4.6 Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 8.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 8.5.1 State Machine scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 8.5.2 Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 8.5.3 Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 8.5.4 Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 8.5.5 Scenario 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 8.5.6 Scenario 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 8.5.7 Scenario 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 8.5.8 Scenario 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 8.5.9 Scenario 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318 8.5.10 Scenario 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 8.5.11 Scenario 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 8.2 8.3 8.4 8.5 Chapter 9 Security (S12XS9SECV2) 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 9.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 13 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 9.1.2 9.1.3 9.1.4 9.1.5 9.1.6 9.1.7 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324 Complete Memory Erase (Special Modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 Chapter 10 S12 Clock, Reset and Power Management Unit (S12CPMU) 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 10.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 10.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 10.1.3 S12CPMU Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332 10.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 10.2.1 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 10.2.2 EXTAL and XTAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 10.2.3 VDDR — Regulator Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 10.2.4 VSS — Ground Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 10.2.5 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 10.2.6 VDDX, VSSX— Pad Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334 10.2.7 VDD — Internal Regulator Output Supply (Core Logic) . . . . . . . . . . . . . . . . . . . . . . . 335 10.2.8 VDDF — Internal Regulator Output Supply (NVM Logic) . . . . . . . . . . . . . . . . . . . . . 335 10.2.9 API_EXTCLK — API external clock output pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 10.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 10.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 10.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337 10.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 10.4.1 Phase Locked Loop with Internal Filter (PLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 10.4.2 Startup from Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364 10.4.3 Stop Mode using PLLCLK as Bus Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365 10.4.4 Full Stop Mode using Oscillator Clock as Bus Clock . . . . . . . . . . . . . . . . . . . . . . . . . . 365 10.4.5 External Oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 10.4.6 System Clock Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 10.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369 10.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369 10.5.2 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369 10.5.3 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 10.5.4 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371 10.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372 10.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372 10.7 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.7.1 General Initialization information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.7.2 Application information for COP and API usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 MC9S12G Family Reference Manual, Rev.1.01 14 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 11 Analog-to-Digital Converter (ADC10B8CV2) 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375 11.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375 11.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376 11.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377 11.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 11.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 11.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380 11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 11.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394 11.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 11.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396 11.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396 Chapter 12 Analog-to-Digital Converter (ADC10B12CV2) 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397 12.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397 12.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398 12.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399 12.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 12.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 12.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 12.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 12.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402 12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 12.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417 12.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 12.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 12.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 Chapter 13 Analog-to-Digital Converter (ADC10B16CV2) 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 13.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 13.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 13.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423 13.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 13.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 13.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 13.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 15 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441 13.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441 13.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442 13.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443 13.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443 Chapter 14 Analog-to-Digital Converter (ADC12B16CV2) 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445 14.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445 14.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446 14.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447 14.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 14.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 14.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 14.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450 14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 14.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 14.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467 14.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468 14.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468 Chapter 15 Digital Analog Converter (DAC_8B5V) 15.1 Revision History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 15.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 15.2.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 15.2.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 15.2.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 15.3 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 15.3.1 DACU Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 15.3.2 AMP Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 15.3.3 AMPP Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 15.3.4 AMPM Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 15.4 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 15.4.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 15.4.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 15.5 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 15.5.1 Functional Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 15.5.2 Mode “Off” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 15.5.3 Mode “Operational Amplifier” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 15.5.4 Mode “Unbuffered DAC” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476 MC9S12G Family Reference Manual, Rev.1.01 16 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 15.5.5 Mode “Unbuffered DAC with Operational Amplifier” . . . . . . . . . . . . . . . . . . . . . . . . . 476 15.5.6 Mode “Buffered DAC” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476 15.5.7 Analog output voltage calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476 Chapter 16 Freescale’s Scalable Controller Area Network (S12MSCANV3) 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481 16.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482 16.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482 16.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483 16.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483 16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483 16.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483 16.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 16.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484 16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 16.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505 16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515 16.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515 16.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516 16.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 519 16.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 16.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 16.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531 16.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 531 16.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533 16.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533 16.5.2 Bus-Off Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533 Chapter 17 Pulse-Width Modulator (S12PWM8B8CV2) 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 17.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 17.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 17.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 17.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 17.2.1 PWM7 - PWM0 — PWM Channel 7 - 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 17.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 17.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 17.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 17.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551 17.4.1 PWM Clock Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 17 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 17.4.2 PWM Channel Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555 17.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562 17.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 Chapter 18 Serial Communication Interface (S12SCIV5) 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565 18.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565 18.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 18.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 18.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 18.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 18.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 18.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 18.3.1 Module Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568 18.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568 18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 18.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 18.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 18.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 18.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583 18.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584 18.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 589 18.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597 18.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 18.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 18.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 18.5.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 18.5.3 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 18.5.4 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601 18.5.5 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601 Chapter 19 Serial Peripheral Interface (S12SPIV5) 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 19.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 19.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 19.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 19.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 19.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 19.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 19.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 MC9S12G Family Reference Manual, Rev.1.01 18 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 19.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 19.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615 19.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616 19.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 19.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618 19.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624 19.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625 19.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626 19.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 Chapter 20 Timer Module (TIM16B8CV3) 20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631 20.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631 20.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632 20.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633 20.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 20.2.1 IOC7 — Input Capture and Output Compare Channel 7 . . . . . . . . . . . . . . . . . . . . . . . . 635 20.2.2 IOC6 - IOC0 — Input Capture and Output Compare Channel 6-0 . . . . . . . . . . . . . . . . 635 20.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 20.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 20.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636 20.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653 20.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655 20.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655 20.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655 20.4.4 Pulse Accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 20.4.5 Event Counter Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 20.4.6 Gated Time Accumulation Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 20.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 20.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657 20.6.1 Channel [7:0] Interrupt (C[7:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 20.6.2 Pulse Accumulator Input Interrupt (PAOVI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 20.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 20.6.4 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 Chapter 21 16 KByte Flash Module (S12FTMRG16K1V1) 21.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 21.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 21.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 19 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 21.2 21.3 21.4 21.5 21.6 21.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663 21.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663 21.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 21.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 21.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 21.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 21.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 21.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 688 21.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 21.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703 21.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 21.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 21.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 21.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 705 21.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 706 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706 Chapter 22 32 KByte Flash Module (S12FTMRG32K1V1) 22.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 22.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708 22.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708 22.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 22.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710 22.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 22.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 22.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714 22.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733 22.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733 22.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733 22.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 22.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 22.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 739 22.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 22.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 754 22.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 22.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 22.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 22.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 22.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 756 22.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 757 MC9S12G Family Reference Manual, Rev.1.01 20 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 22.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 Chapter 23 48 KByte Flash Module (S12FTMRG48K1V1) 23.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759 23.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 23.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 23.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 23.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 23.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 23.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 23.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767 23.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 23.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 23.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 23.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 23.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 23.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 792 23.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793 23.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 807 23.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808 23.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808 23.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808 23.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808 23.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 809 23.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 810 23.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810 Chapter 24 64 KByte Flash Module (S12FTMRG64K1V1) 24.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 24.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 24.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 24.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 24.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 24.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 24.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 24.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 24.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837 24.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837 24.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837 24.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838 24.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838 24.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 843 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 21 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 24.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 844 24.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 858 24.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 24.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 24.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 24.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 24.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 860 24.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 861 24.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 861 Chapter 25 96 KByte Flash Module (S12FTMRG96K1V1) 25.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 863 25.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864 25.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864 25.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 865 25.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 866 25.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867 25.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867 25.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 870 25.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 25.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 25.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 25.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 25.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 25.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 895 25.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 25.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 910 25.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 911 25.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 911 25.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 911 25.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 911 25.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 912 25.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 913 25.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 913 Chapter 26 128 KByte Flash Module (S12FTMRG128K1V1) 26.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 915 26.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 916 26.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 916 26.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 917 26.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 918 26.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919 MC9S12G Family Reference Manual, Rev.1.01 22 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 26.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919 26.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 923 26.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 941 26.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 941 26.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 941 26.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 942 26.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 942 26.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 947 26.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 26.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 962 26.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 26.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 26.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 26.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 26.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 964 26.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 965 26.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 965 Chapter 27 192 KByte Flash Module (S12FTMRG192K2V1) 27.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 967 27.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 968 27.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 968 27.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 969 27.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 970 27.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 971 27.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 971 27.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 975 27.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993 27.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993 27.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993 27.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 994 27.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 994 27.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 999 27.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1000 27.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 27.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 27.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 27.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015 27.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015 27.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1016 27.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1016 27.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 23 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 28 240 KByte Flash Module (S12FTMRG240K2V1) 28.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1019 28.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020 28.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020 28.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021 28.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1022 28.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1023 28.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1023 28.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027 28.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1045 28.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1045 28.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1045 28.4.3 Internal NVM resource (NVMRES) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 28.4.4 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 28.4.5 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . 1051 28.4.6 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1052 28.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065 28.4.8 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1066 28.4.9 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1066 28.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1067 28.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1067 28.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1068 28.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1068 28.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1068 Appendix A Electrical Characteristics A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074 A.1.1 Parameter Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074 A.1.2 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074 A.1.3 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075 A.1.4 Current Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075 A.1.5 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075 A.1.6 ESD Protection and Latch-up Immunity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076 A.1.7 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077 A.1.8 Power Dissipation and Thermal Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078 A.2 I/O Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082 A.2.1 Supply Currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085 A.3 ADC Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089 A.3.1 ATD Operating Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089 A.3.2 Factors Influencing Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1090 A.3.3 ATD Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091 A.4 ACMP Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098 MC9S12G Family Reference Manual, Rev.1.01 24 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. A.5 DAC Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099 A.6 NVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100 A.6.1 Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100 A.6.2 NVM Reliability Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108 A.7 Phase Locked Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109 A.7.1 Jitter Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109 A.7.2 Electrical Characteristics for the PLL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111 A.8 Electrical Characteristics for the IRC1M . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111 A.9 Electrical Characteristics for the Oscillator (XOSCLCP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112 A.10 Reset Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112 A.11 Electrical Specification for Voltage Regulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113 A.12 Chip Power-up and Voltage Drops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114 A.13 MSCAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1114 A.14 SPI Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115 A.14.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115 A.14.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1117 A.15 ADC Conversion Result Reference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119 Appendix B Detailed Register Address Map B.1 Detailed Register Map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120 Appendix C Ordering Information Appendix D Package Information D.1 D.2 D.3 D.4 D.5 D.6 100 LQFP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143 64 LQFP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1146 48 LQFP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1149 48 QFN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1151 32 LQFP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1154 20 TSSOP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 25 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. MC9S12G Family Reference Manual, Rev.1.01 26 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 1 Device Overview MC9S12G-Family Revision History Version Number Rev 0.17 Rev 0.18 Rev 0.19 Rev 0.20 Rev 0.21 Rev 0.22 Rev 0.23 Revision Date 11-Aug-2010 12-Aug-2010 20-Aug-2010 17-Sep-2010 15-Oct-2010 8-Nov-2010 3-Jan-2010 • Typos and formatting • Typos and formatting • Typos and formatting • Typos and formatting • Corrected Table 1-28 • Typos and formatting • Reformatted Section 1.8, “Device Pinouts” • Typos and formatting • • • • • • • • • • • • • • • • • • • • • Corrected Figure 1-4 Corrected Figure 1-6 Corrected Figure 1-9 Typos and formatting Added Section 1.14, “Autonomous Clock (ACLK) Configuration” Corrected Figure 1-12 Corrected Figure 1-10 Corrected Figure 1-13 Corrected Figure 1-11 Typos and formatting Added Section 1.14, “Autonomous Clock (ACLK) Configuration” Corrected Figure 1-12 Corrected Figure 1-10 Corrected Figure 1-13 Corrected Figure 1-11 Typos and formatting Updated Table 1-1(added temperatur sensor feature) Updated Section 1.3.14, “Analog-to-Digital Converter Module (ADC)” Updated Table 1-31 Typos and formatting Description of Changes Rev 0.24 8-Feb-2010 Rev 0.25 18-Feb-2011 Rev 0.26 21-Feb-2011 Rev 0.27 Rev 0.28 1-Apr-2011 11-May-2011 • Typos and formatting 1.1 Introduction The MC9S12G-Family is an optimized, automotive, 16-bit microcontroller product line focused on low-cost, high-performance, and low pin-count. This family is intended to bridge between high-end 8-bit microcontrollers and high-performance 16-bit microcontrollers, such as the MC9S12XS-Family. The MC9S12G-Family is targeted at generic automotive applications requiring CAN or LIN/J2602 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 27 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family communication. Typical examples of these applications include body controllers, occupant detection, door modules, seat controllers, RKE receivers, smart actuators, lighting modules, and smart junction boxes. The MC9S12G-Family uses many of the same features found on the MC9S12XS- and MC9S12P-Family, including error correction code (ECC) on flash memory, a fast analog-to-digital converter (ADC) and a frequency modulated phase locked loop (IPLL) that improves the EMC performance. The MC9S12G-Family is optimized for lower program memory sizes down to 16k. In order to simplify customer use it features an EEPROM with a small 4 bytes erase sector size. The MC9S12G-Family deliver all the advantages and efficiencies of a 16-bit MCU while retaining the low cost, power consumption, EMC, and code-size efficiency advantages currently enjoyed by users of Freescale’s existing 8-bit and 16-bit MCU families. Like the MC9S12XS-Family, the MC9S12G-Family run 16-bit wide accesses without wait states for all peripherals and memories. The MC9S12G-Family is available in 100-pin LQFP, 64-pin LQFP, 48-pin LQFP/QFN, 32-pin LQFP and 20-pin TSSOP package options and aims to maximize the amount of functionality especially for the lower pin count packages. In addition to the I/O ports available in each module, further I/O ports are available with interrupt capability allowing wake-up from stop or wait modes. 1.2 Features This section describes the key features of the MC9S12G-Family. 1.2.1 MC9S12G-Family Comparison Table 1-1 provides a summary of different members of the MC9S12G-Family and their features. This information is intended to provide an understanding of the range of functionality offered by this microcontroller family. Table 1-1. MC9S12G-Family Overview1 Feature CPU Flash memory [kBytes] EEPROM [Bytes] RAM [Bytes] MSCAN SCI SPI 16-Bit Timer channels 8-Bit PWM channels 10-Bit ADC channels 16 512 1024 — 1 1 6 6 8 32 1024 2048 — 1 1 6 6 8 48 1536 4096 — 2 2 6 6 12 48 1536 4096 1 2 2 6 6 12 64 2048 4096 1 2 2 6 6 12 S12GN16 S12GN32 S12GN48 S12G48 S12G64 S12G96 S12G128 S12G192 S12GA192 S12G240 S12GA240 CPU12V1 96 3072 8192 1 3 3 8 8 12 128 4096 8192 1 3 3 8 8 12 192 4096 11264 1 3 3 8 8 16 192 4096 11264 1 3 3 8 8 — 240 4096 11264 1 3 3 8 8 16 240 4096 11264 1 3 3 8 8 — MC9S12G Family Reference Manual, Rev.1.01 28 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family Table 1-1. MC9S12G-Family Overview1 Feature 12-Bit ADC channels Temperature Sensor RVA 8-Bit DAC ACMP (analog comparator) PLL External osc Internal 1 MHz RC oscillator 20-pin TSSOP 32-pin LQFP 48-pin LQFP 48-pin QFN 64-pin LQFP 100-pin LQFP Supply voltage Execution speed 1 S12GN16 S12GN32 S12GN48 S12G48 S12G64 S12G96 S12G128 S12G192 S12GA192 S12G240 S12GA240 — — — — 1 Yes Yes Yes Yes Yes Yes Yes — — — — — — 1 Yes Yes Yes Yes Yes Yes Yes — — — — — — 1 Yes Yes Yes — Yes Yes — Yes — — — — — 1 Yes Yes Yes — Yes Yes — Yes — — — — — 1 Yes Yes Yes — Yes Yes — Yes — — — — — — Yes Yes Yes — — Yes — Yes Yes — — — — — Yes Yes Yes — — Yes — Yes Yes — — — — — Yes Yes Yes — — Yes — Yes Yes 16 YES YES 2 — Yes Yes Yes — — Yes — Yes Yes — — — — — Yes Yes Yes — — Yes — Yes Yes 16 YES YES 2 — Yes Yes Yes — — Yes — Yes Yes 3.13 V – 5.5 V Static – 25 MHz Not all peripherals are available in all package types Table 1-2shows the maximum number of peripherals or peripheral channels per package type. Not all peripherals are available at the same time. The maximum number of peripherals is also limited by the device chosen as per Table 1-1. Table 1-2. Maximum Peripheral Availability per Package Peripheral MSCAN SCI0 SCI1 SCI2 SPI0 SPI1 SPI2 Timer Channels 8-Bit PWM Channels 20 TSSOP — Yes — — Yes — — 4=0…3 4=0…3 32 LQFP Yes Yes Yes — Yes — — 6=0…5 6=0…5 48 LQFP, 48 QNFN Yes Yes Yes Yes Yes Yes — 8=0…7 8=0…7 64 LQFP Yes Yes Yes Yes Yes Yes Yes 8=0…7 8=0…7 100 LQFP Yes Yes Yes Yes Yes Yes Yes 8=0…7 8=0…7 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 29 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family Table 1-2. Maximum Peripheral Availability per Package Peripheral ADC channels DAC0 DAC1 ACMP Total GPIO 20 TSSOP 6=0…5 — — Yes 14 32 LQFP 8=0…7 — — Yes 26 48 LQFP, 48 QNFN 12 = 0 … 11 Yes Yes Yes 40 64 LQFP 16 = 0 … 15 Yes Yes Yes 54 100 LQFP 16 = 0 … 15 Yes Yes — 86 1.2.2 Chip-Level Features On-chip modules available within the family include the following features: • S12 CPU core • Up to 240 Kbyte on-chip flash with ECC • Up to 4 Kbyte EEPROM with ECC • Up to 11 Kbyte on-chip SRAM • Phase locked loop (IPLL) frequency multiplier with internal filter • 4–16 MHz amplitude controlled Pierce oscillator • 1 MHz internal RC oscillator • Timer module (TIM) supporting up to eight channels that provide a range of 16-bit input capture, output compare, counter, and pulse accumulator functions • Pulse width modulation (PWM) module with up to eight x 8-bit channels • Up to 16-channel, 10 or 12-bit resolution successive approximation analog-to-digital converter (ADC) • Up to two 8-bit digital-to-analog converters (DAC) • Up to one 5V analog comparator (ACMP) • Up to three serial peripheral interface (SPI) modules • Up to three serial communication interface (SCI) modules supporting LIN communications • Up to one multi-scalable controller area network (MSCAN) module (supporting CAN protocol 2.0A/B) • On-chip voltage regulator (VREG) for regulation of input supply and all internal voltages • Autonomous periodic interrupt (API) • Precision fixed voltage reference for ADC conversions • Optional reference voltage attenuator module to increase ADC accuracy 1.3 Module Features The following sections provide more details of the modules implemented on the MC9S12G-Family family. MC9S12G Family Reference Manual, Rev.1.01 30 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family 1.3.1 S12 16-Bit Central Processor Unit (CPU) S12 CPU is a high-speed 16-bit processing unit: • Full 16-bit data paths supports efficient arithmetic operation and high-speed math execution • Includes many single-byte instructions. This allows much more efficient use of ROM space. • Extensive set of indexed addressing capabilities, including: — Using the stack pointer as an indexing register in all indexed operations — Using the program counter as an indexing register in all but auto increment/decrement mode — Accumulator offsets using A, B, or D accumulators — Automatic index predecrement, preincrement, postdecrement, and postincrement (by –8 to +8) 1.3.2 On-Chip Flash with ECC On-chip flash memory on the MC9S12G-Family family features the following: • Up to 240 Kbyte of program flash memory — 32 data bits plus 7 syndrome ECC (error correction code) bits allow single bit error correction and double fault detection — Erase sector size 512 bytes — Automated program and erase algorithm — User margin level setting for reads — Protection scheme to prevent accidental program or erase • Up to 4 Kbyte EEPROM — 16 data bits plus 6 syndrome ECC (error correction code) bits allow single bit error correction and double fault detection — Erase sector size 4 bytes — Automated program and erase algorithm — User margin level setting for reads 1.3.3 • On-Chip SRAM Up to 11 Kbytes of general-purpose RAM 1.3.4 • • • • Port Integration Module (PIM) Data registers and data direction registers for ports A, B, C, D, E, T, S, M, P, J and AD when used as general-purpose I/O Control registers to enable/disable pull devices and select pullups/pulldowns on ports T, S, M, P, J and AD on per-pin basis Single control register to enable/disable pull devices on ports A, B, C, D and E, on per-port basis and on BKGD pin Control registers to enable/disable open-drain (wired-or) mode on ports S and M MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 31 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family • • • • • • • Interrupt flag register for pin interrupts on ports P, J and AD Control register to configure IRQ pin operation Routing register to support programmable signal redirection in 20 TSSOP only Routing register to support programmable signal redirection in 100 LQFP package only Package code register preset by factory related to package in use, writable once after reset. Also includes bit to reprogram routing of API_EXTCLK in all packages. Control register for free-running clock outputs 1.3.5 • Main External Oscillator (XOSCLCP) Loop control Pierce oscillator using a 4 MHz to 16 MHz crystal — Current gain control on amplitude output — Signal with low harmonic distortion — Low power — Good noise immunity — Eliminates need for external current limiting resistor — Transconductance sized for optimum start-up margin for typical crystals — Oscillator pins can be shared w/ GPIO functionality 1.3.6 • Internal RC Oscillator (IRC) Trimmable internal reference clock. — Frequency: 1 MHz — Trimmed accuracy over –40˚C to +125˚C ambient temperature range: ±1.0% for temperature option C and V (see Table A-4) ±1.3% for temperature option M (see Table A-4) 1.3.7 • Internal Phase-Locked Loop (IPLL) Phase-locked-loop clock frequency multiplier — No external components required — Reference divider and multiplier allow large variety of clock rates — Automatic bandwidth control mode for low-jitter operation — Automatic frequency lock detector — Configurable option to spread spectrum for reduced EMC radiation (frequency modulation) — Reference clock sources: – External 4–16 MHz resonator/crystal (XOSCLCP) – Internal 1 MHz RC oscillator (IRC) MC9S12G Family Reference Manual, Rev.1.01 32 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family 1.3.8 • • • • • • System Integrity Support Power-on reset (POR) System reset generation Illegal address detection with reset Low-voltage detection with interrupt or reset Real time interrupt (RTI) Computer operating properly (COP) watchdog — Configurable as window COP for enhanced failure detection — Initialized out of reset using option bits located in flash memory Clock monitor supervising the correct function of the oscillator • 1.3.9 • • • Timer (TIM) Up to eight x 16-bit channels for input capture or output compare 16-bit free-running counter with 7-bit precision prescaler In case of eight channel timer Version an additional 16-bit pulse accumulator is available 1.3.10 • Pulse Width Modulation Module (PWM) Up to eight channel x 8-bit or up to four channel x 16-bit pulse width modulator — Programmable period and duty cycle per channel — Center-aligned or left-aligned outputs — Programmable clock select logic with a wide range of frequencies 1.3.11 • Controller Area Network Module (MSCAN) • • • • • • 1 Mbit per second, CAN 2.0 A, B software compatible — Standard and extended data frames — 0–8 bytes data length — Programmable bit rate up to 1 Mbps Five receive buffers with FIFO storage scheme Three transmit buffers with internal prioritization Flexible identifier acceptance filter programmable as: — 2 x 32-bit — 4 x 16-bit — 8 x 8-bit Wakeup with integrated low pass filter option Loop back for self test Listen-only mode to monitor CAN bus MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 33 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Device Overview MC9S12G-Family • • Bus-off recovery by software intervention or automatically 16-bit time stamp of transmitted/received messages 1.3.12 • • • • • • • • • Serial Communication Interface Module (SCI) Up to three SCI modules Full-duplex or single-wire operation Standard mark/space non-return-to-zero (NRZ) format Selectable IrDA 1.4 return-to-zero-inverted (RZI) format with programmable pulse widths 13-bit baud rate selection Programmable character length Programmable polarity for transmitter and receiver Active edge receive wakeup Break detect and transmit collision detect supporting LIN 1.3, 2.0, 2.1 and SAE J2602 1.3.13 • • • • • • • Serial Peripheral Interface Module (SPI) Up to three SPI modules Configurable 8- or 16-bit data size Full-duplex or single-wire bidirectional Double-buffered transmit and receive Master or slave mode MSB-first or LSB-first shifting Serial clock phase and polarity options 1.3.14 Analog-to-Digital Converter Module (ADC) Up to 16-channel, 10-bit/12-bit1 analog-to-digital converter — 3 us conversion time — 8-/101-bit resolution — Left or right justified result data — Wakeup from low power modes on analog comparison > or GPO • 100 LQFP: The API_EXTCLK signal is mapped to this pin when used with the external clock function. If the Autonomous Periodic Interrupt clock is enabled and routed here the I/O state is forced to output. • Signal priority: 100 LQFP: API_EXTCLK > GPO • 100 LQFP: The ECLK signal is mapped to this pin when used with the external clock function. The enabled ECLK signal forces the I/O state to an output. • Signal priority: 100 LQFP: ECLK > GPO PB4 PB3 PB2 PB1 PB0 2.3.4 Pins PC7-0 • NOTE When using AMPM1, AMPP1 or DACU1 please refer to section 2.6.1, “Initialization”. MC9S12G Family Reference Manual, Rev.1.01 132 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) • When routing of ADC channels to PC4-PC0 is selected (PRR1[PRR1AN]=1) the related bit in the ADC Digital Input Enable Register (ATDDIEN) must be set to 1 to activate the digital input function on those pins not used as ADC inputs. Table 2-8. Port C Pins PC7-0 PC7 • 100 LQFP: The unbuffered analog output signal DACU1 of the DAC1 module is mapped to this pin if the DAC is operating in “unbuffered DAC” mode. If this pin is used with the DAC then the digital I/O function and pull device are disabled. • Signal priority: 100 LQFP: DACU1 > GPO • 100 LQFP: The non-inverting analog input signal AMPP1 of the DAC1 module is mapped to this pin if the DAC is operating in “unbuffered DAC with operational amplifier” or “operational amplifier only” mode. If this pin is used with the DAC then the digital input buffer is disabled. • Signal priority: 100 LQFP: GPO • 100 LQFP: The inverting analog input signal AMPM1 of the DAC1 module is mapped to this pin if the DAC is operating in “unbuffered DAC with operational amplifier” or “operational amplifier only” mode. If this pin is used with the DAC then the digital input buffer is disabled. • Signal priority: 100 LQFP: GPO • 100 LQFP: If routing is active (PRR1[PRR1AN]=1) the ADC analog input channel signals AN15-13 and their related digital trigger inputs are mapped to these pins. The routed ADC function has no effect on the output state. The input buffers are controlled by the related ATDDIEN bits and the ADC trigger functions. • Signal priority: 100 LQFP: GPO • 100 LQFP: If routing is active (PRR1[PRR1AN]=1) the ADC analog input channel signals AN11-10 and their related digital trigger inputs are mapped to these pins. The routed ADC function has no effect on the output state. The input buffers are controlled by the related ATDDIEN bits and the ADC trigger functions. • Signal priority: 100 LQFP: GPO PC6 PC5 PC4-PC2 PC1-PC0 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 133 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.3.5 PD7-PD0 Pins PD7-0 Table 2-9. Port D Pins PD7-0 • These pins feature general-purpose I/O functionality only. 2.3.6 PE1 Pins PE1-0 Table 2-10. Port E Pins PE1-0 • If the CPMU OSC function is active this pin is used as XTAL signal and the pulldown device is disabled. • 20 TSSOP: The SCI0 TXD signal is mapped to this pin when used with the SCI function. If the SCI0 TXD signal is enabled and routed here the I/O state will depend on the SCI0 configuration. • 20 TSSOP: The TIM channel 3 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • 20 TSSOP: The PWM channel 1 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • 20 TSSOP: The ADC ETRIG1 signal is mapped to this pin when used with the ADC function. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Signal priority: 20 TSSOP: XTAL > TXD0 > IOC3 > PWM1 > GPO Others: XTAL > GPO • If the CPMU OSC function is active this pin is used as EXTAL signal and the pulldown device is disabled. • 20 TSSOP: The SCI0 RXD signal is mapped to this pin when used with the SCI function. If the SCI0 RXD signal is enabled and routed here the I/O state will be forced to input. • 20 TSSOP: The TIM channel 2 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • 20 TSSOP: The PWM channel 0 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • 20 TSSOP: The ADC ETRIG0 signal is mapped to this pin when used with the ADC function. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Signal priority: 20 TSSOP: EXTAL > RXD0 > IOC2 > PWM0 > GPO Others: EXTAL > GPO PE0 2.3.7 PT7-PT6 Pins PT7-0 Table 2-11. Port T Pins PT7-0 • 64/100 LQFP: The TIM channels 7 and 6 signal are mapped to these pins when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • Signal priority: 64/100 LQFP: IOC7-6 > GPO • 48/64/100 LQFP: The TIM channel 5 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. If the ACMP timer link is enabled this pin is disconnected from the timer input so that it can still be used as general-purpose I/O or as timer output. The use case for the ACMP timer link requires the timer input capture function to be enabled. • Signal priority: 48/64/100 LQFP: IOC5 > GPO PT5 MC9S12G Family Reference Manual, Rev.1.01 134 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-11. Port T Pins PT7-0 (continued) PT4 • 48/64/100 LQFP: The TIM channel 4 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • Signal priority: 48/64/100 LQFP: IOC4 > GPO • Except 20 TSSOP: The TIM channels 3 and 2 signal are mapped to these pins when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • Signal priority: Except 20 TSSOP: IOC3-2 > GPO • Except 100 LQFP: The IRQ signal is mapped to this pin when used with the IRQ interrupt function. If enabled (IRQCR[IRQEN]=1) the I/O state of the pin is forced to be an input. • The TIM channel 1 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • Signal priority: 100 LQFP: IOC1 > GPO Others: IRQ > IOC1 > GPO • Except 100 LQFP: The XIRQ signal is mapped to this pin when used with the XIRQ interrupt function.The interrupt is enabled by clearing the X mask bit in the CPU Condition Code register. The I/O state of the pin is forced to input level upon the first clearing of the X bit and held in this state even if the bit is set again. A STOP or WAIT recovery with the X bit set (refer to CPU12/CPU12X Reference Manual) is not available. • The TIM channel 0 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • Signal priority: 100 LQFP: IOC0 > GPO Others: XIRQ > IOC0 > GPO PT3-PT2 PT1 PT0 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 135 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.3.8 PS7 Pins PS7-0 Table 2-12. Port S Pins PS7-0 • The SPI0 SS signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI0 the I/O state is forced to be input or output. • 20 TSSOP: The SCI0 TXD signal is mapped to this pin when used with the SCI function. If the SCI0 TXD signal is enabled and routed here the I/O state will depend on the SCI0 configuration. • 20 TSSOP: The PWM channel 3 signal is mapped to this pin when used with the PWM function. If the PWM channel is enabled and routed here the I/O state is forced to output.The enabled PWM channel forces the I/O state to be an output. • 32 LQFP: The PWM channel 5 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • 64/48/32/20 LQFP: The ECLK signal is mapped to this pin when used with the external clock function. If the ECLK output is enabled the I/O state will be forced to output. • The API_EXTCLK signal is mapped to this pin when used with the external clock function. If the Autonomous Periodic Interrupt clock is enabled and routed here the I/O state is forced to output. • 20 TSSOP: The ADC ETRIG3 signal is mapped to this pin if PWM channel 3 is routed here. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Signal priority: 20 TSSOP: SS0 > TXD0 > PWM3 > ECLK > API_EXTCLK > GPO 32 LQFP: SS0 > PWM5 > ECLK > API_EXTCLK > GPO 48/64 LQFP: SS0 > ECLK > API_EXTCLK > GPO 100 LQFP: SS0 > API_EXTCLK > GPO • The SPI0 SCK signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI0 the I/O state is forced to be input or output. • 20 TSSOP: The TIM channel 3 signal is mapped to this pin when used with the timer function. If the TIM output compare signal is enabled and routed here the I/O state will be forced to output. • 32 LQFP: The TIM channel 5 signal is mapped to this pin when used with the timer function. If the TIM output compare signal is enabled and routed here the I/O state will be forced to output. If the ACMP timer link is enabled this pin is disconnected from the timer input so that it can still be used as general-purpose I/O or as timer output. The use case for the ACMP timer link requires the timer input capture function to be enabled. • Signal priority: 20 TSSOP: SCK0 > IOC3 > GPO 32 LQFP: SCK0 > IOC5 > GPO Others: SCK0 > GPO • The SPI0 MOSI signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI0 the I/O state is forced to be input or output. • 20 TSSOP: The TIM channel 2 signal is mapped to this pin when used with the timer function. If the TIM output compare signal is enabled and routed here the I/O state will be forced to output. • 32 LQFP: The TIM channel 4 signal is mapped to this pin when used with the timer function. If the TIM output compare signal is enabled and routed here the I/O state will be forced to output. • Signal priority: 20 TSSOP: MOSI0 > IOC2 > GPO 32 LQFP: MOSI0 > IOC4 > GPO Others: MOSI0 > GPO PS6 PS5 MC9S12G Family Reference Manual, Rev.1.01 136 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-12. Port S Pins PS7-0 (continued) PS4 • The SPI0 MISO signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI0 the I/O state is forced to be input or output. • 20 TSSOP: The SCI0 RXD signal is mapped to this pin when used with the SCI function. If the SCI0 RXD signal is enabled and routed here the I/O state will be forced to input. • 20 TSSOP: The PWM channel 2 signal is mapped to this pin when used with the PWM function. If the PWM channel is enabled and routed here the I/O state is forced to output. • 32 LQFP: The PWM channel 4 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • 20 TSSOP: The ADC ETRIG2 signal is mapped to this pin if PWM channel 2 is routed here. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Signal priority: 20 TSSOP: MISO0 > RXD0 > PWM2 > GPO 32 LQFP: MISO0 > PWM4 > GPO Others: MISO0 > GPO • Except 20 TSSOP and 32 LQFP: The SCI1 TXD signal is mapped to this pin when used with the SCI function. If the SCI1 TXD signal is enabled the I/O state will depend on the SCI1 configuration. • Signal priority: 48/64/100 LQFP: TXD1 > GPO • Except 20 TSSOP and 32 LQFP: The SCI1 RXD signal is mapped to this pin when used with the SCI function. If the SCI1 RXD signal is enabled the I/O state will be forced to be input. • Signal priority: 20 TSSOP and 32 LQFP: GPO Others: RXD1 > GPO • Except 20 TSSOP: The SCI0 TXD signal is mapped to this pin when used with the SCI function. If the SCI0 TXD signal is enabled the I/O state will depend on the SCI0 configuration. • Signal priority: Except 20 TSSOP: TXD0 > GPO • Except 20 TSSOP: The SCI0 RXD signal is mapped to this pin when used with the SCI function. If the SCI0 RXD signal is enabled the I/O state will be forced to be input. • Signal priority: 20 TSSOP: GPO Others: RXD0 > GPO PS3 PS2 PS1 PS0 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 137 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.3.9 PM3 Pins PM3-0 Table 2-13. Port M Pins PM3-0 • 64/100 LQFP: The SCI2 TXD signal is mapped to this pin when used with the SCI function. If the SCI2 TXD signal is enabled the I/O state will depend on the SCI2 configuration. • Signal priority: 64/100 LQFP: TXD2 > GPO • 64/100 LQFP: The SCI2 RXD signal is mapped to this pin when used with the SCI function. If the SCI2 RXD signal is enabled the I/O state will be forced to be input. • Signal priority: 64/100 LQFP: RXD2 > GPO • Except 20 TSSOP: The TXCAN signal is mapped to this pin when used with the CAN function. The enabled CAN forces the I/O state to be an output. • 32 LQFP: The SCI1 TXD signal is mapped to this pin when used with the SCI function. If the SCI1 TXD signal is enabled the I/O state will depend on the SCI1 configuration. • 48 LQFP: The SCI2 TXD signal is mapped to this pin when used with the SCI function. If the SCI2 TXD signal is enabled the I/O state will depend on the SCI2 configuration. • Signal priority: 32 LQFP: TXCAN > TXD1 > GPO 48 LQFP: TXCAN > TXD2 > GPO 64/100 LQFP: TXCAN > GPO • Except 20 TSSOP: The RXCAN signal is mapped to this pin when used with the CAN function. The enabled CAN forces the I/O state to be an input. If CAN is active the selection of a pulldown device on the RXCAN input has no effect. • 32 LQFP: The SCI1 RXD signal is mapped to this pin when used with the SCI function. The enabled SCI1 RXD signal forces the I/O state to an input. • 48 LQFP: The SCI2 RXD signal is mapped to this pin when used with the SCI function. The enabled SCI2 RXD signal forces the I/O state to an input. • Signal priority: 32 LQFP: RXCAN > RXD1 > GPO 48 LQFP: RXCAN > RXD2 > GPO 64/100 LQFP: RXCAN > GPO PM2 PM1 PM0 2.3.10 PP7-PP6 Pins PP7-0 Table 2-14. Port P Pins PP7-0 • 64/100 LQFP: The PWM channels 7 and 6 signal are mapped to these pins when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • 64/100 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 64/100 LQFP: PWM > GPO • 48/64/100 LQFP: The PWM channels 5 and 4 signal are mapped to these pins when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • 48/64/100 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 48/64/100 LQFP: PWM > GPO PP5-PP4 MC9S12G Family Reference Manual, Rev.1.01 138 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-14. Port P Pins PP7-0 (continued) PP3-PP2 • Except 20 TSSOP: The PWM channels 3 and 2 signal are mapped to these pins when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • Except 20 TSSOP: The ADC ETRIG 3 and 2 signal are mapped to these pins when used with the ADC function. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Except 20 TSSOP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: Except 20 TSSOP: PWM > GPO • Except 20 TSSOP: The PWM channel 1 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • Except 100 LQFP and 20 TSSOP: The ECLKX2 signal is mapped to this pin when used with the external clock function. The enabled ECLKX2 forces the I/O state to an output. • Except 20 TSSOP: The ADC ETRIG1 signal is mapped to this pin when used with the ADC function. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Except 20 TSSOP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: Except 100 LQFP and 20 TSSOP: PWM1 > ECLKX2 > GPO 100 LQFP: PWM1 > GPO • Except 20 TSSOP: The PWM channel 0 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • Except 100 LQFP and 20 TSSOP: The API_EXTCLK signal is mapped to this pin when used with the external clock function. If the Autonomous Periodic Interrupt clock is enabled and routed here the I/O state is forced to output. • Except 20 TSSOP: The ADC ETRIG0 signal is mapped to this pin when used with the ADC function. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Except 20 TSSOP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: Except 100 LQFP and 20 TSSOP: PWM0 > API_EXTCLK > GPO 100 LQFP: PWM0 > GPO PP1 PP0 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 139 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.3.11 PJ7 Pins PJ7-0 Table 2-15. Port J Pins PJ7-0 • 64/100 LQFP: The SPI2 SS signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI2 the I/O state is forced to be input or output. • 64/100 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 64/100 LQFP: SS2 > GPO • 64/100 LQFP: The SPI2 SCK signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI2 the I/O state is forced to be input or output. • 64/100 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 64/100 LQFP: SCK2 > GPO • 64/100 LQFP: The SPI2 MOSI signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI2 the I/O state is forced to be input or output. • 64/100 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 64/100 LQFP: MOSI2 > GPO • 64/100 LQFP: The SPI2 MISO signal is mapped to this pin when used with the SPI function.Depending on the configuration of the enabled SPI2 the I/O state is forced to be input or output. • 64/100 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 64/100 LQFP: MISO2 > GPO • Except 20 TSSOP and 32 LQFP: The SPI1 SS signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI1 the I/O state is forced to be input or output. • 48 LQFP: The PWM channel 7 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • Except 20 TSSOP and 32 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 48 LQFP: SS1 > PWM7 > GPO 64/100 LQFP: SS1 > GPO • Except 20 TSSOP and 32 LQFP: The SPI1 SCK signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI1 the I/O state is forced to be input or output. • 48 LQFP: The TIM channel 7 signal is mapped to this pin when used with the TIM function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output. • Except 20 TSSOP and 32 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 48 LQFP: SCK1 > IOC7 > GPO 64/100 LQFP: SCK1 > GPO PJ6 PJ5 PJ4 PJ3 PJ2 MC9S12G Family Reference Manual, Rev.1.01 140 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-15. Port J Pins PJ7-0 (continued) PJ1 • Except 20 TSSOP and 32 LQFP: The SPI1 MOSI signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI1 the I/O state is forced to be input or output. • 48 LQFP: The TIM channel 6 signal is mapped to this pin when used with the timer function. The TIM forces the I/O state to be an output for a timer port associated with an enabled output. • Except 20 TSSOP and 32 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 48 LQFP: MOSI1 > IOC6 > GPO 64/100 LQFP: MOSI1 > GPO • Except 20 TSSOP and 32 LQFP: The SPI1 MISO signal is mapped to this pin when used with the SPI function. Depending on the configuration of the enabled SPI1 the I/O state is forced to be input or output. • 48 LQFP: The PWM channel 6 signal is mapped to this pin when used with the PWM function. The enabled PWM channel forces the I/O state to be an output. • Except 20 TSSOP and 32 LQFP: Pin interrupts can be generated if enabled in input or output mode. • Signal priority: 48 LQFP: MISO1 > PWM6 > GPO 64/100 LQFP: MISO1 > GPO PJ0 2.3.12 Pins AD15-0 NOTE To activate the digital input function the related bit in the ADC Digital Input Enable Register (ATDDIEN) must be set to 1. If the ADC is routed to port C the input buffers are automatically enabled on the freed up port AD pins. Additionally on pins shared with ACMPM and ACMPP the ACDIEN bit must be set to 1 in the ACMP Control Register (ACMPC). Table 2-16. Port AD Pins AD15-8 PAD15 • 64/100 LQFP: The unbuffered analog output signal DACU0 of the DAC0 module is mapped to this pin if the DAC is operating in “unbuffered DAC” mode. If this pin is used with the DAC then the digital I/O function and pull device are disabled. • 64/100 LQFP: If routing is inactive (PRR1[PRR1AN]=0) the ADC analog input channel signal AN15 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 64/100 LQFP: DACU0 > GPO • 64/100 LQFP: The non-inverting analog input signal AMPP0 of the DAC0 module is mapped to this pin if the DAC is operating in “unbuffered DAC with operational amplifier” or “operational amplifier only” mode. If this pin is used with the DAC then the digital input buffer is disabled. • 64/100 LQFP: If routing is inactive (PRR1[PRR1AN]=0) the ADC analog input channel signal AN14 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 64/100 LQFP: GPO PAD14 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 141 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-16. Port AD Pins AD15-8 PAD13 • 64/100 LQFP: The inverting analog input signal AMPM0 of the DAC0 module is mapped to this pin if the DAC is operating in “unbuffered DAC with operational amplifier” or “operational amplifier only” mode. If this pin is used with the DAC then the digital input buffer is disabled. • 64/100 LQFP: If routing is inactive (PRR1[PRR1AN]=0) the ADC analog input channel signal AN13 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 64/100 LQFP: GPO • 64/100 LQFP: The ADC analog input channel signal AN12 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 64/100 LQFP: GPO • 48/64/100 LQFP: The buffered analog output signal AMP0 of the DAC0 module is mapped to this pin if the DAC is operating in “buffered DAC”, “unbuffered DAC with operational amplifier” or “operational amplifier only” mode. If this pin is used with the DAC then the digital I/O function and pull device are disabled. • 48 LQFP: The unbuffered analog output signal DACU0 of the DAC0 module is mapped to this pin if the DAC is operating in “unbuffered DAC” mode. If this pin is used with the DAC then the digital output function and pull device are disabled. • 48/64 LQFP: The inverting input signal ACMPM of the analog comparator is mapped to this pin when used with the ACMP function. The ACMP function has no effect on the output state. The input buffer is controlled by the ACDIEN bit . • 48/64/100 LQFP: If routing is inactive (PRR1[PRR1AN]=0) the ADC analog input channel signal AN11 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 48/64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 48 LQFP: AMP0 | DACU0 > GPO 64/100 LQFP: AMP0 > GPO • 48/64 LQFP: The buffered analog output signal AMP1 of the DAC1 module is mapped to this pin if the DAC is operating in “buffered DAC” mode. If this pin is used with the DAC then the digital output function and pull device are disabled. • 100 LQFP: The buffered analog output signal AMP1 of the DAC1 module is mapped to this pin if the DAC is operating in “buffered DAC”, “unbuffered DAC with operational amplifier” or “operational amplifier only” mode. If this pin is used with the DAC then the digital I/O function and pull device are disabled. • 48/64 LQFP: The unbuffered analog output signal DACU1 of the DAC1 module is mapped to this pin if the DAC is operating in “unbuffered DAC” mode. If this pin is used with the DAC then the digital output function and pull device are disabled. • 48/64 LQFP: The non-inverting input signal ACMPP of the analog comparator is mapped to this pin when used with the ACMP function. The ACMP function has no effect on the output state. The input buffer is controlled by the ACDIEN bit . • 48/64/100 LQFP: If routing is inactive (PRR1[PRR1AN]=0) the ADC analog input channel signal AN10 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 48/64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 48/64 LQFP: AMP1 | DACU1 > GPO 100 LQFP: AMP1 > GPO PAD12 PAD11 PAD10 MC9S12G Family Reference Manual, Rev.1.01 142 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-16. Port AD Pins AD15-8 PAD9 • 48/64 LQFP: The ACMPO signal of the analog comparator is mapped to this pin when used with the ACMP function. If the ACMP output is enabled (ACMPC[ACOPE]=1) the I/O state will be forced to output. • 48/64/100 LQFP: The ADC analog input channel signal AN9 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 48/64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 48 LQFP: ACMPO > GPO 64/100 LQFP: GPO • 48/64/100 LQFP: The ADC analog input channel signal AN8 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 48/64/100 LQFP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 48/64/100 LQFP: GPO PAD8 Table 2-17. Port AD Pins AD7-0 PAD7 • 32 LQFP: The inverting input signal ACMPM of the analog comparator is mapped to this pin when used with the ACMP function. The ACMP function has no effect on the output state. The input buffer is controlled by the ACDIEN bit . • Except 20 TSSOP: The ADC analog input channel signal AN7 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • Except 20 TSSOP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: Except 20 TSSOP: GPO • 32 LQFP: The non-inverting input signal ACMPP of the analog comparator is mapped to this pin when used with the ACMP function. The ACMP function has no effect on the output state. The input buffer is controlled by the ACDIEN bit . • Except 20 TSSOP: The ADC analog input channel signal AN6 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • Except 20 TSSOP: Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: Except 20 TSSOP: GPO PAD6 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 143 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-17. Port AD Pins AD7-0 (continued) PAD5 • 32 LQFP: The ACMPO signal of the analog comparator is mapped to this pin when used with the ACMP function. If the ACMP output is enabled (ACMPC[ACOPE]=1) the I/O state will be forced to output. • 20 TSSOP: The inverting input signal ACMPM of the analog comparator is mapped to this pin when used with the ACMP function. The ACMP function has no effect on the output state. The input buffer is controlled by the ACDIEN bit. • The ADC analog input channel signal AN5 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 20 TSSOP: The SCI0 TXD signal is mapped to this pin. If the SCI0 TXD signal is enabled the I/O state will depend on the SCI0 configuration. • 20 TSSOP: The TIM channel 3 signal is mapped to this pin. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • 20 TSSOP: The PWM channel 3 signal is mapped to this pin. If the PWM channel is enabled and routed here the I/O state is forced to output. • 20 TSSOP: The ADC ETRIG3 signal is mapped to this pin if PWM channel 3 is routed here. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 32 LQFP: ACMPO > GPO 20 TSSOP: TXD0 > IOC3 > PWM3 > GPO Others: GPO • 20 TSSOP: The non-inverting input signal ACMPP of the analog comparator is mapped to this pin when used with the ACMP function. The ACMP function has no effect on the output state. The input buffer is controlled by the ACDIEN bit. • The ADC analog input channel signal AN4 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • 20 TSSOP: The SCI0 RXD signal is mapped to this pin. If the SCI0 RXD signal is enabled and routed here the I/O state will be forced to input. • 20 TSSOP: The TIM channel 2 signal is mapped to this pin. The TIM forces the I/O state to be an output for a timer port associated with an enabled output compare. • 20 TSSOP: The PWM channel 2 signal is mapped to this pin. If the PWM channel is enabled and routed here the I/O state is forced to output. • 20 TSSOP: The ADC ETRIG2 signal is mapped to this pin if PWM channel 2 is routed here. The enabled external trigger function has no effect on the I/O state. Refer to Section 2.6.4, “ADC External Triggers ETRIG3-0”. • Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 20 TSSOP: RXD0 > IOC2 > PWM2 > GPO Others: GPO PAD4 MC9S12G Family Reference Manual, Rev.1.01 144 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-17. Port AD Pins AD7-0 (continued) PAD3 • 20 TSSOP: The ACMPO signal of the analog comparator is mapped to this pin when used with the ACMP function. If the ACMP output is enabled (ACMPC[ACOPE]=1) the I/O state will be forced to output. • The ADC analog input channel signal AN3 and the related digital trigger input are mapped to this pin. The ADC function has no effect on the output state. The input buffer is controlled by the related ATDDIEN bit and the ADC trigger function. • Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: 20 TSSOP: ACMPO > GPO Others: GPO • The ADC analog input channel signals AN2-0 and their related digital trigger inputs are mapped to this pin. The ADC function has no effect on the output state. The input buffers are controlled by the related ATDDIEN bits and the ADC trigger functions. • Pin interrupts can be generated if enabled in digital input or output mode. • Signal priority: GPO PAD2-PAD0 2.4 PIM Ports - Memory Map and Register Definition This section provides a detailed description of all PIM registers. 2.4.1 Memory Map Table 2-18 shows the memory maps of all groups (for definitions see Table 2-2). Addresses 0x0000 to 0x0007 are only implemented in group G1 otherwise reserved. Table 2-18. Block Memory Map (0x0000-0x027F) Port (A) (B) Global Address 0x0000 0x0001 0x0002 0x0003 (C) (D) 0x0004 0x0005 0x0006 0x0007 E 0x0008 0x0009 0x000A : 0x000B Register PORTA—Port A Data Register1 PORTB—Port B Data Register1 DDRA—Port A Data Direction Register1 Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W Reset Value 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Section/Page 2.4.3.1/2-164 2.4.3.2/2-165 2.4.3.3/2-166 2.4.3.4/2-166 2.4.3.5/2-167 2.4.3.6/2-168 2.4.3.7/2-168 2.4.3.8/2-169 DDRB—Port B Data Direction Register1 PORTC—Port C Data Register1 PORTD—Port D Data Register1 DDRC—Port C Data Direction Register1 DDRD—Port D Data Direction Register1 PORTE—Port E Data Register DDRE—Port E Data Direction Register Non-PIM address range2 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 145 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-18. Block Memory Map (0x0000-0x027F) (continued) Port (A) (B) (C) (D) E Global Address 0x000C 0x000D Register PUCR—Pull Control Register Reserved Access R/W R Reset Value 0x50 0x00 Section/Page 2.4.3.11/2-171 0x000E : 0x001B 0x001C 0x001D 0x001E 0x001F 0x0020 : 0x023F T 0x0240 0x0241 0x0242 0x0243 0x0244 0x0245 0x0246 0x0247 S 0x0248 0x0249 0x024A 0x024B 0x024C 0x024D 0x024E 0x024F Non-PIM address range2 - - - ECLKCTL—ECLK Control Register Reserved IRQCR—IRQ Control Register Reserved Non-PIM address range2 R/W R R/W R - 0xC0 0x00 0x00 0x00 - 2.4.3.12/2-173 2.4.3.13/2-173 - PTT—Port T Data Register PTIT—Port T Input Register DDRT—Port T Data Direction Register Reserved PERT—Port T Pull Device Enable Register PPST—Port T Polarity Select Register Reserved Reserved PTS—Port S Data Register PTIS—Port S Input Register DDRS—Port S Data Direction Register Reserved PERS—Port S Pull Device Enable Register PPSS—Port S Polarity Select Register WOMS—Port S Wired-Or Mode Register PRR0—Pin Routing Register 04 R/W R R/W R R/W R/W R R R/W R R/W R R/W R/W R/W R/W 0x00 3 2.4.3.15/2-175 2.4.3.16/2-175 2.4.3.17/2-176 0x00 0x00 0x00 0x00 0x00 0x00 0x00 3 2.4.3.18/2-177 2.4.3.19/2-178 2.4.3.20/2-178 2.4.3.21/2-179 2.4.3.22/2-179 0x00 0x00 0xFF 0x00 0x00 0x00 2.4.3.23/2-180 2.4.3.24/2-180 2.4.3.25/2-181 2.4.3.26/2-181 MC9S12G Family Reference Manual, Rev.1.01 146 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-18. Block Memory Map (0x0000-0x027F) (continued) Port M Global Address 0x0250 0x0251 0x0252 0x0253 0x0254 0x0255 0x0256 0x0257 P 0x0258 0x0259 0x025A 0x025B 0x025C 0x025D 0x025E 0x025F 0x0260 0x0261 0x0262 : 0x0266 J 0x0268 0x0269 0x026A 0x026B 0x026C 0x026D 0x026E 0x026F Reserved Register PTM—Port M Data Register PTIM—Port M Input Register DDRM—Port M Data Direction Register Reserved PERM—Port M Pull Device Enable Register PPSM—Port M Polarity Select Register WOMM—Port M Wired-Or Mode Register PKGCR—Package Code Register PTP—Port P Data Register PTIP—Port P Input Register DDRP—Port P Data Direction Register Reserved PERP—Port P Pull Device Enable Register PPSP—Port P Polarity Select Register PIEP—Port P Interrupt Enable Register PIFP—Port P Interrupt Flag Register Reserved for ACMP available in group G2 and G3 Access R/W R R/W R R/W R/W R/W R/W R/W R R/W R R/W R/W R/W R/W R(/W) R(/W) R Reset Value 0x00 3 Section/Page 2.4.3.27/2-183 2.4.3.29/2-184 2.4.3.29/2-184 0x00 0x00 0x00 0x00 0x00 5 2.4.3.30/2-185 2.4.3.31/2-186 2.4.3.32/2-186 2.4.3.33/2-187 2.4.3.34/2-188 2.4.3.35/2-189 2.4.3.36/2-190 0x00 3 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 2.4.3.37/2-190 2.4.3.38/2-191 2.4.3.39/2-192 2.4.3.40/2-192 (3.6.2.1/3-217) (3.6.2.2/3-218) PTJ—Port J Data Register PTIJ—Port J Input Register DDRJ—Port J Data Direction Register Reserved PERJ—Port J Pull Device Enable Register PPSJ—Port J Polarity Select Register PIEJ—Port J Interrupt Enable Register PIFJ—Port J Interrupt Flag Register R/W R R/W R R/W R/W R/W R/W 0x00 3 2.4.3.42/2-193 2.4.3.43/2-194 2.4.3.44/2-195 0x00 0x00 0xFF (G1,G2) 0x0F (G3) 0x00 0x00 0x00 2.4.3.45/2-195 2.4.3.46/2-196 2.4.3.47/2-197 2.4.3.48/2-197 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 147 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-18. Block Memory Map (0x0000-0x027F) (continued) Port AD Global Address 0x0270 0x0271 0x0272 0x0273 0x0274 0x0275 0x0276 0x0277 0x0278 0x0279 0x027A 0x027B 0x027C 0x027D 0x027E 0x027F 1 2 3 4 5 6 Register PT0AD—Port AD Data Register PT1AD—Port AD Data Register PTI0AD—Port AD Input Register PTI1AD—Port AD Input Register DDR0AD—Port AD Data Direction Register DDR1AD—Port AD Data Direction Register Reserved for RVACTL on G(A)240 and G(A)192 only PRR1—Pin Routing Register 16 PER0AD—Port AD Pull Device Enable Register PER1AD—Port AD Pull Device Enable Register PPS0AD—Port AD Polarity Select Register PPS1AD—Port AD Polarity Select Register PIE0AD—Port AD Interrupt Enable Register PIE1AD—Port AD Interrupt Enable Register PIF0AD—Port AD Interrupt Flag Register PIF1AD—Port AD Interrupt Flag Register Access R/W R/W R R R/W R/W R(/W) R/W R/W R/W R/W R/W R/W R/W R/W R/W Reset Value 0x00 0x00 3 3 Section/Page 2.4.3.49/2-198 2.4.3.50/2-199 2.4.3.51/2-199 2.4.3.54/2-201 2.4.3.53/2-200 2.4.3.54/2-201 (4.6.2.1/4-222) 2.4.3.56/2-201 2.4.3.57/2-203 2.4.3.58/2-203 2.4.3.59/2-204 2.4.3.60/2-205 2.4.3.61/2-205 2.4.3.62/2-206 2.4.3.63/2-207 2.4.3.64/2-207 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Available in group G1 only. In any other case this address is reserved. Refer to device memory map to determine related module. Read always returns logic level on pins. Routing takes only effect if the PKGCR is set to 20 TSSOP. Preset by factory. Routing register only available on G(A)240 and G(A)192 only. Takes only effect if the PKGCR is set to 100 LQFP. 2.4.2 Register Map The following tables show the individual register maps of groups G1 (Table 2-19), G2 (Table 2-20) and G3 (Table 2-21). NOTE To maintain SW compatibility write data to unimplemented register bits must be zero. MC9S12G Family Reference Manual, Rev.1.01 148 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.2.1 Block Register Map (G1) Table 2-19. Block Register Map (G1) Global Address Register Name 0x0000 PORTA 0x0001 PORTB 0x0002 DDRA 0x0003 DDRB 0x0004 PORTC 0x0005 PORTD 0x0006 DDRC 0x0007 DDRD 0x0008 PORTE 0x0009 DDRE 0x000A–0x000B Non-PIM Address Range 0x000C PUCR 0x000D Reserved 0x000E–0x001B Non-PIM Address Range R W R W R W R W R W R W R W R Bit 7 PA7 6 PA6 5 PA5 4 PA4 3 PA3 2 PA2 1 PA1 Bit 0 PA0 PB7 PB6 PB5 PB4 PB3 PB2 PB1 PB0 DDRA7 DDRA6 DDRA5 DDRA4 DDRA3 DDRA2 DDRA1 DDRA0 DDRB7 DDRB6 DDRB5 DDRB4 DDRB3 DDRB2 DDRB1 DDRB0 PC7 PC6 PC5 PC4 PC3 PC2 PC1 PC0 PD7 PD6 PD5 PD4 PD3 PD2 PD1 PD0 DDRC7 DDRC6 DDRC5 DDRC4 DDRC3 DDRC2 DDRC1 DDRC0 DDRD7 0 DDRD6 0 DDRD5 0 DDRD4 0 DDRD3 0 DDRD2 0 DDRD1 DDRD0 R W R W R W R W R W R W PE1 PE0 0 0 0 0 0 0 DDRE1 DDRE0 Non-PIM Address Range 0 BKPUE 0 0 PDPEE 0 PUPDE 0 PUPCE 0 PUPBE 0 PUPAE 0 0 0 Non-PIM Address Range = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 149 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-19. Block Register Map (G1) (continued) Global Address Register Name 0x001C ECLKCTL 0x001D Reserved 0x001E IRQCR 0x001F Reserved 0x0020–0x023F Non-PIM Address Range 0x0240 PTT 0x0241 PTIT 0x0242 DDRT 0x0243 Reserved 0x0244 PERT 0x0245 PPST 0x0246 Reserved 0x0247 Reserved 0x0248 PTS 0x0249 PTIS R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W = Unimplemented or Reserved PTS7 PTIS7 PTS6 PTIS6 PTS5 PTIS5 PTS4 PTIS4 PTS3 PTIS3 PTS2 PTIS2 PTS1 PTIS1 PTS0 PTIS0 0 0 0 0 0 0 0 0 PERT7 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 DDRT7 0 DDRT6 0 DDRT5 0 DDRT4 0 DDRT3 0 DDRT2 0 DDRT1 0 DDRT0 0 Non-PIM Address Range IRQE IRQEN 0 0 0 0 0 0 Bit 7 NECLK 0 6 NCLKX2 0 5 DIV16 0 4 EDIV4 0 3 EDIV3 0 2 EDIV2 0 1 EDIV1 0 Bit 0 EDIV0 0 Reserved Reserved Reserved Reserved Reserved Reserved Reserved Reserved PTT7 PTIT7 PTT6 PTIT6 PTT5 PTIT5 PTT4 PTIT4 PTT3 PTIT3 PTT2 PTIT2 PTT1 PTIT1 PTT0 PTIT0 PPST7 0 PPST6 0 PPST5 0 PPST4 0 PPST3 0 PPST2 0 PPST1 0 PPST0 0 MC9S12G Family Reference Manual, Rev.1.01 150 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-19. Block Register Map (G1) (continued) Global Address Register Name 0x024A DDRS 0x024B Reserved 0x024C PERS 0x024D PPSS 0x024E WOMS 0x024F PRR0 0x0250 PTM 0x0251 PTIM 0x0252 DDRM 0x0253 Reserved 0x0254 PERM 0x0255 PPSM 0x0256 WOMM 0x0257 PKGCR 0x0258 PTP R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W APICLKS7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PERM3 PERM2 PERM1 PERM0 0 0 0 0 0 0 0 0 DDRM3 0 DDRM2 0 DDRM1 0 DDRM0 0 0 0 0 0 PERS7 PERS6 PERS5 PERS4 PERS3 PERS2 PERS1 PERS0 Bit 7 DDRS7 0 6 DDRS6 0 5 DDRS5 0 4 DDRS4 0 3 DDRS3 0 2 DDRS2 0 1 DDRS1 0 Bit 0 DDRS0 0 PPSS7 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 WOMS7 WOMS6 WOMS5 WOMS4 WOMS3 WOMS2 WOMS1 WOMS0 PRR0P3 0 PRR0P2 0 PRR0T31 0 PRR0T30 0 PRR0T21 PRR0T20 PRR0S1 PRR0S0 PTM3 PTIM3 PTM2 PTIM2 PTM1 PTIM1 PTM0 PTIM0 PPSM3 PPSM2 PPSM1 PPSM0 WOMM3 0 WOMM2 WOMM1 WOMM0 PKGCR2 PKGCR1 PKGCR0 PTP7 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 151 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-19. Block Register Map (G1) (continued) Global Address Register Name 0x0259 PTIP 0x025A DDRP 0x025B Reserved 0x025C PERP 0x025D PPSP 0x025E PIEP 0x025F PIFP 0x0260–0x0267 Reserved 0x0268 PTJ 0x0269 PTIJ 0x026A DDRJ 0x026B Reserved 0x026C PERJ 0x026D PPSJ 0x026E PIEJ R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W PERJ7 PERJ6 PERJ5 PERJ4 PERJ3 PERJ2 PERJ1 PERJ0 DDRJ7 0 DDRJ6 0 DDRJ5 0 DDRJ4 0 DDRJ3 0 DDRJ2 0 DDRJ1 0 DDRJ0 0 PTJ7 PTIJ7 PTJ6 PTIJ6 PTJ5 PTIJ5 PTJ4 PTIJ4 PTJ3 PTIJ3 PTJ2 PTIJ2 PTJ1 PTIJ1 PTJ0 PTIJ0 PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 DDRP7 0 DDRP6 0 DDRP5 0 DDRP4 0 DDRP3 0 DDRP2 0 DDRP1 0 DDRP0 0 Bit 7 PTIP7 6 PTIP6 5 PTIP5 4 PTIP4 3 PTIP3 2 PTIP2 1 PTIP1 Bit 0 PTIP0 PPSP7 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 PIEP7 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 PIFP7 0 PIFP6 0 PIFP5 0 PIFP4 0 PIFP3 0 PIFP2 0 PIFP1 0 PIFP0 0 PPSJ7 PPSJ6 PPSJ5 PPSJ4 PPSJ3 PPSJ2 PPSJ1 PPSJ0 PIEJ7 PIEJ6 PIEJ5 PIEJ4 PIEJ3 PIEJ2 PIEJ1 PIEJ0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 152 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-19. Block Register Map (G1) (continued) Global Address Register Name 0x026F PIFJ 0x0270 PT0AD 0x0271 PT1AD 0x0272 PTI0AD 0x0273 PTI1AD 0x0274 DDR0AD 0x0275 DDR1AD 0x0276 Reserved 0x0277 PRR1 0x0278 PER0AD 0x0279 PER1AD 0x027A PPS0AD 0x027B PPS1AD 0x027C PIE0AD 0x027D PIE1AD R W R W R W Bit 7 PIFJ7 6 PIFJ6 5 PIFJ5 4 PIFJ4 3 PIFJ3 2 PIFJ2 1 PIFJ1 Bit 0 PIFJ0 PT0AD7 PT0AD6 PT0AD5 PT0AD4 PT0AD3 PT0AD2 PT0AD1 PT0AD0 PT1AD7 PT1AD6 PTI0AD6 PT1AD5 PTI0AD5 PT1AD4 PTI0AD4 PT1AD3 PTI0AD3 PT1AD2 PTI0AD2 PT1AD1 PTI0AD1 PT1AD0 PTI0AD0 R PTI0AD7 W R PTI1AD7 W R W R W R W R W R W R W R W R W R W R W 0 PTI1AD6 PTI1AD5 PTI1AD4 PTI1AD3 PTI1AD2 PTI1AD1 PTI1AD0 DDR0AD7 DDR0AD6 DDR0AD5 DDR0AD4 DDR0AD3 DDR0AD2 DDR0AD1 DDR0AD0 DDR1AD7 DDR1AD6 DDR1AD5 DDR1AD4 DDR1AD3 DDR1AD2 DDR1AD1 DDR1AD0 Reserved for RVACTL on G(A)240 and G(A)192 0 0 0 0 0 0 PRR1AN PER0AD7 PER0AD6 PER0AD5 PER0AD4 PER0AD3 PER0AD2 PER0AD1 PER0AD0 PER1AD7 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 PPS0AD7 PPS0AD6 PPS0AD5 PPS0AD4 PPS0AD3 PPS0AD2 PPS0AD1 PPS0AD0 PPS1AD7 PPS1AD6 PPS1AD5 PPS1AD4 PPS1AD3 PPS1AD2 PPS1AD1 PPS1AD0 PIE0AD7 PIE0AD6 PIE0AD5 PIE0AD4 PIE0AD3 PIE0AD2 PIE0AD1 PIE0AD0 PIE1AD7 PIE1AD6 PIE1AD5 PIE1AD4 PIE1AD3 PIE1AD2 PIE1AD1 PIE1AD0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 153 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-19. Block Register Map (G1) (continued) Global Address Register Name 0x027E PIF0AD 0x027F PIF1AD R W R W Bit 7 PIF0AD7 6 PIF0AD6 5 PIF0AD5 4 PIF0AD4 3 PIF0AD3 2 PIF0AD2 1 PIF0AD1 Bit 0 PIF0AD0 PIF1AD7 PIF1AD6 PIF1AD5 PIF1AD4 PIF1AD3 PIF1AD2 PIF1AD1 PIF1AD0 = Unimplemented or Reserved 2.4.2.2 Block Register Map (G2) Table 2-20. Block Register Map (G2) Global Address Register Name 0x0000–0x0007 Reserved 0x0008 PORTE 0x0009 DDRE 0x000A–0x000B Non-PIM Address Range 0x000C PUCR 0x000D Reserved 0x000E–0x001B Non-PIM Address Range 0x001C ECLKCTL 0x001D Reserved R W R W R W R W R W R W R W R W R W Bit 7 0 6 0 5 0 4 0 3 0 2 0 1 0 Bit 0 0 0 0 0 0 0 0 PE1 PE0 0 0 0 0 0 0 DDRE1 DDRE0 Non-PIM Address Range 0 BKPUE 0 0 PDPEE 0 0 0 0 0 0 0 0 0 0 0 Non-PIM Address Range NECLK 0 NCLKX2 0 DIV16 0 EDIV4 0 EDIV3 0 EDIV2 0 EDIV1 0 EDIV0 0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 154 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-20. Block Register Map (G2) (continued) Global Address Register Name 0x001E IRQCR 0x001F Reserved 0x0020–0x023F Non-PIM Address Range 0x0240 PTT 0x0241 PTIT 0x0242 DDRT 0x0243 Reserved 0x0244 PERT 0x0245 PPST 0x0246 Reserved 0x0247 Reserved 0x0248 PTS 0x0249 PTIS 0x024A DDRS 0x024B Reserved R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W = Unimplemented or Reserved DDRS7 0 DDRS6 0 DDRS5 0 DDRS4 0 DDRS3 0 DDRS2 0 DDRS1 0 DDRS0 0 PTS7 PTIS7 PTS6 PTIS6 PTS5 PTIS5 PTS4 PTIS4 PTS3 PTIS3 PTS2 PTIS2 PTS1 PTIS1 PTS0 PTIS0 0 0 0 0 0 0 0 0 PERT7 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 DDRT7 0 DDRT6 0 DDRT5 0 DDRT4 0 DDRT3 0 DDRT2 0 DDRT1 0 DDRT0 0 Non-PIM Address Range Bit 7 IRQE 6 IRQEN 5 0 4 0 3 0 2 0 1 0 Bit 0 0 Reserved Reserved Reserved Reserved Reserved Reserved Reserved Reserved PTT7 PTIT7 PTT6 PTIT6 PTT5 PTIT5 PTT4 PTIT4 PTT3 PTIT3 PTT2 PTIT2 PTT1 PTIT1 PTT0 PTIT0 PPST7 0 PPST6 0 PPST5 0 PPST4 0 PPST3 0 PPST2 0 PPST1 0 PPST0 0 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 155 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-20. Block Register Map (G2) (continued) Global Address Register Name 0x024C PERS 0x024D PPSS 0x024E WOMS 0x024F PRR0 0x0250 PTM 0x0251 PTIM 0x0252 DDRM 0x0253 Reserved 0x0254 PERM 0x0255 PPSM 0x0256 WOMM 0x0257 PKGCR 0x0258 PTP 0x0259 PTIP 0x025A DDRP R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W DDRP7 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 APICLKS7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PERM3 PERM2 PERM1 PERM0 0 0 0 0 0 0 0 0 DDRM3 0 DDRM2 0 DDRM1 0 DDRM0 0 0 0 0 0 Bit 7 PERS7 6 PERS6 5 PERS5 4 PERS4 3 PERS3 2 PERS2 1 PERS1 Bit 0 PERS0 PPSS7 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 WOMS7 WOMS6 WOMS5 WOMS4 WOMS3 WOMS2 WOMS1 WOMS0 PRR0P3 0 PRR0P2 0 PRR0T31 0 PRR0T30 0 PRR0T21 PRR0T20 PRR0S1 PRR0S0 PTM3 PTIM3 PTM2 PTIM2 PTM1 PTIM1 PTM0 PTIM0 PPSM3 PPSM2 PPSM1 PPSM0 WOMM3 0 WOMM2 WOMM1 WOMM0 PKGCR2 PKGCR1 PKGCR0 PTP7 PTIP7 PTP6 PTIP6 PTP5 PTIP5 PTP4 PTIP4 PTP3 PTIP3 PTP2 PTIP2 PTP1 PTIP1 PTP0 PTIP0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 156 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-20. Block Register Map (G2) (continued) Global Address Register Name 0x025B Reserved 0x025C PERP 0x025D PPSP 0x025E PIEP 0x025F PIFP 0x0260–0x0261 Reserved 0x0262–0x0266 Reserved 0x0267 Reserved 0x0268 PTJ 0x0269 PTIJ 0x026A DDRJ 0x026B Reserved 0x026C PERJ 0x026D PPSJ 0x026E PIEJ R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W PERJ7 PERJ6 PERJ5 PERJ4 PERJ3 PERJ2 PERJ1 PERJ0 DDRJ7 0 DDRJ6 0 DDRJ5 0 DDRJ4 0 DDRJ3 0 DDRJ2 0 DDRJ1 0 DDRJ0 0 Reserved Reserved Reserved Reserved Reserved Reserved Reserved Reserved 0 0 0 PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 Bit 7 0 6 0 5 0 4 0 3 0 2 0 1 0 Bit 0 0 PPSP7 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 PIEP7 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 PIFP7 PIFP6 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 Reserved for ACMP 0 0 0 0 0 PTJ7 PTIJ7 PTJ6 PTIJ6 PTJ5 PTIJ5 PTJ4 PTIJ4 PTJ3 PTIJ3 PTJ2 PTIJ2 PTJ1 PTIJ1 PTJ0 PTIJ0 PPSJ7 PPSJ6 PPSJ5 PPSJ4 PPSJ3 PPSJ2 PPSJ1 PPSJ0 PIEJ7 PIEJ6 PIEJ5 PIEJ4 PIEJ3 PIEJ2 PIEJ1 PIEJ0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 157 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-20. Block Register Map (G2) (continued) Global Address Register Name 0x026F PIFJ 0x0270 PT0AD 0x0271 PT1AD 0x0272 PTI0AD 0x0273 PTI1AD 0x0274 DDR0AD 0x0275 DDR1AD 0x0276 Reserved 0x0277 Reserved 0x0278 PER0AD 0x0279 PER1AD 0x027A PPS0AD 0x027B PPS1AD 0x027C PIE0AD 0x027D PIE1AD R W R W R W Bit 7 PIFJ7 6 PIFJ6 5 PIFJ5 4 PIFJ4 3 PIFJ3 2 PIFJ2 1 PIFJ1 Bit 0 PIFJ0 PT0AD7 PT0AD6 PT0AD5 PT0AD4 PT0AD3 PT0AD2 PT0AD1 PT0AD0 PT1AD7 PT1AD6 PTI0AD6 PT1AD5 PTI0AD5 PT1AD4 PTI0AD4 PT1AD3 PTI0AD3 PT1AD2 PTI0AD2 PT1AD1 PTI0AD1 PT1AD0 PTI0AD0 R PTI0AD7 W R PTI1AD7 W R W R W R W R W R W R W R W R W R W R W 0 PTI1AD6 PTI1AD5 PTI1AD4 PTI1AD3 PTI1AD2 PTI1AD1 PTI1AD0 DDR0AD7 DDR0AD6 DDR0AD5 DDR0AD4 DDR0AD3 DDR0AD2 DDR0AD1 DDR0AD0 DDR1AD7 DDR1AD6 DDR1AD5 DDR1AD4 DDR1AD3 DDR1AD2 DDR1AD1 DDR1AD0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PER0AD7 PER0AD6 PER0AD5 PER0AD4 PER0AD3 PER0AD2 PER0AD1 PER0AD0 PER1AD7 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 PPS0AD7 PPS0AD6 PPS0AD5 PPS0AD4 PPS0AD3 PPS0AD2 PPS0AD1 PPS0AD0 PPS1AD7 PPS1AD6 PPS1AD5 PPS1AD4 PPS1AD3 PPS1AD2 PPS1AD1 PPS1AD0 PIE0AD7 PIE0AD6 PIE0AD5 PIE0AD4 PIE0AD3 PIE0AD2 PIE0AD1 PIE0AD0 PIE1AD7 PIE1AD6 PIE1AD5 PIE1AD4 PIE1AD3 PIE1AD2 PIE1AD1 PIE1AD0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 158 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-20. Block Register Map (G2) (continued) Global Address Register Name 0x027E PIF0AD 0x027F PIF1AD R W R W Bit 7 PIF0AD7 6 PIF0AD6 5 PIF0AD5 4 PIF0AD4 3 PIF0AD3 2 PIF0AD2 1 PIF0AD1 Bit 0 PIF0AD0 PIF1AD7 PIF1AD6 PIF1AD5 PIF1AD4 PIF1AD3 PIF1AD2 PIF1AD1 PIF1AD0 = Unimplemented or Reserved 2.4.2.3 Block Register Map (G3) Table 2-21. Block Register Map (G3) Global Address Register Name 0x0000–0x0007 Reserved 0x0008 PORTE 0x0009 DDRE 0x000A–0x000B Non-PIM Address Range 0x000C PUCR 0x000D Reserved 0x000E–0x001B Non-PIM Address Range 0x001C ECLKCTL 0x001D Reserved R W R W R W R W R W R W R W R W R W Bit 7 0 6 0 5 0 4 0 3 0 2 0 1 0 Bit 0 0 0 0 0 0 0 0 PE1 PE0 0 0 0 0 0 0 DDRE1 DDRE0 Non-PIM Address Range 0 BKPUE 0 0 PDPEE 0 0 0 0 0 0 0 0 0 0 0 Non-PIM Address Range NECLK 0 NCLKX2 0 DIV16 0 EDIV4 0 EDIV3 0 EDIV2 0 EDIV1 0 EDIV0 0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 159 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-21. Block Register Map (G3) (continued) Global Address Register Name 0x001E IRQCR 0x001F Reserved 0x0020–0x023F Non-PIM Address Range 0x0240 PTT 0x0241 PTIT 0x0242 DDRT 0x0243 Reserved 0x0244 PERT 0x0245 PPST 0x0246 Reserved 0x0247 Reserved 0x0248 PTS 0x0249 PTIS 0x024A DDRS 0x024B Reserved R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W = Unimplemented or Reserved DDRS7 0 DDRS6 0 DDRS5 0 DDRS4 0 DDRS3 0 DDRS2 0 DDRS1 0 DDRS0 0 PTS7 PTIS7 PTS6 PTIS6 PTS5 PTIS5 PTS4 PTIS4 PTS3 PTIS3 PTS2 PTIS2 PTS1 PTIS1 PTS0 PTIS0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 0 0 0 0 DDRT5 0 DDRT4 0 DDRT3 0 DDRT2 0 DDRT1 0 DDRT0 0 0 0 0 0 Non-PIM Address Range Bit 7 IRQE 6 IRQEN 5 0 4 0 3 0 2 0 1 0 Bit 0 0 Reserved Reserved Reserved Reserved Reserved Reserved Reserved Reserved PTT5 PTIT5 PTT4 PTIT4 PTT3 PTIT3 PTT2 PTIT2 PTT1 PTIT1 PTT0 PTIT0 PPST5 0 PPST4 0 PPST3 0 PPST2 0 PPST1 0 PPST0 0 MC9S12G Family Reference Manual, Rev.1.01 160 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-21. Block Register Map (G3) (continued) Global Address Register Name 0x024C PERS 0x024D PPSS 0x024E WOMS 0x024F PRR0 0x0250 PTM 0x0251 PTIM 0x0252 DDRM 0x0253 Reserved 0x0254 PERM 0x0255 PPSM 0x0256 WOMM 0x0257 PKGCR 0x0258 PTP 0x0259 PTIP 0x025A DDRP R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W 0 0 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 0 0 APICLKS7 0 0 0 0 0 PKGCR2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PERM1 PERM0 0 0 0 0 0 0 0 0 0 0 0 0 DDRM1 0 DDRM0 0 0 0 0 0 0 0 Bit 7 PERS7 6 PERS6 5 PERS5 4 PERS4 3 PERS3 2 PERS2 1 PERS1 Bit 0 PERS0 PPSS7 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 WOMS7 WOMS6 WOMS5 WOMS4 WOMS3 WOMS2 WOMS1 WOMS0 PRR0P3 0 PRR0P2 0 PRR0T31 0 PRR0T30 0 PRR0T21 0 PRR0T20 0 PRR0S1 PRR0S0 PTM1 PTIM1 PTM0 PTIM0 PPSM1 PPSM0 WOMM1 WOMM0 PKGCR1 PKGCR0 0 PTP5 PTIP5 PTP4 PTIP4 PTP3 PTIP3 PTP2 PTIP2 PTP1 PTIP1 PTP0 PTIP0 = Unimplemented or Reserved MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 161 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-21. Block Register Map (G3) (continued) Global Address Register Name 0x025B Reserved 0x025C PERP 0x025D PPSP 0x025E PIEP 0x025F PIFP 0x0260–0x0261 Reserved 0x0262–0x0267 Reserved 0x0268 PTJ 0x0269 PTIJ 0x026A DDRJ 0x026B Reserved 0x026C PERJ 0x026D PPSJ 0x026E PIEJ 0x026F PIFJ R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W = Unimplemented or Reserved 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PERJ3 PERJ2 PERJ1 PERJ0 0 0 0 0 0 0 0 0 DDRJ3 0 DDRJ2 0 DDRJ1 0 DDRJ0 0 0 0 0 0 0 0 0 0 PTJ3 PTIJ3 PTJ2 PTIJ2 PTJ1 PTIJ1 PTJ0 PTIJ0 0 0 0 0 0 0 0 0 0 0 0 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 Bit 7 0 6 0 5 0 4 0 3 0 2 0 1 0 Bit 0 0 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 Reserved for ACMP 0 0 0 0 0 PPSJ3 PPSJ2 PPSJ1 PPSJ0 PIEJ3 PIEJ2 PIEJ1 PIEJ0 PIFJ3 PIFJ2 PIFJ1 PIFJ0 MC9S12G Family Reference Manual, Rev.1.01 162 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-21. Block Register Map (G3) (continued) Global Address Register Name 0x0270 PT0AD 0x0271 PT1AD 0x0272 PTI0AD 0x0273 PTI1AD 0x0274 DDR0AD 0x0275 DDR1AD 0x0276 Reserved 0x0277 Reserved 0x0278 PER0AD 0x0279 PER1AD 0x027A PPS0AD 0x027B PPS1AD 0x027C PIE0AD 0x027D PIE1AD 0x027E PIF0AD R W R W R W R PTI1AD7 W R W R W R W R W R W R W R W R W R W R W R W = Unimplemented or Reserved PIE1AD7 0 PIE1AD6 0 PIE1AD5 0 PIE1AD4 0 PPS1AD7 0 PPS1AD6 0 PPS1AD5 0 PPS1AD4 0 0 0 0 0 PER0AD3 PER0AD2 PER0AD1 PER0AD0 0 0 0 0 0 0 0 0 0 0 0 0 DDR0AD3 DDR0AD2 DDR0AD1 DDR0AD0 PTI1AD6 PTI1AD5 PTI1AD4 PTI1AD3 PTI1AD2 PTI1AD1 PTI1AD0 PT1AD7 0 PT1AD6 0 PT1AD5 0 PT1AD4 0 Bit 7 0 6 0 5 0 4 0 3 PT0AD3 2 PT0AD2 1 PT0AD1 Bit 0 PT0AD0 PT1AD3 PTI0AD3 PT1AD2 PTI0AD2 PT1AD1 PTI0AD1 PT1AD0 PTI0AD0 DDR1AD7 DDR1AD6 DDR1AD5 DDR1AD4 DDR1AD3 DDR1AD2 DDR1AD1 DDR1AD0 0 0 0 0 0 0 0 0 PER1AD7 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 0 0 0 0 PPS0AD3 PPS0AD2 PPS0AD1 PPS0AD0 PPS1AD3 PPS1AD2 PPS1AD1 PPS1AD0 PIE0AD3 PIE0AD2 PIE0AD1 PIE0AD0 PIE1AD3 PIE1AD2 PIE1AD1 PIE1AD0 PIF0AD3 PIF0AD2 PIF0AD1 PIF0AD0 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 163 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-21. Block Register Map (G3) (continued) Global Address Register Name 0x027F PIF1AD R W Bit 7 PIF1AD7 6 PIF1AD6 5 PIF1AD5 4 PIF1AD4 3 PIF1AD3 2 PIF1AD2 1 PIF1AD1 Bit 0 PIF1AD0 = Unimplemented or Reserved 2.4.3 Register Descriptions This section describes the details of all configuration registers. Every register has the same functionality in all groups if not specified separately. Refer to the register figures for reserved locations. If not stated differently, writing to reserved bits has not effect and read returns zero. • • • NOTE All register read accesses are synchronous to internal clocks General-purpose data output availability depends on prioritization; input data registers always reflect the pin status independent of the use Pull-device availability, pull-device polarity, wired-or mode, key-wakeup functionality are independent of the prioritization unless noted differently in section Section 2.3, “PIM Routing - Functional description”. 2.4.3.1 Port A Data Register (PORTA) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0000 (G1) 7 R PA7 W Reset 0 0 0 0 0 0 0 0 PA6 PA5 PA4 PA3 PA2 PA1 PA0 Address 0x0000 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-2. Port A Data Register (PORTA) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 164 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-22. PORTA Register Field Descriptions Field 7-0 PA Description Port A general-purpose input/output data—Data Register The associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. 2.4.3.2 Port B Data Register (PORTB) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0001 (G1) 7 R PB7 W Reset 0 0 0 0 0 0 0 0 PB6 PB5 PB4 PB3 PB2 PB1 PB0 Address 0x0001 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-3. Port B Data Register (PORTB) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-23. PORTB Register Field Descriptions Field 7-0 PB Description Port B general-purpose input/output data—Data Register The associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 165 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.3 Port A Data Direction Register (DDRA) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0002 (G1) 7 R DDRA7 W Reset 0 0 0 0 0 0 0 0 DDRA6 DDRA5 DDRA4 DDRA3 DDRA2 DDRA1 DDRA0 Address 0x0002 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-4. Port A Data Direction Register (DDRA) 1 Read: Anytime Write: Anytime Table 2-24. DDRA Register Field Descriptions Field 7-0 DDRA Description Port A Data Direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.4 Port B Data Direction Register (DDRB) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0003 (G1) 7 R DDRB7 W Reset 0 0 0 0 0 0 0 0 DDRB6 DDRB5 DDRB4 DDRB3 DDRB2 DDRB1 DDRB0 Address 0x0003 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-5. Port B Data Direction Register (DDRB) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 166 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-25. DDRB Register Field Descriptions Field 7-0 DDRB Description Port B Data Direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.5 Port C Data Register (PORTC) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0004 (G1) 7 R PC7 W Reset 0 0 0 0 0 0 0 0 PC6 PC5 PC4 PC3 PC2 PC1 PC0 Address 0x0004 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-6. Port C Data Register (PORTC) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-26. PORTC Register Field Descriptions Field 7-0 PC Description Port C general-purpose input/output data—Data Register The associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 167 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.6 Port D Data Register (PORTD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0005 (G1) 7 R PD7 W Reset 0 0 0 0 0 0 0 0 PD6 PD5 PD4 PD3 PD2 PD1 PD0 Address 0x0005 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-7. Port D Data Register (PORTD) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-27. PORTD Register Field Descriptions Field 7-0 PD Description Port D general-purpose input/output data—Data Register The associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. 2.4.3.7 Port C Data Direction Register (DDRC) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0006 (G1) 7 R DDRC7 W Reset 0 0 0 0 0 0 0 0 DDRC6 DDRC5 DDRA4 DDRC3 DDRC2 DDRC1 DDRC0 Address 0x0006 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-8. Port C Data Direction Register (DDRC) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 168 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-28. DDRC Register Field Descriptions Field 7-0 DDRC Description Port C Data Direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.8 Port D Data Direction Register (DDRD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0007 (G1) 7 R DDRD7 W Reset 0 0 0 0 0 0 0 0 DDRD6 DDRD5 DDRD4 DDRD3 DDRD2 DDRD1 DDRD0 Address 0x0007 (G2, G3) 7 6 5 4 3 2 Access: User read only 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-9. Port D Data Direction Register (DDRD) 1 Read: Anytime Write: Anytime Table 2-29. DDRD Register Field Descriptions Field 7-0 DDRD Description Port D Data Direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.9 Port E Data Register (PORTE) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0008 7 R W Reset 0 0 0 0 0 0 PE1 PE0 0 0 0 0 0 0 0 0 Figure 2-10. Port E Data Register (PORTE) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 169 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-30. PORTE Register Field Descriptions Field 1-0 PE Description Port E general-purpose input/output data—Data Register When not used with an alternative signal, this pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit is driven to the pin. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 2.4.3.10 Port E Data Direction Register (DDRE) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0009 7 R W Reset 0 0 0 0 0 0 DDRE1 DDRE0 0 0 0 0 0 0 0 0 Figure 2-11. Port E Data Direction Register (DDRE) 1 Read: Anytime Write: Anytime Table 2-31. DDRE Register Field Descriptions Field 1-0 DDRE Description Port E Data Direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input MC9S12G Family Reference Manual, Rev.1.01 170 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.11 Ports A, B, C, D, E, BKGD pin Pull Control Register (PUCR) Access: User read/write1 6 5 4 3 2 1 0 Address 0x000C (G1) 7 R W Reset 0 BKPUE 0 1 0 PDPEE 0 1 PUPDE 0 PUPCE 0 PUPBE 0 PUPAE 0 Address 0x000C (G2, G3) 7 6 5 4 3 2 Access: User read/write 1 0 R W Reset 0 BKPUE 0 1 0 PDPEE 0 1 0 0 0 0 0 0 0 0 Figure 2-12. Ports A, B, C, D, E, BKGD pin Pullup Control Register (PUCR) 1 Read:Anytime in normal mode. Write:Anytime, except BKPUE, which is writable in special mode only. Table 2-32. PUCR Register Field Descriptions Field 6 BKPUE Description BKGD pin Pullup Enable—Enable pullup device on pin This bit configures whether a pullup device is activated, if the pin is used as input. If a pin is used as output this bit has no effect. Out of reset the pullup device is enabled. 1 Pullup device enabled 0 Pullup device disabled 4 PDPEE Port E Pulldown Enable—Enable pulldown devices on all port input pins This bit configures whether a pulldown device is activated on all associated port input pins. If a pin is used as output or used with the CPMU OSC function this bit has no effect. Out of reset the pulldown devices are enabled. 1 Pulldown devices enabled 0 Pulldown devices disabled 3 PUPDE Port D Pullup Enable—Enable pullup devices on all port input pins This bit configures whether a pullup device is activated on all associated port input pins. If a pin is used as output this bit has no effect. 1 Pullup devices enabled 0 Pullup devices disabled 2 PUPCE Port C Pullup Enable—Enable pullup devices on all port input pins This bit configures whether a pullup device is activated on all associated port input pins. If a pin is used as output this bit has no effect. 1 Pullup devices enabled 0 Pullup devices disabled MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 171 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-32. PUCR Register Field Descriptions (continued) Field 1 PUPBE Description Port B Pullup Enable—Enable pullup devices on all port input pins This bit configures whether a pullup device is activated on all associated port input pins. If a pin is used as output this bit has no effect. 1 Pullup devices enabled 0 Pullup devices disabled 0 PUPAE Port A Pullup Enable—Enable pullup devices on all port input pins This bit configures whether a pullup device is activated on all associated port input pins. If a pin is used as output this bit has no effect. 1 Pullup devices enabled 0 Pullup devices disabled MC9S12G Family Reference Manual, Rev.1.01 172 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.12 ECLK Control Register (ECLKCTL) Access: User read/write1 6 5 4 3 2 1 0 Address 0x001C 7 R NECLK W Reset: 1 1 0 0 0 0 0 0 NCLKX2 DIV16 EDIV4 EDIV3 EDIV2 EDIV1 EDIV0 Figure 2-13. ECLK Control Register (ECLKCTL) 1 Read: Anytime Write: Anytime Table 2-33. ECLKCTL Register Field Descriptions Field 7 NECLK Description No ECLK—Disable ECLK output This bit controls the availability of a free-running clock on the ECLK pin. This clock has a fixed rate equivalent to the internal bus clock. 1 ECLK disabled 0 ECLK enabled No ECLKX2—Disable ECLKX2 output This bit controls the availability of a free-running clock on the ECLKX2 pin. This clock has a fixed rate of twice the internal bus clock. 1 ECLKX2 disabled 0 ECLKX2 enabled 5 DIV16 Free-running ECLK predivider—Divide by 16 This bit enables a divide-by-16 stage on the selected EDIV rate. 1 Divider enabled: ECLK rate = EDIV rate divided by 16 0 Divider disabled: ECLK rate = EDIV rate 4-0 EDIV Free-running ECLK Divider—Configure ECLK rate These bits determine the rate of the free-running clock on the ECLK pin. 00000 ECLK rate = bus clock rate 00001 ECLK rate = bus clock rate divided by 2 00010 ECLK rate = bus clock rate divided by 3,... 11111 ECLK rate = bus clock rate divided by 32 6 NCLKX2 2.4.3.13 IRQ Control Register (IRQCR) Access: User read/write1 6 5 4 3 2 1 0 Address 0x001E 7 R IRQE W Reset 0 0 IRQEN 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-14. IRQ Control Register (IRQCR) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 173 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 1 Read: Anytime Write: IRQE: Once in normal mode, anytime in special mode IRQEN: Anytime Table 2-34. IRQCR Register Field Descriptions Field 7 IRQE IRQ select edge sensitive only— 1 IRQ pin configured to respond only to falling edges. Falling edges on the IRQ pin are detected anytime when IRQE=1 and will be cleared only upon a reset or the servicing of the IRQ interrupt. 0 IRQ pin configured for low level recognition 6 IRQEN IRQ enable— 1 IRQ pin is connected to interrupt logic 0 IRQ pin is disconnected from interrupt logic Description NOTE If the input is driven to active level (IRQ=0) a write access to set either IRQCR[IRQEN] and IRQCR[IRQE] to 1 simultaneously or to set IRQCR[IRQEN] to 1 when IRQCR[IRQE]=1 causes an IRQ interrupt to be generated if the I-bit is cleared. Refer to Section 2.6.3, “Enabling IRQ edge-sensitive mode”. 2.4.3.14 Reserved Register Access: User read/write1 6 5 4 3 2 1 0 Address 0x001F 7 R Reserved W Reset x x x x x x x x Reserved Reserved Reserved Reserved Reserved Reserved Reserved Figure 2-15. Reserved Register 1 Read: Anytime Write: Only in special mode These reserved registers are designed for factory test purposes only and are not intended for general user access. Writing to these registers when in special mode can alter the module’s functionality. MC9S12G Family Reference Manual, Rev.1.01 174 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.15 Port T Data Register (PTT) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0240 (G1, G2) 7 R PTT7 W Reset 0 0 0 0 0 0 0 0 PTT6 PTT5 PTT4 PTT3 PTT2 PTT1 PTT0 Address 0x0240 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PTT5 PTT4 0 PTT3 0 PTT2 0 PTT1 0 PTT0 0 0 0 0 Figure 2-16. Port T Data Register (PTT) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-35. PTT Register Field Descriptions Field 7-0 PTT Description Port T general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. 2.4.3.16 Port T Input Register (PTIT) Access: User read only1 6 5 4 3 2 1 0 Address 0x0241 (G1, G2) 7 R W Reset PTIT7 PTIT6 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 0 0 0 0 0 0 0 0 Address 0x0241 (G3) 7 6 5 4 3 2 Access: User read only1 1 0 R W Reset 0 0 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 0 0 0 0 0 0 0 0 Figure 2-17. Port T Input Register (PTIT) 1 Read: Anytime Write:Never MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 175 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-36. PTIT Register Field Descriptions Field 7-0 PTIT Description Port T input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. 2.4.3.17 Port T Data Direction Register (DDRT) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0242 (G1, G2) 7 R DDRT7 W Reset 0 0 0 0 0 0 0 0 DDRT6 DDRT5 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 Address 0x0242 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 DDRT5 DDRT4 0 DDRT3 0 DDRT2 0 DDRT1 0 DDRT0 0 0 0 0 Figure 2-18. Port T Data Direction Register (DDRT) 1 Read: Anytime Write: Anytime Table 2-37. DDRT Register Field Descriptions Field 7-0 DDRT Description Port T data direction— This bit determines whether the pin is a general-purpose input or output. 1 Associated pin configured as output 0 Associated pin configured as input MC9S12G Family Reference Manual, Rev.1.01 176 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.18 Port T Pull Device Enable Register (PERT) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0244 (G1, G2) 7 R PERT7 W Reset 0 0 0 0 0 0 0 0 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 Address 0x0244 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PERT5 PERT4 0 PERT3 0 PERT2 0 PERT1 0 PERT0 0 0 0 0 Figure 2-19. Port T Pull Device Enable Register (PERT) 1 Read: Anytime Write: Anytime Table 2-38. PERT Register Field Descriptions Field 7-2 PERT Description Port T pull device enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. If a pin is used as output this bit has no effect. The polarity is selected by the related polarity select register bit. 1 Pull device enabled 0 Pull device disabled 1 PERT Port T pull device enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. The polarity is selected by the related polarity select register bit. If this pin is used as IRQ only a pullup device can be enabled. 1 Pull device enabled 0 Pull device disabled 0 PERT Port T pull device enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. The polarity is selected by the related polarity select register bit. If this pin is used as XIRQ only a pullup device can be enabled. 1 Pull device enabled 0 Pull device disabled MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 177 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.19 Port T Polarity Select Register (PPST) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0245 (G1, G2) 7 R PPST7 W Reset 0 0 0 0 0 0 0 0 PPST6 PPST5 PPST4 PPST3 PPST2 PPST1 PPST0 Address 0x0245 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PPST5 PPST4 0 PPST3 0 PPST2 0 PPST1 0 PPST0 0 0 0 0 Figure 2-20. Port T Polarity Select Register (PPST) 1 Read: Anytime Write: Anytime Table 2-39. PPST Register Field Descriptions Field 7-0 PPST Description Port T pull device select—Configure pull device polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. 1 Pulldown device selected 0 Pullup device selected 2.4.3.20 Port S Data Register (PTS) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0248 7 R PTS7 W 0 0 0 0 0 0 0 0 PTS6 PTS5 PTS4 PTS3 PTS2 PTS1 PTS0 Figure 2-21. Port S Data Register (PTS) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 178 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-40. PTS Register Field Descriptions Field 7-0 PTS Description Port S general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. 2.4.3.21 Port S Input Register (PTIS) Access: User read only1 6 5 4 3 2 1 0 Address 0x0249 7 R W Reset PTIS7 PTIS6 PTIS5 PTIS4 PTIS3 PTIS2 PTIS1 PTIS0 0 0 0 0 0 0 0 0 Figure 2-22. Port S Input Register (PTIS) 1 Read: Anytime Write:Never Table 2-41. PTIS Register Field Descriptions Field 7-0 PTIS Description Port S input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. 2.4.3.22 Port S Data Direction Register (DDRS) Access: User read/write1 6 5 4 3 2 1 0 Address 0x024A 7 R DDRS7 W Reset 0 0 0 0 0 0 0 0 DDRS6 DDRS5 DDRS4 DDRS3 DDRS2 DDRS1 DDRS0 Figure 2-23. Port S Data Direction Register (DDRS) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 179 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-42. DDRS Register Field Descriptions Field 7-0 DDRS Description Port S data direction— This bit determines whether the associated pin is a general-purpose input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.23 Port S Pull Device Enable Register (PERS) Access: User read/write1 6 5 4 3 2 1 0 Address 0x024C 7 R PERS7 W Reset 1 1 1 1 1 1 1 1 PERS6 PERS5 PERS4 PERS3 PERS2 PERS1 PERS0 Figure 2-24. Port S Pull Device Enable Register (PERS) 1 Read: Anytime Write: Anytime Table 2-43. PERS Register Field Descriptions Field 7-0 PERS Description Port S pull device enable—Enable pull device on input pin or wired-or output pin This bit controls whether a pull device on the associated port input pin is active. The polarity is selected by the related polarity select register bit. If a pin is used as output this bit has only effect if used in wired-or mode with a pullup device. 1 Pull device enabled 0 Pull device disabled 2.4.3.24 Port S Polarity Select Register (PPSS) Access: User read/write1 6 5 4 3 2 1 0 Address 0x024D 7 R PPSS7 W Reset 0 0 0 0 0 0 0 0 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 Figure 2-25. Port S Polarity Select Register (PPSS) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 180 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-44. PPSS Register Field Descriptions Field 7-0 PPSS Description Port S pull device select—Configure pull device polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. 1 Pulldown device selected 0 Pullup device selected 2.4.3.25 Port S Wired-Or Mode Register (WOMS) Access: User read/write1 6 5 4 3 2 1 0 Address 0x024E 7 R WOMS7 W Reset 0 0 0 0 0 0 0 0 WOMS6 WOMS5 WOMS4 WOMS3 WOMS2 WOMS1 WOMS0 Figure 2-26. Port S Wired-Or Mode Register (WOMS) 1 Read: Anytime Write: Anytime Table 2-45. WOMS Register Field Descriptions Field 7-0 WOMS Description Port S wired-or mode—Enable open-drain functionality on output pin This bit configures an output pin as wired-or (open-drain) or push-pull. In wired-or mode a logic “0” is driven active-low while a logic “1” remains undriven. This allows a multipoint connection of several serial modules. The bit has no influence on pins used as input. 1 Output buffer operates as open-drain output. 0 Output buffer operates as push-pull output. 2.4.3.26 Pin Routing Register 0 (PRR0) NOTE Routing takes only effect if PKGCR is set to select the 20 TSSOP package. Address 0x024F 7 6 5 4 3 2 Access: User read/write1 1 0 R PRR0P3 W Reset 0 0 0 0 0 0 0 0 PRR0P2 PRR0T31 PRR0T30 PRR0T21 PRR0T20 PRR0S1 PRR0S0 Figure 2-27. Pin Routing Register (PRR0) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 181 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-46. PRR0 Register Field Descriptions Field 7 PRR0P3 6 PRR0P2 Description Pin Routing Register PWM3 —Select alternative routing of PWM3 output, ETRIG3 input This bit programs the routing of the PWM3 channel and the ETRIG3 input to a different external pin in 20 TSSOP. See Table 2-47 for more details. Pin Routing Register PWM2 —Select alternative routing of PWM2 output, ETRIG2 input This bit programs the routing of the PWM2 channel and the ETRIG2 input to a different external pin in 20 TSSOP. See Table 2-48 for more details. 5 Pin Routing Register IOC3 —Select alternative routing of IOC3 output and input PRR0T31 Those two bits program the routing of the timer IOC3 channel to different external pins in 20 TSSOP. See Table 2-49 for more details. 4 PRR0T30 3 Pin Routing Register IOC2 —Select alternative routing of IOC2 output and input PRR0T21 Those two bits program the routing of the timer IOC2 channel to different external pins in 20 TSSOP. See Table 2-50 for more details. 2 PRR0T20 1 PRR0S1 0 PRR0S0 Pin Routing Register Serial Module —Select alternative routing of SCI0 pins Those bits program the routing of the SCI0 module pins to different external pins in 20 TSSOP. See Table 2-51 for more details. Table 2-47. PWM3/ETRIG3 Routing Options PRR0P3 0 1 PWM3/ETRIG3 Associated Pin PS7 - PWM3, ETRIG3 PAD5 - PWM3, ETRIG3 Table 2-48. PWM2/ETRIG2 Routing Options PRR0P2 0 1 PWM2/ETRIG2 Associated Pin PS4 - PWM2, ETRIG2 PAD4 - PWM2, ETRIG2 Table 2-49. IOC3 Routing Options PRR0T31 0 0 1 1 PRR0T30 0 1 0 1 PS6 - IOC3 PE1 - IOC3 PAD5 - IOC3 Reserved IOC3 Associated Pin MC9S12G Family Reference Manual, Rev.1.01 182 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-50. IOC2 Routing Options PRR0T21 0 0 1 1 PRR0T20 0 1 0 1 PS5 - IOC2 PE0 - IOC2 PAD4 - IOC2 Reserved IOC2 Associated Pin Table 2-51. SCI0 Routing Options PRR0S1 0 0 1 1 PRR0S0 0 1 0 1 SCI0 Associated Pin PE0 - RXD, PE1 - TXD PS4 - RXD, PS7 - TXD PAD4 - RXD, PAD5 - TXD Reserved 2.4.3.27 Port M Data Register (PTM) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0250 (G1, G2) 7 R W Reset 0 0 0 0 PTM3 PTM2 0 PTM1 0 PTM0 0 0 0 0 0 0 Address 0x0250 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 0 0 PTM1 PTM0 0 0 0 0 0 0 0 0 Figure 2-28. Port M Data Register (PTM) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-52. PTM Register Field Descriptions Field 3-0 PTM Description Port M general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 183 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.28 Port M Input Register (PTIM) Access: User read only1 6 5 4 3 2 1 0 Address 0x0251 (G1, G2) 7 R W Reset 0 0 0 0 PTIM3 PTIM2 PTIM1 PTIM0 0 0 0 0 0 0 0 0 Address 0x0251 (G3) 7 6 5 4 3 2 Access: User read only1 1 0 R W Reset 0 0 0 0 0 0 PTIM1 PTIM0 0 0 0 0 0 0 0 0 Figure 2-29. Port M Input Register (PTIM) 1 Read: Anytime Write:Never Table 2-53. PTIM Register Field Descriptions Field 3-0 PTIM Description Port M input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. 2.4.3.29 Port M Data Direction Register (DDRM) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0252 (G1, G2) 7 R W Reset 0 0 0 0 DDRM3 DDRM2 0 DDRM1 0 DDRM0 0 0 0 0 0 0 Address 0x0252 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 0 0 DDRM1 DDRM0 0 0 0 0 0 0 0 0 Figure 2-30. Port M Data Direction Register (DDRM) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 184 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-54. DDRM Register Field Descriptions Field 3-0 DDRM Description Port M data direction— This bit determines whether the associated pin is a general-purpose input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.30 Port M Pull Device Enable Register (PERM) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0254 (G1, G2) 7 R W Reset 0 0 0 0 PERM3 PERM2 0 PERM1 0 PERM0 0 0 0 0 0 0 Address 0x0254 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 0 0 PERM1 PERM0 0 0 0 0 0 0 0 0 Figure 2-31. Port M Pull Device Enable Register (PERM) 1 Read: Anytime Write: Anytime Table 2-55. PERM Register Field Descriptions Field 3-1 PERM Description Port M pull device enable—Enable pull device on input pin or wired-or output pin This bit controls whether a pull device on the associated port input pin is active. The polarity is selected by the related polarity select register bit. If a pin is used as output this bit has only effect if used in wired-or mode with a pullup device. 1 Pull device enabled 0 Pull device disabled 0 PERM Port M pull device enable—Enable pull device on input pin or wired-or output pin This bit controls whether a pull device on the associated port input pin is active. The polarity is selected by the related polarity select register bit. If a pin is used as output this bit has only effect if used in wired-or mode with a pullup device. If CAN is active the selection of a pulldown device on the RXCAN input will have no effect. 1 Pull device enabled 0 Pull device disabled MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 185 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.31 Port M Polarity Select Register (PPSM) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0255 (G1, G2) 7 R W Reset 0 0 0 0 PPSM3 PPSM2 0 PPSM1 0 PPSM0 0 0 0 0 0 0 Address 0x0255 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 0 0 PPSM1 PPSM0 0 0 0 0 0 0 0 0 Figure 2-32. Port M Polarity Select Register (PPSM) 1 Read: Anytime Write: Anytime Table 2-56. PPSM Register Field Descriptions Field 3-0 PPSM Description Port M pull device select—Configure pull device polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. 1 Pulldown device selected 0 Pullup device selected 2.4.3.32 Port M Wired-Or Mode Register (WOMM) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0256 (G1, G2) 7 R W Reset 0 0 0 0 WOMM3 WOMM2 0 WOMM1 0 WOMM0 0 0 0 0 0 0 Address 0x0256 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 0 0 WOMM1 WOMM0 0 0 0 0 0 0 0 0 Figure 2-33. Port M Wired-Or Mode Register (WOMM) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 186 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-57. WOMM Register Field Descriptions Field 3-0 WOMM Description Port M wired-or mode—Enable open-drain functionality on output pin This bit configures an output pin as wired-or (open-drain) or push-pull. In wired-or mode a logic “0” is driven active-low while a logic “1” remains undriven. This allows a multipoint connection of several serial modules. The bit has no influence on pins used as input. 1 Output buffer operates as open-drain output. 0 Output buffer operates as push-pull output. 2.4.3.33 Package Code Register (PKGCR) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0257 7 R APICLKS7 W Reset 0 0 0 0 0 PKGCR2 PKGCR1 F PKGCR0 F 0 0 0 0 F After deassert of system reset the values are automatically loaded from the Flash memory. See device specification for details. Figure 2-34. Package Code Register (PKGCR) 1 Read: Anytime Write: APICLKS7: Anytime PKGCR2-0: Once in normal mode, anytime in special mode Table 2-58. PKGCR Register Field Descriptions Field Description 7 Pin Routing Register API_EXTCLK —Select PS7 as API_EXTCLK output APICLKS7 When set to 1 the API_EXTCLK output will be routed to PS7. The default pin will be disconnected in all packages except 20 TSSOP, which has no default location for API_EXTCLK. See Table 2-59 for more details. 2-0 PKGCR Package Code Register —Select package in use Those bits are preset by factory and reflect the package in use. See Table 2-60 for code definition. The bits can be modified once after reset to allow software development for a different package. In any other application it is recommended to re-write the actual package code once after reset to lock the register from inadvertent changes during operation. Writing reserved codes or codes of larger packages than the given device is offered in are illegal. In these cases the code will be converted to PKGCR[2:0]=0b111 and select the maximum available package option for the given device. Codes writes of smaller packages than the given device is offered in are not restricted. Depending on the package selection the input buffers of non-bonded pins are disabled to avoid shoot-through current. Also a predefined signal routing will take effect. Refer also to Section 2.6.5, “Emulation of Smaller Packages”. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 187 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-59. API_EXTCLK Routing Options APICLKS7 0 API_EXTCLK Associated Pin PB1 (100 LQFP) PP0 (64/48/32 LQFP) N.C. (20TSSOP) PS7 1 Table 2-60. Package Options PKGCR2 1 1 1 1 0 0 0 0 1 PKGCR1 1 1 0 0 1 1 0 0 PKGCR0 1 0 1 0 1 0 1 0 Selected Package Reserved1 100 LQFP Reserved 64 LQFP 48 LQFP Reserved 32 LQFP 20 TSSOP Reading this value indicates an illegal code write or uninitialized factory programming. 2.4.3.34 Port P Data Register (PTP) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0258 (G1, G2) 7 R PTP7 W Reset 0 0 0 0 0 0 0 0 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 Address 0x0258 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PTP5 PTP4 0 PTP3 0 PTP2 0 PTP1 0 PTP0 0 0 0 0 Figure 2-35. Port P Data Register (PTP) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 188 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-61. PTP Register Field Descriptions Field 7-0 PTP Description Port P general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. 2.4.3.35 Port P Input Register (PTIP) Access: User read only1 6 5 4 3 2 1 0 Address 0x0259 (G1, G2) 7 R W Reset PTIP7 PTIP6 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 0 0 0 0 0 0 0 0 Address 0x0259 (G3) 7 6 5 4 3 2 Access: User read only1 1 0 R W Reset 0 0 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 0 0 0 0 0 0 0 0 Figure 2-36. Port P Input Register (PTIP) 1 Read: Anytime Write:Never Table 2-62. PTIP Register Field Descriptions Field 7-0 PTIP Description Port P input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 189 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.36 Port P Data Direction Register (DDRP) Access: User read/write1 6 5 4 3 2 1 0 Address 0x025A (G1, G2) 7 R DDRP7 W Reset 0 0 0 0 0 0 0 0 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 Address 0x025A (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 DDRP5 DDRP4 0 DDRP3 0 DDRP2 0 DDRP1 0 DDRP0 0 0 0 0 Figure 2-37. Port P Data Direction Register (DDRP) 1 Read: Anytime Write: Anytime Table 2-63. DDRP Register Field Descriptions Field 7-0 DDRP Description Port P data direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.37 Port P Pull Device Enable Register (PERP) Access: User read/write1 6 5 4 3 2 1 0 Address 0x025C (G1, G2) 7 R PERP7 W Reset 0 0 0 0 0 0 0 0 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 Address 0x025C (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PERP5 PERP4 0 PERP3 0 PERP2 0 PERP1 0 PERP0 0 0 0 0 Figure 2-38. Port P Pull Device Enable Register (PERP) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 190 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-64. PERP Register Field Descriptions Field 7-0 PERP Description Port P pull device enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. If a pin is used as output this bit has no effect. The polarity is selected by the related polarity select register bit. 1 Pull device enabled 0 Pull device disabled 2.4.3.38 Port P Polarity Select Register (PPSP) Access: User read/write1 6 5 4 3 2 1 0 Address 0x025D (G1, G2) 7 R PPSP7 W Reset 0 0 0 0 0 0 0 0 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 Address 0x025D (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PPSP5 PPSP4 0 PPSP3 0 PPSP2 0 PPSP1 0 PPSP0 0 0 0 0 Figure 2-39. Port P Polarity Select Register (PPSP) 1 Read: Anytime Write: Anytime Table 2-65. PPSP Register Field Descriptions Field 7-0 PPSP Description Port P pull device select—Configure pull device and pin interrupt edge polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. This bit also selects the polarity of the active pin interrupt edge. 1 Pulldown device selected; rising edge selected 0 Pullup device selected; falling edge selected MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 191 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.39 Read: Anytime Port P Interrupt Enable Register (PIEP) Access: User read/write1 6 5 4 3 2 1 0 Address 0x025E (G1, G2) 7 R PIEP7 W Reset 0 0 0 0 0 0 0 0 PIEP6 PIEP5 PIEP4 PIEP3 PIEP2 PIEP1 PIEP0 Address 0x025E (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PIEP5 PIEP4 0 PIEP3 0 PIEP2 0 PIEP1 0 PIEP0 0 0 0 0 Figure 2-40. Port P Interrupt Enable Register (PIEP) 1 Read: Anytime Write: Anytime Table 2-66. PIEP Register Field Descriptions Field 7-0 PIEP Description Port P interrupt enable— This bit enables or disables the edge sensitive pin interrupt on the associated pin. An interrupt can be generated if the pin is operating in input or output mode when in use with the general-purpose or related peripheral function. 1 Interrupt is enabled 0 Interrupt is disabled (interrupt flag masked) 2.4.3.40 Port P Interrupt Flag Register (PIFP) Access: User read/write1 6 5 4 3 2 1 0 Address 0x025F (G1, G2) 7 R PIFP7 W Reset 0 0 0 0 0 0 0 0 PIFP6 PIFP5 PIFP4 PIFP3 PIFP2 PIFP1 PIFP0 Address 0x025F (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 PIFP5 PIFP4 0 PIFP3 0 PIFP2 0 PIFP1 0 PIFP0 0 0 0 0 Figure 2-41. Port P Interrupt Flag Register (PIFP) MC9S12G Family Reference Manual, Rev.1.01 192 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 1 Read: Anytime Write: Anytime, write 1 to clear Table 2-67. PIFP Register Field Descriptions Field 7-0 PIFP Description Port P interrupt flag— If the associated interrupt enable bit is set this flag asserts after a valid active edge was detected on the related pin (see Section 2.5.4.2, “Pin Interrupts and Wakeup”). This can be a rising or a falling edge based on the state of the polarity select register. Writing a logic “1” to the corresponding bit field clears the flag. 1 Active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set) 0 No active edge occurred 2.4.3.41 Reserved Registers NOTE Addresses 0x0260-0x0261 are reserved for ACMP registers in G2 and G3 only. Refer to Section 3.6.2.1, “ACMP Control Register (ACMPC)” and Section 3.6.2.2, “ACMP Status Register (ACMPS)”. 2.4.3.42 Port J Data Register (PTJ) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0268 (G1, G2) 7 R PTJ7 W Reset 0 0 0 0 0 0 0 0 PTJ6 PTJ5 PTJ4 PTJ3 PTJ2 PTJ1 PTJ0 Address 0x0268 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PTJ3 PTJ2 0 PTJ1 0 PTJ0 0 0 0 0 0 0 Figure 2-42. Port J Data Register (PTJ) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 193 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-69. PTJ Register Field Descriptions Field 7-0 PTJ Description Port J general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read. 2.4.3.43 Port J Input Register (PTIJ) Access: User read only1 6 5 4 3 2 1 0 Address 0x0269 (G1, G2) 7 R W Reset PTIJ7 PTIJ6 PTIJ5 PTIJ4 PTIJ3 PTIJ2 PTIJ1 PTIJ0 0 0 0 0 0 0 0 0 Address 0x0269 (G3) 7 6 5 4 3 2 Access: User read only1 1 0 R W Reset 0 0 0 0 PTIJ3 PTIJ2 PTIJ1 PTIJ0 0 0 0 0 0 0 0 0 Figure 2-43. Port J Input Register (PTIJ) 1 Read: Anytime Write:Never Table 2-70. PTIJ Register Field Descriptions Field 7-0 PTIJ Description Port J input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. MC9S12G Family Reference Manual, Rev.1.01 194 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.44 Port J Data Direction Register (DDRJ) Access: User read/write1 6 5 4 3 2 1 0 Address 0x026A (G1, G2) 7 R DDRJ7 W Reset 0 0 0 0 0 0 0 0 DDRJ6 DDRJ5 DDRJ4 DDRJ3 DDRJ2 DDRJ1 DDRJ0 Address 0x026A (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 DDRJ3 DDRJ2 0 DDRJ1 0 DDRJ0 0 0 0 0 0 0 Figure 2-44. Port J Data Direction Register (DDRJ) 1 Read: Anytime Write: Anytime Table 2-71. DDRJ Register Field Descriptions Field 7-0 DDRJ Description Port J data direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.45 Port J Pull Device Enable Register (PERJ) Access: User read/write1 6 5 4 3 2 1 0 Address 0x026C (G1, G2) 7 R PERJ7 W Reset 1 1 1 1 1 1 1 1 PERJ6 PERJ5 PERJ4 PERJ3 PERJ2 PERJ1 PERJ0 Address 0x026C (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PERJ3 PERJ2 1 PERJ1 1 PERJ0 1 0 0 0 0 1 Figure 2-45. Port J Pull Device Enable Register (PERJ) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 195 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-72. PERJ Register Field Descriptions Field 7-0 PERJ Description Port J pull device enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. If a pin is used as output this bit has no effect. The polarity is selected by the related polarity select register bit. 1 Pull device enabled 0 Pull device disabled 2.4.3.46 Port J Polarity Select Register (PPSJ) Access: User read/write1 6 5 4 3 2 1 0 Address 0x026D (G1, G2) 7 R PPSJ7 W Reset 0 0 0 0 0 0 0 0 PPSJ6 PPSJ5 PPSJ4 PPSJ3 PPSJ2 PPSJ1 PPSJ0 Address 0x026D (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PPSJ3 PPSJ2 0 PPSJ1 0 PPSJ0 0 0 0 0 0 0 Figure 2-46. Port J Polarity Select Register (PPSJ) 1 Read: Anytime Write: Anytime Table 2-73. PPSJ Register Field Descriptions Field 7-0 PPSJ Description Port J pull device select—Configure pull device and pin interrupt edge polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. This bit also selects the polarity of the active pin interrupt edge. 1 Pulldown device selected; rising edge selected 0 Pullup device selected; falling edge selected MC9S12G Family Reference Manual, Rev.1.01 196 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.47 Read: Anytime Port J Interrupt Enable Register (PIEJ) Access: User read/write1 6 5 4 3 2 1 0 Address 0x026E (G1, G2) 7 R PIEJ7 W Reset 0 0 0 0 0 0 0 0 PIEJ6 PIEJ5 PIEJ4 PIEJ3 PIEJ2 PIEJ1 PIEJ0 Address 0x026E (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PIEJ3 PIEJ2 0 PIEJ1 0 PIEJ0 0 0 0 0 0 0 Figure 2-47. Port J Interrupt Enable Register (PIEJ) 1 Read: Anytime Write: Anytime Table 2-74. PIEJ Register Field Descriptions Field 7-0 PIEJ Description Port J interrupt enable— This bit enables or disables the edge sensitive pin interrupt on the associated pin. An interrupt can be generated if the pin is operating in input or output mode when in use with the general-purpose or related peripheral function. 1 Interrupt is enabled 0 Interrupt is disabled (interrupt flag masked) 2.4.3.48 Port J Interrupt Flag Register (PIFJ) Access: User read/write1 6 5 4 3 2 1 0 Address 0x026F (G1, G2) 7 R PIFJ7 W Reset 0 0 0 0 0 0 0 0 PIFJ6 PIFJ5 PIFJ4 PIFJ3 PIFJ2 PIFJ1 PIFJ0 Address 0x026F (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PIFJ3 PIFJ2 0 PIFJ1 0 PIFJ0 0 0 0 0 0 0 Figure 2-48. Port J Interrupt Flag Register (PIFJ) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 197 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 1 Read: Anytime Write: Anytime, write 1 to clear Table 2-75. PIFJ Register Field Descriptions Field 7-0 PIFJ Description Port J interrupt flag— If the associated interrupt enable bit is set this flag asserts after a valid active edge was detected on the related pin (see Section 2.5.4.2, “Pin Interrupts and Wakeup”). This can be a rising or a falling edge based on the state of the polarity select register. Writing a logic “1” to the corresponding bit field clears the flag. 1 Active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set) 0 No active edge occurred 2.4.3.49 Port AD Data Register (PT0AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0270 (G1, G2) 7 R PT0AD7 W Reset 0 0 0 0 0 0 0 0 PT0AD6 PT0AD5 PT0AD4 PT0AD3 PT0AD2 PT0AD1 PT0AD0 Address 0x0270 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PT0AD3 PT0AD2 0 PT0AD1 0 PT0AD0 0 0 0 0 0 0 Figure 2-49. Port AD Data Register (PT0AD) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-76. PT0AD Register Field Descriptions Field 7-0 PT0AD Description Port AD general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read if the digital input buffers are enabled (Section 2.3.12, “Pins AD15-0”). MC9S12G Family Reference Manual, Rev.1.01 198 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.50 Port AD Data Register (PT1AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0271 7 R PT1AD7 W Reset 0 0 0 0 0 0 0 0 PT1AD6 PT1AD5 PT1AD4 PT1AD3 PT1AD2 PT1AD1 PT1AD0 Figure 2-50. Port AD Data Register (PT1AD) 1 Read: Anytime. The data source is depending on the data direction value. Write: Anytime Table 2-77. PT1AD Register Field Descriptions Field 7-0 PT1AD Description Port AD general-purpose input/output data—Data Register When not used with an alternative signal, the associated pin can be used as general-purpose I/O. In general-purpose output mode the port data register bit value is driven to the pin. If the associated data direction bit is set to 1, a read returns the value of the port data register bit, otherwise the buffered pin input state is read if the digital input buffers are enabled (Section 2.3.12, “Pins AD15-0”). 2.4.3.51 Port AD Input Register (PTI0AD) Access: User read only1 6 5 4 3 2 1 0 Address 0x0272 (G1, G2) 7 R W Reset PTI0AD7 PTI0AD6 PTI0AD5 PTI0AD4 PTI0AD3 PTI0AD2 PTI0AD1 PTI0AD0 0 0 0 0 0 0 0 0 Address 0x0272 (G3) 7 6 5 4 3 2 Access: User read only1 1 0 R W Reset 0 0 0 0 PTI0AD3 PTI0AD2 PTI0AD1 PTI0AD0 0 0 0 0 0 0 0 0 Figure 2-51. Port AD Input Register (PTI0AD) 1 Read: Anytime Write: Never MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 199 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-78. PTI0AD Register Field Descriptions Field 7-0 PTI0AD Description Port AD input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. 2.4.3.52 Port AD Input Register (PTI1AD) Access: User read only1 6 5 4 3 2 1 0 Address 0x0273 7 R W Reset PTI1AD7 PTI1AD6 PTI1AD5 PTI1AD4 PTI1AD3 PTI1AD2 PTI1AD1 PTI1AD0 0 0 0 0 0 0 0 0 Figure 2-52. Port AD Input Register (PTI1AD) 1 Read: Anytime Write: Never Table 2-79. PTI1AD Register Field Descriptions Field 7-0 PTI1AD Description Port AD input data— A read always returns the buffered input state of the associated pin. It can be used to detect overload or short circuit conditions on output pins. 2.4.3.53 Port AD Data Direction Register (DDR0AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0274 (G1, G2) 7 R DDR0AD7 W Reset 0 0 0 0 0 0 0 0 DDR0AD6 DDR0AD5 DDR0AD4 DDR0AD3 DDR0AD2 DDR0AD1 DDR0AD0 Address 0x0274 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 DDR0AD3 DDR0AD2 0 DDR0AD1 0 DDR0AD0 0 0 0 0 0 0 Figure 2-53. Port AD Data Direction Register (DDR0AD) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 200 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-80. DDR0AD Register Field Descriptions Field 7-0 DDR0AD Description Port AD data direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.54 Port AD Data Direction Register (DDR1AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0275 7 R DDR1AD7 W Reset 0 0 0 0 0 0 0 0 DDR1AD6 DDR1AD5 DDR1AD4 DDR1AD3 DDR1AD2 DDR1AD1 DDR1AD0 Figure 2-54. Port AD Data Direction Register (DDR1AD) 1 Read: Anytime Write: Anytime Table 2-81. DDR1AD Register Field Descriptions Field 7-0 DDR1AD Description Port AD data direction— This bit determines whether the associated pin is an input or output. 1 Associated pin configured as output 0 Associated pin configured as input 2.4.3.55 Reserved Register NOTE Address 0x0276 is reserved for RVA on G(A)240 and G(A)192 only. Refer to Section 4.6.2.1, “RVA Control Register (RVACTL)”. 2.4.3.56 Pin Routing Register 1 (PRR1) NOTE Routing takes only effect if PKGCR is set to select the 100 LQFP package. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 201 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Address 0x0277 (G(A)240 and G(A)192 only) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 0 0 0 PRR1AN 0 0 0 0 0 0 0 0 Address 0x0277 (non G(A)240 and G(A)192) 7 6 5 4 3 2 Access: User read/write 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 2-55. Pin Routing Register (PRR1) 1 Read: Anytime Write: Anytime Table 2-82. PRR1 Register Field Descriptions Field 0 PRR1AN Description Pin Routing Register ADC channels — Select alternative routing for AN15/14/13/11/10 pins to port C This bit programs the routing of the specific ADC channels to alternative external pins in 100 LQFP. See Table 2-83. The routing affects the analog signals and digital input trigger paths to the ADC. Refer to the related pin descriptions in Section 2.3.4, “Pins PC7-0” and Section 2.3.12, “Pins AD15-0”. 1 AN inputs on port C 0 AN inputs on port AD Table 2-83. AN Routing Options PRR1AN 0 Associated Pins AN10 - PAD10 AN11 - PAD11 AN13 - PAD13 AN14 - PAD14 AN15 - PAD15 AN10 - PC0 AN11 - PC1 AN13 - PC2 AN14 - PC3 AN15 - PC4 1 MC9S12G Family Reference Manual, Rev.1.01 202 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.57 Port AD Pull Enable Register (PER0AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0278 (G1, G2) 7 R PER0AD7 W Reset 0 0 0 0 0 0 0 0 PER0AD6 PER0AD5 PER0AD4 PER0AD3 PER0AD2 PER0AD1 PER0AD0 Address 0x0278 (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PER0AD3 PER0AD2 0 PER0AD1 0 PER0AD0 0 0 0 0 0 0 Figure 2-56. Port AD Pullup Enable Register (PER0AD) 1 Read: Anytime Write: Anytime Table 2-84. PER0AD Register Field Descriptions Field 7-0 PER0AD Description Port AD pull enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. If a pin is used as output this bit has no effect. The polarity is selected by the related polarity select register bit. 1 Pull device enabled 0 Pull device disabled 2.4.3.58 Port AD Pull Enable Register (PER1AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0279 7 R PER1AD7 W Reset 0 0 0 0 0 0 0 0 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 Figure 2-57. Port AD Pullup Enable Register (PER1AD) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 203 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-85. PER1AD Register Field Descriptions Field 7-0 PER1AD Description Port AD pull enable—Enable pull device on input pin This bit controls whether a pull device on the associated port input pin is active. If a pin is used as output this bit has no effect. The polarity is selected by the related polarity select register bit. 1 Pull device enabled 0 Pull device disabled 2.4.3.59 Port AD Polarity Select Register (PPS0AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x027A (G1, G2) 7 R PPS0AD7 W Reset 0 0 0 0 0 0 0 0 PPS0AD6 PPS0AD5 PPS0AD4 PPS0AD3 PPS0AD2 PPS0AD1 PPS0AD0 Address 0x027A (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PPS0AD3 PPS0AD2 0 PPS0AD1 0 PPS0AD0 0 0 0 0 0 0 Figure 2-58. Port AD Polarity Select Register (PPS0AD) 1 Read: Anytime Write: Anytime Table 2-86. PPS0AD Register Field Descriptions Field 7-0 PPS0AD Description Port AD pull device select—Configure pull device and pin interrupt edge polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. This bit also selects the polarity of the active pin interrupt edge. 1 Pulldown device selected; rising edge selected 0 Pullup device selected; falling edge selected MC9S12G Family Reference Manual, Rev.1.01 204 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.60 Port AD Polarity Select Register (PPS1AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x027B 7 R PPS1AD7 W Reset 0 0 0 0 0 0 0 0 PPS1AD6 PPS1AD5 PPS1AD4 PPS1AD3 PPS1AD2 PPS1AD1 PPS1AD0 Figure 2-59. Port AD Polarity Select Register (PPS1AD) 1 Read: Anytime Write: Anytime Table 2-87. PPS1AD Register Field Descriptions Field 7-0 PPS1AD Description Port AD pull device select—Configure pull device and pin interrupt edge polarity on input pin This bit selects a pullup or a pulldown device if enabled on the associated port input pin. This bit also selects the polarity of the active pin interrupt edge. 1 Pulldown device selected; rising edge selected 0 Pullup device selected; falling edge selected 2.4.3.61 Read: Anytime Port AD Interrupt Enable Register (PIE0AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x027C (G1, G2) 7 R PIE0AD7 W Reset 0 0 0 0 0 0 0 0 PIE0AD6 PIE0AD5 PIE0AD4 PIE0AD3 PIE0AD2 PIE0AD1 PIE0AD0 Address 0x027C (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PIE0AD3 PIE0AD2 0 PIE0AD1 0 PIE0AD0 0 0 0 0 0 0 Figure 2-60. Port AD Interrupt Enable Register (PIE0AD) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 205 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-88. PIE0AD Register Field Descriptions Field 7-0 PIE0AD Description Port AD interrupt enable— This bit enables or disables the edge sensitive pin interrupt on the associated pin. An interrupt can be generated if the pin is operating in input or output mode when in use with the general-purpose or related peripheral function. 1 Interrupt is enabled 0 Interrupt is disabled (interrupt flag masked) 2.4.3.62 Read: Anytime Port AD Interrupt Enable Register (PIE1AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x027D 7 R PIE1AD7 W Reset 0 0 0 0 0 0 0 0 PIE1AD6 PIE1AD5 PIE1AD4 PIE1AD3 PIE1AD2 PIE1AD1 PIE1AD0 Figure 2-61. Port AD Interrupt Enable Register (PIE1AD) 1 Read: Anytime Write: Anytime Table 2-89. PIE1AD Register Field Descriptions Field 7-0 PIE1AD Description Port AD interrupt enable— This bit enables or disables the edge sensitive pin interrupt on the associated pin. An interrupt can be generated if the pin is operating in input or output mode when in use with the general-purpose or related peripheral function. 1 Interrupt is enabled 0 Interrupt is disabled (interrupt flag masked) MC9S12G Family Reference Manual, Rev.1.01 206 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.4.3.63 Port AD Interrupt Flag Register (PIF0AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x027E (G1, G2) 7 R PIF0AD7 W Reset 0 0 0 0 0 0 0 0 PIF0AD6 PIF0AD5 PIF0AD4 PIF0AD3 PIF0AD2 PIF0AD1 PIF0AD0 Address 0x027E (G3) 7 6 5 4 3 2 Access: User read/write1 1 0 R W Reset 0 0 0 0 PIF0AD3 PIF0AD2 0 PIF0AD1 0 PIF0AD0 0 0 0 0 0 0 Figure 2-62. Port AD Interrupt Flag Register (PIF0AD) 1 Read: Anytime Write: Anytime, write 1 to clear Table 2-90. PIF0AD Register Field Descriptions Field 7-0 PIF0AD Description Port AD interrupt flag— If the associated interrupt enable bit is set this flag asserts after a valid active edge was detected on the related pin (see Section 2.4.2.1, “Block Register Map (G1)”). This can be a rising or a falling edge based on the state of the polarity select register. Writing a logic “1” to the corresponding bit field clears the flag. 1 Active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set) 0 No active edge occurred 2.4.3.64 Port AD Interrupt Flag Register (PIF1AD) Access: User read/write1 6 5 4 3 2 1 0 Address 0x027F 7 R PIF1AD7 W Reset 0 0 0 0 0 0 0 0 PIF1AD6 PIF1AD5 PIF1AD4 PIF1AD3 PIF1AD2 PIF1AD1 PIF1AD0 Figure 2-63. Port AD Interrupt Flag Register (PIF1AD) 1 Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 207 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-91. PIF1AD Register Field Descriptions Field 7-0 PIF1AD Description Port AD interrupt flag— If the associated interrupt enable bit is set this flag asserts after a valid active edge was detected on the related pin (see Section 2.5.4.2, “Pin Interrupts and Wakeup”). This can be a rising or a falling edge based on the state of the polarity select register. Writing a logic “1” to the corresponding bit field clears the flag. 1 Active edge on the associated bit has occurred (an interrupt will occur if the associated enable bit is set) 0 No active edge occurred 2.5 2.5.1 PIM Ports - Functional Description General Each pin except BKGD can act as general-purpose I/O. In addition most pins can act as an output or input of a peripheral module. 2.5.2 Registers A set of configuration registers is common to all ports with exception of the ADC port (Table 2-92). All registers can be written at any time, however a specific configuration might not become active. Example: Selecting a pullup device. This device does not become active while the port is used as a push-pull output. Table 2-92. Register availability per port1 Port A B C D E T S M P J AD 1 Data (Portx, PTx) yes yes yes yes yes yes yes yes yes yes yes Input (PTIx) yes yes yes yes yes yes Data Direction (DDRx) yes yes yes yes yes yes yes yes yes yes yes Pull Enable (PERx) Polarity Select (PPSx) - WiredOr Mode (WOMx) yes yes - Interrupt Enable (PIEx) yes yes yes Interrupt Flag (PIFx) yes yes yes yes - yes yes yes yes yes yes yes yes yes yes yes yes Each cell represents one register with individual configuration bits MC9S12G Family Reference Manual, Rev.1.01 208 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.5.2.1 Data Register (PORTx, PTx) This register holds the value driven out to the pin if the pin is used as a general-purpose I/O. Writing to this register has only an effect on the pin if the pin is used as general-purpose output. When reading this address, the buffered state of the pin is returned if the associated data direction register bit is set to 0. If the data direction register bits are set to 1, the contents of the data register is returned. This is independent of any other configuration (Figure 2-64). 2.5.2.2 Input Register (PTIx) This register is read-only and always returns the buffered state of the pin (Figure 2-64). 2.5.2.3 Data Direction Register (DDRx) This register defines whether the pin is used as an general-purpose input or an output. If a peripheral module controls the pin the contents of the data direction register is ignored (Figure 2-64). Independent of the pin usage with a peripheral module this register determines the source of data when reading the associated data register address (2.5.2.1/2-209). NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on port data or port input registers, when changing the data direction register. PTI 0 1 PT 0 1 PIN DDR data out 0 1 Module output enable module enable Figure 2-64. Illustration of I/O pin functionality MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 209 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) 2.5.2.4 Pull Device Enable Register (PERx) This register turns on a pullup or pulldown device on the related pins determined by the associated polarity select register (2.5.2.5/2-210). The pull device becomes active only if the pin is used as an input or as a wired-or output. Some peripheral module only allow certain configurations of pull devices to become active. Refer to Section 2.3, “PIM Routing - Functional description”. 2.5.2.5 Pin Polarity Select Register (PPSx) This register selects either a pullup or pulldown device if enabled. It becomes only active if the pin is used as an input. A pullup device can be activated if the pin is used as a wired-or output. 2.5.2.6 Wired-Or Mode Register (WOMx) If the pin is used as an output this register turns off the active-high drive. This allows wired-or type connections of outputs. 2.5.2.7 Interrupt Enable Register (PIEx) If the pin is used as an interrupt input this register serves as a mask to the interrupt flag to enable/disable the interrupt. 2.5.2.8 Interrupt Flag Register (PIFx) If the pin is used as an interrupt input this register holds the interrupt flag after a valid pin event. 2.5.2.9 Pin Routing Register (PRRx) This register allows software re-configuration of the pinouts for specific peripherals in the 20 TSSOP package only. 2.5.2.10 Package Code Register (PKGCR) This register determines the package in use. Pre programmed by factory. 2.5.3 Pin Configuration Summary The following table summarizes the effect of the various configuration bits, that is data direction (DDR), output level (IO), pull enable (PE), pull select (PS) on the pin function and pull device activity. The configuration bit PS is used for two purposes: 1. Configure the sensitive interrupt edge (rising or falling), if interrupt is enabled. 2. Select either a pullup or pulldown device if PE is active. MC9S12G Family Reference Manual, Rev.1.01 210 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Table 2-93. Pin Configuration Summary DDR 0 0 0 0 0 0 0 1 1 1 1 1 2 IO x x x x x x x 0 1 0 1 PE 0 1 1 0 0 1 1 x x x x PS1 x 0 1 0 1 0 1 x x 0 1 IE2 0 0 0 1 1 1 1 0 0 1 1 Input3 Input Input 3 3 Function Pull Device Disabled Pullup Pulldown Disabled Disabled Pullup Pulldown Disabled Disabled Disabled Disabled Interrupt Disabled Disabled Disabled Falling edge Rising edge Falling edge Rising edge Disabled Disabled Falling edge Rising edge Input3 Input Input Input 3 3 3 Output, drive to 0 Output, drive to 1 Output, drive to 0 Output, drive to 1 Always “0” on port A, B, C, D, BKGD. Always “1” on port E Applicable only on port P, J and AD. 3 Port AD: Assuming digital input buffer enabled in ADC module (ATDDIEN) and ACMP module (ACDIEN) 2.5.4 Interrupts This section describes the interrupts generated by the PIM and their individual sources. Vector addresses and interrupt priorities are defined at MCU level. Table 2-94. PIM Interrupt Sources Module Interrupt Sources XIRQ IRQ Port P pin interrupt Port J pin interrupt Port AD pin interrupt None IRQCR[IRQEN] PIEP[PIEP5-PIEP0] PIEJ[PIEJ3-PIEJ0] PIE0AD[PIE0AD3-PIE0AD0] PIE1AD[PIE1AD7-PIE1AD0] Local Enable 2.5.4.1 XIRQ, IRQ Interrupts The XIRQ pin allows requesting non-maskable interrupts after reset initialization. During reset, the X bit in the condition code register is set and any interrupts are masked until software enables them. The IRQ pin allows requesting asynchronous interrupts. The interrupt input is disabled out of reset. To enable the interrupt the IRQCR[IRQEN] bit must be set and the I bit cleared in the condition code register. The interrupt can be configured for level-sensitive or falling-edge-sensitive triggering. If IRQCR[IRQEN] is cleared while an interrupt is pending, the request will deassert. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 211 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Port Integration Module (S12GPIMV0) Both interrupts are capable to wake-up the device from stop mode. Means for glitch filtering are not provided on these pins. 2.5.4.2 Pin Interrupts and Wakeup Ports P, J and AD offer pin interrupt capability. The related interrupt enable (PIE) as well as the sensitivity to rising or falling edges (PPS) can be individually configured on per-pin basis. All bits/pins in a port share the same interrupt vector. Interrupts can be used with the pins configured as inputs or outputs. An interrupt is generated when a port interrupt flag (PIF) and its corresponding port interrupt enable (PIE) are both set. The pin interrupt feature is also capable to wake up the CPU when it is in stop or wait mode. A digital filter on each pin prevents short pulses from generating an interrupt. A valid edge on an input is detected if 4 consecutive samples of a passive level are followed by 4 consecutive samples of an active level. Else the sampling logic is restarted. In run and wait mode the filters are continuously clocked by the bus clock. Pulses with a duration of tPULSE < nP_MASK/fbus are assuredly filtered out while pulses with a duration of tPULSE > nP_PASS/fbus guarantee a pin interrupt. In stop mode the clock is generated by an RC-oscillator. The minimum pulse length varies over process conditions, temperature and voltage (Figure 2-65). Pulses with a duration of tPULSE < tP_MASK are assuredly filtered out while pulses with a duration of tPULSE > tP_PASS guarantee a wakeup event. Please refer to the appendix table “Pin Interrupt Characteristics” for pulse length limits. To maximize current saving the RC oscillator is active only if the following condition is true on any individual pin: Sample count VACMPM) before the initialization delay has passed, a flag will be set immediately after this. Similarly the flag will also be set when disabling the ACMP, then re-enabling it with the inputs changing to produce an opposite result to the hold state before the end of the initialization delay. By setting the ACMPC[ACICE] bit the gated comparator output can be connected to the synchronized timer input capture channel 5 (see Figure 3-1). This feature can be used to generate time stamps and timer interrupts on ACMP events. The comparator output signal synchronized to the bus clock is used to read the comparator output status (ACMPS[ACO]) and to set the interrupt flag (ACMPS[ACIF]). The condition causing the interrupt flag (ACMPS[ACIF]) to assert is selected with register bits ACMPC[ACMOD1:ACMOD0]. This includes any edge configuration, that is rising, or falling, or rising and falling (toggle) edges of the comparator output. Also flag setting can be disabled. An interrupt will be generated if the interrupt enable bit (ACMPC[ACIE]) and the interrupt flag (ACMPS[ACIF]) are both set. ACMPS[ACIF] is cleared by writing a 1. The raw comparator output signal ACMPO can be driven out on an external pin by setting the ACMPC[ACOPE] bit. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 219 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) Chapter 4 Reference Voltage Attenuator (RVAV1) Revision History Rev. No. (Item No.) V00.04 V00.05 V00.06 Date (Submitted By) 26 May 2010 09 Jun 2010 01 Jul 2010 Sections Affected Substantial Change(s) • Added reference to device overview for internal connections • Added appendix title in note to reference reduced ADC clock • Orthographical corrections aligned to Freescale Publications Style Guide • Aligned to S12 register guidelines 4.1 Introduction The reference voltage attenuator (RVA) provides a circuit for reduction of the ADC reference voltage difference VRH-VSSA to gain more ADC resolution. 4.2 Features The RVA has the following features: • Attenuation of ADC reference voltage with low long-term drift 4.3 Block Diagram The block diagram of the RVA module is shown below. Refer to device overview section “ADC VRH/VRL Signal Connection” for connection of RVA to pins and ADC module. MC9S12G Family Reference Manual, Rev.1.01 220 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) STOP RVAON VRH RVA R VRH_INT 5R to ADC VRL_INT 4R VSSA Figure 4-1. RVA Module Block Diagram 4.4 External Signals The RVA has two external input signals, VRH and VSSA. 4.5 Modes of Operation 1. Attenuation Mode The RVA is attenuating the reference voltage when enabled by the register control bit and the MCU not being in STOP mode. 2. Bypass Mode The RVA is in bypass mode either when disabled or during STOP mode. In these cases the resistor ladder of the RVA is disconnected for power saving. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 221 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) 4.6 4.6.1 Memory Map and Register Definition Register Map Table 4-1 shows the RVA register map. Table 4-1. RVA Register Map Global Address Register Name 0x0276 RVACTL R W = Unimplemented or Reserved Bit 7 0 6 0 5 0 4 0 3 0 2 0 1 0 Bit 0 RVAON 4.6.2 4.6.2.1 Register Descriptions RVA Control Register (RVACTL) Access: User read/write1 6 5 4 3 2 1 0 Address 0x0276 7 R W Reset 0 0 0 0 0 0 0 RVAON 0 0 0 0 0 0 0 0 Figure 4-2. RVA Control Register (RVACTL) 1 Read: Anytime Write: Anytime Table 4-2. RVACTL Register Field Descriptions Field 0 RVAON RVA On — This bit turns on the reference voltage attenuation. 0 RVA in bypass mode 1 RVA in attenuation mode Description 4.7 Functional Description The RVA is a prescaler for the ADC reference voltage. If the attenuation is turned off the resistive divider is disconnected from VSSA, VRH_INT is connected to VRH and VRL_INT is connected to VSSA. In this mode the attenuation is bypassed and the resistive divider does not draw current. MC9S12G Family Reference Manual, Rev.1.01 222 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) If the attenuation is turned on the resistive divider is connected to VSSA, VRH_INT and VRL_INT are connected to intermediate voltage levels: VRH_INT = 0.9 * (VRH - VSSA) + VSSA VRL_INT = 0.4 * (VRH - VSSA) + VSSA Eqn. 4-1 Eqn. 4-2 The attenuated reference voltage difference (VRH_INT - VRL_INT) equals 50% of the input reference voltage difference (VRH - VSSA). With reference voltage attenuation the resolution of the ADC is improved by a factor of 2. NOTE In attenuation mode the maximum ADC clock is reduced. Please refer to the conditions in appendix A “ATD Accuracy”, table “ATD Conversion Performance 5V range, RVA enabled”. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 223 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 224 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 225 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 226 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 227 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 228 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 229 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 230 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 231 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Reference Voltage Attenuator (RVAV1) MC9S12G Family Reference Manual, Rev.1.01 232 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 5 S12G Memory Map Controller (S12GMMCV1) Table 5-1. Revision History Table Rev. No. Date (Item No.) (Submitted By) 01.02 01.03 01.04 20-May 2010 26-Jul 2010 20-Aug 2010 Sections Affected Substantial Change(s) Updates for S12VR48 and S12VR64 5.1 Introduction The S12GMMC module controls the access to all internal memories and peripherals for the CPU12 and S12SBDM module. It regulates access priorities and determines the address mapping of the on-chip ressources. Figure 5-1 shows a block diagram of the S12GMMC module. 5.1.1 Glossary Table 5-2. Glossary Of Terms Term Definition Address within the CPU12’s Local Address Map (Figure 5-11) Address within the Global Address Map (Figure 5-11) Bus access to an even address. Bus access to an odd address. Normal Single-Chip Mode Special Single-Chip Mode Address ranges which are not mapped to any on-chip resource. Non-volatile Memory; Flash or EEPROM NVM Information Row. Refer to FTMRG Block Guide Local Addresses Global Address Aligned Bus Access Misaligned Bus Access NS SS Unimplemented Address Ranges NVM IFR 5.1.2 Overview The S12GMMC connects the CPU12’s and the S12SBDM’s bus interfaces to the MCU’s on-chip resources (memories and peripherals). It arbitrates the bus accesses and determines all of the MCU’s memory maps. Furthermore, the S12GMMC is responsible for constraining memory accesses on secured devices and for selecting the MCU’s functional mode. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 233 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12G Memory Map Controller (S12GMMCV1) 5.1.3 Features The main features of this block are: • Paging capability to support a global 256 KByte memory address space • Bus arbitration between the masters CPU12, S12SBDM to different resources. • MCU operation mode control • MCU security control • Generation of system reset when CPU12 accesses an unimplemented address (i.e., an address which does not belong to any of the on-chip modules) in single-chip modes 5.1.4 Modes of Operation The S12GMMC selects the MCU’s functional mode. It also determines the devices behavior in secured and unsecured state. 5.1.4.1 Functional Modes Two functional modes are implemented on devices of the S12G product family: • Normal Single Chip (NS) The mode used for running applications. • Special Single Chip Mode (SS) A debug mode which causes the device to enter BDM Active Mode after each reset. Peripherals may also provide special debug features in this mode. 5.1.4.2 Security S12G devices can be secured to prohibit external access to the on-chip flash. The S12GMMC module determines the access permissions to the on-chip memories in secured and unsecured state. 5.1.5 Block Diagram Figure 5-1 shows a block diagram of the S12GMMC. MC9S12G Family Reference Manual, Rev.1.01 234 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12G Memory Map Controller (S12GMMCV1) BDM CPU MMC Address Decoder & Priority DBG Target Bus Controller EEPROM Flash RAM Peripherals Figure 5-1. S12GMMC Block Diagram 5.2 External Signal Description The S12GMMC uses two external pins to determine the devices operating mode: RESET and MODC (Figure 5-3) See Device User Guide (DUG) for the mapping of these signals to device pins{statement}. Table 5-3. External System Pins Associated With S12GMMC Pin Name RESET (See Section Device Overview) MODC (See Section Device Overview) Pin Functions RESET The RESET pin is used the select the MCU’s operating mode. MODC Description The MODC pin is captured at the rising edge of the RESET pin. The captured value determines the MCU’s operating mode. 5.3 5.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the S12GMMC block is shown in Figure 5-2. Detailed descriptions of the registers and bits are given in the subsections that follow. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 235 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12G Memory Map Controller (S12GMMCV1) Address 0x000A Register Name Reserved R W Bit 7 0 6 0 5 0 4 0 3 0 2 0 1 0 Bit 0 0 0x000B MODE R W MODC 0 0 0 0 0 0 0 0 0x0010 Reserved R W 0 0 0 0 0 0 0 0x0011 DIRECT R W DP15 0 DP14 0 DP13 0 DP12 0 DP11 0 DP10 0 DP9 0 DP8 0 0x0012 Reserved R W 0x0013 MMCCTL1 R W 0 0 0 0 0 0 0 NVMRES 0 0x0014 Reserved R W 0 0 0 0 0 0 0 0x0015 PPAGE R W 0 0 0 0 PIX3 0 PIX2 0 PIX1 0 PIX0 0 0x00160x0017 Reserved R W 0 0 0 0 = Unimplemented or Reserved Figure 5-2. MMC Register Summary 5.3.2 Register Descriptions This section consists of the S12GMMC control register descriptions in address order. 5.3.2.1 Mode Register (MODE) Address: 0x000B 7 6 5 4 3 2 1 0 R W Reset MODC MODC1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1. External signal (see Table 5-3). = Unimplemented or Reserved Figure 5-3. Mode Register (MODE) MC9S12G Family Reference Manual, Rev.1.01 236 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12G Memory Map Controller (S12GMMCV1) Read: Anytime. Write: Only if a transition is allowed (see Figure 5-4). The MODC bit of the MODE register is used to select the MCU’s operating mode. Table 5-4. MODE Field Descriptions Field 7 MODC Description Mode Select Bit — This bit controls the current operating mode during RESET high (inactive). The external mode pin MODC determines the operating mode during RESET low (active). The state of the pin is registered into the respective register bit after the RESET signal goes inactive (see Figure 5-4). Write restrictions exist to disallow transitions between certain modes. Figure 5-4 illustrates all allowed mode changes. Attempting non authorized transitions will not change the MODE bit, but it will block further writes to the register bit except in special modes. Write accesses to the MODE register are blocked when the device is secured. RESET 1 0 Normal Single-Chip (NS) 1 1 Special Single-Chip (SS) 0 Figure 5-4. Mode Transition Diagram when MCU is Unsecured 5.3.2.2 Direct Page Register (DIRECT) Address: 0x0011 7 6 5 4 3 2 1 0 R W Reset DP15 0 DP14 0 DP13 0 DP12 0 DP11 0 DP10 0 DP9 0 DP8 0 Figure 5-5. Direct Register (DIRECT) Read: Anytime Write: anytime in special SS, write-once in NS. This register determines the position of the 256 Byte direct page within the memory map.It is valid for both global and local mapping scheme. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 237 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12G Memory Map Controller (S12GMMCV1) Table 5-5. DIRECT Field Descriptions Field 7–0 DP[15:8] Description Direct Page Index Bits 15–8 — These bits are used by the CPU when performing accesses using the direct addressing mode. These register bits form bits [15:8] of the local address (see Figure 5-6). Bit15 DP [15:8] Bit8 Bit7 Bit0 CPU Address [15:0] Figure 5-6. DIRECT Address Mapping Example 5-1. This example demonstrates usage of the Direct Addressing Mode MOVB #$04,DIRECT ;Set DIRECT register to 0x04. From this point on, all memory ;accesses using direct addressing mode will be in the local ;address range from 0x0400 to 0x04FF. ;Load the Y index register from 0x0412 (direct access). LDY GO 2 Opcode (hex) 62 63 64 65 66 67 42 43 44 45 46 47 08 0C 10 18 Data Description 16-bit data out Increment X index register by 2 (X = X + 2), then read word X points to. 16-bit data out Read program counter. 16-bit data out Read D accumulator. 16-bit data out Read X index register. 16-bit data out Read Y index register. 16-bit data out Read stack pointer. 16-bit data in 16-bit data in 16-bit data in 16-bit data in 16-bit data in 16-bit data in none none none none Increment X index register by 2 (X = X + 2), then write word to location pointed to by X. Write program counter. Write D accumulator. Write X index register. Write Y index register. Write stack pointer. Go to user program. If enabled, ACK will occur when leaving active background mode. Go to user program. If enabled, ACK will occur upon returning to active background mode. Execute one user instruction then return to active BDM. If enabled, ACK will occur upon returning to active background mode. (Previous enable tagging and go to user program.) This command will be deprecated and should not be used anymore. Opcode will be executed as a GO command. If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 2 When the firmware command READ_NEXT or WRITE_NEXT is used to access the BDM address space the BDM resources are accessed rather than user code. Writing BDM firmware is not possible. 3 System stop disables the ACK function and ignored commands will not have an ACK-pulse (e.g., CPU in stop or wait mode). The GO_UNTIL command will not get an Acknowledge if CPU executes the wait or stop instruction before the “UNTIL” condition (BDM active again) is reached (see Section 7.4.7, “Serial Interface Hardware Handshake Protocol” last note). 1 7.4.5 BDM Command Structure Hardware and firmware BDM commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word, depending on the command. All the read commands return 16 bits of data despite the byte or word implication in the command name. 8-bit reads return 16-bits of data, only one byte of which contains valid data. If reading an even address, the valid data will appear in the MSB. If reading an odd address, the valid data will appear in the LSB. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 265 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) 16-bit misaligned reads and writes are generally not allowed. If attempted by BDM hardware command, the BDM ignores the least significant bit of the address and assumes an even address from the remaining bits. For hardware data read commands, the external host must wait at least 150 bus clock cycles after sending the address before attempting to obtain the read data. This is to be certain that valid data is available in the BDM shift register, ready to be shifted out. For hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the BDM waits for a free cycle before stealing a cycle. For BDM firmware read commands, the external host should wait at least 48 bus clock cycles after sending the command opcode and before attempting to obtain the read data. The 48 cycle wait allows enough time for the requested data to be made available in the BDM shift register, ready to be shifted out. For BDM firmware write commands, the external host must wait 36 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The external host should wait for at least for 76 bus clock cycles after a TRACE1 or GO command before starting any new serial command. This is to allow the CPU to exit gracefully from the standard BDM firmware lookup table and resume execution of the user code. Disturbing the BDM shift register prematurely may adversely affect the exit from the standard BDM firmware lookup table. NOTE If the bus rate of the target processor is unknown or could be changing, it is recommended that the ACK (acknowledge function) is used to indicate when an operation is complete. When using ACK, the delay times are automated. Figure 7-6 represents the BDM command structure. The command blocks illustrate a series of eight bit times starting with a falling edge. The bar across the top of the blocks indicates that the BKGD line idles in the high state. The time for an 8-bit command is 8 × 16 target clock cycles.1 1. Target clock cycles are cycles measured using the target MCU’s serial clock rate. See Section 7.4.6, “BDM Serial Interface” and Section 7.3.2.1, “BDM Status Register (BDMSTS)” for information on how serial clock rate is selected. MC9S12G Family Reference Manual, Rev.1.01 266 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) 8 Bits AT ~16 TC/Bit Hardware Read Command 16 Bits AT ~16 TC/Bit Address 150-BC Delay 16 Bits AT ~16 TC/Bit Data 150-BC Delay Next Command Hardware Write Command 48-BC DELAY Address Data Next Command Firmware Read Command Data 36-BC DELAY Next Command Firmware Write Command 76-BC Delay Data Next Command GO, TRACE Command Next Command BC = Bus Clock Cycles TC = Target Clock Cycles Figure 7-6. BDM Command Structure 7.4.6 BDM Serial Interface The BDM communicates with external devices serially via the BKGD pin. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the BDM. The BDM serial interface is timed based on the VCO clock (please refer to the CPMU Block Guide for more details), which gets divided by 8. This clock will be referred to as the target clock in the following explanation. The BDM serial interface uses a clocking scheme in which the external host generates a falling edge on the BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per bit. The interface times out if 512 clock cycles occur between falling edges from the host. The BKGD pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times. It is assumed that there is an external pull-up and that drivers connected to BKGD do not typically drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host for transmit cases and the target for receive cases. The timing for host-to-target is shown in Figure 7-7 and that of target-to-host in Figure 7-8 and Figure 7-9. All four cases begin when the host drives the BKGD pin low to generate a falling edge. Since the host and target are operating from separate clocks, it can take the target system up to one full clock cycle to recognize this edge. The target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove BKGD low to start the bit up to one target clock cycle MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 267 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) earlier. Synchronization between the host and target is established in this manner at the start of every bit time. Figure 7-7 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. BDM Clock (Target MCU) Host Transmit 1 Host Transmit 0 Perceived Start of Bit Time 10 Cycles Synchronization Uncertainty Target Senses Bit Earliest Start of Next Bit Figure 7-7. BDM Host-to-Target Serial Bit Timing The receive cases are more complicated. Figure 7-8 shows the host receiving a logic 1 from the target system. Since the host is asynchronous to the target, there is up to one clock-cycle delay from the host-generated falling edge on BKGD to the perceived start of the bit time in the target. The host holds the BKGD pin low long enough for the target to recognize it (at least two target clock cycles). The host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock cycles after it started the bit time. MC9S12G Family Reference Manual, Rev.1.01 268 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) BDM Clock (Target MCU) Host Drive to BKGD Pin Target System Speedup Pulse Perceived Start of Bit Time R-C Rise BKGD Pin High-Impedance High-Impedance High-Impedance 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 7-8. BDM Target-to-Host Serial Bit Timing (Logic 1) Figure 7-9 shows the host receiving a logic 0 from the target. Since the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on BKGD to the start of the bit time as perceived by the target. The host initiates the bit time but the target finishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target clock cycles then briefly drives it high to speed up the rising edge. The host samples the bit level about 10 target clock cycles after starting the bit time. BDM Clock (Target MCU) Host Drive to BKGD Pin Target System Drive and Speedup Pulse Perceived Start of Bit Time BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit High-Impedance Speedup Pulse Figure 7-9. BDM Target-to-Host Serial Bit Timing (Logic 0) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 269 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) 7.4.7 Serial Interface Hardware Handshake Protocol BDM commands that require CPU execution are ultimately treated at the MCU bus rate. Since the BDM clock source can be modified when changing the settings for the VCO frequency (CPMUSYNR), it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the CPU. The BDM clock frequency is always VCO frequency divided by 8. The alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. This sub-section will describe the hardware handshake protocol. The hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. This protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the BKGD pin. This pulse is generated by the target MCU when a command, issued by the host, has been successfully executed (see Figure 7-10). This pulse is referred to as the ACK pulse. After the ACK pulse has finished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (BACKGROUND, GO, GO_UNTIL or TRACE1). The ACK pulse is not issued earlier than 32 serial clock cycles after the BDM command was issued. The end of the BDM command is assumed to be the 16th tick of the last bit. This minimum delay assures enough time for the host to perceive the ACK pulse. Note also that, there is no upper limit for the delay between the command and the related ACK pulse, since the command execution depends upon the CPU bus, which in some cases could be very slow due to long accesses taking place.This protocol allows a great flexibility for the POD designers, since it does not rely on any accurate time measurement or short response time to any event in the serial communication. BDM Clock (Target MCU) 16 Cycles Target Transmits ACK Pulse High-Impedance 32 Cycles Speedup Pulse Minimum Delay From the BDM Command BKGD Pin Earliest Start of Next Bit High-Impedance 16th Tick of the Last Command Bit Figure 7-10. Target Acknowledge Pulse (ACK) NOTE If the ACK pulse was issued by the target, the host assumes the previous command was executed. If the CPU enters wait or stop prior to executing a hardware command, the ACK pulse will not be issued meaning that the BDM command was not executed. After entering wait or stop mode, the BDM command is no longer pending. MC9S12G Family Reference Manual, Rev.1.01 270 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) Figure 7-11 shows the ACK handshake protocol in a command level timing diagram. The READ_BYTE instruction is used as an example. First, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. The target BDM decodes the instruction. A bus cycle is grabbed (free or stolen) by the BDM and it executes the READ_BYTE operation. Having retrieved the data, the BDM issues an ACK pulse to the host controller, indicating that the addressed byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the byte retrieval process. Note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. Target BKGD Pin READ_BYTE Host Byte Address Target Host New BDM Command Host BDM Issues the ACK Pulse (out of scale) BDM Executes the READ_BYTE Command Target (2) Bytes are Retrieved BDM Decodes the Command Figure 7-11. Handshake Protocol at Command Level Differently from the normal bit transfer (where the host initiates the transmission), the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative edge in the BKGD pin. The hardware handshake protocol in Figure 7-10 specifies the timing when the BKGD pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical conflict in the BKGD pin. NOTE The only place the BKGD pin can have an electrical conflict is when one side is driving low and the other side is issuing a speedup pulse (high). Other “highs” are pulled rather than driven. However, at low rates the time of the speedup pulse can become lengthy and so the potential conflict time becomes longer as well. The ACK handshake protocol does not support nested ACK pulses. If a BDM command is not acknowledge by an ACK pulse, the host needs to abort the pending command first in order to be able to issue a new BDM command. When the CPU enters wait or stop while the host issues a hardware command (e.g., WRITE_BYTE), the target discards the incoming command due to the wait or stop being detected. Therefore, the command is not acknowledged by the target, which means that the ACK pulse will not be issued in this case. After a certain time the host (not aware of stop or wait) should decide to abort any possible pending ACK pulse in order to be sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command, and its corresponding ACK, can be aborted. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 271 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) NOTE The ACK pulse does not provide a time out. This means for the GO_UNTIL command that it can not be distinguished if a stop or wait has been executed (command discarded and ACK not issued) or if the “UNTIL” condition (BDM active) is just not reached yet. Hence in any case where the ACK pulse of a command is not issued the possible pending command should be aborted before issuing a new command. See the handshake abort procedure described in Section 7.4.8, “Hardware Handshake Abort Procedure”. 7.4.8 Hardware Handshake Abort Procedure The abort procedure is based on the SYNC command. In order to abort a command, which had not issued the corresponding ACK pulse, the host controller should generate a low pulse in the BKGD pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse. By detecting this long low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 7.4.9, “SYNC — Request Timed Reference Pulse”, and assumes that the pending command and therefore the related ACK pulse, are being aborted. Therefore, after the SYNC protocol has been completed the host is free to issue new BDM commands. For BDM firmware READ or WRITE commands it can not be guaranteed that the pending command is aborted when issuing a SYNC before the corresponding ACK pulse. There is a short latency time from the time the READ or WRITE access begins until it is finished and the corresponding ACK pulse is issued. The latency time depends on the firmware READ or WRITE command that is issued and on the selected bus clock rate. When the SYNC command starts during this latency time the READ or WRITE command will not be aborted, but the corresponding ACK pulse will be aborted. A pending GO, TRACE1 or GO_UNTIL command can not be aborted. Only the corresponding ACK pulse can be aborted by the SYNC command. Although it is not recommended, the host could abort a pending BDM command by issuing a low pulse in the BKGD pin shorter than 128 serial clock cycles, which will not be interpreted as the SYNC command. The ACK is actually aborted when a negative edge is perceived by the target in the BKGD pin. The short abort pulse should have at least 4 clock cycles keeping the BKGD pin low, in order to allow the negative edge to be detected by the target. In this case, the target will not execute the SYNC protocol but the pending command will be aborted along with the ACK pulse. The potential problem with this abort procedure is when there is a conflict between the ACK pulse and the short abort pulse. In this case, the target may not perceive the abort pulse. The worst case is when the pending command is a read command (i.e., READ_BYTE). If the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. In this case, host and target will run out of synchronism. However, if the command to be aborted is not a read command the short abort pulse could be used. After a command is aborted the target assumes the next negative edge, after the abort pulse, is the first bit of a new BDM command. NOTE The details about the short abort pulse are being provided only as a reference for the reader to better understand the BDM internal behavior. It is not recommended that this procedure be used in a real application. MC9S12G Family Reference Manual, Rev.1.01 272 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) Since the host knows the target serial clock frequency, the SYNC command (used to abort a command) does not need to consider the lower possible target frequency. In this case, the host could issue a SYNC very close to the 128 serial clock cycles length. Providing a small overhead on the pulse length in order to assure the SYNC pulse will not be misinterpreted by the target. See Section 7.4.9, “SYNC — Request Timed Reference Pulse”. Figure 7-12 shows a SYNC command being issued after a READ_BYTE, which aborts the READ_BYTE command. Note that, after the command is aborted a new command could be issued by the host computer. READ_BYTE CMD is Aborted by the SYNC Request (Out of Scale) BKGD Pin READ_BYTE Host Memory Address Target SYNC Response From the Target (Out of Scale) READ_STATUS Host Target New BDM Command Host Target BDM Decode and Starts to Execute the READ_BYTE Command New BDM Command Figure 7-12. ACK Abort Procedure at the Command Level NOTE Figure 7-12 does not represent the signals in a true timing scale Figure 7-13 shows a conflict between the ACK pulse and the SYNC request pulse. This conflict could occur if a POD device is connected to the target BKGD pin and the target is already in debug active mode. Consider that the target CPU is executing a pending BDM command at the exact moment the POD is being connected to the BKGD pin. In this case, an ACK pulse is issued along with the SYNC command. In this case, there is an electrical conflict between the ACK speedup pulse and the SYNC pulse. Since this is not a probable situation, the protocol does not prevent this conflict from happening. At Least 128 Cycles BDM Clock (Target MCU) ACK Pulse Target MCU Drives to BKGD Pin Host Drives SYNC To BKGD Pin Host and Target Drive to BKGD Pin Host SYNC Request Pulse BKGD Pin 16 Cycles High-Impedance Electrical Conflict Speedup Pulse Figure 7-13. ACK Pulse and SYNC Request Conflict MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 273 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) NOTE This information is being provided so that the MCU integrator will be aware that such a conflict could occur. The hardware handshake protocol is enabled by the ACK_ENABLE and disabled by the ACK_DISABLE BDM commands. This provides backwards compatibility with the existing POD devices which are not able to execute the hardware handshake protocol. It also allows for new POD devices, that support the hardware handshake protocol, to freely communicate with the target device. If desired, without the need for waiting for the ACK pulse. The commands are described as follows: • ACK_ENABLE — enables the hardware handshake protocol. The target will issue the ACK pulse when a CPU command is executed by the CPU. The ACK_ENABLE command itself also has the ACK pulse as a response. • ACK_DISABLE — disables the ACK pulse protocol. In this case, the host needs to use the worst case delay time at the appropriate places in the protocol. The default state of the BDM after reset is hardware handshake protocol disabled. All the read commands will ACK (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the BKGD serial pin. All the write commands will ACK (if enabled) after the data has been received by the BDM through the BKGD serial pin and when the data bus cycle is complete. See Section 7.4.3, “BDM Hardware Commands” and Section 7.4.4, “Standard BDM Firmware Commands” for more information on the BDM commands. The ACK_ENABLE sends an ACK pulse when the command has been completed. This feature could be used by the host to evaluate if the target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. If the target does not support the hardware handshake protocol the ACK pulse is not issued. In this case, the ACK_ENABLE command is ignored by the target since it is not recognized as a valid command. The BACKGROUND command will issue an ACK pulse when the CPU changes from normal to background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO command will issue an ACK pulse when the CPU exits from background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO_UNTIL command is equivalent to a GO command with exception that the ACK pulse, in this case, is issued when the CPU enters into background mode. This command is an alternative to the GO command and should be used when the host wants to trace if a breakpoint match occurs and causes the CPU to enter active background mode. Note that the ACK is issued whenever the CPU enters BDM, which could be caused by a breakpoint match or by a BGND instruction being executed. The ACK pulse related to this command could be aborted using the SYNC command. The TRACE1 command has the related ACK pulse issued when the CPU enters background active mode after one instruction of the application program is executed. The ACK pulse related to this command could be aborted using the SYNC command. MC9S12G Family Reference Manual, Rev.1.01 274 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) 7.4.9 SYNC — Request Timed Reference Pulse The SYNC command is unlike other BDM commands because the host does not necessarily know the correct communication speed to use for BDM communications until after it has analyzed the response to the SYNC command. To issue a SYNC command, the host should perform the following steps: 1. Drive the BKGD pin low for at least 128 cycles at the lowest possible BDM serial communication frequency (The lowest serial communication frequency is determined by the settings for the VCO clock (CPMUSYNR). The BDM clock frequency is always VCO clock frequency divided by 8.) 2. Drive BKGD high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. Remove all drive to the BKGD pin so it reverts to high impedance. 4. Listen to the BKGD pin for the sync response pulse. Upon detecting the SYNC request from the host, the target performs the following steps: 1. Discards any incomplete command received or bit retrieved. 2. Waits for BKGD to return to a logic one. 3. Delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. Drives BKGD low for 128 cycles at the current BDM serial communication frequency. 5. Drives a one-cycle high speedup pulse to force a fast rise time on BKGD. 6. Removes all drive to the BKGD pin so it reverts to high impedance. The host measures the low time of this 128 cycle SYNC response pulse and determines the correct speed for subsequent BDM communications. Typically, the host can determine the correct communication speed within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. As soon as the SYNC request is detected by the target, any partially received command or bit retrieved is discarded. This is referred to as a soft-reset, equivalent to a time-out in the serial communication. After the SYNC response, the target will consider the next negative edge (issued by the host) as the start of a new BDM command or the start of new SYNC request. Another use of the SYNC command pulse is to abort a pending ACK pulse. The behavior is exactly the same as in a regular SYNC command. Note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. In this case, the command may not have been understood by the target and so an ACK response pulse will not be issued. 7.4.10 Instruction Tracing When a TRACE1 command is issued to the BDM in active BDM, the CPU exits the standard BDM firmware and executes a single instruction in the user code. Once this has occurred, the CPU is forced to return to the standard BDM firmware and the BDM is active and ready to receive a new command. If the TRACE1 command is issued again, the next user instruction will be executed. This facilitates stepping or tracing through the user code one instruction at a time. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 275 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) If an interrupt is pending when a TRACE1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. Once back in standard BDM firmware execution, the program counter points to the first instruction in the interrupt service routine. Be aware when tracing through the user code that the execution of the user code is done step by step but all peripherals are free running. Hence possible timing relations between CPU code execution and occurrence of events of other peripherals no longer exist. Do not trace the CPU instruction BGND used for soft breakpoints. Tracing over the BGND instruction will result in a return address pointing to BDM firmware address space. When tracing through user code which contains stop or wait instructions the following will happen when the stop or wait instruction is traced: The CPU enters stop or wait mode and the TRACE1 command can not be finished before leaving the low power mode. This is the case because BDM active mode can not be entered after CPU executed the stop instruction. However all BDM hardware commands except the BACKGROUND command are operational after tracing a stop or wait instruction and still being in stop or wait mode. If system stop mode is entered (all bus masters are in stop mode) no BDM command is operational. As soon as stop or wait mode is exited the CPU enters BDM active mode and the saved PC value points to the entry of the corresponding interrupt service routine. In case the handshake feature is enabled the corresponding ACK pulse of the TRACE1 command will be discarded when tracing a stop or wait instruction. Hence there is no ACK pulse when BDM active mode is entered as part of the TRACE1 command after CPU exited from stop or wait mode. All valid commands sent during CPU being in stop or wait mode or after CPU exited from stop or wait mode will have an ACK pulse. The handshake feature becomes disabled only when system stop mode has been reached. Hence after a system stop mode the handshake feature must be enabled again by sending the ACK_ENABLE command. 7.4.11 Serial Communication Time Out The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command was issued. In this case, the target will keep waiting for a rising edge on BKGD in order to answer the SYNC request pulse. If the rising edge is not detected, the target will keep waiting forever without any time-out limit. Consider now the case where the host returns BKGD to logic one before 128 cycles. This is interpreted as a valid bit transmission, and not as a SYNC request. The target will keep waiting for another falling edge marking the start of a new bit. If, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a time-out occurs and the current command is discarded without affecting memory or the operating mode of the MCU. This is referred to as a soft-reset. If a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occur causing the command to be disregarded. The data is not available for retrieval after the time-out has occurred. This is the expected behavior if the handshake protocol is not enabled. In order to allow the data to be retrieved even with a large clock frequency mismatch (between BDM and CPU) when the hardware MC9S12G Family Reference Manual, Rev.1.01 276 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. Therefore, the host could wait for more then 512 serial clock cycles and still be able to retrieve the data from an issued read command. However, once the handshake pulse (ACK pulse) is issued, the time-out feature is re-activated, meaning that the target will time out after 512 clock cycles. Therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ACK pulse had been issued. After that period, the read command is discarded and the data is no longer available for retrieval. Any negative edge in the BKGD pin after the time-out period is considered to be a new command or a SYNC request. Note that whenever a partially issued command, or partially retrieved data, has occurred the time out in the serial communication is active. This means that if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. The next negative edge in the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDM command, or the start of a SYNC request pulse. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 277 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Background Debug Module (S12SBDMV1) MC9S12G Family Reference Manual, Rev.1.01 278 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 8 S12S Debug Module (S12SDBG) Revision History Revision Number 02.00 02.01 02.02 02.03 02.04 02.05 02.06 Date 31.JUL..2007 09.AUG..2007 10.AUG..2007 29.AUG..2007 17.OCT.2007 19.OCT.2007 22.NOV.2007 Author Summary of Changes State sequencer encoding enhanced Simultaneous TRIG and ARM setting updated Pure PC replaced with Compressed Pure PC Mode 8.4.5.2.4 Enhanced compressed Pure PC mode description Added CompA size & databus byte compare enhancement DBGSCR1 encoding 1101 added. CompA functional description improved Swapped NDB and SZ in DBGACTL to match DBGBCTL Reverted to final state transition priority Table 8-33 DB byte access configuration corrected Table 8-39 Correction Section 8.4.5.6, “Trace Buffer Reset State Added NOTE Section 8.5, “Application Information Added application information 02.07 13.DEC.2007 8.1 Introduction The S12SDBG module provides an on-chip trace buffer with flexible triggering capability to allow non-intrusive debug of application software. The S12SDBG module is optimized for S12SCPU debugging. Typically the S12SDBG module is used in conjunction with the S12SBDM module, whereby the user configures the S12SDBG module for a debugging session over the BDM interface. Once configured the S12SDBG module is armed and the device leaves BDM returning control to the user program, which is then monitored by the S12SDBG module. Alternatively the S12SDBG module can be configured over a serial interface using SWI routines. 8.1.1 Glossary Of Terms COF: Change Of Flow. Change in the program flow due to a conditional branch, indexed jump or interrupt. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 279 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) BDM: Background Debug Mode S12SBDM: Background Debug Module DUG: Device User Guide, describing the features of the device into which the DBG is integrated. WORD: 16 bit data entity Data Line: 20 bit data entity CPU: S12SCPU module DBG: S12SDBG module POR: Power On Reset Tag: Tags can be attached to CPU opcodes as they enter the instruction pipe. If the tagged opcode reaches the execution stage a tag hit occurs. 8.1.2 Overview The comparators monitor the bus activity of the CPU module. A match can initiate a state sequencer transition. On a transition to the Final State, bus tracing is triggered and/or a breakpoint can be generated. Independent of comparator matches a transition to Final State with associated tracing and breakpoint can be triggered immediately by writing to the TRIG control bit. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. Tracing is disabled when the MCU system is secured. 8.1.3 • Features Three comparators (A, B and C) — Comparators A compares the full address bus and full 16-bit data bus — Comparator A features a data bus mask register — Comparators B and C compare the full address bus only — Each comparator features selection of read or write access cycles — Comparator B allows selection of byte or word access cycles — Comparator matches can initiate state sequencer transitions Three comparator modes — Simple address/data comparator match mode — Inside address range mode, Addmin ≤ Address ≤ Addmax — Outside address range match mode, Address < Addmin or Address > Addmax Two types of matches — Tagged — This matches just before a specific instruction begins execution — Force — This is valid on the first instruction boundary after a match occurs Two types of breakpoints MC9S12G Family Reference Manual, Rev.1.01 • • • 280 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) • • • — CPU breakpoint entering BDM on breakpoint (BDM) — CPU breakpoint executing SWI on breakpoint (SWI) Trigger mode independent of comparators — TRIG Immediate software trigger Four trace modes — Normal: change of flow (COF) PC information is stored (see Section 8.4.5.2.1, “Normal Mode) for change of flow definition. — Loop1: same as Normal but inhibits consecutive duplicate source address entries — Detail: address and data for all cycles except free cycles and opcode fetches are stored — Compressed Pure PC: all program counter addresses are stored 4-stage state sequencer for trace buffer control — Tracing session trigger linked to Final State of state sequencer — Begin and End alignment of tracing to trigger 8.1.4 Modes of Operation The DBG module can be used in all MCU functional modes. During BDM hardware accesses and whilst the BDM module is active, CPU monitoring is disabled. When the CPU enters active BDM Mode through a BACKGROUND command, the DBG module, if already armed, remains armed. The DBG module tracing is disabled if the MCU is secure, however, breakpoints can still be generated Table 8-1. Mode Dependent Restriction Summary BDM Enable x 0 0 1 1 BDM Active x 0 1 0 1 MCU Secure 1 0 0 0 0 Yes No Comparator Matches Enabled Yes Yes Breakpoints Possible Yes Only SWI Yes No Tagging Possible Yes Yes Yes No Tracing Possible No Yes Yes No Active BDM not possible when not enabled MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 281 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.1.5 Block Diagram TAGS BREAKPOINT REQUESTS TAGHITS SECURE MATCH0 TRANSITION TO CPU COMPARATOR MATCH CONTROL CPU BUS BUS INTERFACE COMPARATOR A COMPARATOR B MATCH1 TAG & MATCH CONTROL LOGIC STATE STATE SEQUENCER STATE COMPARATOR C MATCH2 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 8-1. Debug Module Block Diagram 8.2 External Signal Description There are no external signals associated with this module. 8.3 8.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the DBG sub-block is shown in Figure 8-2. Detailed descriptions of the registers and bits are given in the subsections that follow. Address 0x0020 Name DBGC1 R W R W R W R W Bit 7 ARM 1TBF 6 0 TRIG 0 5 0 4 BDM 0 3 DBGBRK 0 2 0 1 Bit 0 COMRV 0x0021 DBGSR 0 SSF2 SSF1 SSF0 0x0022 DBGTCR 0 TSOURCE 0 0 0 TRCMOD 0 0 0 TALIGN 0x0023 DBGC2 0 0 0 ABCM Figure 8-2. Quick Reference to DBG Registers MC9S12G Family Reference Manual, Rev.1.01 282 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Address 0x0024 Name DBGTBH R W R W Bit 7 Bit 15 6 Bit 14 5 Bit 13 4 Bit 12 3 Bit 11 2 Bit 10 1 Bit 9 Bit 0 Bit 8 0x0025 DBGTBL Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0026 DBGCNT R 1 TBF W R W R W 0 0 0 CNT 0x0027 0x0027 2 DBGSCRX DBGMFR 0 0 0 0 0 0 SC3 0 SC2 MC2 SC1 MC1 SC0 MC0 0x0028 0x0028 0x0028 3 4 R W R DBGBCTL W R DBGCCTL W DBGACTL DBGXAH R W R W R W R W R W R W SZE SZE 0 SZ SZ 0 TAG TAG TAG 0 BRK BRK BRK 0 RW RW RW 0 RWE RWE RWE 0 NDB 0 0 COMPE COMPE COMPE 0x0029 0 0 Bit 17 Bit 16 0x002A DBGXAM Bit 15 14 13 12 11 10 9 Bit 8 0x002B DBGXAL Bit 7 6 5 4 3 2 1 Bit 0 0x002C DBGADH Bit 15 14 13 12 11 10 9 Bit 8 0x002D DBGADL Bit 7 6 5 4 3 2 1 Bit 0 0x002E DBGADHM Bit 15 14 13 12 11 10 9 Bit 8 0x002F 1 2 3 4 R Bit 7 6 5 4 3 2 W This bit is visible at DBGCNT[7] and DBGSR[7] This represents the contents if the Comparator A control register is blended into this address. This represents the contents if the Comparator B control register is blended into this address This represents the contents if the Comparator C control register is blended into this address DBGADLM 1 Bit 0 Figure 8-2. Quick Reference to DBG Registers 8.3.2 Register Descriptions This section consists of the DBG control and trace buffer register descriptions in address order. Each comparator has a bank of registers that are visible through an 8-byte window between 0x0028 and 0x002F in the DBG module register address map. When ARM is set in DBGC1, the only bits in the DBG module registers that can be written are ARM, TRIG, and COMRV[1:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 283 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.3.2.1 Debug Control Register 1 (DBGC1) Address: 0x0020 7 6 5 4 3 2 1 0 R W Reset ARM 0 0 TRIG 0 0 0 BDM 0 DBGBRK 0 0 0 0 COMRV 0 = Unimplemented or Reserved Figure 8-3. Debug Control Register (DBGC1) Read: Anytime Write: Bits 7, 1, 0 anytime Bit 6 can be written anytime but always reads back as 0. Bits 4:3 anytime DBG is not armed. NOTE When disarming the DBG by clearing ARM with software, the contents of bits[4:3] are not affected by the write, since up until the write operation, ARM = 1 preventing these bits from being written. These bits must be cleared using a second write if required. Table 8-2. DBGC1 Field Descriptions Field 7 ARM Description Arm Bit — The ARM bit controls whether the DBG module is armed. This bit can be set and cleared by user software and is automatically cleared on completion of a debug session, or if a breakpoint is generated with tracing not enabled. On setting this bit the state sequencer enters State1. 0 Debugger disarmed 1 Debugger armed Immediate Trigger Request Bit — This bit when written to 1 requests an immediate trigger independent of state sequencer status. When tracing is complete a forced breakpoint may be generated depending upon DBGBRK and BDM bit settings. This bit always reads back a 0. Writing a 0 to this bit has no effect. If the DBGTCR_TSOURCE bit is clear no tracing is carried out. If tracing has already commenced using BEGIN trigger alignment, it continues until the end of the tracing session as defined by the TALIGN bit, thus TRIG has no affect. In secure mode tracing is disabled and writing to this bit cannot initiate a tracing session. The session is ended by setting TRIG and ARM simultaneously. 0 Do not trigger until the state sequencer enters the Final State. 1 Trigger immediately Background Debug Mode Enable — This bit determines if a breakpoint causes the system to enter Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDM is not enabled by the ENBDM bit in the BDM module, then breakpoints default to SWI. 0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint. 1 Breakpoint to BDM, if BDM enabled. Otherwise breakpoint to SWI S12SDBG Breakpoint Enable Bit — The DBGBRK bit controls whether the debugger will request a breakpoint on reaching the state sequencer Final State. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If tracing is not enabled, the breakpoint is generated immediately. 0 No Breakpoint generated 1 Breakpoint generated 6 TRIG 4 BDM 3 DBGBRK MC9S12G Family Reference Manual, Rev.1.01 284 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-2. DBGC1 Field Descriptions Field 1–0 COMRV Description Comparator Register Visibility Bits — These bits determine which bank of comparator register is visible in the 8-byte window of the S12SDBG module address map, located between 0x0028 to 0x002F. Furthermore these bits determine which register is visible at the address 0x0027. See Table 8-3. Table 8-3. COMRV Encoding COMRV 00 01 10 11 Visible Comparator Comparator A Comparator B Comparator C None Visible Register at 0x0027 DBGSCR1 DBGSCR2 DBGSCR3 DBGMFR 8.3.2.2 Debug Status Register (DBGSR) Address: 0x0021 7 6 5 4 3 2 1 0 R W Reset POR TBF — 0 0 0 0 0 0 0 0 0 0 0 0 0 SSF2 0 0 SSF1 0 0 SSF0 0 0 = Unimplemented or Reserved Figure 8-4. Debug Status Register (DBGSR) Read: Anytime Write: Never Table 8-4. DBGSR Field Descriptions Field 7 TBF Description Trace Buffer Full — The TBF bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines will be valid data, regardless of the value of DBGCNT bits. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit This bit is also visible at DBGCNT[7] State Sequencer Flag Bits — The SSF bits indicate in which state the State Sequencer is currently in. During a debug session on each transition to a new state these bits are updated. If the debug session is ended by software clearing the ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a debug session is ended by an internal event, then the state sequencer returns to state0 and these bits are cleared to indicate that state0 was entered during the session. On arming the module the state sequencer enters state1 and these bits are forced to SSF[2:0] = 001. See Table 8-5. 2–0 SSF[2:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 285 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-5. SSF[2:0] — State Sequence Flag Bit Encoding SSF[2:0] 000 001 010 011 100 101,110,111 Current State State0 (disarmed) State1 State2 State3 Final State Reserved 8.3.2.3 Debug Trace Control Register (DBGTCR) Address: 0x0022 7 6 5 4 3 2 1 0 R W Reset 0 0 TSOURCE 0 0 0 0 0 0 TRCMOD 0 0 0 TALIGN 0 Figure 8-5. Debug Trace Control Register (DBGTCR) Read: Anytime Write: Bit 6 only when DBG is neither secure nor armed.Bits 3,2,0 anytime the module is disarmed. Table 8-6. DBGTCR Field Descriptions Field 6 TSOURCE Description Trace Source Control Bit — The TSOURCE bit enables a tracing session given a trigger condition. If the MCU system is secured, this bit cannot be set and tracing is inhibited. This bit must be set to read the trace buffer. 0 Debug session without tracing requested 1 Debug session with tracing requested Trace Mode Bits — See Section 8.4.5.2, “Trace Modes for detailed Trace Mode descriptions. In Normal Mode, change of flow information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. In Compressed Pure PC mode the program counter value for each instruction executed is stored. See Table 8-7. Trigger Align Bit — This bit controls whether the trigger is aligned to the beginning or end of a tracing session. 0 Trigger at end of stored data 1 Trigger before storing data 3–2 TRCMOD 0 TALIGN Table 8-7. TRCMOD Trace Mode Bit Encoding TRCMOD 00 01 10 11 Description Normal Loop1 Detail Compressed Pure PC MC9S12G Family Reference Manual, Rev.1.01 286 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.3.2.4 Debug Control Register2 (DBGC2) Address: 0x0023 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 ABCM 0 = Unimplemented or Reserved Figure 8-6. Debug Control Register2 (DBGC2) Read: Anytime Write: Anytime the module is disarmed. This register configures the comparators for range matching. Table 8-8. DBGC2 Field Descriptions Field 1–0 ABCM[1:0] Description A and B Comparator Match Control — These bits determine the A and B comparator match mapping as described in Table 8-9. Table 8-9. ABCM Encoding ABCM 00 01 10 11 1 Description Match0 mapped to comparator A match: Match1 mapped to comparator B match. Match 0 mapped to comparator A/B inside range: Match1 disabled. Match 0 mapped to comparator A/B outside range: Match1 disabled. Reserved1 Currently defaults to Comparator A, Comparator B disabled 8.3.2.5 Debug Trace Buffer Register (DBGTBH:DBGTBL) Address: 0x0024, 0x0025 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W POR Other Resets Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 X — X — X — X — X — X — X — Bit 8 X — Bit 7 X — Bit 6 X — Bit 5 X — Bit 4 X — Bit 3 X — Bit 2 X — Bit 1 X — Bit 0 X — Figure 8-7. Debug Trace Buffer Register (DBGTB) Read: Only when unlocked AND unsecured AND not armed AND TSOURCE set. Write: Aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 287 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-10. DBGTB Field Descriptions Field 15–0 Bit[15:0] Description Trace Buffer Data Bits — The Trace Buffer Register is a window through which the 20-bit wide data lines of the Trace Buffer may be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to the next address to be read. When the ARM bit is set the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module is disarmed. The DBGTB register can be read only as an aligned word, any byte reads or misaligned access of these registers return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. Similarly reads while the debugger is armed or with the TSOURCE bit clear, return 0 and do not affect the trace buffer pointer. The POR state is undefined. Other resets do not affect the trace buffer contents. 8.3.2.6 Debug Count Register (DBGCNT) Address: 0x0026 7 6 5 4 3 2 1 0 R W Reset POR TBF — 0 0 — 0 — 0 — 0 — 0 CNT — 0 — 0 — 0 = Unimplemented or Reserved Figure 8-8. Debug Count Register (DBGCNT) Read: Anytime Write: Never Table 8-11. DBGCNT Field Descriptions Field 7 TBF Description Trace Buffer Full — The TBF bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines will be valid data, regardless of the value of DBGCNT bits. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit This bit is also visible at DBGSR[7] Count Value — The CNT bits indicate the number of valid data 20-bit data lines stored in the Trace Buffer. Table 8-12 shows the correlation between the CNT bits and the number of valid data lines in the Trace Buffer. When the CNT rolls over to zero, the TBF bit in DBGSR is set and incrementing of CNT will continue in end-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by power-on-reset initialization but is not cleared by other system resets. Thus should a reset occur during a debug session, the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. The DBGCNT register is not decremented when reading from the trace buffer. 5–0 CNT[5:0] Table 8-12. CNT Decoding Table TBF 0 CNT[5:0] 000000 Description No data valid MC9S12G Family Reference Manual, Rev.1.01 288 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-12. CNT Decoding Table TBF 0 CNT[5:0] 000001 000010 000100 000110 .. 111111 000000 000001 .. .. 111110 Description 1 line valid 2 lines valid 4 lines valid 6 lines valid .. 63 lines valid 64 lines valid; if using Begin trigger alignment, ARM bit will be cleared and the tracing session ends. 64 lines valid, oldest data has been overwritten by most recent data 1 1 8.3.2.7 Debug State Control Registers There is a dedicated control register for each of the state sequencer states 1 to 3 that determines if transitions from that state are allowed, depending upon comparator matches or tag hits, and defines the next state for the state sequencer following a match. The three debug state control registers are located at the same address in the register address map (0x0027). Each register can be accessed using the COMRV bits in DBGC1 to blend in the required register. The COMRV = 11 value blends in the match flag register (DBGMFR). Table 8-13. State Control Register Access Encoding COMRV 00 01 10 11 Visible State Control Register DBGSCR1 DBGSCR2 DBGSCR3 DBGMFR 8.3.2.7.1 Address: 0x0027 7 Debug State Control Register 1 (DBGSCR1) 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 SC3 0 SC2 0 SC1 0 SC0 0 = Unimplemented or Reserved Figure 8-9. Debug State Control Register 1 (DBGSCR1) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 00. The state control register 1 selects the targeted next state whilst in State1. The matches refer to the match channels of the comparator match MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 289 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) control logic as depicted in Figure 8-1 and described in 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-14. DBGSCR1 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State1, based upon the match event. Table 8-15. State1 Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description (Unspecified matches have no effect) Any match to Final State Match1 to State3 Match2 to State2 Match1 to State2 Match0 to State2....... Match1 to State3 Match1 to State3.........Match0 to Final State Match0 to State2....... Match2 to State3 Either Match0 or Match1 to State2 Reserved Match0 to State3 Reserved Reserved Reserved Either Match0 or Match2 to Final State........Match1 to State2 Reserved Reserved The priorities described in Table 8-35 dictate that in the case of simultaneous matches, a match leading to final state has priority followed by the match on the lower channel number (0,1,2). Thus with SC[3:0]=1101 a simultaneous match0/match1 transitions to final state. 8.3.2.7.2 Address: 0x0027 7 6 5 4 3 2 1 0 Debug State Control Register 2 (DBGSCR2) R W Reset 0 0 0 0 0 0 0 0 SC3 0 SC2 0 SC1 0 SC0 0 = Unimplemented or Reserved Figure 8-10. Debug State Control Register 2 (DBGSCR2) Read: If COMRV[1:0] = 01 Write: If COMRV[1:0] = 01 and DBG is not armed. MC9S12G Family Reference Manual, Rev.1.01 290 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) This register is visible at 0x0027 only with COMRV[1:0] = 01. The state control register 2 selects the targeted next state whilst in State2. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1, “Debug Comparator Control Register (DBGXCTL). Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-16. DBGSCR2 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State2, based upon the match event. Table 8-17. State2 —Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description (Unspecified matches have no effect) Match0 to State1....... Match2 to State3. Match1 to State3 Match2 to State3 Match1 to State3....... Match0 Final State Match1 to State1....... Match2 to State3. Match2 to Final State Match2 to State1..... Match0 to Final State Either Match0 or Match1 to Final State Reserved Reserved Reserved Reserved Either Match0 or Match1 to Final State........Match2 to State3 Reserved Reserved Either Match0 or Match1 to Final State........Match2 to State1 The priorities described in Table 8-35 dictate that in the case of simultaneous matches, a match leading to final state has priority followed by the match on the lower channel number (0,1,2) 8.3.2.7.3 Address: 0x0027 7 6 5 4 3 2 1 0 Debug State Control Register 3 (DBGSCR3) R W Reset 0 0 0 0 0 0 0 0 SC3 0 SC2 0 SC1 0 SC0 0 = Unimplemented or Reserved Figure 8-11. Debug State Control Register 3 (DBGSCR3) Read: If COMRV[1:0] = 10 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 291 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Write: If COMRV[1:0] = 10 and DBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 10. The state control register three selects the targeted next state whilst in State3. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1, “Debug Comparator Control Register (DBGXCTL). Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-18. DBGSCR3 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State3, based upon the match event. Table 8-19. State3 — Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description (Unspecified matches have no effect) Match0 to State1 Match2 to State2........ Match1 to Final State Match0 to Final State....... Match1 to State1 Match1 to Final State....... Match2 to State1 Match1 to State2 Match1 to Final State Match2 to State2........ Match0 to Final State Match0 to Final State Reserved Reserved Either Match1 or Match2 to State1....... Match0 to Final State Reserved Reserved Either Match1 or Match2 to Final State....... Match0 to State1 Match0 to State2....... Match2 to Final State Reserved The priorities described in Table 8-35 dictate that in the case of simultaneous matches, a match leading to final state has priority followed by the match on the lower channel number (0,1,2). 8.3.2.7.4 Address: 0x0027 7 6 5 4 3 2 1 0 Debug Match Flag Register (DBGMFR) R W Reset 0 0 0 0 0 0 0 0 0 0 MC2 0 MC1 0 MC0 0 = Unimplemented or Reserved Figure 8-12. Debug Match Flag Register (DBGMFR) MC9S12G Family Reference Manual, Rev.1.01 292 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Read: If COMRV[1:0] = 11 Write: Never DBGMFR is visible at 0x0027 only with COMRV[1:0] = 11. It features 3 flag bits each mapped directly to a channel. Should a match occur on the channel during the debug session, then the corresponding flag is set and remains set until the next time the module is armed by writing to the ARM bit. Thus the contents are retained after a debug session for evaluation purposes. These flags cannot be cleared by software, they are cleared only when arming the module. A set flag does not inhibit the setting of other flags. Once a flag is set, further comparator matches on the same channel in the same session have no affect on that flag. 8.3.2.8 Comparator Register Descriptions Each comparator has a bank of registers that are visible through an 8-byte window in the DBG module register address map. Comparator A consists of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). Comparator B consists of four register bytes (three address bus compare registers and a control register). Comparator C consists of four register bytes (three address bus compare registers and a control register). Each set of comparator registers can be accessed using the COMRV bits in the DBGC1 register. Unimplemented registers (e.g. Comparator B data bus and data bus masking) read as zero and cannot be written. The control register for comparator B differs from those of comparators A and C. Table 8-20. Comparator Register Layout 0x0028 0x0029 0x002A 0x002B 0x002C 0x002D 0x002E 0x002F CONTROL ADDRESS HIGH ADDRESS MEDIUM ADDRESS LOW DATA HIGH COMPARATOR DATA LOW COMPARATOR DATA HIGH MASK DATA LOW MASK Read/Write Read/Write Read/Write Read/Write Read/Write Read/Write Read/Write Read/Write Comparators A,B and C Comparators A,B and C Comparators A,B and C Comparators A,B and C Comparator A only Comparator A only Comparator A only Comparator A only 8.3.2.8.1 Debug Comparator Control Register (DBGXCTL) The contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the DBG module register address map. Address: 0x0028 7 6 5 4 3 2 1 0 R W Reset SZE 0 SZ 0 TAG 0 BRK 0 RW 0 RWE 0 NDB 0 COMPE 0 = Unimplemented or Reserved Figure 8-13. Debug Comparator Control Register DBGACTL (Comparator A) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 293 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Address: 0x0028 7 6 5 4 3 2 1 0 R W Reset SZE 0 SZ 0 TAG 0 BRK 0 RW 0 RWE 0 0 0 COMPE 0 = Unimplemented or Reserved Figure 8-14. Debug Comparator Control Register DBGBCTL (Comparator B) Address: 0x0028 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 TAG 0 BRK 0 RW 0 RWE 0 0 0 COMPE 0 = Unimplemented or Reserved Figure 8-15. Debug Comparator Control Register DBGCCTL (Comparator C) Read: DBGACTL if COMRV[1:0] = 00 DBGBCTL if COMRV[1:0] = 01 DBGCCTL if COMRV[1:0] = 10 Write: DBGACTL if COMRV[1:0] = 00 and DBG not armed DBGBCTL if COMRV[1:0] = 01 and DBG not armed DBGCCTL if COMRV[1:0] = 10 and DBG not armed Table 8-21. DBGXCTL Field Descriptions Field 7 SZE (Comparators A and B) 6 SZ (Comparators A and B) 5 TAG Description Size Comparator Enable Bit — The SZE bit controls whether access size comparison is enabled for the associated comparator. This bit is ignored if the TAG bit in the same register is set. 0 Word/Byte access size is not used in comparison 1 Word/Byte access size is used in comparison Size Comparator Value Bit — The SZ bit selects either word or byte access size in comparison for the associated comparator. This bit is ignored if the SZE bit is cleared or if the TAG bit in the same register is set. 0 Word access size is compared 1 Byte access size is compared Tag Select— This bit controls whether the comparator match has immediate effect, causing an immediate state sequencer transition or tag the opcode at the matched address. Tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 Allow state sequencer transition immediately on match 1 On match, tag the opcode. If the opcode is about to be executed allow a state sequencer transition Break— This bit controls whether a comparator match terminates a debug session immediately, independent of state sequencer state. To generate an immediate breakpoint the module breakpoints must be enabled using the DBGC1 bit DBGBRK. 0 The debug session termination is dependent upon the state sequencer and trigger conditions. 1 A match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. 4 BRK MC9S12G Family Reference Manual, Rev.1.01 294 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-21. DBGXCTL Field Descriptions Field 3 RW Description Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the associated comparator. The RW bit is not used if RWE = 0. This bit is ignored if the TAG bit in the same register is set. 0 Write cycle is matched1Read cycle is matched Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the associated comparator.This bit is ignored if the TAG bit in the same register is set 0 Read/Write is not used in comparison 1 Read/Write is used in comparison 2 RWE 1 Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator NDB register value or when the data bus differs from the register value. This bit is ignored if the TAG bit in the same (Comparator A) register is set. This bit is only available for comparator A. 0 Match on data bus equivalence to comparator register contents 1 Match on data bus difference to comparator register contents 0 COMPE Determines if comparator is enabled 0 The comparator is not enabled 1 The comparator is enabled Table 8-22 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if the corresponding TAG bit is set since the match occurs based on the tagged opcode reaching the execution stage of the instruction queue. Table 8-22. Read or Write Comparison Logic Table RWE Bit 0 0 1 1 1 1 RW Bit x x 0 0 1 1 RW Signal 0 1 0 1 0 1 Comment RW not used in comparison RW not used in comparison Write data bus No match No match Read data bus 8.3.2.8.2 Address: 0x0029 7 Debug Comparator Address High Register (DBGXAH) 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 Bit 17 0 Bit 16 0 = Unimplemented or Reserved Figure 8-16. Debug Comparator Address High Register (DBGXAH) The DBGC1_COMRV bits determine which comparator address registers are visible in the 8-byte window from 0x0028 to 0x002F as shown in Section Table 8-23., “Comparator Address Register Visibility MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 295 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-23. Comparator Address Register Visibility COMRV 00 01 10 11 Visible Comparator DBGAAH, DBGAAM, DBGAAL DBGBAH, DBGBAM, DBGBAL DBGCAH, DBGCAM, DBGCAL None Read: Anytime. See Table 8-23 for visible register encoding. Write: If DBG not armed. See Table 8-23 for visible register encoding. Table 8-24. DBGXAH Field Descriptions Field 1–0 Bit[17:16] Description Comparator Address High Compare Bits — The Comparator address high compare bits control whether the selected comparator compares the address bus bits [17:16] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 8.3.2.8.3 Address: 0x002A 7 Debug Comparator Address Mid Register (DBGXAM) 6 5 4 3 2 1 0 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 8-17. Debug Comparator Address Mid Register (DBGXAM) Read: Anytime. See Table 8-23 for visible register encoding. Write: If DBG not armed. See Table 8-23 for visible register encoding. Table 8-25. DBGXAM Field Descriptions Field 7–0 Bit[15:8] Description Comparator Address Mid Compare Bits — The Comparator address mid compare bits control whether the selected comparator compares the address bus bits [15:8] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one MC9S12G Family Reference Manual, Rev.1.01 296 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.3.2.8.4 Address: 0x002B 7 Debug Comparator Address Low Register (DBGXAL) 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 8-18. Debug Comparator Address Low Register (DBGXAL) Read: Anytime. See Table 8-23 for visible register encoding. Write: If DBG not armed. See Table 8-23 for visible register encoding. Table 8-26. DBGXAL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Address Low Compare Bits — The Comparator address low compare bits control whether the selected comparator compares the address bus bits [7:0] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 8.3.2.8.5 Address: 0x002C 7 Debug Comparator Data High Register (DBGADH) 6 5 4 3 2 1 0 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 8-19. Debug Comparator Data High Register (DBGADH) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 8-27. DBGADH Field Descriptions Field 7–0 Bits[15:8] Description Comparator Data High Compare Bits— The Comparator data high compare bits control whether the selected comparator compares the data bus bits [15:8] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparator A. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 297 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.3.2.8.6 Address: 0x002D 7 Debug Comparator Data Low Register (DBGADL) 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 8-20. Debug Comparator Data Low Register (DBGADL) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 8-28. DBGADL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Data Low Compare Bits — The Comparator data low compare bits control whether the selected comparator compares the data bus bits [7:0] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparator A. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one 8.3.2.8.7 Address: 0x002E 7 Debug Comparator Data High Mask Register (DBGADHM) 6 5 4 3 2 1 0 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 8-21. Debug Comparator Data High Mask Register (DBGADHM) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 8-29. DBGADHM Field Descriptions Field 7–0 Bits[15:8] Description Comparator Data High Mask Bits — The Comparator data high mask bits control whether the selected comparator compares the data bus bits [15:8] to the corresponding comparator data compare bits. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear 0 Do not compare corresponding data bit Any value of corresponding data bit allows match. 1 Compare corresponding data bit MC9S12G Family Reference Manual, Rev.1.01 298 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.3.2.8.8 Address: 0x002F 7 Debug Comparator Data Low Mask Register (DBGADLM) 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 8-22. Debug Comparator Data Low Mask Register (DBGADLM) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 8-30. DBGADLM Field Descriptions Field 7–0 Bits[7:0] Description Comparator Data Low Mask Bits — The Comparator data low mask bits control whether the selected comparator compares the data bus bits [7:0] to the corresponding comparator data compare bits. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear 0 Do not compare corresponding data bit. Any value of corresponding data bit allows match 1 Compare corresponding data bit 8.4 Functional Description This section provides a complete functional description of the DBG module. If the part is in secure mode, the DBG module can generate breakpoints but tracing is not possible. 8.4.1 S12SDBG Operation Arming the DBG module by setting ARM in DBGC1 allows triggering the state sequencer, storing of data in the trace buffer and generation of breakpoints to the CPU. The DBG module is made up of four main blocks, the comparators, control logic, the state sequencer, and the trace buffer. The comparators monitor the bus activity of the CPU. All comparators can be configured to monitor address bus activity. Comparator A can also be configured to monitor databus activity and mask out individual data bus bits during a compare. Comparators can be configured to use R/W and word/byte access qualification in the comparison. A match with a comparator register value can initiate a state sequencer transition to another state (see Figure 8-24). Either forced or tagged matches are possible. Using a forced match, a state sequencer transition can occur immediately on a successful match of system busses and comparator registers. Whilst tagging, at a comparator match, the instruction opcode is tagged and only if the instruction reaches the execution stage of the instruction queue can a state sequencer transition occur. In the case of a transition to Final State, bus tracing is triggered and/or a breakpoint can be generated. A state sequencer transition to final state (with associated breakpoint, if enabled) can be initiated by writing to the TRIG bit in the DBGC1 control register. The trace buffer is visible through a 2-byte window in the register address map and must be read out using standard 16-bit word reads. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 299 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) TAGHITS TAGS BREAKPOINT REQUESTS SECURE MATCH0 TRANSITION TO CPU COMPARATOR MATCH CONTROL CPU BUS BUS INTERFACE COMPARATOR A COMPARATOR B MATCH1 TAG & MATCH CONTROL LOGIC STATE STATE SEQUENCER STATE COMPARATOR C MATCH2 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 8-23. DBG Overview 8.4.2 Comparator Modes The DBG contains three comparators, A, B and C. Each comparator compares the system address bus with the address stored in DBGXAH, DBGXAM, and DBGXAL. Furthermore, comparator A also compares the data buses to the data stored in DBGADH, DBGADL and allows masking of individual data bus bits. All comparators are disabled in BDM and during BDM accesses. The comparator match control logic (see Figure 8-23) configures comparators to monitor the buses for an exact address or an address range, whereby either an access inside or outside the specified range generates a match condition. The comparator configuration is controlled by the control register contents and the range control by the DBGC2 contents. A match can initiate a transition to another state sequencer state (see Section 8.4.4, “State Sequence Control”). The comparator control register also allows the type of access to be included in the comparison through the use of the RWE, RW, SZE, and SZ bits. The RWE bit controls whether read or write comparison is enabled for the associated comparator and the RW bit selects either a read or write access for a valid match. Similarly the SZE and SZ bits allow the size of access (word or byte) to be considered in the compare. Only comparators A and B feature SZE and SZ. The TAG bit in each comparator control register is used to determine the match condition. By setting TAG, the comparator qualifies a match with the output of opcode tracking logic and a state sequencer transition occurs when the tagged instruction reaches the CPU execution stage. Whilst tagging the RW, RWE, SZE, and SZ bits and the comparator data registers are ignored; the comparator address register must be loaded with the exact opcode address. If the TAG bit is clear (forced type match) a comparator match is generated when the selected address appears on the system address bus. If the selected address is an opcode address, the match is generated MC9S12G Family Reference Manual, Rev.1.01 300 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) when the opcode is fetched from the memory, which precedes the instruction execution by an indefinite number of cycles due to instruction pipelining. For a comparator match of an opcode at an odd address when TAG = 0, the corresponding even address must be contained in the comparator register. Thus for an opcode at odd address (n), the comparator register must contain address (n–1). Once a successful comparator match has occurred, the condition that caused the original match is not verified again on subsequent matches. Thus if a particular data value is verified at a given address, this address may not still contain that data value when a subsequent match occurs. Match[0, 1, 2] map directly to Comparators [A, B, C] respectively, except in range modes (see Section 8.3.2.4, “Debug Control Register2 (DBGC2)). Comparator channel priority rules are described in the priority section (Section 8.4.3.4, “Channel Priorities). 8.4.2.1 Single Address Comparator Match With range comparisons disabled, the match condition is an exact equivalence of address bus with the value stored in the comparator address registers. Further qualification of the type of access (R/W, word/byte) and databus contents is possible, depending on comparator channel. 8.4.2.1.1 Comparator C Comparator C offers only address and direction (R/W) comparison. The exact address is compared, thus with the comparator address register loaded with address (n) a word access of address (n–1) also accesses (n) but does not cause a match. Table 8-31. Comparator C Access Considerations Condition For Valid Match Read and write accesses of ADDR[n] Write accesses of ADDR[n] Read accesses of ADDR[n] 1 Comp C Address RWE ADDR[n] 1 RW X 0 1 Examples LDAA ADDR[n] STAA #$BYTE ADDR[n] STAA #$BYTE ADDR[n] LDAA #$BYTE ADDR[n] 0 1 1 ADDR[n] ADDR[n] A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address from the code. 8.4.2.1.2 Comparator B Comparator B offers address, direction (R/W) and access size (word/byte) comparison. If the SZE bit is set the access size (word or byte) is compared with the SZ bit value such that only the specified size of access causes a match. Thus if configured for a byte access of a particular address, a word access covering the same address does not lead to match. Assuming the access direction is not qualified (RWE=0), for simplicity, the size access considerations are shown in Table 8-32. Table 8-32. Comparator B Access Size Considerations Condition For Valid Match Word and byte accesses of ADDR[n] Comp B Address RWE ADDR[n]1 0 SZE 0 SZ8 X Examples MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 301 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-32. Comparator B Access Size Considerations Condition For Valid Match Word accesses of ADDR[n] only Byte accesses of ADDR[n] only 1 Comp B Address RWE ADDR[n] ADDR[n] 0 0 SZE 1 1 SZ8 0 1 Examples MOVW #$WORD ADDR[n] LDD ADDR[n] MOVB #$BYTE ADDR[n] LDAB ADDR[n] A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address from the code. Access direction can also be used to qualify a match for Comparator B in the same way as described for Comparator C in Table 8-31. 8.4.2.1.3 Comparator A Comparator A offers address, direction (R/W), access size (word/byte) and data bus comparison. Table 8-33 lists access considerations with data bus comparison. On word accesses the data byte of the lower address is mapped to DBGADH. Access direction can also be used to qualify a match for Comparator A in the same way as described for Comparator C in Table 8-31. Table 8-33. Comparator A Matches When Accessing ADDR[n] SZE 0 0 0 0 0 0 1 1 1 1 1 1 SZ X X X X X X 0 0 0 0 1 1 DBGADHM, DBGADLM $0000 $FF00 $00FF $00FF $FFFF $FFFF $0000 $00FF $FF00 $FFFF $0000 $FF00 Byte Word Byte, data(ADDR[n])=DH Word, data(ADDR[n])=DH, data(ADDR[n+1])=X Word, data(ADDR[n])=X, data(ADDR[n+1])=DL Byte, data(ADDR[n])=X, data(ADDR[n+1])=DL Word, data(ADDR[n])=DH, data(ADDR[n+1])=DL Byte, data(ADDR[n])=DH, data(ADDR[n+1])=DL Word Word, data(ADDR[n])=X, data(ADDR[n+1])=DL Word, data(ADDR[n])=DH, data(ADDR[n+1])=X Word, data(ADDR[n])=DH, data(ADDR[n+1])=DL Byte Byte, data(ADDR[n])=DH Access DH=DBGADH, DL=DBGADL Comment No databus comparison Match data( ADDR[n]) Match data( ADDR[n+1]) Possible unintended match Match data( ADDR[n], ADDR[n+1]) Possible unintended match No databus comparison Match only data at ADDR[n+1] Match only data at ADDR[n] Match data at ADDR[n] & ADDR[n+1] No databus comparison Match data at ADDR[n] 8.4.2.1.4 Comparator A Data Bus Comparison NDB Dependency Comparator A features an NDB control bit, which allows data bus comparators to be configured to either trigger on equivalence or trigger on difference. This allows monitoring of a difference in the contents of an address location from an expected value. When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by clearing the corresponding mask bit (DBGADHM/DBGADLM) so that it is ignored in the comparison. A MC9S12G Family Reference Manual, Rev.1.01 302 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) match occurs when all data bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is based on the address bus only, the data bus is ignored. When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored and prevents a match because no difference can be detected. In this case address bus equivalence does not cause a match. Table 8-34. NDB and MASK bit dependency NDB 0 0 1 1 DBGADHM[n] / DBGADLM[n] 0 1 0 1 Comment Do not compare data bus bit. Compare data bus bit. Match on equivalence. Do not compare data bus bit. Compare data bus bit. Match on difference. 8.4.2.2 Range Comparisons Using the AB comparator pair for a range comparison, the data bus can also be used for qualification by using the comparator A data registers. Furthermore the DBGACTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access. The corresponding DBGBCTL bits are ignored. The SZE and SZ control bits are ignored in range mode. The comparator A TAG bit is used to tag range comparisons. The comparator B TAG bit is ignored in range modes. In order for a range comparison using comparators A and B, both COMPEA and COMPEB must be set; to disable range comparisons both must be cleared. The comparator A BRK bit is used to for the AB range, the comparator B BRK bit is ignored in range mode. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. 8.4.2.2.1 Inside Range (CompA_Addr ≤ address ≤ CompB_Addr) In the Inside Range comparator mode, comparator pair A and B can be configured for range comparisons. This configuration depends upon the control register (DBGC2). The match condition requires that a valid match for both comparators happens on the same bus cycle. A match condition on only one comparator is not valid. An aligned word access which straddles the range boundary is valid only if the aligned address is inside the range. 8.4.2.2.2 Outside Range (address < CompA_Addr or address > CompB_Addr) In the Outside Range comparator mode, comparator pair A and B can be configured for range comparisons. A single match condition on either of the comparators is recognized as valid. An aligned word access which straddles the range boundary is valid only if the aligned address is outside the range. Outside range mode in combination with tagging can be used to detect if the opcode fetches are from an unexpected range. In forced match mode the outside range match would typically be activated at any interrupt vector fetch or register access. This can be avoided by setting the upper range limit to $3FFFF or lower range limit to $00000 respectively. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 303 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.4.3 Match Modes (Forced or Tagged) Match modes are used as qualifiers for a state sequencer change of state. The Comparator control register TAG bits select the match mode. The modes are described in the following sections. 8.4.3.1 Forced Match When configured for forced matching, a comparator channel match can immediately initiate a transition to the next state sequencer state whereby the corresponding flags in DBGSR are set. The state control register for the current state determines the next state. Forced matches are typically generated 2-3 bus cycles after the final matching address bus cycle, independent of comparator RWE/RW settings. Furthermore since opcode fetches occur several cycles before the opcode execution a forced match of an opcode address typically precedes a tagged match at the same address. 8.4.3.2 Tagged Match If a CPU taghit occurs a transition to another state sequencer state is initiated and the corresponding DBGSR flags are set. For a comparator related taghit to occur, the DBG must first attach tags to instructions as they are fetched from memory. When the tagged instruction reaches the execution stage of the instruction queue a taghit is generated by the CPU. This can initiate a state sequencer transition. 8.4.3.3 Immediate Trigger Independent of comparator matches it is possible to initiate a tracing session and/or breakpoint by writing to the TRIG bit in DBGC1. If configured for begin aligned tracing, this triggers the state sequencer into the Final State, if configured for end alignment, setting the TRIG bit disarms the module, ending the session and issues a forced breakpoint request to the CPU. It is possible to set both TRIG and ARM simultaneously to generate an immediate trigger, independent of the current state of ARM. 8.4.3.4 Channel Priorities In case of simultaneous matches the priority is resolved according to Table 8-35. The lower priority is suppressed. It is thus possible to miss a lower priority match if it occurs simultaneously with a higher priority. The priorities described in Table 8-35 dictate that in the case of simultaneous matches, the match pointing to final state has highest priority followed by the lower channel number (0,1,2). Table 8-35. Channel Priorities Priority Highest Source TRIG Channel pointing to Final State Match0 (force or tag hit) Match1 (force or tag hit) Lowest Match2 (force or tag hit) Action Enter Final State Transition to next state as defined by state control registers Transition to next state as defined by state control registers Transition to next state as defined by state control registers Transition to next state as defined by state control registers MC9S12G Family Reference Manual, Rev.1.01 304 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.4.4 State Sequence Control ARM = 0 State 0 (Disarmed) ARM = 1 State1 ARM = 0 Session Complete (Disarm) Final State ARM = 0 State3 State2 Figure 8-24. State Sequencer Diagram The state sequencer allows a defined sequence of events to provide a trigger point for tracing of data in the trace buffer. Once the DBG module has been armed by setting the ARM bit in the DBGC1 register, then state1 of the state sequencer is entered. Further transitions between the states are then controlled by the state control registers and channel matches. From Final State the only permitted transition is back to the disarmed state0. Transition between any of the states 1 to 3 is not restricted. Each transition updates the SSF[2:0] flags in DBGSR accordingly to indicate the current state. Alternatively writing to the TRIG bit in DBGSC1, provides an immediate trigger independent of comparator matches. Independent of the state sequencer, each comparator channel can be individually configured to generate an immediate breakpoint when a match occurs through the use of the BRK bits in the DBGxCTL registers. Thus it is possible to generate an immediate breakpoint on selected channels, whilst a state sequencer transition can be initiated by a match on other channels. If a debug session is ended by a match on a channel the state sequencer transitions through Final State for a clock cycle to state0. This is independent of tracing and breakpoint activity, thus with tracing and breakpoints disabled, the state sequencer enters state0 and the debug module is disarmed. 8.4.4.1 Final State On entering Final State a trigger may be issued to the trace buffer according to the trace alignment control as defined by the TALIGN bit (see Section 8.3.2.3, “Debug Trace Control Register (DBGTCR)”). If the TSOURCE bit in DBGTCR is clear then the trace buffer is disabled and the transition to Final State can only generate a breakpoint request. In this case or upon completion of a tracing session when tracing is enabled, the ARM bit in the DBGC1 register is cleared, returning the module to the disarmed state0. If tracing is enabled a breakpoint request can occur at the end of the tracing session. If neither tracing nor breakpoints are enabled then when the final state is reached it returns automatically to state0 and the debug module is disarmed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 305 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.4.5 Trace Buffer Operation The trace buffer is a 64 lines deep by 20-bits wide RAM array. The DBG module stores trace information in the RAM array in a circular buffer format. The system accesses the RAM array through a register window (DBGTBH:DBGTBL) using 16-bit wide word accesses. After each complete 20-bit trace buffer line is read, an internal pointer into the RAM increments so that the next read receives fresh information. Data is stored in the format shown in Table 8-36 and Table 8-39. After each store the counter register DBGCNT is incremented. Tracing of CPU activity is disabled when the BDM is active. Reading the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not incremented. 8.4.5.1 Trace Trigger Alignment Using the TALIGN bit (see Section 8.3.2.3, “Debug Trace Control Register (DBGTCR)) it is possible to align the trigger with the end or the beginning of a tracing session. If End tracing is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is entered; the transition to Final State signals the end of the tracing session. Tracing with Begin-Trigger starts at the opcode of the trigger. Using End Trigger or when the tracing is initiated by writing to the TRIG bit whilst configured for Begin-Trigger, tracing starts in the second cycle after the DBGC1 write cycle. 8.4.5.1.1 Storing with Begin-Trigger Storing with Begin-Trigger, data is not stored in the Trace Buffer until the Final State is entered. Once the trigger condition is met the DBG module remains armed until 64 lines are stored in the Trace Buffer. If the trigger is at the address of the change-of-flow instruction the change of flow associated with the trigger is stored in the Trace Buffer. Using Begin-trigger together with tagging, if the tagged instruction is about to be executed then the trace is started. Upon completion of the tracing session the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 8.4.5.1.2 Storing with End-Trigger Storing with End-Trigger, data is stored in the Trace Buffer until the Final State is entered, at which point the DBG module becomes disarmed and no more data is stored. If the trigger is at the address of a change of flow instruction, the trigger event is not stored in the Trace Buffer. 8.4.5.2 Trace Modes Four trace modes are available. The mode is selected using the TRCMOD bits in the DBGTCR register. Tracing is enabled using the TSOURCE bit in the DBGTCR register. The modes are described in the following subsections. 8.4.5.2.1 Normal Mode In Normal Mode, change of flow (COF) program counter (PC) addresses are stored. COF addresses are defined as follows: • Source address of taken conditional branches (long, short, bit-conditional, and loop primitives) • Destination address of indexed JMP, JSR, and CALL instruction MC9S12G Family Reference Manual, Rev.1.01 306 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) • • Destination address of RTI, RTS, and RTC instructions Vector address of interrupts, except for BDM vectors LBRA, BRA, BSR, BGND as well as non-indexed JMP, JSR, and CALL instructions are not classified as change of flow and are not stored in the trace buffer. Stored information includes the full 18-bit address bus and information bits, which contains a source/destination bit to indicate whether the stored address was a source address or destination address. NOTE When a COF instruction with destination address is executed, the destination address is stored to the trace buffer on instruction completion, indicating the COF has taken place. If an interrupt occurs simultaneously then the next instruction carried out is actually from the interrupt service routine. The instruction at the destination address of the original program flow gets executed after the interrupt service routine. In the following example an IRQ interrupt occurs during execution of the indexed JMP at address MARK1. The BRN at the destination (SUB_1) is not executed until after the IRQ service routine but the destination address is entered into the trace buffer to indicate that the indexed JMP COF has taken place. MARK1 MARK2 SUB_1 LDX JMP NOP BRN NOP DBNE LDAB STAB RTI #SUB_1 0,X ; IRQ interrupt occurs during execution of this ; ; JMP Destination address TRACE BUFFER ENTRY 1 ; RTI Destination address TRACE BUFFER ENTRY 3 ; ; Source address TRACE BUFFER ENTRY 4 ; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2 ; * ADDR1 IRQ_ISR A,PART5 #$F0 VAR_C1 The execution flow taking into account the IRQ is as follows MARK1 IRQ_ISR LDX JMP LDAB STAB RTI BRN NOP DBNE #SUB_1 0,X #$F0 VAR_C1 * A,PART5 ; ; ; ; ; SUB_1 ADDR1 8.4.5.2.2 Loop1 Mode Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it however allows the filtering out of redundant information. The intent of Loop1 Mode is to prevent the Trace Buffer from being filled entirely with duplicate information from a looping construct such as delays using the DBNE instruction or polling loops using MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 307 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) BRSET/BRCLR instructions. Immediately after address information is placed in the Trace Buffer, the DBG module writes this value into a background register. This prevents consecutive duplicate address entries in the Trace Buffer resulting from repeated branches. Loop1 Mode only inhibits consecutive duplicate source address entries that would typically be stored in most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector addresses, since repeated entries of these would most likely indicate a bug in the user’s code that the DBG module is designed to help find. 8.4.5.2.3 Detail Mode In Detail Mode, address and data for all memory and register accesses is stored in the trace buffer. This mode is intended to supply additional information on indexed, indirect addressing modes where storing only the destination address would not provide all information required for a user to determine where the code is in error. This mode also features information bit storage to the trace buffer, for each address byte storage. The information bits indicate the size of access (word or byte) and the type of access (read or write). When tracing in Detail Mode, all cycles are traced except those when the CPU is either in a free or opcode fetch cycle. 8.4.5.2.4 Compressed Pure PC Mode In Compressed Pure PC Mode, the PC addresses of all executed opcodes, including illegal opcodes are stored. A compressed storage format is used to increase the effective depth of the trace buffer. This is achieved by storing the lower order bits each time and using 2 information bits to indicate if a 64 byte boundary has been crossed, in which case the full PC is stored. Each Trace Buffer row consists of 2 information bits and 18 PC address bits NOTE: When tracing is terminated using forced breakpoints, latency in breakpoint generation means that opcodes following the opcode causing the breakpoint can be stored to the trace buffer. The number of opcodes is dependent on program flow. This can be avoided by using tagged breakpoints. 8.4.5.3 Trace Buffer Organization (Normal, Loop1, Detail modes) ADRH, ADRM, ADRL denote address high, middle and low byte respectively. The numerical suffix refers to the tracing count. The information format for Loop1 and Normal modes is identical. In Detail mode, the address and data for each entry are stored on consecutive lines, thus the maximum number of entries is 32. In this case DBGCNT bits are incremented twice, once for the address line and once for the data line, on each trace buffer entry. In Detail mode CINF comprises of R/W and size access information (CRW and CSZ respectively). Single byte data accesses in Detail Mode are always stored to the low byte of the trace buffer (DATAL) and the high byte is cleared. When tracing word accesses, the byte at the lower address is always stored to trace buffer byte1 and the byte at the higher address is stored to byte0. MC9S12G Family Reference Manual, Rev.1.01 308 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-36. Trace Buffer Organization (Normal,Loop1,Detail modes) Mode Entry Number 4-bits Field 2 8-bits Field 1 8-bits Field 0 Entry 1 Detail Mode Entry 2 CINF1,ADRH1 0 CINF2,ADRH2 0 PCH1 PCH2 ADRM1 DATAH1 ADRM2 DATAH2 PCM1 PCM2 ADRL1 DATAL1 ADRL2 DATAL2 PCL1 PCL2 Normal/Loop1 Modes Entry 1 Entry 2 8.4.5.3.1 Information Bit Organization The format of the bits is dependent upon the active trace mode as described below. Field2 Bits in Detail Mode Bit 3 CSZ Bit 2 CRW Bit 1 Bit 0 ADDR[17] ADDR[16] Figure 8-25. Field2 Bits in Detail Mode In Detail Mode the CSZ and CRW bits indicate the type of access being made by the CPU. Table 8-37. Field Descriptions Bit 3 CSZ 2 CRW Description Access Type Indicator— This bit indicates if the access was a byte or word size when tracing in Detail Mode 0 Word Access 1 Byte Access Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access when tracing in Detail Mode. 0 Write Access 1 Read Access Address Bus bit 17— Corresponds to system address bus bit 17. Address Bus bit 16— Corresponds to system address bus bit 16. 1 ADDR[17] 0 ADDR[16] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 309 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Field2 Bits in Normal and Loop1 Modes Bit 3 CSD Bit 2 CVA Bit 1 PC17 Bit 0 PC16 Figure 8-26. Information Bits PCH Table 8-38. PCH Field Descriptions Bit 3 CSD Description Source Destination Indicator — In Normal and Loop1 mode this bit indicates if the corresponding stored address is a source or destination address. This bit has no meaning in Compressed Pure PC mode. 0 Source Address 1 Destination Address Vector Indicator — In Normal and Loop1 mode this bit indicates if the corresponding stored address is a vector address. Vector addresses are destination addresses, thus if CVA is set, then the corresponding CSD is also set. This bit has no meaning in Compressed Pure PC mode . 0 Non-Vector Destination Address 1 Vector Destination Address Program Counter bit 17— In Normal and Loop1 mode this bit corresponds to program counter bit 17. Program Counter bit 16— In Normal and Loop1 mode this bit corresponds to program counter bit 16. 2 CVA 1 PC17 0 PC16 8.4.5.4 Trace Buffer Organization (Compressed Pure PC mode) Table 8-39. Trace Buffer Organization Example (Compressed PurePC mode) 2-bits Line Number Field 3 Line 1 Line 2 Line 3 Line 4 Line 5 Line 6 00 11 01 00 10 00 0 PC4 0 6-bits Field 2 6-bits Field 1 PC1 (Initial 18-bit PC Base Address) PC3 0 PC6 (New 18-bit PC Base Address) PC8 PC9 (New 18-bit PC Base Address) PC7 PC2 PC5 6-bits Field 0 Mode Compressed Pure PC Mode MC9S12G Family Reference Manual, Rev.1.01 310 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Field3 Bits in Compressed Pure PC Modes Table 8-40. Compressed Pure PC Mode Field 3 Information Bit Encoding INF1 0 0 1 1 INF0 0 1 0 1 TRACE BUFFER ROW CONTENT Base PC address TB[17:0] contains a full PC[17:0] value Trace Buffer[5:0] contain incremental PC relative to base address zero value Trace Buffer[11:0] contain next 2 incremental PCs relative to base address zero value Trace Buffer[17:0] contain next 3 incremental PCs relative to base address zero value Each time that PC[17:6] differs form the previous base PC[17:6], then a new base address is stored. The base address zero value is the lowest address in the 64 address range The first line of the trace buffer always gets a base PC address, this applies also on rollover. 8.4.5.5 Reading Data from Trace Buffer The data stored in the Trace Buffer can be read provided the DBG module is not armed, is configured for tracing (TSOURCE bit is set) and the system not secured. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by a single aligned word write to DBGTB when the module is disarmed. The Trace Buffer can only be read through the DBGTB register using aligned word reads, any byte or misaligned reads return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. The Trace Buffer data is read out first-in first-out. By reading CNT in DBGCNT the number of valid lines can be determined. DBGCNT does not decrement as data is read. Whilst reading an internal pointer is used to determine the next line to be read. After a tracing session, the pointer points to the oldest data entry, thus if no overflow has occurred, the pointer points to line0, otherwise it points to the line with the oldest entry. In compressed Pure PC mode on rollover the line with the oldest data entry may also contain newer data entries in fields 0 and 1. Thus if rollover is indicated by the TBF bit, the line status must be decoded using the INF bits in field3 of that line. If both INF bits are clear then the line contains only entires from before the last rollover. If INF0=1 then field 0 contains post rollover data but fields 1 and 2 contain pre rollover data. If INF1=1 then fields 0 and 1 contain post rollover data but field 2 contains pre rollover data. The pointer is initialized by each aligned write to DBGTBH to point to the oldest data again. This enables an interrupted trace buffer read sequence to be easily restarted from the oldest data entry. The least significant word of line is read out first. This corresponds to the fields 1 and 0 of Table 8-36. The next word read returns field 2 in the least significant bits [3:0] and “0” for bits [15:4]. Reading the Trace Buffer while the DBG module is armed returns invalid data and no shifting of the RAM pointer occurs. 8.4.5.6 Trace Buffer Reset State The Trace Buffer contents and DBGCNT bits are not initialized by a system reset. Thus should a system reset occur, the trace session information from immediately before the reset occurred can be read out and the number of valid lines in the trace buffer is indicated by DBGCNT. The internal pointer to the current MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 311 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) trace buffer address is initialized by unlocking the trace buffer and points to the oldest valid data even if a reset occurred during the tracing session. To read the trace buffer after a reset, TSOURCE must be set, otherwise the trace buffer reads as all zeroes. Generally debugging occurrences of system resets is best handled using end trigger alignment since the reset may occur before the trace trigger, which in the begin trigger alignment case means no information would be stored in the trace buffer. The Trace Buffer contents and DBGCNT bits are undefined following a POR. NOTE An external pin RESET that occurs simultaneous to a trace buffer entry can, in very seldom cases, lead to either that entry being corrupted or the first entry of the session being corrupted. In such cases the other contents of the trace buffer still contain valid tracing information. The case occurs when the reset assertion coincides with the trace buffer entry clock edge. 8.4.6 Tagging A tag follows program information as it advances through the instruction queue. When a tagged instruction reaches the head of the queue a tag hit occurs and can initiate a state sequencer transition. Each comparator control register features a TAG bit, which controls whether the comparator match causes a state sequencer transition immediately or tags the opcode at the matched address. If a comparator is enabled for tagged comparisons, the address stored in the comparator match address registers must be an opcode address. Using Begin trigger together with tagging, if the tagged instruction is about to be executed then the transition to the next state sequencer state occurs. If the transition is to the Final State, tracing is started. Only upon completion of the tracing session can a breakpoint be generated. Using End alignment, when the tagged instruction is about to be executed and the next transition is to Final State then a breakpoint is generated immediately, before the tagged instruction is carried out. R/W monitoring, access size (SZ) monitoring and data bus monitoring are not useful if tagging is selected, since the tag is attached to the opcode at the matched address and is not dependent on the data bus nor on ta type of access. Thus these bits are ignored if tagging is selected. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. Tagging is disabled when the BDM becomes active. 8.4.7 Breakpoints It is possible to generate breakpoints from channel transitions to final state or using software to write to the TRIG bit in the DBGC1 register. 8.4.7.1 Breakpoints From Comparator Channels Breakpoints can be generated when the state sequencer transitions to the Final State. If configured for tagging, then the breakpoint is generated when the tagged opcode reaches the execution stage of the instruction queue. MC9S12G Family Reference Manual, Rev.1.01 312 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) If a tracing session is selected by the TSOURCE bit, breakpoints are requested when the tracing session has completed, thus if Begin aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 8-41). If no tracing session is selected, breakpoints are requested immediately. If the BRK bit is set, then the associated breakpoint is generated immediately independent of tracing trigger alignment. Table 8-41. Breakpoint Setup For CPU Breakpoints BRK 0 0 0 0 1 1 TALIGN 0 0 1 1 x x DBGBRK 0 1 0 1 1 0 Breakpoint Alignment Fill Trace Buffer until trigger then disarm (no breakpoints) Fill Trace Buffer until trigger, then breakpoint request occurs Start Trace Buffer at trigger (no breakpoints) Start Trace Buffer at trigger A breakpoint request occurs when Trace Buffer is full Terminate tracing and generate breakpoint immediately on trigger Terminate tracing immediately on trigger 8.4.7.2 Breakpoints Generated Via The TRIG Bit If a TRIG triggers occur, the Final State is entered whereby tracing trigger alignment is defined by the TALIGN bit. If a tracing session is selected by the TSOURCE bit, breakpoints are requested when the tracing session has completed, thus if Begin aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 8-41). If no tracing session is selected, breakpoints are requested immediately. TRIG breakpoints are possible with a single write to DBGC1, setting ARM and TRIG simultaneously. 8.4.7.3 Breakpoint Priorities If a TRIG trigger occurs after Begin aligned tracing has already started, then the TRIG no longer has an effect. When the associated tracing session is complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent comparator channel match, it has no effect, since tracing has already started. If a forced SWI breakpoint coincides with a BGND in user code with BDM enabled, then the BDM is activated by the BGND and the breakpoint to SWI is suppressed. 8.4.7.3.1 DBG Breakpoint Priorities And BDM Interfacing Breakpoint operation is dependent on the state of the BDM module. If the BDM module is active, the CPU is executing out of BDM firmware, thus comparator matches and associated breakpoints are disabled. In addition, while executing a BDM TRACE command, tagging into BDM is disabled. If BDM is not active, the breakpoint gives priority to BDM requests over SWI requests if the breakpoint happens to coincide with a SWI instruction in user code. On returning from BDM, the SWI from user code gets executed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 313 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) Table 8-42. Breakpoint Mapping Summary DBGBRK 0 1 X 1 1 BDM Bit (DBGC1[4]) X 0 X 1 1 BDM Enabled X X 1 0 1 BDM Active X 0 1 X 0 Breakpoint Mapping No Breakpoint Breakpoint to SWI No Breakpoint Breakpoint to SWI Breakpoint to BDM BDM cannot be entered from a breakpoint unless the ENABLE bit is set in the BDM. If entry to BDM via a BGND instruction is attempted and the ENABLE bit in the BDM is cleared, the CPU actually executes the BDM firmware code, checks the ENABLE and returns if ENABLE is not set. If not serviced by the monitor then the breakpoint is re-asserted when the BDM returns to normal CPU flow. If the comparator register contents coincide with the SWI/BDM vector address then an SWI in user code could coincide with a DBG breakpoint. The CPU ensures that BDM requests have a higher priority than SWI requests. Returning from the BDM/SWI service routine care must be taken to avoid a repeated breakpoint at the same address. Should a tagged or forced breakpoint coincide with a BGND in user code, then the instruction that follows the BGND instruction is the first instruction executed when normal program execution resumes. NOTE When program control returns from a tagged breakpoint using an RTI or BDM GO command without program counter modification it returns to the instruction whose tag generated the breakpoint. To avoid a repeated breakpoint at the same location reconfigure the DBG module in the SWI routine, if configured for an SWI breakpoint, or over the BDM interface by executing a TRACE command before the GO to increment the program flow past the tagged instruction. 8.5 8.5.1 Application Information State Machine scenarios Defining the state control registers as SCR1,SCR2, SCR3 and M0,M1,M2 as matches on channels 0,1,2 respectively. SCR encoding supported by S12SDBGV1 are shown in black. SCR encoding supported only in S12SDBGV2 are shown in red. For backwards compatibility the new scenarios use a 4th bit in each SCR register. Thus the existing encoding for SCRx[2:0] is not changed. MC9S12G Family Reference Manual, Rev.1.01 314 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.5.2 Scenario 1 Figure 8-27. Scenario 1 A trigger is generated if a given sequence of 3 code events is executed. SCR1=0011 State1 M1 SCR2=0010 State2 M2 SCR3=0111 State3 M0 Final State Scenario 1 is possible with S12SDBGV1 SCR encoding 8.5.3 Scenario 2 Figure 8-28. Scenario 2a A trigger is generated if a given sequence of 2 code events is executed. SCR1=0011 State1 M1 SCR2=0101 State2 M2 Final State A trigger is generated if a given sequence of 2 code events is executed, whereby the first event is entry into a range (COMPA,COMPB configured for range mode). M1 is disabled in range modes. Figure 8-29. Scenario 2b SCR1=0111 State1 M01 SCR2=0101 State2 M2 Final State A trigger is generated if a given sequence of 2 code events is executed, whereby the second event is entry into a range (COMPA,COMPB configured for range mode) Figure 8-30. Scenario 2c SCR1=0010 State1 M2 SCR2=0011 State2 M0 Final State All 3 scenarios 2a,2b,2c are possible with the S12SDBGV1 SCR encoding MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 315 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.5.4 Scenario 3 Figure 8-31. Scenario 3 A trigger is generated immediately when one of up to 3 given events occurs SCR1=0000 State1 M012 Final State Scenario 3 is possible with S12SDBGV1 SCR encoding 8.5.5 Scenario 4 Trigger if a sequence of 2 events is carried out in an incorrect order. Event A must be followed by event B and event B must be followed by event A. 2 consecutive occurances of event A without an intermediate event B cause a trigger. Similarly 2 consecutive occurances of event B without an intermediate event A cause a trigger. This is possible by using CompA and CompC to match on the same address as shown. Figure 8-32. Scenario 4a SCR1=0100 State1 M1 M0 M2 M1 State2 M0 SCR2=0011 SCR3=0001 State 3 M1 Final State This scenario is currently not possible using 2 comparators only. S12SDBGV2 makes it possible with 2 comparators, State 3 allowing a M0 to return to state 2, whilst a M2 leads to final state as shown. Figure 8-33. Scenario 4b (with 2 comparators) SCR1=0110 State1 M2 M0 M0 M2 State2 M01 SCR2=1100 M1 disabled in range mode Final State SCR3=1110 State 3 M2 The advantage of using only 2 channels is that now range comparisons can be included (channel0) MC9S12G Family Reference Manual, Rev.1.01 316 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) This however violates the S12SDBGV1 specification, which states that a match leading to final state always has priority in case of a simultaneous match, whilst priority is also given to the lowest channel number. For S12SDBG the corresponding CPU priority decoder is removed to support this, such that on simultaneous taghits, taghits pointing to final state have highest priority. If no taghit points to final state then the lowest channel number has priority. Thus with the above encoding from State3, the CPU and DBG would break on a simultaneous M0/M2. 8.5.6 Scenario 5 Figure 8-34. Scenario 5 Trigger if following event A, event C precedes event B. ie. the expected execution flow is A->B->C. SCR1=0011 State1 M1 M2 SCR2=0110 State2 M0 Final State Scenario 5 is possible with the S12SDBGV1 SCR encoding 8.5.7 Scenario 6 Trigger if event A occurs twice in succession before any of 2 other events (BC) occurs. This scenario is not possible using the S12SDBGV1 SCR encoding. S12SDBGV2 includes additions shown in red. The change in SCR1 encoding also has the advantage that a State1->State3 transition using M0 is now possible. This is advantageous because range and data bus comparisons use channel0 only. Figure 8-35. Scenario 6 SCR1=1001 State1 M0 M12 SCR3=1010 State3 M0 Final State 8.5.8 Scenario 7 Trigger when a series of 3 events is executed out of order. Specifying the event order as M1,M2,M0 to run in loops (120120120). Any deviation from that order should trigger. This scenario is not possible using the MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 317 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) S12SDBGV1 SCR encoding because OR possibilities are very limited in the channel encoding. By adding OR forks as shown in red this scenario is possible. Figure 8-36. Scenario 7 M01 SCR1=1101 State1 M1 SCR2=1100 State2 M2 SCR3=1101 State3 M12 Final State M0 M02 On simultaneous matches the lowest channel number has priority so with this configuration the forking from State1 has the peculiar effect that a simultaneous match0/match1 transitions to final state but a simultaneous match2/match1transitions to state2. 8.5.9 Scenario 8 Figure 8-37. Scenario 8a Trigger when a routine/event at M2 follows either M1 or M0. SCR1=0111 State1 M01 SCR2=0101 State2 M2 Final State Trigger when an event M2 is followed by either event M0 or event M1 Figure 8-38. Scenario 8b SCR1=0010 State1 M2 SCR2=0111 State2 M01 Final State Scenario 8a and 8b are possible with the S12SDBGV1 and S12SDBGV2 SCR encoding MC9S12G Family Reference Manual, Rev.1.01 318 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) 8.5.10 Scenario 9 Trigger when a routine/event at A (M2) does not follow either B or C (M1 or M0) before they are executed again. This cannot be realised with theS12SDBGV1 SCR encoding due to OR limitations. By changing the SCR2 encoding as shown in red this scenario becomes possible. Figure 8-39. Scenario 9 SCR1=0111 State1 M01 M2 SCR2=1111 State2 M01 Final State 8.5.11 Scenario 10 Trigger if an event M0 occurs following up to two successive M2 events without the resetting event M1. As shown up to 2 consecutive M2 events are allowed, whereby a reset to State1 is possible after either one or two M2 events. If an event M0 occurs following the second M2, before M1 resets to State1 then a trigger is generated. Configuring CompA and CompC the same, it is possible to generate a breakpoint on the third consecutive occurance of event M0 without a reset M1. Figure 8-40. Scenario 10a M1 SCR1=0010 State1 M2 SCR2=0100 State2 M2 SCR3=0010 State3 M0 Final State M1 Figure 8-41. Scenario 10b M0 SCR1=0010 State1 M2 SCR2=0011 State2 M1 SCR3=0000 State3 Final State M0 Scenario 10b shows the case that after M2 then M1 must occur before M0. Starting from a particular point in code, event M2 must always be followed by M1 before M0. If after any M2, event M0 occurs before M1 then a trigger is generated. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 319 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12S Debug Module (S12SDBG) MC9S12G Family Reference Manual, Rev.1.01 320 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 9 Security (S12XS9SECV2) Table 9-1. Revision History Revision Number 02.00 02.01 02.02 Revision Date 27 Aug 2004 21 Feb 2007 19 Apr 2007 Sections Affected Description of Changes reviewed and updated for S12XD architecture added S12XE, S12XF and S12XS architectures corrected statement about Backdoor key access via BDM on XE, XF, XS 9.1 Introduction NOTE No security feature is absolutely secure. However, Freescale’s strategy is to make reading or copying the FLASH and/or EEPROM difficult for unauthorized users. This specification describes the function of the security mechanism in the MC9S12G-Family (9SEC). 9.1.1 Features The user must be reminded that part of the security must lie with the application code. An extreme example would be application code that dumps the contents of the internal memory. This would defeat the purpose of security. At the same time, the user may also wish to put a backdoor in the application program. An example of this is the user downloads a security key through the SCI, which allows access to a programming routine that updates parameters stored in another section of the Flash memory. The security features of the MC9S12G-Family (in secure mode) are: • Protect the content of non-volatile memories (Flash, EEPROM) • Execution of NVM commands is restricted • Disable access to internal memory via background debug module (BDM) 9.1.2 Modes of Operation Table 9-2. Feature Availability in Unsecure and Secure Modes on S12XS Unsecure Mode NS Flash Array Access ✔ SS ✔ NX ES EX ST NS ✔ SS ✔ Secure Mode NX ES EX ST Table 9-2 gives an overview over availability of security relevant features in unsecure and secure modes. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 321 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Security (S12XS9SECV2) Table 9-2. Feature Availability in Unsecure and Secure Modes on S12XS Unsecure Mode NS EEPROM Array Access NVM Commands BDM DBG Module Trace 1 2 Secure Mode EX ST NS ✔ ✔ 1 SS ✔ ✔ ✔ ✔ NX ES SS ✔ ✔1 ✔2 — NX ES EX ST ✔ ✔ 1 ✔ ✔ — — Restricted NVM command set only. Please refer to the NVM wrapper block guides for detailed information. BDM hardware commands restricted to peripheral registers only. 9.1.3 Securing the Microcontroller Once the user has programmed the Flash and EEPROM, the chip can be secured by programming the security bits located in the options/security byte in the Flash memory array. These non-volatile bits will keep the device secured through reset and power-down. The options/security byte is located at address 0xFF0F (= global address 0x7F_FF0F) in the Flash memory array. This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for security (SEC[1:0]). On devices which have a memory page window, the Flash options/security byte is also available at address 0xBF0F by selecting page 0x3F with the PPAGE register. The contents of this byte are copied into the Flash security register (FSEC) during a reset sequence. 7 6 5 4 3 2 1 0 0xFF0F KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 Figure 9-1. Flash Options/Security Byte The meaning of the bits KEYEN[1:0] is shown in Table 9-3. Please refer to Section 9.1.5.1, “Unsecuring the MCU Using the Backdoor Key Access” for more information. Table 9-3. Backdoor Key Access Enable Bits KEYEN[1:0] 00 01 10 11 Backdoor Key Access Enabled 0 (disabled) 0 (disabled) 1 (enabled) 0 (disabled) The meaning of the security bits SEC[1:0] is shown in Table 9-4. For security reasons, the state of device security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’. MC9S12G Family Reference Manual, Rev.1.01 322 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Security (S12XS9SECV2) Table 9-4. Security Bits SEC[1:0] 00 01 10 11 Security State 1 (secured) 1 (secured) 0 (unsecured) 1 (secured) NOTE Please refer to the Flash block guide for actual security configuration (in section “Flash Module Security”). 9.1.4 Operation of the Secured Microcontroller By securing the device, unauthorized access to the EEPROM and Flash memory contents can be prevented. However, it must be understood that the security of the EEPROM and Flash memory contents also depends on the design of the application program. For example, if the application has the capability of downloading code through a serial port and then executing that code (e.g. an application containing bootloader code), then this capability could potentially be used to read the EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this example, the security of the application could be enhanced by requiring a challenge/response authentication before any code can be downloaded. Secured operation has the following effects on the microcontroller: 9.1.4.1 • • • Normal Single Chip Mode (NS) Background debug module (BDM) operation is completely disabled. Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. 9.1.4.2 • • • • Special Single Chip Mode (SS) BDM firmware commands are disabled. BDM hardware commands are restricted to the register space. Execution of Flash and EEPROM commands is restricted. Please refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. Special single chip mode means BDM is active after reset. The availability of BDM firmware commands depends on the security state of the device. The BDM secure firmware first performs a blank check of both the Flash memory and the EEPROM. If the blank check succeeds, security will be temporarily turned off and the state of the security bits in the appropriate Flash memory location can be changed If the blank check fails, security will remain active, only the BDM hardware commands will be enabled, and the accessible memory space is restricted to the peripheral register area. This will allow the BDM to be used to erase the EEPROM and Flash memory without giving access to their contents. After erasing both Flash MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 323 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Security (S12XS9SECV2) memory and EEPROM, another reset into special single chip mode will cause the blank check to succeed and the options/security byte can be programmed to “unsecured” state via BDM. While the BDM is executing the blank check, the BDM interface is completely blocked, which means that all BDM commands are temporarily blocked. 9.1.5 Unsecuring the Microcontroller Unsecuring the microcontroller can be done by three different methods: 1. Backdoor key access 2. Reprogramming the security bits 3. Complete memory erase (special modes) 9.1.5.1 Unsecuring the MCU Using the Backdoor Key Access In normal modes (single chip and expanded), security can be temporarily disabled using the backdoor key access method. This method requires that: • The backdoor key at 0xFF00–0xFF07 (= global addresses 0x3_FF00–0x3_FF07) has been programmed to a valid value. • The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’. • In single chip mode, the application program programmed into the microcontroller must be designed to have the capability to write to the backdoor key locations. The backdoor key values themselves would not normally be stored within the application data, which means the application program would have to be designed to receive the backdoor key values from an external source (e.g. through a serial port). The backdoor key access method allows debugging of a secured microcontroller without having to erase the Flash. This is particularly useful for failure analysis. NOTE No word of the backdoor key is allowed to have the value 0x0000 or 0xFFFF. 9.1.6 Reprogramming the Security Bits In normal single chip mode (NS), security can also be disabled by erasing and reprogramming the security bits within Flash options/security byte to the unsecured value. Because the erase operation will erase the entire sector from 0xFE00–0xFFFF (0x7F_FE00–0x7F_FFFF), the backdoor key and the interrupt vectors will also be erased; this method is not recommended for normal single chip mode. The application software can only erase and program the Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected (see Flash protection). Thus Flash protection is a useful means of preventing this method. The microcontroller will enter the unsecured state after the next reset following the programming of the security bits to the unsecured value. This method requires that: MC9S12G Family Reference Manual, Rev.1.01 324 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Security (S12XS9SECV2) • • The application software previously programmed into the microcontroller has been designed to have the capability to erase and program the Flash options/security byte, or security is first disabled using the backdoor key method, allowing BDM to be used to issue commands to erase and program the Flash options/security byte. The Flash sector containing the Flash options/security byte is not protected. 9.1.7 Complete Memory Erase (Special Modes) The microcontroller can be unsecured in special modes by erasing the entire EEPROM and Flash memory contents. When a secure microcontroller is reset into special single chip mode (SS), the BDM firmware verifies whether the EEPROM and Flash memory are erased. If any EEPROM or Flash memory address is not erased, only BDM hardware commands are enabled. BDM hardware commands can then be used to write to the EEPROM and Flash registers to mass erase the EEPROM and all Flash memory blocks. When next reset into special single chip mode, the BDM firmware will again verify whether all EEPROM and Flash memory are erased, and this being the case, will enable all BDM commands, allowing the Flash options/security byte to be programmed to the unsecured value. The security bits SEC[1:0] in the Flash security register will indicate the unsecure state following the next reset. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 325 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Security (S12XS9SECV2) MC9S12G Family Reference Manual, Rev.1.01 326 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 10 S12 Clock, Reset and Power Management Unit (S12CPMU) Revision History Version Revision Effective Number Date Date V04.09 V04.10 V04.11 22 Jun 10 01 Jul 10 23 Aug 10 22 Jun 10 01 Jul 10 23 Aug 10 Author Description of Changes Changed IP-Name from OSCLCP to XOSCLCP, added OSCCLK_LCP clock name intoFigure 10-1 and Figure 10-2 updated description of Section 10.2.2, “EXTAL and XTAL. Added TC trimming to feature list Removed feature of adaptive oscillator filter. Register bits 6 and 4to 0in the CPMUOSC register are marked reserved and do not alter. 10.1 Introduction This specification describes the function of the Clock, Reset and Power Management Unit (S12CPMU). • The Pierce oscillator (XOSCLCP) provides a robust, low-noise and low-power external clock source. It is designed for optimal start-up margin with typical quartz crystals and ceramic resonators. • The Voltage regulator (IVREG) operates from the range 3.13V to 5.5V. It provides all the required chip internal voltages and voltage monitors. • The Phase Locked Loop (PLL) provides a highly accurate frequency multiplier with internal filter. • The Internal Reference Clock (IRC1M) provides a1MHz clock. 10.1.1 Features The Pierce Oscillator (XOSCLCP) contains circuitry to dynamically control current gain in the output amplitude. This ensures a signal with low harmonic distortion, low power and good noise immunity. • Supports quartz crystals or ceramic resonators from 4MHz to 16MHz. • High noise immunity due to input hysteresis and spike filtering. • Low RF emissions with peak-to-peak swing limited dynamically MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 327 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) • • • • Transconductance (gm) sized for optimum start-up margin for typical crystals Dynamic gain control eliminates the need for external current limiting resistor Integrated resistor eliminates the need for external bias resistor. Low power consumption: Operates from internal 1.8V (nominal) supply, Amplitude control limits power The Voltage Regulator (IVREG) has the following features: • Input voltage range from 3.13V to 5.5V • Low-voltage detect (LVD) with low-voltage interrupt (LVI) • Power-on reset (POR) • Low-voltage reset (LVR) The Phase Locked Loop (PLL) has the following features: • highly accurate and phase locked frequency multiplier • Configurable internal filter for best stability and lock time. • Frequency modulation for defined jitter and reduced emission • Automatic frequency lock detector • Interrupt request on entry or exit from locked condition • Reference clock either external (crystal) or internal square wave (1MHz IRC1M) based. • PLL stability is sufficient for LIN communication, even if using IRC1M as reference clock The Internal Reference Clock (IRC1M) has the following features: • Frequency trimming (A factory trim value for 1MHz is loaded from Flash Memory into the IRCTRIM register after reset, which can be overwritten by application if required) • Temperature Coefficient (TC) trimming. (A factory trim value is loaded from Flash Memory into the IRCTRIM register to turned off TC trimming after reset. Application can trim the TC if required by overwriting the IRCTRIM register). • Other features of the S12CPMU include • Clock monitor to detect loss of crystal • Autonomous periodical interrupt (API) • Bus Clock Generator — Clock switch to select either PLLCLK or external crystal/resonator based Bus Clock — PLLCLK divider to adjust system speed • System Reset generation from the following possible sources: — Power-on reset (POR) — Low-voltage reset (LVR) — Illegal address access MC9S12G Family Reference Manual, Rev.1.01 328 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) — COP time out — Loss of oscillation (clock monitor fail) — External pin RESET 10.1.2 Modes of Operation This subsection lists and briefly describes all operating modes supported by the S12CPMU. 10.1.2.1 Run Mode The voltage regulator is in Full Performance Mode (FPM). The Phase Locked Loop (PLL) is on. The Internal Reference Clock (IRC1M) is on. The API is available. • PLL Engaged Internal (PEI) — This is the default mode after System Reset and Power-On Reset. — The Bus Clock is based on the PLLCLK. — After reset the PLL is configured for 50 MHz VCOCLK operation Post divider is 0x03, so PLLCLK is VCOCLK divided by 4, that is 12.5MHz and Bus Clock is 6.25MHz. The PLL can be re-configured for other bus frequencies. — The reference clock for the PLL (REFCLK) is based on internal reference clock IRC1M • PLL Engaged External (PEE) — The Bus Clock is based n the PLLCLK. — This mode can be entered from default mode PEI by performing the following steps: – Configure the PLL for desired bus frequency. – Program the reference divider (REFDIV[3:0] bits) to divide down oscillator frequency if necessary. – Enable the external oscillator (OSCE bit) – Wait for oscillator to start up (UPOSC=1) and PLL to lock (LOCK=1). • PLL Bypassed External (PBE) — The Bus Clock is based on the Oscillator Clock (OSCCLK). — The PLLCLK is always on to qualify the external oscillator clock. Therefore it is necessary to make sure a valid PLL configuration is used for the selected oscillator frequency. — This mode can be entered from default mode PEI by performing the following steps: – Make sure the PLL configuration is valid for the selected oscillator frequency. – Enable the external oscillator (OSCE bit) – Wait for oscillator to start up (UPOSC=1) – Select the Oscillator Clock (OSCCLK) as Bus Clock (PLLSEL=0). MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 329 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) — The PLLCLK is on and used to qualify the external oscillator clock. 10.1.2.2 Wait Mode For S12CPMU Wait Mode is the same as Run Mode. 10.1.2.3 Stop Mode This mode is entered by executing the CPU STOP instruction. The voltage regulator is in Reduced Power Mode (RPM). The API is available. The Phase Locked Loop (PLL) is off. The Internal Reference Clock (IRC1M) is off. Core Clock, Bus Clock and BDM Clock are stopped. Depending on the setting of the PSTP and the OSCE bit, Stop Mode can be differentiated between Full Stop Mode (PSTP = 0 or OSCE=0) and Pseudo Stop Mode (PSTP = 1 and OSCE=1). In addition, the behavior of the COP in each mode will change based on the clocking method selected by COPOSCSEL[1:0]. • Full Stop Mode (PSTP = 0 or OSCE=0) External oscillator (XOSCLCP) is disabled. — If COPOSCSEL1=0: The COP and RTI counters halt during Full Stop Mode. After wake-up from Full Stop Mode the Core Clock and Bus Clock are running on PLLCLK (PLLSEL=1). COP and RTI are running on IRCCLK (COPOSCSEL0=0, RTIOSCSEL=0). — If COPOSCSEL1=1: During Full Stop Mode the COP is running on ACLK (trimmable internal RC-Oscillator clock) and the RTI counter halts. After wake-up from Full Stop Mode the Core Clock and Bus Clock are running on PLLCLK (PLLSEL=1). The COP runs on ACLK and RTI is running on IRCCLK (COPOSCSEL0=0, RTIOSCSEL=0). • Pseudo Stop Mode (PSTP = 1 and OSCE=1) External oscillator (XOSCLCP) continues to run. — If COPOSCSEL1=0: If the respective enable bits are set (PCE=1 and PRE=1) the COP and RTI will continue to run with a clock derived from the oscillator clock. The clock configuration bits PLLSEL, COPOSCSEL0, RTIOSCSEL are unchanged. — If COPOSCSEL1=1: If the respective enable bit for the RTI is set (PRE=1) the RTI will continue to run with a clock derived from the oscillator clock. MC9S12G Family Reference Manual, Rev.1.01 330 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) The COP will continue to run on ACLK. The clock configuration bits PLLSEL, COPOSCSEL0, RTIOSCSEL are unchanged. NOTE When starting up the external oscillator (either by programming OSCE bit to 1 or on exit from Full Stop Mode with OSCE bit already 1) the software must wait for a minimum time equivalent to the startup-time of the external oscillator tUPOSC before entering Pseudo Stop Mode. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 331 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) 10.1.3 S12CPMU Block Diagram MMC Illegal Address Access VDD, VDDF (core supplies) Low Voltage Detect VDDA Low Voltage Detect VDDX Voltage Regulator 3.13 to 5.5V Power-On Detect LVRF PORF Power-On Reset Clock Monitor monitor fail UPOSC Reset Generator UPOSC=0 sets PLLSEL bit OSCCLK System Reset Oscillator status Interrupt OSCIE & PLLSEL POSTDIV[4:0] Post Divider 1,2,.,32 divide by 4 ECLK2X (Core Clock) PLLCLK ECLK divide by 2 (Bus Clock) IRCCLK (to LCD) divide by 8 BDM Clock CAN_OSCCLK (to MSCAN) COP time out S12CPMU ILAF LVDS LVIE VDDR VSS VDDX VSSX VDDA VSSA RESET Low Voltage Interrupt External Loop OSCCLK_LCP EXTAL Controlled Pierce Oscillator XTAL (XOSCLCP) 4MHz-16MHz REFDIV[3:0] IRCTRIM[9:0] Reference Divider Internal Reference Clock (IRC1M) PSTP OSCE VCOFRQ[1:0] VCOCLK Lock detect REFCLK FBCLK Phase locked Loop with internal Filter (PLL) REFFRQ[1:0] LOCK Divide by 2*(SYNDIV+1) SYNDIV[5:0] APICLK APIE RTIE Bus Clock RC ACLK Osc. LOCKIE PLL Lock Interrupt Autonomous API_EXTCLK Periodic Interrupt (API) API Interrupt RTI Interrupt UPOSC ACLK IRCCLK OSCCLK COPOSCSEL1 COP time out COPCLK COP to Reset Watchdog Generator IRCCLK PCE CPMUCOP OSCCLK Real Time RTICLK Interrupt (RTI) PRE CPMURTI COPOSCSEL0 UPOSC=0 clears RTIOSCSEL Figure 10-1. Block diagram of S12CPMU MC9S12G Family Reference Manual, Rev.1.01 332 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) Figure 10-2 shows a block diagram of the XOSCLCP. OSCCLK_LCP Clock Monitor Peak Detector Gain Control VDD = 1.8 V monitor fail VSS Rf EXTAL or Ceramic Resonators Quartz Crystals XTAL C1 VSS C2 VSS Figure 10-2. XOSCLCP Block Diagram 10.2 Signal Description This section lists and describes the signals that connect off chip. 10.2.1 RESET Pin RESET is an active-low bidirectional pin. As an input it initializes the MCU asynchronously to a known start-up state. As an open-drain output it indicates that an MCU-internal reset has been triggered. 10.2.2 EXTAL and XTAL These pins provide the interface for a crystal to control the internal clock generator circuitry. EXTAL is the input to the crystal oscillator amplifier. XTAL is the output of the crystal oscillator amplifier. If XOSCLCP is enabled, the MCU internal OSCCLK_LCP is derived from the EXTAL input frequency. If OSCE=0, the EXTAL pin is pulled down by an internal resistor of approximately 200 kΩ and the XTAL pin is pulled down by an internal resistor of approximately 700 kΩ. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 333 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) NOTE Freescale recommends an evaluation of the application board and chosen resonator or crystal by the resonator or crystal supplier. The loop controlled circuit (XOSCLCP) is not suited for overtone resonators and crystals. 10.2.3 VDDR — Regulator Power Input Pin Pin VDDR is the power input of IVREG. All currents sourced into the regulator loads flow through this pin. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDR and VSS can smooth ripple on VDDR. 10.2.4 VSS — Ground Pin VSS must be grounded. 10.2.5 VDDA, VSSA — Regulator Reference Supply Pins Pins VDDA and VSSA are used to supply the analog parts of the regulator. Internal precision reference circuits are supplied from these signals. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDA and VSSA can improve the quality of this supply. 10.2.6 VDDX, VSSX— Pad Supply Pins This supply domain is monitored by the Low Voltage Reset circuit. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDX and VSSX can improve the quality of this supply. NOTE Depending on the device package following device supply pins are maybe combined into one pin: VDDR, VDDX and VDDA. Depending on the device package following device supply pins are maybe combined into one pin: VSS, VSSX and VSSA. Please refer to the device Reference Manual for information if device supply pins are combined into one supply pin for certain packages and which supply pins are combined together. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between the combined supply pin pair can improve the quality of this supply. MC9S12G Family Reference Manual, Rev.1.01 334 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) 10.2.7 VDD — Internal Regulator Output Supply (Core Logic) Node VDD is a device internal supply output of the voltage regulator that provides the power supply for the core logic. This supply domain is monitored by the Low Voltage Reset circuit. 10.2.8 VDDF — Internal Regulator Output Supply (NVM Logic) Node VDDF is a device internal supply output of the voltage regulator that provides the power supply for the NVM logic. This supply domain is monitored by the Low Voltage Reset circuit 10.2.9 API_EXTCLK — API external clock output pin This pin provides the signal selected via APIES and is enabled with APIEA bit. See device specification to which pin it connects. 10.3 Memory Map and Registers This section provides a detailed description of all registers accessible in the S12CPMU. 10.3.1 Module Memory Map The S12CPMU registers are shown in Figure 10-3. Addres s 0x0034 0x0035 0x0036 0x0037 0x0038 0x0039 0x003A Name CPMU SYNR CPMU REFDIV CPMU POSTDIV CPMUFLG CPMUINT CPMUCLKS CPMUPLL R W R W R W R W R W R W R W Bit 7 6 5 4 3 2 1 Bit 0 VCOFRQ[1:0] REFFRQ[1:0] 0 0 0 0 0 SYNDIV[5:0] REFDIV[3:0] POSTDIV[4:0] LOCKIF LOCKIE COP OSCSEL1 FM0 LOCK 0 ILAF 0 OSCIF OSCIE RTI OSCSEL 0 UPOSC 0 RTIF RTIE PLLSEL 0 PORF 0 LVRF 0 0 PSTP 0 PRE 0 PCE 0 COP OSCSEL0 0 FM1 = Unimplemented or Reserved Figure 10-3. CPMU Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 335 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) Addres s 0x003B 0x003C 0x003D 0x003E 0x003F 0x02F0 0x02F1 0x02F2 Name CPMURTI CPMUCOP R W R W Bit 7 RTDEC WCOP 0 0 0 Bit 7 0 0 6 RTR6 RSBCK 0 0 0 Bit 6 0 0 0 5 RTR5 0 WRTMASK 0 0 0 Bit 5 0 0 0 4 RTR4 0 0 0 0 Bit 4 0 0 3 RTR3 0 0 0 0 Bit 3 0 0 2 RTR2 CR2 0 0 0 Bit 2 0 LVDS 1 RTR1 CR1 0 0 0 Bit 1 0 Bit 0 RTR0 CR0 0 0 0 Bit 0 0 RESERVEDCP R MUTEST0 W RESERVEDCP R MUTEST1 W CPMU ARMCOP RESERVED CPMU LVCTL CPMU APICTL R W R W R W R W R W R W R W LVIE APIE 0 LVIF APIF 0 APICLK ACLKTR5 APIR15 APIR7 0 0 APIES APIEA APIFE 0x02F3 CPMUACLKTR 0x02F4 0x02F5 0x02F6 0x02F7 0x02F8 0x02F9 CPMUAPIRH CPMUAPIRL ACLKTR4 APIR14 APIR6 0 0 ACLKTR3 APIR13 APIR5 0 0 ACLKTR2 ACLKTR1 ACLKTR0 APIR12 APIR4 0 0 APIR11 APIR3 0 0 APIR10 APIR2 0 0 0 APIR9 APIR1 0 0 APIR8 APIR0 0 0 RESERVEDCP R MUTEST3 W RESERVED CPMU IRCTRIMH CPMU IRCTRIML CPMUOSC W R W R W R W R W R TCTRIM[4:0] IRCTRIM[7:0] OSCPINS_ EN 0 0 0 0 0 0 IRCTRIM[9:8] 0x02FA OSCE 0 0 Reserved 0 0 Reserved 0 0 0 0 0x02FB 0x02FC CPMUPROT PROT 0 RESERVEDCP R MUTEST2 W = Unimplemented or Reserved Figure 10-3. CPMU Register Summary MC9S12G Family Reference Manual, Rev.1.01 336 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. S12 Clock, Reset and Power Management Unit (S12CPMU) 10.3.2 Register Descriptions This section describes all the S12CPMU registers and their individual bits. Address order is as listed in Figure 10-3. 10.3.2.1 S12CPMU Synthesizer Register (CPMUSYNR) The CPMUSYNR register controls the multiplication factor of the PLL and selects the VCO frequency range. 0x0034 7 6 5 4 3 2 1 0 R VCOFRQ[1:0] W Reset 0 1 0 1 1 0 0 0 SYNDIV[5:0] Figure 10-4. S12CPMU Synthesizer Register (CPMUSYNR) Read: Anytime Write: Anytime if PROT=0 (CPMUPROT register) and PLLSEL=1 (CPMUCLKS register). Else write has no effect. NOTE Writing to this register clears the LOCK and UPOSC status bits. If PLL has locked (LOCK=1) f VCO = 2 × f REF × ( SYNDIV + 1 ) NOTE fVCO must be within the specified VCO frequency lock range. Bus frequency fbus must not exceed the specified maximum. The VCOFRQ[1:0] bits are used to configure the VCO gain for optimal stability and lock time. For correct PLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK frequency as shown in Table 10-1. Setting the VCOFRQ[1:0] bits incorrectly can result in a non functional PLL (no locking and/or insufficient stability). Table 10-1. VCO Clock Frequency Selection VCOCLK Frequency Ranges 32MHz TIMxxx - Correct reference: Figure 20-25 -> Figure 20-30 - Add description, “a counter overflow when TTOV[7] is set”, to be the condition of channel 7 override event. - Phrase the description of OC7M to make it more explicit V03.02 Apri,12,2010 20.3.2.8/20-642 -Add Table 20-10 20.3.2.11/20-64 -update TCRE bit description -add Figure 20-31 5 20.4.3/20-655 20.1 Introduction The basic scalable timer consists of a 16-bit, software-programmable counter driven by a flexible programmable prescaler. This timer can be used for many purposes, including input waveform measurements while simultaneously generating an output waveform. Pulse widths can vary from microseconds to many seconds. This timer could contain up to 8 (0....7) input capture/output compare channels with one pulse accumulator available only on channel 7. The input capture function is used to detect a selected transition edge and record the time. The output compare function is used for generating output signals or for timer software delays. The 16-bit pulse accumulator is used to operate as a simple event counter or a gated time accumulator. The pulse accumulator shares timer channel 7 when the channel is available and when in event mode. A full access for the counter registers or the input capture/output compare registers should take place in one clock cycle. Accessing high byte and low byte separately for all of these registers may not yield the same result as accessing them in one word. 20.1.1 Features The TIM16B8CV3 includes these distinctive features: • Up to 8 channels available. (refer to device specification for exact number) • All channels have same input capture/output compare functionality. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 631 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) • • • Clock prescaling. 16-bit counter. 16-bit pulse accumulator on channel 7 if channel 7 exists. 20.1.2 Stop: Freeze: Wait: Normal: Modes of Operation Timer is off because clocks are stopped. Timer counter keeps on running, unless TSFRZ in TSCR1 is set to 1. Counters keeps on running, unless TSWAI in TSCR1 is set to 1. Timer counter keep on running, unless TEN in TSCR1 is cleared to 0. MC9S12G Family Reference Manual, Rev.1.01 632 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.1.3 Block Diagrams Bus clock Prescaler Channel 0 Input capture Output compare Channel 1 Input capture Output compare Channel 2 Input capture Output compare Channel 3 Input capture Output compare IOC0 16-bit Counter IOC1 Timer overflow interrupt Timer channel 0 interrupt IOC2 IOC3 Registers Channel 4 Input capture Output compare Channel 5 Input capture Output compare IOC5 IOC4 Timer channel 7 interrupt Channel 6 Input capture Output compare IOC6 PA overflow interrupt PA input interrupt Channel 7 16-bit Pulse accumulator Input capture Output compare IOC7 Maximum possible channels, scalable from 0 to 7. Pulse Accumulator is available only if channel 7 exists. Figure 20-1. TIM16B8CV3 Block Diagram MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 633 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) TIMCLK (Timer clock) CLK1 CLK0 4:1 MUX PACLK / 256 Prescaled clock (PCLK) PACLK / 65536 Clock select (PAMOD) PACLK Edge detector IOC7 Intermodule Bus Interrupt PACNT MUX Divide by 64 M clock Figure 20-2. 16-Bit Pulse Accumulator Block Diagram 16-bit Main Timer IOCn Edge detector Set CnF Interrupt TCn Input Capture Reg. Figure 20-3. Interrupt Flag Setting MC9S12G Family Reference Manual, Rev.1.01 634 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) PULSE ACCUMULATOR CHANNEL 7 OUTPUT COMPARE OCPD TEN TIOS7 PAD Figure 20-4. Channel 7 Output Compare/Pulse Accumulator Logic 20.2 External Signal Description The TIM16B8CV3 module has a selected number of external pins. Refer to device specification for exact number. 20.2.1 IOC7 — Input Capture and Output Compare Channel 7 This pin serves as input capture or output compare for channel 7 if this channel is available. This can also be configured as pulse accumulator input. 20.2.2 IOC6 - IOC0 — Input Capture and Output Compare Channel 6-0 Those pins serve as input capture or output compare for TIM168CV3 channel if the corresponding channel is available. NOTE For the description of interrupts see Section 20.6, “Interrupts”. 20.3 Memory Map and Register Definition This section provides a detailed description of all memory and registers. 20.3.1 Module Memory Map The memory map for the TIM16B8CV3 module is given below in Figure 20-5. The address listed for each register is the address offset. The total address for each register is the sum of the base address for the TIM16B8CV3 module and the address offset for each register. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 635 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2 Register Descriptions This section consists of register descriptions in address order. Each description includes a standard register diagram with an associated figure number. Details of register bit and field function follow the register diagrams, in bit order. Only bits related to implemented channels are valid. Register Name 0x0000 TIOS1 0x0001 CFORC1 0x0002 OC7M2 0x0003 2 OC7D 0x0004 TCNTH 0x0005 TCNTL 0x0006 TSCR1 0x0007 TTOV1 0x0008 TCTL11 0x0009 TCTL21 0x000A TCTL31 0x000B TCTL41 0x000C TIE1 0x000D TSCR21 R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 6 5 4 3 2 1 Bit 0 IOS7 IOS6 IOS5 IOS4 IOS3 IOS2 IOS1 IOS0 0 FOC7 OC7M7 0 FOC6 OC7M6 0 FOC5 OC7M5 0 FOC4 OC7M4 0 FOC3 OC7M3 0 FOC2 OC7M2 0 FOC1 OC7M1 0 FOC0 OC7M0 OC7D7 OC7D6 OC7D5 OC7D4 OC7D3 OC7D2 OC7D1 OC7D0 TCNT15 TCNT14 TCNT13 TCNT12 TCNT11 TCNT10 TCNT9 TCNT8 TCNT7 TCNT6 TCNT5 TCNT4 TCNT3 TCNT2 0 TCNT1 0 TCNT0 0 TEN TSWAI TSFRZ TFFCA PRNT TOV7 TOV6 TOV5 TOV4 TOV3 TOV2 TOV1 TOV0 OM7 OL7 OM6 OL6 OM5 OL5 OM4 OL4 OM3 OL3 OM2 OL2 OM1 OL1 OM0 OL0 EDG7B EDG7A EDG6B EDG6A EDG5B EDG5A EDG4B EDG4A EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A C7I C6I 0 C5I 0 C4I 0 C3I C2I C1I C0I TOI TCRE PR2 PR1 PR0 = Unimplemented or Reserved Figure 20-5. TIM16B8CV3 Register Summary (Sheet 1 of 2) MC9S12G Family Reference Manual, Rev.1.01 636 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Register Name 0x000E TFLG11 0x000F TFLG2 0x0010–0x001F TCxH–TCxL3 R W R W R W R W 0x0020 2 PACTL 0x0021 2 PAFLG 0x0022 2 PACNTH 0x0023 2 PACNTL 0x0024–0x002B Reserved 0x002C OCPD1 0x002D Reserved R W R W Bit 7 C7F 6 C6F 0 5 C5F 0 4 C4F 0 3 C3F 0 2 C2F 0 1 C1F 0 Bit 0 C0F 0 TOF Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 0 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PAEN 0 PAMOD 0 PEDGE 0 CLK1 0 CLK0 0 PAOVI PAI 0 PAOVF PAIF R PACNT15 W R W R W R W R OCPD7 PACNT7 PACNT14 PACNT13 PACNT12 PACNT11 PACNT10 PACNT9 PACNT8 PACNT6 PACNT5 PACNT4 PACNT3 PACNT2 PACNT1 PACNT0 OCPD6 OCPD5 OCPD4 OCPD3 OCPD2 OCPD1 OCPD0 0x002E PTPSR 0x002F Reserved R W R W PTPS7 PTPS6 PTPS5 PTPS4 PTPS3 PTPS2 PTPS1 PTPS0 = Unimplemented or Reserved Figure 20-5. TIM16B8CV3 Register Summary (Sheet 2 of 2) 1 2 The related bit is available only if corresponding channel exists The register is available only if channel 7 exists. 3 The register is available only if corresponding channel exists. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 637 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2.1 R Timer Input Capture/Output Compare Select (TIOS) 7 6 5 4 3 2 1 0 IOS7 W Reset 0 IOS6 0 IOS5 0 IOS4 0 IOS3 0 IOS2 0 IOS1 0 IOS0 0 Figure 20-6. Timer Input Capture/Output Compare Select (TIOS) Read: Anytime Write: Anytime Table 20-2. TIOS Field Descriptions Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero. Field 7:0 IOS[7:0] Description Input Capture or Output Compare Channel Configuration 0 The corresponding implemented channel acts as an input capture. 1 The corresponding implemented channel acts as an output compare. 20.3.2.2 R W Reset Timer Compare Force Register (CFORC) 7 6 5 4 3 2 1 0 0 FOC7 0 0 FOC6 0 0 FOC5 0 0 FOC4 0 0 FOC3 0 0 FOC2 0 0 FOC1 0 0 FOC0 0 Figure 20-7. Timer Compare Force Register (CFORC) Read: Anytime but will always return 0x0000 (1 state is transient) Write: Anytime Table 20-3. CFORC Field Descriptions Note: Bits related to available channels have functional effect. Writing to unavailable bits has no effect. Read from unavailable bits return a zero. Field 7:0 FOC[7:0] Description Force Output Compare Action for Channel 7:0 — A write to this register with the corresponding data bit(s) set causes the action which is programmed for output compare “x” to occur immediately. The action taken is the same as if a successful comparison had just taken place with the TCx register except the interrupt flag does not get set. Note: A channel 7 event, which can be a counter overflow when TTOV[7] is set or a successful output compare on channel 7, overrides any channel 6:0 compares. If forced output compare on any channel occurs at the same time as the successful output compare then forced output compare action will take precedence and interrupt flag won’t get set. MC9S12G Family Reference Manual, Rev.1.01 638 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2.3 R Output Compare 7 Mask Register (OC7M) 7 6 5 4 3 2 1 0 OC7M7 W Reset 0 OC7M6 0 OC7M5 0 OC7M4 0 OC7M3 0 OC7M2 0 OC7M1 0 OC7M0 0 Figure 20-8. Output Compare 7 Mask Register (OC7M) 1 This register is available only when channel 7 exists and is reserved if that channel does not exist. Writes to a reserved register have no functional effect. Reads from a reserved register return zeroes. Read: Anytime Write: Anytime Table 20-4. OC7M Field Descriptions Field 7:0 OC7M[7:0] Description Output Compare 7 Mask — A channel 7 event, which can be a counter overflow when TTOV[7] is set or a successful output compare on channel 7, overrides any channel 6:0 compares. For each OC7M bit that is set, the output compare action reflects the corresponding OC7D bit. 0 The corresponding OC7Dx bit in the output compare 7 data register will not be transferred to the timer port on a channel 7 event, even if the corresponding pin is setup for output compare. 1 The corresponding OC7Dx bit in the output compare 7 data register will be transferred to the timer port on a channel 7 event. Note: The corresponding channel must also be setup for output compare (IOSx = 1 and OCPDx = 0) for data to be transferred from the output compare 7 data register to the timer port. 20.3.2.4 Output Compare 7 Data Register (OC7D) 7 6 5 4 3 2 1 0 R OC7D7 W Reset 0 0 0 0 0 0 0 0 OC7D6 OC7D5 OC7D4 OC7D3 OC7D2 OC7D1 OC7D0 Figure 20-9. Output Compare 7 Data Register (OC7D) 1 This register is available only when channel 7 exists and is reserved if that channel does not exist. Writes to a reserved register have no functional effect. Reads from a reserved register return zeroes. Read: Anytime Write: Anytime Table 20-5. OC7D Field Descriptions Field 7:0 OC7D[7:0] Description Output Compare 7 Data — A channel 7 event, which can be a counter overflow when TTOV[7] is set or a successful output compare on channel 7, can cause bits in the output compare 7 data register to transfer to the timer port data register depending on the output compare 7 mask register. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 639 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2.5 Timer Count Register (TCNT) 15 14 13 12 11 10 9 9 R TCNT15 W Reset 0 0 0 0 0 0 0 0 TCNT14 TCNT13 TCNT12 TCNT11 TCNT10 TCNT9 TCNT8 Figure 20-10. Timer Count Register High (TCNTH) 7 6 5 4 3 2 1 0 R TCNT7 W Reset 0 0 0 0 0 0 0 0 TCNT6 TCNT5 TCNT4 TCNT3 TCNT2 TCNT1 TCNT0 Figure 20-11. Timer Count Register Low (TCNTL) The 16-bit main timer is an up counter. A full access for the counter register should take place in one clock cycle. A separate read/write for high byte and low byte will give a different result than accessing them as a word. Read: Anytime Write: Has no meaning or effect in the normal mode; only writable in special modes (test_mode = 1). The period of the first count after a write to the TCNT registers may be a different size because the write is not synchronized with the prescaler clock. 20.3.2.6 Timer System Control Register 1 (TSCR1) 7 6 5 4 3 2 1 0 R TEN W Reset 0 0 0 0 0 TSWAI TSFRZ TFFCA PRNT 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-12. Timer System Control Register 1 (TSCR1) Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 640 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-6. TSCR1 Field Descriptions Field 7 TEN Description Timer Enable 0 Disables the main timer, including the counter. Can be used for reducing power consumption. 1 Allows the timer to function normally. If for any reason the timer is not active, there is no ÷64 clock for the pulse accumulator because the ÷64 is generated by the timer prescaler. Timer Module Stops While in Wait 0 Allows the timer module to continue running during wait. 1 Disables the timer module when the MCU is in the wait mode. Timer interrupts cannot be used to get the MCU out of wait. TSWAI also affects pulse accumulator. Timer Stops While in Freeze Mode 0 Allows the timer counter to continue running while in freeze mode. 1 Disables the timer counter whenever the MCU is in freeze mode. This is useful for emulation. TSFRZ does not stop the pulse accumulator. Timer Fast Flag Clear All 0 Allows the timer flag clearing to function normally. 1 For TFLG1(0x000E), a read from an input capture or a write to the output compare channel (0x0010–0x001F) causes the corresponding channel flag, CnF, to be cleared. For TFLG2 (0x000F), any access to the TCNT register (0x0004, 0x0005) clears the TOF flag. Any access to the PACNT registers (0x0022, 0x0023) clears the PAOVF and PAIF flags in the PAFLG register (0x0021) if channel 7 exists. This has the advantage of eliminating software overhead in a separate clear sequence. Extra care is required to avoid accidental flag clearing due to unintended accesses. Precision Timer 0 Enables legacy timer. PR0, PR1, and PR2 bits of the TSCR2 register are used for timer counter prescaler selection. 1 Enables precision timer. All bits of the PTPSR register are used for Precision Timer Prescaler Selection, and all bits. This bit is writable only once out of reset. 6 TSWAI 5 TSFRZ 4 TFFCA 3 PRNT 20.3.2.7 Timer Toggle On Overflow Register 1 (TTOV) 7 6 5 4 3 2 1 0 R TOV7 W Reset 0 0 0 0 0 0 0 0 TOV6 TOV5 TOV4 TOV3 TOV2 TOV1 TOV0 Figure 20-13. Timer Toggle On Overflow Register 1 (TTOV) Read: Anytime Write: Anytime MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 641 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-7. TTOV Field Descriptions Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero. Field 7:0 TOV[7:0] Description Toggle On Overflow Bits — TOVx toggles output compare pin on overflow. This feature only takes effect when in output compare mode. When set, it takes precedence over forced output compare but not channel 7 override events. 0 Toggle output compare pin on overflow feature disabled. 1 Toggle output compare pin on overflow feature enabled. 20.3.2.8 Timer Control Register 1/Timer Control Register 2 (TCTL1/TCTL2) 7 6 5 4 3 2 1 0 R OM7 W Reset 0 0 0 0 0 0 0 0 OL7 OM6 OL6 OM5 OL5 OM4 OL4 Figure 20-14. Timer Control Register 1 (TCTL1) 7 6 5 4 3 2 1 0 R OM3 W Reset 0 0 0 0 0 0 0 0 OL3 OM2 OL2 OM1 OL1 OM0 OL0 Figure 20-15. Timer Control Register 2 (TCTL2) Read: Anytime Write: Anytime Table 20-8. TCTL1/TCTL2 Field Descriptions Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero Field 7:0 OMx Description Output Mode — These eight pairs of control bits are encoded to specify the output action to be taken as a result of a successful OCx compare. When either OMx or OLx is 1, the pin associated with OCx becomes an output tied to OCx. Note: To enable output action by OMx bits on timer port, the corresponding bit in OC7M should be cleared. For an output line to be driven by an OCx the OCPDx must be cleared. Output Level — These eight pairs of control bits are encoded to specify the output action to be taken as a result of a successful OCx compare. When either OMx or OLx is 1, the pin associated with OCx becomes an output tied to OCx. Note: To enable output action by OLx bits on timer port, the corresponding bit in OC7M should be cleared. For an output line to be driven by an OCx the OCPDx must be cleared. 7:0 OLx MC9S12G Family Reference Manual, Rev.1.01 642 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-9. Compare Result Output Action OMx 0 0 1 1 OLx 0 1 0 1 Action No output compare action on the timer output signal Toggle OCx output line Clear OCx output line to zero Set OCx output line to one Note: To enable output action using the OM7 and OL7 bits on the timer port,the corresponding bit OC7M7 in the OC7M register must also be cleared. The settings for these bits can be seen inTable 20-10. Table 20-10. The OC7 and OCx event priority OC7M7=0 OC7Mx=1 TC7=TCx TC7>TCx IOCx=OC7Dx IOCx=OC7Dx IOC7=OM7/O +OMx/OLx L7 IOC7=OM7/O L7 OC7Mx=0 TC7=TCx TC7>TCx IOCx=OMx/OLx IOC7=OM7/OL7 OC7Mx=1 TC7=TCx TC7>TCx IOCx=OC7Dx IOCx=OC7Dx IOC7=OC7D7 +OMx/OLx IOC7=OC7D7 OC7M7=1 OC7Mx=0 TC7=TCx TC7>TCx IOCx=OMx/OLx IOC7=OC7D7 Note: in Table 20-10, the IOS7 and IOSx should be set to 1 IOSx is the register TIOS bit x, OC7Mx is the register OC7M bit x, TCx is timer Input Capture/Output Compare register, IOCx is channel x, OMx/OLx is the register TCTL1/TCTL2, OC7Dx is the register OC7D bit x. IOCx = OC7Dx+ OMx/OLx, means that both OC7 event and OCx event will change channel x value. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 643 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2.9 R Timer Control Register 3/Timer Control Register 4 (TCTL3 and TCTL4) 7 6 5 4 3 2 1 0 EDG7B W Reset 0 EDG7A 0 EDG6B 0 EDG6A 0 EDG5B 0 EDG5A 0 EDG4B 0 EDG4A 0 Figure 20-16. Timer Control Register 3 (TCTL3) 7 6 5 4 3 2 1 0 R EDG3B W Reset 0 0 0 0 0 0 0 0 EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A Figure 20-17. Timer Control Register 4 (TCTL4) Read: Anytime Write: Anytime. Table 20-11. TCTL3/TCTL4 Field Descriptions Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero. Field 7:0 EDGnB EDGnA Description Input Capture Edge Control — These eight pairs of control bits configure the input capture edge detector circuits. Table 20-12. Edge Detector Circuit Configuration EDGnB 0 0 1 1 EDGnA 0 1 0 1 Configuration Capture disabled Capture on rising edges only Capture on falling edges only Capture on any edge (rising or falling) 20.3.2.10 Timer Interrupt Enable Register (TIE) 7 6 5 4 3 2 1 0 R C7I W Reset 0 0 0 0 0 0 0 0 C6I C5I C4I C3I C2I C1I C0I Figure 20-18. Timer Interrupt Enable Register (TIE) MC9S12G Family Reference Manual, Rev.1.01 644 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Read: Anytime Write: Anytime. Table 20-13. TIE Field Descriptions Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero Field 7:0 C7I:C0I Description Input Capture/Output Compare “x” Interrupt Enable — The bits in TIE correspond bit-for-bit with the bits in the TFLG1 status register. If cleared, the corresponding flag is disabled from causing a hardware interrupt. If set, the corresponding flag is enabled to cause a interrupt. 20.3.2.11 Timer System Control Register 2 (TSCR2) 7 6 5 4 3 2 1 0 R TOI W Reset 0 0 0 0 TCRE PR2 0 PR1 0 PR0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-19. Timer System Control Register 2 (TSCR2) Read: Anytime Write: Anytime. Table 20-14. TSCR2 Field Descriptions Field 7 TOI 3 TCRE Description Timer Overflow Interrupt Enable 0 Interrupt inhibited. 1 Hardware interrupt requested when TOF flag set. Timer Counter Reset Enable — This bit allows the timer counter to be reset by a successful output compare 7 event. This mode of operation is similar to an up-counting modulus counter. 0 Counter reset inhibited and counter free runs. 1 Counter reset by a successful output compare 7. Note: If TC7 = 0x0000 and TCRE = 1, TCNT will stay at 0x0000 continuously. If TC7 = 0xFFFF and TCRE = 1, TOF will never be set when TCNT is reset from 0xFFFF to 0x0000. Note: TCRE=1 and TC7!=0, the TCNT cycle period will be TC7 x "prescaler counter width" + "1 Bus Clock", for a more detail explanation please refer to Section 20.4.3, “Output Compare Note: This bit and feature is available only when channel 7 exists. If channel 7 doesn’t exist, this bit is reserved. Writing to reserved bit has no effect. Read from reserved bit return a zero. Timer Prescaler Select — These three bits select the frequency of the timer prescaler clock derived from the Bus Clock as shown in Table 20-15. 2 PR[2:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 645 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-15. Timer Clock Selection PR2 0 0 0 0 1 1 1 1 PR1 0 0 1 1 0 0 1 1 PR0 0 1 0 1 0 1 0 1 Timer Clock Bus Clock / 1 Bus Clock / 2 Bus Clock / 4 Bus Clock / 8 Bus Clock / 16 Bus Clock / 32 Bus Clock / 64 Bus Clock / 128 NOTE The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. 20.3.2.12 Main Timer Interrupt Flag 1 (TFLG1) 7 6 5 4 3 2 1 0 R C7F W Reset 0 0 0 0 0 0 0 0 C6F C5F C4F C3F C2F C1F C0F Figure 20-20. Main Timer Interrupt Flag 1 (TFLG1) Read: Anytime Write: Used in the clearing mechanism (set bits cause corresponding bits to be cleared). Writing a zero will not affect current status of the bit. Table 20-16. TRLG1 Field Descriptions Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero. Field 7:0 C[7:0]F Description Input Capture/Output Compare Channel “x” Flag — These flags are set when an input capture or output compare event occurs. Clearing requires writing a one to the corresponding flag bit while TEN or PAEN is set to one. Note: When TFFCA bit in TSCR register is set, a read from an input capture or a write into an output compare channel (0x0010–0x001F) will cause the corresponding channel flag CxF to be cleared. MC9S12G Family Reference Manual, Rev.1.01 646 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2.13 Main Timer Interrupt Flag 2 (TFLG2) 7 6 5 4 3 2 1 0 R TOF W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Unimplemented or Reserved Figure 20-21. Main Timer Interrupt Flag 2 (TFLG2) TFLG2 indicates when interrupt conditions have occurred. To clear a bit in the flag register, write the bit to one while TEN bit of TSCR1 or PAEN bit of PACTL is set to one. Read: Anytime Write: Used in clearing mechanism (set bits cause corresponding bits to be cleared). Any access to TCNT will clear TFLG2 register if the TFFCA bit in TSCR register is set. Table 20-17. TRLG2 Field Descriptions Field 7 TOF Description Timer Overflow Flag — Set when 16-bit free-running timer overflows from 0xFFFF to 0x0000. Clearing this bit requires writing a one to bit 7 of TFLG2 register while the TEN bit of TSCR1 or PAEN bit of PACTL is set to one (See also TCRE control bit explanation.) 20.3.2.14 Timer Input Capture/Output Compare Registers High and Low 0–7 (TCxH and TCxL) 15 14 13 12 11 10 9 0 R Bit 15 W Reset 0 0 0 0 0 0 0 0 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Figure 20-22. Timer Input Capture/Output Compare Register x High (TCxH) 7 6 5 4 3 2 1 0 R Bit 7 W Reset 0 0 0 0 0 0 0 0 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Figure 20-23. Timer Input Capture/Output Compare Register x Low (TCxL) 1 This register is available only when the corresponding channel exists and is reserved if that channel does not exist. Writes to a reserved register have no functional effect. Reads from a reserved register return zeroes. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 647 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Depending on the TIOS bit for the corresponding channel, these registers are used to latch the value of the free-running counter when a defined transition is sensed by the corresponding input capture edge detector or to trigger an output action for output compare. Read: Anytime Write: Anytime for output compare function.Writes to these registers have no meaning or effect during input capture. All timer input capture/output compare registers are reset to 0x0000. NOTE Read/Write access in byte mode for high byte should takes place before low byte otherwise it will give a different result. 20.3.2.15 16-Bit Pulse Accumulator Control Register (PACTL) 7 6 5 4 3 2 1 0 R W Reset 0 PAEN 0 0 PAMOD 0 PEDGE 0 CLK1 0 CLK0 0 PAOVI 0 PAI 0 Unimplemented or Reserved Figure 20-24. 16-Bit Pulse Accumulator Control Register (PACTL) 1 This register is available only when channel 7 exists and is reserved if that channel does not exist. Writes to a reserved register have no functional effect. Reads from a reserved register return zeroes. Read: Any time Write: Any time When PAEN is set, the Pulse Accumulator counter is enabled.The Pulse Accumulator counter shares the input pin with IOC7. Table 20-18. PACTL Field Descriptions Field 6 PAEN Description Pulse Accumulator System Enable — PAEN is independent from TEN. With timer disabled, the pulse accumulator can function unless pulse accumulator is disabled. 0 16-Bit Pulse Accumulator system disabled. 1 Pulse Accumulator system enabled. Pulse Accumulator Mode — This bit is active only when the Pulse Accumulator is enabled (PAEN = 1). See Table 20-19. 0 Event counter mode. 1 Gated time accumulation mode. 5 PAMOD MC9S12G Family Reference Manual, Rev.1.01 648 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-18. PACTL Field Descriptions (continued) Field 4 PEDGE Description Pulse Accumulator Edge Control — This bit is active only when the Pulse Accumulator is enabled (PAEN = 1). For PAMOD bit = 0 (event counter mode). See Table 20-19. 0 Falling edges on IOC7 pin cause the count to be increased. 1 Rising edges on IOC7 pin cause the count to be increased. For PAMOD bit = 1 (gated time accumulation mode). 0 IOC7 input pin high enables M (bus clock) divided by 64 clock to Pulse Accumulator and the trailing falling edge on IOC7 sets the PAIF flag. 1 IOC7 input pin low enables M (bus clock) divided by 64 clock to Pulse Accumulator and the trailing rising edge on IOC7 sets the PAIF flag. Clock Select Bits — Refer to Table 20-20. Pulse Accumulator Overflow Interrupt Enable 0 Interrupt inhibited. 1 Interrupt requested if PAOVF is set. Pulse Accumulator Input Interrupt Enable 0 Interrupt inhibited. 1 Interrupt requested if PAIF is set. 3:2 CLK[1:0] 1 PAOVI 0 PAI Table 20-19. Pin Action PAMOD 0 0 1 1 PEDGE 0 1 0 1 Pin Action Falling edge Rising edge Div. by 64 clock enabled with pin high level Div. by 64 clock enabled with pin low level NOTE If the timer is not active (TEN = 0 in TSCR), there is no divide-by-64 because the ÷64 clock is generated by the timer prescaler. Table 20-20. Timer Clock Selection CLK1 0 0 1 1 CLK0 0 1 0 1 Timer Clock Use timer prescaler clock as timer counter clock Use PACLK as input to timer counter clock Use PACLK/256 as timer counter clock frequency Use PACLK/65536 as timer counter clock frequency For the description of PACLK please refer Figure 20-30. If the pulse accumulator is disabled (PAEN = 0), the prescaler clock from the timer is always used as an input clock to the timer counter. The change from one selected clock to the other happens immediately after these bits are written. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 649 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.3.2.16 Pulse Accumulator Flag Register (PAFLG) 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 PAOVF PAIF 0 0 0 0 0 0 0 0 Unimplemented or Reserved Figure 20-25. Pulse Accumulator Flag Register (PAFLG) 1 This register is available only when channel 7 exists and is reserved if that channel does not exist. Writes to a reserved register have no functional effect. Reads from a reserved register return zeroes. Read: Anytime Write: Anytime When the TFFCA bit in the TSCR register is set, any access to the PACNT register will clear all the flags in the PAFLG register. Timer module or Pulse Accumulator must stay enabled (TEN=1 or PAEN=1) while clearing these bits. Table 20-21. PAFLG Field Descriptions Field 1 PAOVF 0 PAIF Description Pulse Accumulator Overflow Flag — Set when the 16-bit pulse accumulator overflows from 0xFFFF to 0x0000. Clearing this bit requires writing a one to this bit in the PAFLG register while TEN bit of TSCR1 or PAEN bit of PACTL register is set to one. Pulse Accumulator Input edge Flag — Set when the selected edge is detected at the IOC7 input pin.In event mode the event edge triggers PAIF and in gated time accumulation mode the trailing edge of the gate signal at the IOC7 input pin triggers PAIF. Clearing this bit requires writing a one to this bit in the PAFLG register while TEN bit of TSCR1 or PAEN bit of PACTL register is set to one. Any access to the PACNT register will clear all the flags in this register when TFFCA bit in register TSCR(0x0006) is set. 20.3.2.17 Pulse Accumulators Count Registers (PACNT) 15 14 13 12 11 10 9 0 R PACNT15 W Reset 0 0 0 0 0 0 0 0 PACNT14 PACNT13 PACNT12 PACNT11 PACNT10 PACNT9 PACNT8 Figure 20-26. Pulse Accumulator Count Register High (PACNTH) MC9S12G Family Reference Manual, Rev.1.01 650 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 7 6 5 4 3 2 1 0 R PACNT7 W Reset 0 0 0 0 0 0 0 0 PACNT6 PACNT5 PACNT4 PACNT3 PACNT2 PACNT1 PACNT0 Figure 20-27. Pulse Accumulator Count Register Low (PACNTL) 1 This register is available only when channel 7 exists and is reserved if that channel does not exist. Writes to a reserved register have no functional effect. Reads from a reserved register return zeroes. Read: Anytime Write: Anytime These registers contain the number of active input edges on its input pin since the last reset. When PACNT overflows from 0xFFFF to 0x0000, the Interrupt flag PAOVF in PAFLG (0x0021) is set. Full count register access should take place in one clock cycle. A separate read/write for high byte and low byte will give a different result than accessing them as a word. NOTE Reading the pulse accumulator counter registers immediately after an active edge on the pulse accumulator input pin may miss the last count because the input has to be synchronized with the bus clock first. 20.3.2.18 Output Compare Pin Disconnect Register(OCPD) 7 6 5 4 3 2 1 0 R OCPD7 W Reset 0 0 0 0 0 0 0 0 OCPD6 OCPD5 OCPD4 OCPD3 OCPD2 OCPD1 OCPD0 Figure 20-28. Output Compare Pin Disconnect Register (OCPD) Read: Anytime Write: Anytime All bits reset to zero. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 651 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-22. OCPD Field Description Note: Bits related to available channels have functional significance. Writing to unavailable bits has no effect. Read from unavailable bits return a zero. Field Description Output Compare Pin Disconnect Bits 0 Enables the timer channel port. Output Compare action will occur on the channel pin. These bits do not affect the input capture or pulse accumulator functions 1 Disables the timer channel port. Output Compare action will not occur on the channel pin, but the output compare flag still become set. OCPD[7:0} 20.3.2.19 Precision Timer Prescaler Select Register (PTPSR) 7 6 5 4 3 2 1 0 R PTPS7 W Reset 0 0 0 0 0 0 0 0 PTPS6 PTPS5 PTPS4 PTPS3 PTPS2 PTPS1 PTPS0 Figure 20-29. Precision Timer Prescaler Select Register (PTPSR) Read: Anytime Write: Anytime All bits reset to zero. ... Table 20-23. PTPSR Field Descriptions Field 7:0 PTPS[7:0] Description Precision Timer Prescaler Select Bits — These eight bits specify the division rate of the main Timer prescaler. These are effective only when the PRNT bit of TSCR1 is set to 1. Table 20-24 shows some selection examples in this case. The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. The Prescaler can be calculated as follows depending on logical value of the PTPS[7:0] and PRNT bit: PRNT = 1 : Prescaler = PTPS[7:0] + 1 Table 20-24. Precision Timer Prescaler Selection Examples when PRNT = 1 PTPS7 0 0 0 PTPS6 0 0 0 PTPS5 0 0 0 PTPS4 0 0 0 PTPS3 0 0 0 PTPS2 0 0 0 PTPS1 0 0 1 PTPS0 0 1 0 Prescale Factor 1 2 3 MC9S12G Family Reference Manual, Rev.1.01 652 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) PTPS7 0 0 0 0 1 1 1 1 PTPS6 0 0 0 0 1 1 1 1 PTPS5 0 0 0 0 1 1 1 1 PTPS4 0 1 1 1 1 1 1 1 PTPS3 0 0 0 0 1 1 1 1 PTPS2 0 0 1 1 1 1 1 1 PTPS1 1 1 0 0 0 0 1 1 PTPS0 1 1 0 1 0 1 0 1 Prescale Factor 4 20 21 22 253 254 255 256 20.4 Functional Description This section provides a complete functional description of the timer TIM16B8CV3 block. Please refer to the detailed timer block diagram in Figure 20-30 as necessary. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 653 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) PTPSR[7:0] CLK[1:0] PRE-PRESCALER PACLK PACLK/256 PACLK/65536 PRNT MUX Bus Clock PR[2:1:0] channel 7 output compare TCRE CxI CxF CLEAR COUNTER TOF TE TOI PRESCALER 1 MUX 0 TCNT(hi):TCNT(lo) 16-BIT COUNTER INTERRUPT LOGIC TOF CHANNEL 0 16-BIT COMPARATOR TC0 EDG0A EDG0B EDGE DETECT C0F OM:OL0 TOV0 C0F CH. 0 CAPTURE IOC0 PIN LOGIC CH. 0COMPARE IOC0 PIN IOC0 C1F OM:OL1 TOV1 CH. 1 CAPTURE IOC1 PIN LOGIC CH. 1 COMPARE IOC1 PIN CHANNEL 1 16-BIT COMPARATOR TC1 EDG1A EDG1B EDGE DETECT C1F CHANNEL2 IOC1 CHANNEL7 16-BIT COMPARATOR TC7 EDG7A EDG7B EDGE DETECT C7F OM:OL7 TOV7 C7F CH.7 CAPTURE IOC7 PIN PA INPUT LOGIC CH. 7 COMPARE IOC7 PIN IOC7 PAOVF PACNT(hi):PACNT(lo) MUX PACLK PEDGE PAEN EDGE DETECT PACLK/65536 PACLK/256 INTERRUPT REQUEST PAOVI PAOVF 16-BIT COUNTER TEN INTERRUPT LOGIC PAI PAIF PAMOD PEDGE PAIF DIVIDE-BY-64 Bus Clock PAOVF PAOVI Maximum possible channels, scalable from 0 to 7. Pulse Accumulator is available only if channel 7 exists. Figure 20-30. Detailed Timer Block Diagram MC9S12G Family Reference Manual, Rev.1.01 654 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.4.1 Prescaler The prescaler divides the bus clock by 1, 2, 4, 8, 16, 32, 64 or 128. The prescaler select bits, PR[2:0], select the prescaler divisor. PR[2:0] are in timer system control register 2 (TSCR2). The prescaler divides the bus clock by a prescalar value. Prescaler select bits PR[2:0] of in timer system control register 2 (TSCR2) are set to define a prescalar value that generates a divide by 1, 2, 4, 8, 16, 32, 64 and 128 when the PRNT bit in TSCR1 is disabled. By enabling the PRNT bit of the TSCR1 register, the performance of the timer can be enhanced. In this case, it is possible to set additional prescaler settings for the main timer counter in the present timer by using PTPSR[7:0] bits of PTPSR register generating divide by 1, 2, 3, 4,....20, 21, 22, 23,......255, or 256. 20.4.2 Input Capture Clearing the I/O (input/output) select bit, IOSx, configures channel x as an input capture channel. The input capture function captures the time at which an external event occurs. When an active edge occurs on the pin of an input capture channel, the timer transfers the value in the timer counter into the timer channel registers, TCx. The minimum pulse width for the input capture input is greater than two bus clocks. An input capture on channel x sets the CxF flag. The CxI bit enables the CxF flag to generate interrupt requests. Timer module or Pulse Accumulator must stay enabled (TEN bit of TSCR1 or PAEN bit of PACTL register must be set to one) while clearing CxF (writing one to CxF). 20.4.3 Output Compare Setting the I/O select bit, IOSx, configures channel x when available as an output compare channel. The output compare function can generate a periodic pulse with a programmable polarity, duration, and frequency. When the timer counter reaches the value in the channel registers of an output compare channel, the timer can set, clear, or toggle the channel pin if the corresponding OCPDx bit is set to zero. An output compare on channel x sets the CxF flag. The CxI bit enables the CxF flag to generate interrupt requests. Timer module or Pulse Accumulator must stay enabled (TEN bit of TSCR1 or PAEN bit of PACTL register must be set to one) while clearing CxF (writing one to CxF). The output mode and level bits, OMx and OLx, select set, clear, toggle on output compare. Clearing both OMx and OLx results in no output compare action on the output compare channel pin. Setting a force output compare bit, FOCx, causes an output compare on channel x. A forced output compare does not set the channel flag. The following channel 7 feature is available only when channel 7 exists. A channel 7 event, which can be a counter overflow when TTOV[7] is set or a successful output compare on channel 7, overrides output compares on all other output compare channels. The output compare 7 mask register masks the bits in the output compare 7 data register. The timer counter reset enable bit, TCRE, enables channel 7 output compares to reset the timer counter. A channel 7 output compare can reset the timer counter even if the IOC7 pin is being used as the pulse accumulator input. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 655 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Writing to the timer port bit of an output compare pin does not affect the pin state. The value written is stored in an internal latch. When the pin becomes available for general-purpose output, the last value written to the bit appears at the pin. When TCRE is set and TC7 is not equal to 0, then TCNT will cycle from 0 to TC7. When TCNT reaches TC7 value, it will last only one bus cycle then reset to 0. Note: in Figure 20-31,if PR[2:0] is equal to 0, one prescaler counter equal to one bus clock Figure 20-31. The TCNT cycle diagram under TCRE=1 condition prescaler counter TC7 0 1 bus clock 1 ----TC7-1 TC7 0 TC7 event TC7 event 20.4.3.1 OC Channel Initialization The internal register whose output drives OCx can be programmed before the timer drives OCx. The desired state can be programmed to this internal register by writing a one to CFORCx bit with TIOSx, OCPDx and TEN bits set to one. Set OCx: Write a 1 to FOCx while TEN=1, IOSx=1, OMx=1, OLx=1 and OCPDx=1 Clear OCx: Write a 1 to FOCx while TEN=1, IOSx=1, OMx=1, OLx=0 and OCPDx=1 Setting OCPDx to zero allows the internal register to drive the programmed state to OCx. This allows a glitch free switch over of port from general purpose I/O to timer output once the OCPDx bit is set to zero. 20.4.4 Pulse Accumulator The following Pulse Accumulator feature is available only when channel 7 exists. The pulse accumulator (PACNT) is a 16-bit counter that can operate in two modes: Event counter mode — Counting edges of selected polarity on the pulse accumulator input pin, PAI. Gated time accumulation mode — Counting pulses from a divide-by-64 clock. The PAMOD bit selects the mode of operation. The minimum pulse width for the PAI input is greater than two bus clocks. MC9S12G Family Reference Manual, Rev.1.01 656 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) 20.4.5 Event Counter Mode Clearing the PAMOD bit configures the PACNT for event counter operation. An active edge on the IOC7 pin increments the pulse accumulator counter. The PEDGE bit selects falling edges or rising edges to increment the count. NOTE The PACNT input and timer channel 7 use the same pin IOC7. To use the IOC7, disconnect it from the output logic by clearing the channel 7 output mode and output level bits, OM7 and OL7. Also clear the channel 7 output compare 7 mask bit, OC7M7. The Pulse Accumulator counter register reflect the number of active input edges on the PACNT input pin since the last reset. The PAOVF bit is set when the accumulator rolls over from 0xFFFF to 0x0000. The pulse accumulator overflow interrupt enable bit, PAOVI, enables the PAOVF flag to generate interrupt requests. NOTE The pulse accumulator counter can operate in event counter mode even when the timer enable bit, TEN, is clear. 20.4.6 Gated Time Accumulation Mode Setting the PAMOD bit configures the pulse accumulator for gated time accumulation operation. An active level on the PACNT input pin enables a divided-by-64 clock to drive the pulse accumulator. The PEDGE bit selects low levels or high levels to enable the divided-by-64 clock. The trailing edge of the active level at the IOC7 pin sets the PAIF. The PAI bit enables the PAIF flag to generate interrupt requests. The pulse accumulator counter register reflect the number of pulses from the divided-by-64 clock since the last reset. NOTE The timer prescaler generates the divided-by-64 clock. If the timer is not active, there is no divided-by-64 clock. 20.5 Resets The reset state of each individual bit is listed within Section 20.3, “Memory Map and Register Definition” which details the registers and their bit fields. 20.6 Interrupts This section describes interrupts originated by the TIM16B8CV3 block. Table 20-25 lists the interrupts generated by the TIM16B8CV3 to communicate with the MCU. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 657 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Timer Module (TIM16B8CV3) Table 20-25. TIM16B8CV1 Interrupts Interrupt C[7:0]F3 PAOVI 2 Offset1 — — — — Vector1 — — — — Priority1 — — — — Source Timer Channel 7–0 Pulse Accumulator Input Pulse Accumulator Overflow Timer Overflow Description Active high timer channel interrupts 7–0 Active high pulse accumulator input interrupt Pulse accumulator overflow interrupt Timer Overflow interrupt PAOVF2 TOF 1 2 Chip Dependent. This feature is available only when channel 7 exists. 3 Bits related to available channels have functional significance The TIM16B8CV3 could use up to 11 interrupt vectors. The interrupt vector offsets and interrupt numbers are chip dependent. 20.6.1 Channel [7:0] Interrupt (C[7:0]F) This active high outputs will be asserted by the module to request a timer channel 7 – 0 interrupt. The TIM block only generates the interrupt and does not service it. Only bits related to implemented channels are valid. 20.6.2 Pulse Accumulator Input Interrupt (PAOVI) This interrupt is available only when channel 7 exists. This active high output will be asserted by the module to request a timer pulse accumulator input interrupt. The TIM block only generates the interrupt and does not service it. 20.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) This interrupt is available only when channel 7 exists. This active high output will be asserted by the module to request a timer pulse accumulator overflow interrupt. The TIM block only generates the interrupt and does not service it. 20.6.4 Timer Overflow Interrupt (TOF) This active high output will be asserted by the module to request a timer overflow interrupt. The TIM block only generates the interrupt and does not service it. MC9S12G Family Reference Manual, Rev.1.01 658 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 21 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-1. Revision History Revision Number V01.04 Revision Date 17 Jun 2010 Sections Affected Description of Changes 21.4.6.1/21-689 Clarify Erase Verify Commands Descriptions related to the bits MGSTAT[1:0] 21.4.6.2/21-690 of the register FSTAT. 21.4.6.3/21-690 21.4.6.14/21-70 0 21.4.6.2/21-690 Updated description of the commands RD1BLK, MLOADU and MLOADF 21.4.6.12/21-69 7 21.4.6.13/21-69 9 21.3.2.9/21-675 Updated description of protection on Section 21.3.2.9 V01.05 20 aug 2010 Rev.1.01 31 Jan 2011 21.1 Introduction The FTMRG16K1 module implements the following: • 16Kbytes of P-Flash (Program Flash) memory • 512 bytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 659 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 21.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 21.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 21.1.2 21.1.2.1 • Features P-Flash Features 16 Kbytes of P-Flash memory composed of one 16 Kbyte Flash block divided into 32 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 660 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 21.1.2.2 • • • • • • EEPROM Features 512 bytes of EEPROM memory composed of one 512 byte Flash block divided into 128 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 21.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 21.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 21-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 661 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 4Kx39 sector 0 sector 1 sector 31 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 256x22 sector 0 sector 1 sector 127 Figure 21-1. FTMRG16K1 Block Diagram 21.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 662 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 21.6 for a complete description of the reset sequence). . Table 21-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_05FF 0x0_0600 – 0x0_07FF 0x0_4000 – 0x0_7FFF 0x3_8000 – 0x3_BFFF 0x3_C000 – 0x3_FFFF 1 Size (Bytes) 1,024 512 512 16,284 16,384 16,384 Register Space EEPROM Memory FTMRG reserved area Description NVMRES1=1 : NVM Resource area (see Figure 21-3) FTMRG reserved area P-Flash Memory See NVMRES description in Section 21.4.3 21.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x3_C000 and 0x3_FFFF as shown in Table 21-3.The P-Flash memory map is shown in Figure 21-2. Table 21-3. P-Flash Memory Addressing Global Address Size (Bytes) 16 K Description P-Flash Block Contains Flash Configuration Field (see Table 21-4) 0x3_C000 – 0x3_FFFF MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 663 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) The FPROT register, described in Section 21.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Two separate memory regions, one growing downward from global address 0x3_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 21-4. Table 21-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 21.4.6.11, “Verify Backdoor Access Key Command,” and Section 21.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 21.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 21.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 21.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 21.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. P-Flash START = 0x3_C000 Protection Movable End 0x3_E000 Protection Fixed End Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 21-2. P-Flash Memory Map MC9S12G Family Reference Manual, Rev.1.01 664 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 174 2 8 64 Reserved Reserved Version ID1 Reserved Field Description Program Once Field Refer to Section 21.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 21.4.2 Table 21-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_59FF 0x0_5A00 – 0x0_5FFF 0x0_6000 – 0x0_6BFF 0x0_6C00 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 21-5) Reserved. Reserved 512 1,536 3,072 5,120 Reserved Reserved Reserved Reserved Description NVMRES - See Section 21.4.3 for NVMRES (NVM Resource) detail. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 665 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 0x0_4000 P-Flash IFR 1 Kbyte (NVMRES=1) 0x0_4400 RAM Start = 0x0_5800 RAM End = 0x0_59FF Reserved 5k bytes Reserved 512 bytes Reserved 4608 bytes 0x0_6C00 Reserved 5120 bytes 0x0_7FFF Figure 21-3. Memory Controller Resource Memory Map (NVMRES=1) 21.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 21.3). A summary of the Flash module registers is given in Figure 21-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX R W R W R W 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 21-4. FTMRG16K1 Register Summary MC9S12G Family Reference Manual, Rev.1.01 666 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Address & Name 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT R W R 7 0 6 0 5 0 4 0 3 0 2 0 1 0 0 0 0 CCIE 0 IGNSF 0 0 FDFD FSFD W R W R CCIF W R W R FPOPEN W R DPOPEN W R CCOB15 W R CCOB7 W R W R W R W R W R W NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 0 0 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 RNV2 RNV1 RNV0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE Figure 21-4. FTMRG16K1 Register Summary (continued) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 667 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Address & Name 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R W R W R W 7 0 6 0 5 0 4 0 3 0 2 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-4. FTMRG16K1 Register Summary (continued) 21.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 21-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 21-7. FCLKDIV Field Descriptions Field 7 FDIVLD Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset MC9S12G Family Reference Manual, Rev.1.01 668 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-7. FCLKDIV Field Descriptions (continued) Field 6 FDIVLCK Description Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 21-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 21.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] Table 21-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 2 MAX 2 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 10.6 11.6 12.6 13.6 14.6 15.6 16.6 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. 21.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 669 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 21-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 21-4) as indicated by reset condition F in Figure 21-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 21-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 21-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 21-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 21-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. Table 21-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. MC9S12G Family Reference Manual, Rev.1.01 670 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) The security function in the Flash module is described in Section 21.5. 21.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 21-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 21.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 21.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 21.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 671 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 21-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 21.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 21.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 21.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 21.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 21.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 21.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 21.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. MC9S12G Family Reference Manual, Rev.1.01 672 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 21-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 21.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 21.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 21.3.2.8) 0 SFDIE 21.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 21-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 21.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 673 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 21.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 21.4.6, “Flash Command Description,” and Section 21.6, “Initialization” for details. 21.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. MC9S12G Family Reference Manual, Rev.1.01 674 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. 21.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 F1 RNV[2:0] F1 F1 = Unimplemented or Reserved Figure 21-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased. While the RNV[2:0] bits are writable, they should be left in an erased state. During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 21-4) as indicated by reset condition ‘F’ in Figure 21-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 675 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 21-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 21-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS bit defines an unprotected address range as specified by the FPHS bits 1 When FPOPEN is set, the FPHDIS bit enables protection for the address range specified by the FPHS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 21-19. The FPHS bits can only be written to while the FPHDIS bit is set. Reserved Nonvolatile Bits — These RNV bits should remain in the erased state. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2–0 RNV[2:0] Table 21-18. P-Flash Protection Function FPOPEN 1 1 0 0 1 FPHDIS 1 0 1 0 Function1 No P-Flash Protection Protected High Range Full P-Flash Memory Protected Unprotected High Range For range sizes, refer to Table 21-19. Table 21-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 676 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 0 0 DPS[4:0] 0 0 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 21-14. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in P-Flash memory (see Table 21-4) as indicated by reset condition F in Table 21-21. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 21-20. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[4:0] bits determine the size of the protected area in the EEPROM memory as shown inTable 21-21 . 4–0 DPS[4:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 677 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-21. EEPROM Protection Address Range DPS[4:0] 00000 00001 00010 00011 00100 00101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 01111 - to - 11111 0x0_0400 – 0x0_05FF 512 bytes 21.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 21-15. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 21-16. Flash Common Command Object Low Register (FCCOBLO) 21.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates MC9S12G Family Reference Manual, Rev.1.01 678 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 21-22. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 21-22 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 21.4.6. Table 21-22. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO HI 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Global address [7:0] Data 0 [15:8] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command 21.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-17. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 679 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-18. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 21.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-19. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 21.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-20. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 680 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 21-21. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 21-4) as indicated by reset condition F in Figure 21-21. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 21-23. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 21.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-22. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 21.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 681 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-23. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 21.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 21-24. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 682 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4 21.4.1 Functional Description Modes of Operation The FTMRG16K1 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 21-25). 21.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 21-24. Table 21-24. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. 21.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 21-5. The NVMRES global address map is shown in Table 21-6. 21.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 21.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 21-8 shows recommended values for the FDIV field based on BUSCLK frequency. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 683 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 21.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 21.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. 21.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 21.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 21-25. MC9S12G Family Reference Manual, Rev.1.01 684 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 21-25. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 685 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4.4.3 Valid Flash Module Commands Table 21-25 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 21-25. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 21.4.4.4 P-Flash Commands Table 21-26 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 21-26. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 686 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-26. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 21.4.4.5 EEPROM Commands Table 21-27 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 21-27. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 687 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-27. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 21.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 21-28 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 21-28. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 21.4.6.12 and Section 21.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 688 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 21.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 21.4.6.1 Erase Verify All Blocks Command Table 21-29. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 21-30. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the read1or if blank check failed . Set if any non-correctable errors have been encountered during the read or if blank check failed. As found in the memory map for FTMRG32K1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 689 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0] bits determine which block must be verified. Table 21-31. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 21-32 See Table 21-32. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM Invalid (ACCERR) Invalid (ACCERR) P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 21-33. Erase Verify Block Command Error Handling Register Error Bit ACCERR FPVIOL MGSTAT1 MGSTAT0 1 2 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if an invalid FlashBlockSelectionCode[1:0] is supplied1 None Set if any errors have been encountered during the read2 or if blank check failed. Set if any non-correctable errors have been encountered during the read2 or if blank check failed. FSTAT As defined by the memory map for FTMRG32K1. As found in the memory map for FTMRG32K1. 21.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 690 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-34. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 21-35. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:0] is supplied see Table 21-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 2 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read2 or if blank check failed. Set if any non-correctable errors have been encountered during the read2 or if blank check failed. As defined by the memory map for FTMRG32K1. As found in the memory map for FTMRG32K1. 21.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 21.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 21-36. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 691 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-36. Read Once Command FCCOB Requirements CCOBIX[2:0] 101 FCCOB Parameters Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 21-37. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 21-25) Set if an invalid phrase index is supplied 21.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 21-38. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 692 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-39. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:0] is supplied see Table 21-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 1 FSTAT Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMRG32K1. 21.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 21.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 21-40. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 693 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-41. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 21.4.6.7 Erase All Blocks Command Table 21-42. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 21-43. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 21-25) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation1 Set if any non-correctable errors have been encountered during the verify operation1 As found in the memory map for FTMRG32K1. 21.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 694 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-44. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 21-45. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:16] is supplied1 Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 1 2 FSTAT Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation2 Set if any non-correctable errors have been encountered during the verify operation2 As defined by the memory map for FTMRG32K1. As found in the memory map for FTMRG32K1. 21.4.6.9 Erase P-Flash Sector Command Table 21-46. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 21.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 695 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-47. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:16] is supplied see Table 21-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 1 FSTAT Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMRG32K1. 21.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 21-48. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 21-49. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 21-25) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation1 Set if any non-correctable errors have been encountered during the verify operation1 As found in the memory map for FTMRG32K1. MC9S12G Family Reference Manual, Rev.1.01 696 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 21-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 21-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 21-50. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 21-51. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 21.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 21.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 697 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-52. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 21-32 See Margin level setting. Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 21-53. Table 21-53. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 21-54. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 21-32 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None MC9S12G Family Reference Manual, Rev.1.01 698 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 21.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the Table 21-55. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 21-32 See Margin level setting. field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 21-56. Table 21-56. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 699 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-57. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 21-25) ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 21-32 )1 Set if an invalid margin level setting is supplied None None None As defined by the memory map for FTMRG32K1. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 21.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 21-58. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. MC9S12G Family Reference Manual, Rev.1.01 700 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-59. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 21.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 21-60. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 701 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) Table 21-61. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 21.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. Table 21-62. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 21.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 21-63. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 21-25) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 21-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation MC9S12G Family Reference Manual, Rev.1.01 702 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 21-64. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 21.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 21.3.2.5, “Flash Configuration Register (FCNFG)”, Section 21.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 21.3.2.7, “Flash Status Register (FSTAT)”, and Section 21.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 21-26. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 21-26. Flash Module Interrupts Implementation MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 703 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 21.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 21.4.7, “Interrupts”). 21.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. 21.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 21-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 21.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 21.3.2.2), the Verify Backdoor Access Key command (see Section 21.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 21-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 704 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 21.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 21.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 21.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 705 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 16 KByte Flash Module (S12FTMRG16K1V1) 8. Reset the MCU 21.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 21-25. 21.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 706 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 22 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-1. Revision History Revision Number V01.04 Revision Date 17 Jun 2010 Sections Affected Description of Changes 22.4.6.1/22-740 Clarify Erase Verify Commands Descriptions related to the bits MGSTAT[1:0] 22.4.6.2/22-741 of the register FSTAT. 22.4.6.3/22-741 22.4.6.14/22-75 1 22.4.6.2/22-741 Updated description of the commands RD1BLK, MLOADU and MLOADF 22.4.6.12/22-74 8 22.4.6.13/22-75 0 22.3.2.9/22-723 Updated description of protection on Section 22.3.2.9 V01.05 20 aug 2010 Rev.1.01 31 Jan 2011 22.1 Introduction The FTMRG32K1 module implements the following: • 32Kbytes of P-Flash (Program Flash) memory • 1 Kbytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 707 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 22.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 22.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 22.1.2 22.1.2.1 • Features P-Flash Features 32 Kbytes of P-Flash memory composed of one 32 Kbyte Flash block divided into 64 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 708 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 22.1.2.2 • • • • • • EEPROM Features 1 Kbyte of EEPROM memory composed of one 1 Kbyte Flash block divided into 256 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 22.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 22.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 22-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 709 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 8Kx39 sector 0 sector 1 sector 63 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 512x22 sector 0 sector 1 sector 255 Figure 22-1. FTMRG32K1 Block Diagram 22.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 710 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 22.6 for a complete description of the reset sequence). . Table 22-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_07FF 0x0_4000 – 0x0_7FFF 0x3_8000 – 0x3_FFFF 1 Size (Bytes) 1,024 1,024 16,284 32,768 Register Space EEPROM Memory Description NVMRES1=1 : NVM Resource area (see Figure 22-3) P-Flash Memory See NVMRES description in Section 22.4.3 22.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x3_8000 and 0x3_FFFF as shown in Table 22-3.The P-Flash memory map is shown in Figure 22-2. Table 22-3. P-Flash Memory Addressing Global Address Size (Bytes) 32 K Description P-Flash Block Contains Flash Configuration Field (see Table 22-4) 0x3_8000 – 0x3_FFFF MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 711 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) The FPROT register, described in Section 22.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x3_8000 in the Flash memory (called the lower region), one growing downward from global address 0x3_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 22-4. Table 22-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 22.4.6.11, “Verify Backdoor Access Key Command,” and Section 22.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 22.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 22.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 22.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 22.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 712 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) P-Flash START = 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x3_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 22-2. P-Flash Memory Map Table 22-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 174 2 8 64 Reserved Reserved Version ID1 Reserved Field Description Program Once Field Refer to Section 22.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 22.4.2 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 713 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_59FF 0x0_5A00 – 0x0_5FFF 0x0_6000 – 0x0_6BFF 0x0_6C00 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 22-5) Reserved. Reserved 512 1,536 3,072 5,120 Reserved Reserved Reserved Reserved Description NVMRES - See Section 22.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 P-Flash IFR 1 Kbyte (NVMRES=1) 0x0_4400 RAM Start = 0x0_5800 RAM End = 0x0_59FF Reserved 5k bytes Reserved 512 bytes Reserved 4608 bytes 0x0_6C00 Reserved 5120 bytes 0x0_7FFF Figure 22-3. Memory Controller Resource Memory Map (NVMRES=1) 22.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 22.3). MC9S12G Family Reference Manual, Rev.1.01 714 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) A summary of the Flash module registers is given in Figure 22-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W R CCOB15 W R CCOB7 W R W 0 0 0 0 0 0 0 0 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 0 0 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 22-4. FTMRG32K1 Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 715 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Address & Name 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R W R W R W R W R W R W R W 7 0 6 0 5 0 4 0 3 0 2 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-4. FTMRG32K1 Register Summary (continued) 22.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 22-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. MC9S12G Family Reference Manual, Rev.1.01 716 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 22-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 22-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 22.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] Table 22-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX2 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 717 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 22-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 22-4) as indicated by reset condition F in Figure 22-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 22-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 22-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 22-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 22-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. MC9S12G Family Reference Manual, Rev.1.01 718 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 22.5. 22.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 22-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 22.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 22.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 719 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 22-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 22.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 22.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 22.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 22.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 22.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 22.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 22.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. MC9S12G Family Reference Manual, Rev.1.01 720 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 22-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 22.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 22.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 22.3.2.8) 0 SFDIE 22.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 22-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 22.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 721 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 22.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 22.4.6, “Flash Command Description,” and Section 22.6, “Initialization” for details. 22.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. MC9S12G Family Reference Manual, Rev.1.01 722 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. 22.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 22-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 22.3.2.9.1, “P-Flash Protection Restrictions,” and Table 22-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 22-4) as indicated by reset condition ‘F’ in Figure 22-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 723 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 22-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 22-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 22-19. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 22-20. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] Table 22-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 22-19 and Table 22-20. MC9S12G Family Reference Manual, Rev.1.01 724 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 22-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 22-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 725 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 22-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 726 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 32 KByte Flash Module (S12FTMRG32K1V1) 22.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 22-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 22-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 22-14 for a definition of the scenarios. 22.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 0 0 DPS[4:0] 0 0 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 22-15. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 727 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in P-Flash memory (see Table 22-4) as indicated by reset condition F in Table 22-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 22-22. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[4:0] bits determine the size of the protected area in the EEPROM memory as shown inTable 22-23 . 4–0 DPS[4:0] Table 22-23. EEPROM Protection Address Range DPS[4:0] 00000 00001 00010 00011 00100 00101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 11111 - to - 11111 0x0_0400 – 0x0_07FF 1,024 bytes MC9S12G Family Reference Manual, Rev.1.01 728 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 22-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 22-17. Flash Common Command Object Low Register (FCCOBLO) 22.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 22-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 22-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 22.4.6. Table 22-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 729 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 22.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 22.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 22.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 730 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 22.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 22.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 22-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 22-4) as indicated by reset condition F in Figure 22-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 731 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 22.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 22.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 22.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 732 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 22-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 22.4 22.4.1 Functional Description Modes of Operation The FTMRG32K1 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 22-27). 22.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 22-26. Table 22-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 733 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 22-5. The NVMRES global address map is shown in Table 22-6. 22.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 22.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 22-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 22.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 22.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 734 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 22.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 22-26. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 735 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 22-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 736 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.4.3 Valid Flash Module Commands Table 22-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 22-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 22.4.4.4 P-Flash Commands Table 22-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 22-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 737 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 22.4.4.5 EEPROM Commands Table 22-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 22-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 738 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 22.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 22-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 22-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 22.4.6.12 and Section 22.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 739 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 22.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 22.4.6.1 Erase Verify All Blocks Command Table 22-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 22-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the read1or if blank check failed . Set if any non-correctable errors have been encountered during the read1 or if blank check failed. As found in the memory map for FTMRG32K1. MC9S12G Family Reference Manual, Rev.1.01 740 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0] bits determine which block must be verified. Table 22-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 22-34 See Table 22-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM Invalid (ACCERR) Invalid (ACCERR) P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 22-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. Error Condition Set if CCOBIX[2:0] != 000 at command launch 22.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 741 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 22-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 22-3) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 22.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 22.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 22-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value MC9S12G Family Reference Manual, Rev.1.01 742 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 22-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 22-27) Set if an invalid phrase index is supplied 22.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 22-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 743 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 22-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 22.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 22.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 22-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 744 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 22.4.6.7 Erase All Blocks Command Table 22-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 22-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 22-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation1 Set if any non-correctable errors have been encountered during the verify operation As found in the memory map for FTMRG32K1. 22.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 745 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 22-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:16] is supplied Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT 22.4.6.9 Erase P-Flash Sector Command Table 22-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 22.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 746 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:16] is supplied see Table 22-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 1 FSTAT Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMRG32K1. 22.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 22-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 22-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 22-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 22.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 22-10). The Verify Backdoor Access Key command releases security if MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 747 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 22-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 22-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 22-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 22.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 22.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. Table 22-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 22-34 See Margin level setting. MC9S12G Family Reference Manual, Rev.1.01 748 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 22-55. Table 22-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 22-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 22-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 749 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the Table 22-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 22-34 See Margin level setting. field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 22-58. Table 22-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state MC9S12G Family Reference Manual, Rev.1.01 750 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 22-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 22.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 22-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 751 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 22.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 22-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. MC9S12G Family Reference Manual, Rev.1.01 752 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) Table 22-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 22.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. Table 22-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 22.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 22-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 22-27) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 22-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 753 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 22-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 22.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 22.3.2.5, “Flash Configuration Register (FCNFG)”, Section 22.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 22.3.2.7, “Flash Status Register (FSTAT)”, and Section 22.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 22-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 22-27. Flash Module Interrupts Implementation MC9S12G Family Reference Manual, Rev.1.01 754 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 22.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 22.4.7, “Interrupts”). 22.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. 22.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 22-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 22.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 22.3.2.2), the Verify Backdoor Access Key command (see Section 22.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 22-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 755 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 22.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 22.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 22.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state MC9S12G Family Reference Manual, Rev.1.01 756 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) 8. Reset the MCU 22.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 22-27. 22.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 757 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 32 KByte Flash Module (S12FTMRG32K1V1) MC9S12G Family Reference Manual, Rev.1.01 758 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 23 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-1. Revision History Revision Number V01.04 Revision Date 17 Jun 2010 Sections Affected Description of Changes 23.4.6.1/23-793 Clarify Erase Verify Commands Descriptions related to the bits MGSTAT[1:0] 23.4.6.2/23-794 of the register FSTAT. 23.4.6.3/23-794 23.4.6.14/23-80 4 23.4.6.2/23-794 Updated description of the commands RD1BLK, MLOADU and MLOADF 23.4.6.12/23-80 1 23.4.6.13/23-80 3 23.3.2.9/23-776 Updated description of protection on Section 23.3.2.9 V01.05 20 aug 2010 Rev.1.01 31 Jan 2011 23.1 Introduction The FTMRG48K1 module implements the following: • 48Kbytes of P-Flash (Program Flash) memory • 1,536bytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 759 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 23.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 23.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 23.1.2 23.1.2.1 • Features P-Flash Features 48 Kbytes of P-Flash memory composed of one 48 Kbyte Flash block divided into 96 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 760 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 23.1.2.2 • • • • • • EEPROM Features 1.5Kbytes of EEPROM memory composed of one 1.5Kbyte Flash block divided into 384 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 23.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 761 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.1.3 Block Diagram Figure 23-1. FTMRG48K1 Block Diagram The block diagram of the Flash module is shown in Figure 23-1. Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 12Kx39 sector 0 sector 1 sector 95 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 768x22 sector 0 sector 1 sector 383 23.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 762 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 23.6 for a complete description of the reset sequence). . Table 23-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_09FF 0x0_0A00 – 0x0_0BFF 0x0_4000 – 0x0_7FFF 0x3_0000 – 0x3_3FFF 0x3_4000 – 0x3_FFFF 1 Size (Bytes) 1,024 1,536 512 16,284 16,384 49,152 Register Space EEPROM Memory FTMRG reserved area Description NVMRES1=1 : NVM Resource area (see Figure 23-3) FTMRG reserved area P-Flash Memory See NVMRES description in Section 23.4.3 23.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x3_4000 and 0x3_FFFF as shown in Table 23-3 .The P-Flash memory map is shown in Figure 23-2. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 763 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-3. P-Flash Memory Addressing Global Address Size (Bytes) 48 K Description P-Flash Block Contains Flash Configuration Field (see Table 23-4). 0x3_4000 – 0x3_FFFF The FPROT register, described in Section 23.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 23-4. MC9S12G Family Reference Manual, Rev.1.01 764 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 23.4.6.11, “Verify Backdoor Access Key Command,” and Section 23.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 23.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 23.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 23.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 23.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 765 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Figure 23-2. P-Flash Memory Map P-Flash START = 0x3_4000 Flash Protected/Unprotected Region 16 Kbytes 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End 0x3_E000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Table 23-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 174 2 8 64 Reserved Reserved Version ID1 Reserved Field Description Program Once Field Refer to Section 23.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 23.4.2 MC9S12G Family Reference Manual, Rev.1.01 766 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_59FF 0x0_5A00 – 0x0_5FFF 0x0_6000 – 0x0_6BFF 0x0_6C00 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 23-5) Reserved. Reserved 512 1,536 3,072 5,120 Reserved Reserved Reserved Reserved Description NVMRES - See Section 23.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 P-Flash IFR 1 Kbyte (NVMRES=1) 0x0_4400 RAM Start = 0x0_5800 RAM End = 0x0_59FF Reserved 5k bytes Reserved 512 bytes Reserved 4608 bytes 0x0_6C00 Reserved 5120 bytes 0x0_7FFF Figure 23-3. Memory Controller Resource Memory Map (NVMRES=1) 23.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 23.3). MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 767 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) A summary of the Flash module registers is given in Figure 23-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W R CCOB15 W R CCOB7 W R W 0 0 0 0 0 0 0 0 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 0 DPS5 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 23-4. FTMRG48K1 Register Summary MC9S12G Family Reference Manual, Rev.1.01 768 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Address & Name 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R W R W R W R W R W R W R W 7 0 6 0 5 0 4 0 3 0 2 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-4. FTMRG48K1 Register Summary (continued) 23.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 23-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 769 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 23-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 23-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 23.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] Table 23-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX2 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. MC9S12G Family Reference Manual, Rev.1.01 770 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 23-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 23-4) as indicated by reset condition F in Figure 23-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 23-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 23-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 23-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 23-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 771 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 23.5. 23.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 23-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 23.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 23.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 772 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 23-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 23.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 23.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 23.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 23.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 23.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 23.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 23.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 773 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 23-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 23.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 23.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 23.3.2.8) 0 SFDIE 23.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 23-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 23.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 774 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 23.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 23.4.6, “Flash Command Description,” and Section 23.6, “Initialization” for details. 23.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 775 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. 23.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 23-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 23.3.2.9.1, “P-Flash Protection Restrictions,” and Table 23-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 23-4) as indicated by reset condition ‘F’ in Figure 23-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. MC9S12G Family Reference Manual, Rev.1.01 776 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 23-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 23-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 23-19. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 23-20. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] Table 23-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 23-19 and Table 23-20. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 777 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 23-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 23-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 778 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 23-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 779 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 48 KByte Flash Module (S12FTMRG48K1V1) 23.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 23-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 23-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 23-14 for a definition of the scenarios. 23.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 0 DPS[5:0] 0 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 23-15. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. MC9S12G Family Reference Manual, Rev.1.01 780 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in P-Flash memory (see Table 23-4) as indicated by reset condition F in Table 23-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 23-22. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[5:0] bits determine the size of the protected area in the EEPROM memory as shown in Table 23-23 . 5–0 DPS[5:0] Table 23-23. EEPROM Protection Address Range DPS[5:0] 000000 000001 000010 000011 000100 000101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 101111 - to - 111111 0x0_0400 – 0x0_09FF 1,536 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 781 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 23-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 23-17. Flash Common Command Object Low Register (FCCOBLO) 23.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 23-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 23-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 23.4.6. Table 23-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 782 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 23.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 23.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 23.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 783 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 23.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 23.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 23-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 23-4) as indicated by reset condition F in Figure 23-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 784 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 23.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 23.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 23.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 785 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 23-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 23.4 23.4.1 Functional Description Modes of Operation The FTMRG48K1 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 23-27). 23.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 23-26. Table 23-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 786 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 23-5. The NVMRES global address map is shown in Table 23-6. 23.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 23.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 23-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 23.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 23.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 787 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 23.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 23-26. MC9S12G Family Reference Manual, Rev.1.01 788 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 23-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 789 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.4.3 Valid Flash Module Commands Table 23-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 23-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 23.4.4.4 P-Flash Commands Table 23-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 23-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 790 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 23.4.4.5 EEPROM Commands Table 23-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 23-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 791 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 23.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 23-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 23-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 23.4.6.12 and Section 23.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 792 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 23.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 23.4.6.1 Erase Verify All Blocks Command Table 23-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 23-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the reador if blank check failed . Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 793 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0] bits determine which block must be verified. Table 23-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 23-34 See Table 23-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM Invalid (ACCERR) Invalid (ACCERR) P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 23-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. Error Condition Set if CCOBIX[2:0] != 000 at command launch 23.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 794 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 23-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 23-3) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 23.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 23.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 23-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 795 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 23-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 23-27) Set if an invalid phrase index is supplied 23.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 23-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 796 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 23-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 23.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 23.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 23-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 797 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 23.4.6.7 Erase All Blocks Command Table 23-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 23-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 23-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 23.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 798 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 23-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:16] is supplied Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT 23.4.6.9 Erase P-Flash Sector Command Table 23-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 23.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 799 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:16] is supplied see Table 23-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 23.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 23-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 23-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 23-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 23.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 23-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see MC9S12G Family Reference Manual, Rev.1.01 800 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 23-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 23-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 23.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 23.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. Table 23-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. See Margin level setting. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 801 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 23-55. Table 23-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 23-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 23-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. MC9S12G Family Reference Manual, Rev.1.01 802 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the Table 23-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 23-34 See Margin level setting. field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 23-58. Table 23-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 803 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 23-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 23.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 23-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. MC9S12G Family Reference Manual, Rev.1.01 804 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 23.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 23-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 805 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) Table 23-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 23.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. Table 23-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 23.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 23-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 23-27) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 23-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation MC9S12G Family Reference Manual, Rev.1.01 806 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 23-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 23.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 23.3.2.5, “Flash Configuration Register (FCNFG)”, Section 23.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 23.3.2.7, “Flash Status Register (FSTAT)”, and Section 23.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 23-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 23-27. Flash Module Interrupts Implementation MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 807 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 23.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 23.4.7, “Interrupts”). 23.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. 23.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 23-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 23.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 23.3.2.2), the Verify Backdoor Access Key command (see Section 23.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 23-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 808 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 23.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 23.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 23.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 809 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 48 KByte Flash Module (S12FTMRG48K1V1) 8. Reset the MCU 23.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 23-27. 23.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 810 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 24 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-1. Revision History Revision Number V01.04 Revision Date 17 Jun 2010 Sections Affected Description of Changes 24.4.6.1/24-844 Clarify Erase Verify Commands Descriptions related to the bits MGSTAT[1:0] 24.4.6.2/24-845 of the register FSTAT. 24.4.6.3/24-845 24.4.6.14/24-85 5 24.4.6.2/24-845 Updated description of the commands RD1BLK, MLOADU and MLOADF 24.4.6.12/24-85 2 24.4.6.13/24-85 4 24.3.2.9/24-827 Updated description of protection on Section 24.3.2.9 V01.05 20 aug 2010 Rev.1.01 31 Jan 2011 24.1 Introduction The FTMRG64K1 module implements the following: • 64Kbytes of P-Flash (Program Flash) memory • 2 Kbytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 811 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 24.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 24.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 24.1.2 24.1.2.1 • Features P-Flash Features 64 Kbytes of P-Flash memory composed of one 64 Kbyte Flash block divided into 128 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 812 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 24.1.2.2 • • • • • • EEPROM Features 2 Kbytes of EEPROM memory composed of one 2 Kbyte Flash block divided into 512 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 24.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 24.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 24-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 813 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 16Kx39 sector 0 sector 1 sector 127 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 1Kx22 sector 0 sector 1 sector 511 Figure 24-1. FTMRG64K1 Block Diagram 24.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 814 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 24.6 for a complete description of the reset sequence). . Table 24-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_0BFF 0x0_4000 – 0x0_7FFF 0x3_0000 – 0x3_FFFF 1 Size (Bytes) 1,024 2,048 16,284 65,536 Register Space EEPROM Memory Description NVMRES1=1 : NVM Resource area (see Figure 24-3) P-Flash Memory See NVMRES description in Section 24.4.3 24.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x3_0000 and 0x3_FFFF as shown in Table 24-3.The P-Flash memory map is shown in Figure 24-2. Table 24-3. P-Flash Memory Addressing Global Address Size (Bytes) 64 K Description P-Flash Block Contains Flash Configuration Field (see Table 24-4) 0x3_0000 – 0x3_FFFF MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 815 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) The FPROT register, described in Section 24.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x3_8000 in the Flash memory (called the lower region), one growing downward from global address 0x3_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 24-4. Table 24-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 24.4.6.11, “Verify Backdoor Access Key Command,” and Section 24.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 24.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 24.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 24.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 24.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 816 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) P-Flash START = 0x3_0000 Flash Protected/Unprotected Region 32 Kbytes 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End 0x3_E000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 24-2. P-Flash Memory Map Table 24-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 174 2 8 64 Reserved Reserved Version ID1 Reserved Field Description Program Once Field Refer to Section 24.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 24.4.2 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 817 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_59FF 0x0_5A00 – 0x0_5FFF 0x0_6000 – 0x0_6BFF 0x0_6C00 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 24-5) Reserved. Reserved 512 1,536 3,072 5,120 Reserved Reserved Reserved Reserved Description NVMRES - See Section 24.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 P-Flash IFR 1 Kbyte (NVMRES=1) 0x0_4400 RAM Start = 0x0_5800 RAM End = 0x0_59FF Reserved 5k bytes Reserved 512 bytes Reserved 4608 bytes 0x0_6C00 Reserved 5120 bytes 0x0_7FFF Figure 24-3. Memory Controller Resource Memory Map (NVMRES=1) 24.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 24.3). MC9S12G Family Reference Manual, Rev.1.01 818 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) A summary of the Flash module registers is given in Figure 24-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W R CCOB15 W R CCOB7 W R W 0 0 0 0 0 0 0 0 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 0 DPS5 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 24-4. FTMRG64K1 Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 819 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Address & Name 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R W R W R W R W R W R W R W 7 0 6 0 5 0 4 0 3 0 2 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-4. FTMRG64K1 Register Summary (continued) 24.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 24-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. MC9S12G Family Reference Manual, Rev.1.01 820 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 24-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 24-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 24.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] Table 24-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX2 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 821 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 24-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 24-4) as indicated by reset condition F in Figure 24-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 24-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 24-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 24-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 24-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. MC9S12G Family Reference Manual, Rev.1.01 822 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 24.5. 24.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 24-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 24.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 24.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 823 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 24-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 24.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 24.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 24.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 24.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 24.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 24.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 24.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. MC9S12G Family Reference Manual, Rev.1.01 824 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 24-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 24.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 24.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 24.3.2.8) 0 SFDIE 24.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 24-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 24.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 825 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 24.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 24.4.6, “Flash Command Description,” and Section 24.6, “Initialization” for details. 24.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. MC9S12G Family Reference Manual, Rev.1.01 826 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. 24.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 24-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 24.3.2.9.1, “P-Flash Protection Restrictions,” and Table 24-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 24-4) as indicated by reset condition ‘F’ in Figure 24-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 827 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 24-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 24-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 24-19. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 24-20. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] Table 24-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 24-19 and Table 24-20. MC9S12G Family Reference Manual, Rev.1.01 828 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 24-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 24-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 829 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 24-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 830 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 64 KByte Flash Module (S12FTMRG64K1V1) 24.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 24-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 24-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 24-14 for a definition of the scenarios. 24.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 0 DPS[5:0] 0 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 24-15. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 831 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in P-Flash memory (see Table 24-4) as indicated by reset condition F in Table 24-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 24-22. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[5:0] bits determine the size of the protected area in the EEPROM memory as shown in Table 24-23 . 5–0 DPS[5:0] Table 24-23. EEPROM Protection Address Range DPS[5:0] 000000 000001 000010 000011 000100 000101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 111111 0x0_0400 – 0x0_0BFF 2,048 bytes MC9S12G Family Reference Manual, Rev.1.01 832 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 24-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 24-17. Flash Common Command Object Low Register (FCCOBLO) 24.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 24-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 24-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 24.4.6. Table 24-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 833 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 24.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 24.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 24.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 834 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 24.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 24.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 24-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 24-4) as indicated by reset condition F in Figure 24-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 835 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 24.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 24.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 24.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 836 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 24-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 24.4 24.4.1 Functional Description Modes of Operation The FTMRG64K1 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 24-27). 24.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 24-26. Table 24-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 837 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 24-5. The NVMRES global address map is shown in Table 24-6. 24.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 24.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 24-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 24.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 24.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 838 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 24.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 24-26. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 839 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 24-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 840 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.4.3 Valid Flash Module Commands Table 24-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 24-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 24.4.4.4 P-Flash Commands Table 24-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 24-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 841 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 24.4.4.5 EEPROM Commands Table 24-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 24-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 842 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 24.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 24-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 24-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 24.4.6.12 and Section 24.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 843 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 24.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 24.4.6.1 Erase Verify All Blocks Command Table 24-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 24-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the reador if blank check failed . Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 844 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0] bits determine which block must be verified. Table 24-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 24-34 See Table 24-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM Invalid (ACCERR) Invalid (ACCERR) P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 24-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. Error Condition Set if CCOBIX[2:0] != 000 at command launch 24.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 845 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 24-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 24-3) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 24.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 24.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 24-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value MC9S12G Family Reference Manual, Rev.1.01 846 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 24-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 24-27) Set if an invalid phrase index is supplied 24.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 24-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 847 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 24-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 24.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 24.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 24-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 848 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 24.4.6.7 Erase All Blocks Command Table 24-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 24-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 24-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 24.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 849 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 24-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:16] is supplied Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT 24.4.6.9 Erase P-Flash Sector Command Table 24-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 24.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 850 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:16] is supplied see Table 24-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 24.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 24-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 24-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 24-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 24.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 24-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 851 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 24-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 24-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 24.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 24.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. Table 24-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 24-34 See Margin level setting. MC9S12G Family Reference Manual, Rev.1.01 852 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 24-55. Table 24-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 24-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 24-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 853 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the Table 24-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 24-34 See Margin level setting. field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 24-58. Table 24-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state MC9S12G Family Reference Manual, Rev.1.01 854 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 24-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 24.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 24-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 855 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 24.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 24-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. MC9S12G Family Reference Manual, Rev.1.01 856 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) Table 24-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 24.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. Table 24-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 24.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 24-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 24-27) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 24-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 857 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 24-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 24.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 24.3.2.5, “Flash Configuration Register (FCNFG)”, Section 24.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 24.3.2.7, “Flash Status Register (FSTAT)”, and Section 24.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 24-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 24-27. Flash Module Interrupts Implementation MC9S12G Family Reference Manual, Rev.1.01 858 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 24.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 24.4.7, “Interrupts”). 24.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. 24.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 24-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 24.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 24.3.2.2), the Verify Backdoor Access Key command (see Section 24.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 24-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 859 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 24.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 24.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 24.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state MC9S12G Family Reference Manual, Rev.1.01 860 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) 8. Reset the MCU 24.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 24-27. 24.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 861 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 64 KByte Flash Module (S12FTMRG64K1V1) MC9S12G Family Reference Manual, Rev.1.01 862 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 25 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-1. Revision History Revision Number V01.04 Revision Date 17 Jun 2010 Sections Affected Description of Changes 25.4.6.1/25-896 Clarify Erase Verify Commands Descriptions related to the bits MGSTAT[1:0] 25.4.6.2/25-897 of the register FSTAT. 25.4.6.3/25-898 25.4.6.14/25-90 7 25.4.6.2/25-897 Updated description of the commands RD1BLK, MLOADU and MLOADF 25.4.6.12/25-90 4 25.4.6.13/25-90 6 25.3.2.9/25-879 Updated description of protection on Section 25.3.2.9 V01.05 20 aug 2010 Rev.1.01 31 Jan 2011 25.1 Introduction The FTMRG96K1 module implements the following: • 96Kbytes of P-Flash (Program Flash) memory • 3 Kbytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 863 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 25.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 25.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 25.1.2 25.1.2.1 • Features P-Flash Features 96 Kbytes of P-Flash memory composed of one 96 Kbyte Flash block divided into 192 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 864 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 25.1.2.2 • • • • • • EEPROM Features 3 Kbytes of EEPROM memory composed of one 3 Kbyte Flash block divided into 768 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 25.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 25.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 25-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 865 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 24Kx39 sector 0 sector 1 sector 191 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 1.5Kx22 sector 0 sector 1 sector 767 Figure 25-1. FTMRG96K1 Block Diagram 25.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 866 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 25.6 for a complete description of the reset sequence). . Table 25-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_0FFF 0x0_1000 – 0x0_13FF 0x0_4000 – 0x0_7FFF 0x2_0000 – 0x2_7FFF 0x2_8000 – 0x3_FFFF 1 Size (Bytes) 1,024 3,072 1,024 16,284 32,767 98,304 Register Space EEPROM Memory FTMRG reserved area Description NVMRES1=1 : NVM Resource area (see Figure 25-3) FTMRG reserved area P-Flash Memory See NVMRES description in Section 25.4.3 25.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x2_8000 and 0x3_FFFF as shown in Table 25-3.The P-Flash memory map is shown in Figure 25-2. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 867 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-3. P-Flash Memory Addressing Global Address Size (Bytes) 96 K Description P-Flash Block Contains Flash Configuration Field (see Table 25-4) 0x2_8000 – 0x3_FFFF The FPROT register, described in Section 25.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x3_8000 in the Flash memory (called the lower region), one growing downward from global address 0x3_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 25-4. Table 25-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 25.4.6.11, “Verify Backdoor Access Key Command,” and Section 25.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 25.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 25.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 25.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 25.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 868 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) P-Flash START = 0x2_8000 Flash Protected/Unprotected Region 64 Kbytes 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x3_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 25-2. P-Flash Memory Map Table 25-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 174 2 8 64 Reserved Reserved Version ID1 Reserved Field Description Program Once Field Refer to Section 25.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 25.4.2 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 869 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_59FF 0x0_5A00 – 0x0_5FFF 0x0_6000 – 0x0_6BFF 0x0_6C00 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 25-5) Reserved. Reserved 512 1,536 3,072 5,120 Reserved Reserved Reserved Reserved Description NVMRES - See Section 25.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 P-Flash IFR 1 Kbyte (NVMRES=1) 0x0_4400 RAM Start = 0x0_5800 RAM End = 0x0_59FF Reserved 5k bytes Reserved 512 bytes Reserved 4608 bytes 0x0_6C00 Reserved 5120 bytes 0x0_7FFF Figure 25-3. Memory Controller Resource Memory Map (NVMRES=1) 25.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 25.3). MC9S12G Family Reference Manual, Rev.1.01 870 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) A summary of the Flash module registers is given in Figure 25-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W R CCOB15 W R CCOB7 W R W 0 0 0 0 0 0 0 0 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 DPS6 DPS5 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 25-4. FTMRG96K1 Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 871 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Address & Name 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R W R W R W R W R W R W R W 7 0 6 0 5 0 4 0 3 0 2 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-4. FTMRG96K1 Register Summary (continued) 25.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 25-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. MC9S12G Family Reference Manual, Rev.1.01 872 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 25-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 25-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 25.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] Table 25-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX2 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 873 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 25-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 25-4) as indicated by reset condition F in Figure 25-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 25-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 25-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 25-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 25-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. MC9S12G Family Reference Manual, Rev.1.01 874 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 25.5. 25.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 25-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 25.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 25.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 875 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 25-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 25.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 25.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 25.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 25.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 25.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 25.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 25.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. MC9S12G Family Reference Manual, Rev.1.01 876 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 25-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 25.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 25.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 25.3.2.8) 0 SFDIE 25.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 25-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 25.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 877 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 25.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 25.4.6, “Flash Command Description,” and Section 25.6, “Initialization” for details. 25.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. MC9S12G Family Reference Manual, Rev.1.01 878 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. 25.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 25-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 25.3.2.9.1, “P-Flash Protection Restrictions,” and Table 25-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 25-4) as indicated by reset condition ‘F’ in Figure 25-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 879 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 25-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 25-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 25-19. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 25-20. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] Table 25-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 25-19 and Table 25-20. MC9S12G Family Reference Manual, Rev.1.01 880 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 25-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 25-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 881 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 25-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 882 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 96 KByte Flash Module (S12FTMRG96K1V1) 25.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 25-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 25-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 25-14 for a definition of the scenarios. 25.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 F1 F1 F1 F1 F1 F1 F1 DPS[6:0] Figure 25-15. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 883 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) P-Flash memory (see Table 25-4) as indicated by reset condition F in Table 25-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 25-22. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[6:0] bits determine the size of the protected area in the EEPROM memory, this size increase in step of 32 bytes, as shown in Table 25-23 . 6–0 DPS[6:0] Table 25-23. EEPROM Protection Address Range DPS[6:0] 0000000 0000001 0000010 0000011 0000100 0000101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 1011111 - to - 1111111 0x0_0400 – 0x0_0FFF 3,072 bytes MC9S12G Family Reference Manual, Rev.1.01 884 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 25-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 25-17. Flash Common Command Object Low Register (FCCOBLO) 25.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 25-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 25-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 25.4.6. Table 25-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 885 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 25.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 25.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 25.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 886 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 25.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 25.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 25-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 25-4) as indicated by reset condition F in Figure 25-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 887 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 25.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 25.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 25.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 888 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 25-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 25.4 25.4.1 Functional Description Modes of Operation The FTMRG96K1 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 25-27). 25.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 25-26. Table 25-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 889 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 25-5. The NVMRES global address map is shown in Table 25-6. 25.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 25.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 25-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 25.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 25.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 890 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 25.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 25-26. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 891 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 25-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 892 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.4.3 Valid Flash Module Commands Table 25-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 25-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 25.4.4.4 P-Flash Commands Table 25-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 25-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 893 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 25.4.4.5 EEPROM Commands Table 25-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 25-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 894 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 25.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 25-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 25-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 25.4.6.12 and Section 25.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 895 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 25.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 25.4.6.1 Erase Verify All Blocks Command Table 25-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 25-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the read1or if blank check failed . Set if any non-correctable errors have been encountered during the read1 or if blank check failed. As found in the memory map for FTMRG96K1. MC9S12G Family Reference Manual, Rev.1.01 896 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0] bits determine which block must be verified. Table 25-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 25-34 See Table 25-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM Invalid (ACCERR) P-Flash P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 25-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR FPVIOL MGSTAT1 MGSTAT0 1 2 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if an invalid FlashBlockSelectionCode[1:0] is supplied1 None Set if any errors have been encountered during the read2 or if blank check failed. Set if any non-correctable errors have been encountered during the read2 or if blank check failed. FSTAT As defined by the memory map for FTMRG96K1. As found in the memory map for FTMRG96K1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 897 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. Table 25-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 25-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 25-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 2 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read2 or if blank check failed. Set if any non-correctable errors have been encountered during the read2 or if blank check failed. As defined by the memory map for FTMRG96K1. As found in the memory map for FTMRG96K1. 25.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 25.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 25-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 0x04 FCCOB Parameters Not Required MC9S12G Family Reference Manual, Rev.1.01 898 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 001 010 011 100 101 FCCOB Parameters Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 25-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 25-27) Set if an invalid phrase index is supplied 25.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 25-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x06 FCCOB Parameters Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 899 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 1 Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. Table 25-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 25-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 1 FSTAT Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMRG96K1. 25.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 25.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 25-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. MC9S12G Family Reference Manual, Rev.1.01 900 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. Table 25-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 25.4.6.7 Erase All Blocks Command Table 25-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 25-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 25-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation1 Set if any non-correctable errors have been encountered during the verify operation1 As found in the memory map for FTMRG96K1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 901 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.6.8 Erase Flash Block Command Table 25-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 25-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:16] is supplied1 Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 1 2 FSTAT Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation2 Set if any non-correctable errors have been encountered during the verify operation2 As defined by the memory map for FTMRG96K1. As found in the memory map for FTMRG96K1. 25.4.6.9 Erase P-Flash Sector Command Table 25-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 25.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 902 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:16] is supplied see Table 25-3)1 Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 1 FSTAT Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation As defined by the memory map for FTMRG96K1. 25.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 25-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 25-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 25-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation1 Set if any non-correctable errors have been encountered during the verify operation1 As found in the memory map for FTMRG96K1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 903 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 25-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 25-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 25-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 25-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 25.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 25.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 904 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 25-34 See Margin level setting. Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 25-55. Table 25-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 25-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 25-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 905 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 25.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the Table 25-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 25-34 See Margin level setting. field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 25-58. Table 25-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state MC9S12G Family Reference Manual, Rev.1.01 906 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 25-27) ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 25-34 )1 Set if an invalid margin level setting is supplied None None None As defined by the memory map for FTMRG96K1. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 25.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 25-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 907 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 25.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 25-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. MC9S12G Family Reference Manual, Rev.1.01 908 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) Table 25-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 25.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. Table 25-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 25.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 25-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 25-27) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 25-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 909 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 25-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 25.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 25.3.2.5, “Flash Configuration Register (FCNFG)”, Section 25.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 25.3.2.7, “Flash Status Register (FSTAT)”, and Section 25.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 25-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 25-27. Flash Module Interrupts Implementation MC9S12G Family Reference Manual, Rev.1.01 910 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 25.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 25.4.7, “Interrupts”). 25.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. 25.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 25-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 25.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 25.3.2.2), the Verify Backdoor Access Key command (see Section 25.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 25-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 911 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 25.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 25.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 25.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state MC9S12G Family Reference Manual, Rev.1.01 912 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) 8. Reset the MCU 25.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 25-27. 25.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 913 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 96 KByte Flash Module (S12FTMRG96K1V1) MC9S12G Family Reference Manual, Rev.1.01 914 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 26 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-1. Revision History Revision Number V01.11 Revision Date 17 Jun 2010 Sections Affected Description of Changes 26.4.6.1/26-948 Clarify Erase Verify Commands Descriptions related to the bits MGSTAT[1:0] 26.4.6.2/26-949 of the register FSTAT. 26.4.6.3/26-949 26.4.6.14/26-95 9 26.4.6.2/26-949 Updated description of the commands RD1BLK, MLOADU and MLOADF 26.4.6.12/26-95 6 26.4.6.13/26-95 8 26.3.2.9/26-932 Updated description of protection on Section 26.3.2.9 V01.12 31 aug 2010 Rev.1.01 31 Jan 2011 26.1 Introduction The FTMRG128K1 module implements the following: • 128Kbytes of P-Flash (Program Flash) memory • 4 Kbytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 915 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 26.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 26.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 26.1.2 26.1.2.1 • Features P-Flash Features 128 Kbytes of P-Flash memory composed of one 128 Kbyte Flash block divided into 256 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 916 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 26.1.2.2 • • • • • • EEPROM Features 4 Kbytes of EEPROM memory composed of one 4 Kbyte Flash block divided into 1024 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 26.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 26.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 26-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 917 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 32Kx39 sector 0 sector 1 sector 255 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 2Kx22 sector 0 sector 1 sector 1023 Figure 26-1. FTMRG128K1 Block Diagram 26.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 918 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 26.6 for a complete description of the reset sequence). . Table 26-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_13FF 0x0_4000 – 0x0_7FFF 0x2_0000 – 0x3_FFFF 1 Size (Bytes) 1,024 4,096 16,284 131,072 Register Space EEPROM Memory Description NVMRES1=1 : NVM Resource area (see Figure 26-3) P-Flash Memory See NVMRES description in Section 26.4.3 26.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x2_0000 and 0x3_FFFF as shown in Table 26-3.The P-Flash memory map is shown in Figure 26-2. Table 26-3. P-Flash Memory Addressing Global Address Size (Bytes) 128 K Description P-Flash Block Contains Flash Configuration Field (see Table 26-4) 0x2_0000 – 0x3_FFFF MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 919 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) The FPROT register, described in Section 26.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x3_8000 in the Flash memory (called the lower region), one growing downward from global address 0x3_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 26-4. Table 26-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 26.4.6.11, “Verify Backdoor Access Key Command,” and Section 26.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 26.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 26.3.2.10, “EEPROM Protection Register (DFPROT)” Flash Nonvolatile byte Refer to Section 26.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 26.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 920 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) P-Flash START = 0x2_0000 Flash Protected/Unprotected Region 96 Kbytes 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x3_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 26-2. P-Flash Memory Map Table 26-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 Size (Bytes) 8 174 2 Reserved Reserved Version ID1 Field Description MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 921 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-5. Program IFR Fields Global Address 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 64 Reserved Field Description Program Once Field Refer to Section 26.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 26.4.2 Table 26-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_59FF 0x0_5A00 – 0x0_5FFF 0x0_6000 – 0x0_6BFF 0x0_6C00 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 26-5) Reserved. Reserved 512 1,536 3,072 5,120 Reserved Reserved Reserved Reserved Description NVMRES - See Section 26.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 P-Flash IFR 1 Kbyte (NVMRES=1) 0x0_4400 RAM Start = 0x0_5800 RAM End = 0x0_59FF Reserved 5k bytes Reserved 512 bytes Reserved 4608 bytes 0x0_6C00 Reserved 5120 bytes 0x0_7FFF Figure 26-3. Memory Controller Resource Memory Map (NVMRES=1) MC9S12G Family Reference Manual, Rev.1.01 922 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 26.3). A summary of the Flash module registers is given in Figure 26-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 DFPROT R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W DPS6 DPS5 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 26-4. FTMRG128K1 Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 923 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Address & Name 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R 7 6 5 4 3 2 1 0 CCOB15 W R CCOB7 W R W R W R W R W R W R W R W R W 0 0 0 NV7 0 0 0 0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-4. FTMRG128K1 Register Summary (continued) 26.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. MC9S12G Family Reference Manual, Rev.1.01 924 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 26-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 26-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 26-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 26.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 925 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN1 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. 26.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 26-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 26-4) as MC9S12G Family Reference Manual, Rev.1.01 926 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) indicated by reset condition F in Figure 26-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 26-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 26-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 26-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 26-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. Table 26-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 26.5. 26.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-7. FCCOB Index Register (FCCOBIX) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 927 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 26-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 26.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 26.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 26.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 928 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 26.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 26.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 26.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 26.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 26.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 26.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 26.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 929 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 26.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 26.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 26.3.2.8) 0 SFDIE 26.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 26-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 26.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. Table 26-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 26.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected 5 ACCERR 4 FPVIOL MC9S12G Family Reference Manual, Rev.1.01 930 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-15. FSTAT Field Descriptions (continued) Field 3 MGBUSY 2 RSVD Description Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 26.4.6, “Flash Command Description,” and Section 26.6, “Initialization” for details. 26.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. Table 26-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 931 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 26-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 26.3.2.9.1, “P-Flash Protection Restrictions,” and Table 26-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 26-4) as indicated by reset condition ‘F’ in Figure 26-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 26-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 26-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 26-19. The FPHS bits can only be written to while the FPHDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] MC9S12G Family Reference Manual, Rev.1.01 932 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-17. FPROT Field Descriptions (continued) Field 2 FPLDIS Description Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 26-20. The FPLS bits can only be written to while the FPLDIS bit is set. 1–0 FPLS[1:0] Table 26-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 26-19 and Table 26-20. Table 26-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 26-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 26-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 933 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 26-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 934 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 128 KByte Flash Module (S12FTMRG128K1V1) 26.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 26-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 26-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 26-14 for a definition of the scenarios. 26.3.2.10 EEPROM Protection Register (DFPROT) The DFPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 F1 F1 F1 F1 F1 F1 F1 DPS[6:0] Figure 26-15. EEPROM Protection Register (DFPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the DFPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, fields DPOPEN and DPS of the DFPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 935 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) P-Flash memory (see Table 26-4) as indicated by reset condition F in Table 26-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 26-22. DFPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[6:0] bits determine the size of the protected area in the EEPROM memory, this size increase in step of 32 bytes, as shown in Table 26-23 . 6–0 DPS[6:0] Table 26-23. EEPROM Protection Address Range DPS[6:0] 0000000 0000001 0000010 0000011 0000100 0000101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 1111111 0x0_0400 – 0x0_13FF 4,096 bytes MC9S12G Family Reference Manual, Rev.1.01 936 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 26-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 26-17. Flash Common Command Object Low Register (FCCOBLO) 26.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 26-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 26-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 26.4.6. Table 26-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 937 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 26.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 26.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 26.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 938 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 26.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 26.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 26-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 26-4) as indicated by reset condition F in Figure 26-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 939 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 26.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 26.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 26.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 940 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 26.4 26.4.1 Functional Description Modes of Operation The FTMRG128K1 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and DFPROT registers (see Table 26-27). 26.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 26-26. Table 26-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 941 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 26-5. The NVMRES global address map is shown in Table 26-6. 26.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 26.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 26-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 26.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 26.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 942 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 26.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 26-26. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 943 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 26-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 944 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.4.3 Valid Flash Module Commands Table 26-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 26-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 26.4.4.4 P-Flash Commands Table 26-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 26-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 945 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 26.4.4.5 EEPROM Commands Table 26-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 26-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 946 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the DFPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 26.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 26-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 26-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 26.4.6.12 and Section 26.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 947 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 26.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 26.4.6.1 Erase Verify All Blocks Command Table 26-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 26-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the reador if blank check failed . Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 948 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0] bits determine which block must be verified. Table 26-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 26-34 See Table 26-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM Invalid (ACCERR) P-Flash P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 26-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. Error Condition Set if CCOBIX[2:0] != 000 at command launch 26.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 949 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 26-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:0] is supplied (see Table 26-3) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 26.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 26.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 26-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value MC9S12G Family Reference Manual, Rev.1.01 950 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 26-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 26-27) Set if an invalid phrase index is supplied 26.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 26-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 951 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:0] is supplied (see Table 26-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 26.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 26.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 26-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 952 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 26.4.6.7 Erase All Blocks Command Table 26-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 26-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 26-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 26.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 953 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 26-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:16] is supplied Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT 26.4.6.9 Erase P-Flash Sector Command Table 26-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 26.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 954 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:16] is supplied (see Table 26-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 26.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 26-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 26-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 26-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 26.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 26-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 955 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 26-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 26-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 26.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 26.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. Table 26-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 26-34 See Margin level setting. MC9S12G Family Reference Manual, Rev.1.01 956 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 26-55. Table 26-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 26-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 26-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 957 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the Table 26-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 26-34 See Margin level setting. field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 26-58. Table 26-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state MC9S12G Family Reference Manual, Rev.1.01 958 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid FlashBlockSelectionCode[1:0] is supplied (See Table 26-34 ) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid margin level setting is supplied None None None CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 26.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 26-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 959 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 26.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 26-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. MC9S12G Family Reference Manual, Rev.1.01 960 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) Table 26-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 26.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. Table 26-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 26.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 26-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 26-27) ACCERR Set if an invalid global address [17:0] is supplied (see Table 26-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 961 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 26-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 26.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 26.3.2.5, “Flash Configuration Register (FCNFG)”, Section 26.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 26.3.2.7, “Flash Status Register (FSTAT)”, and Section 26.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 26-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 26-27. Flash Module Interrupts Implementation MC9S12G Family Reference Manual, Rev.1.01 962 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 26.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 26.4.7, “Interrupts”). 26.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. 26.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 26-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 26.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 26.3.2.2), the Verify Backdoor Access Key command (see Section 26.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 26-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 963 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 26.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 26.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 26.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state MC9S12G Family Reference Manual, Rev.1.01 964 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) 8. Reset the MCU 26.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 26-27. 26.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 965 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 128 KByte Flash Module (S12FTMRG128K1V1) MC9S12G Family Reference Manual, Rev.1.01 966 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 27 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-1. Revision History Revision Number V01.06 Revision Date 23 Jun 2010 Sections Affected Description of Changes 27.4.6.2/27-100 Updated description of the commands RD1BLK, MLOADU and MLOADF 1 27.4.6.12/27-10 08 27.4.6.13/27-10 09 27.4.6.2/27-100 Updated description of the commands RD1BLK, MLOADU and MLOADF 1 27.4.6.12/27-10 08 27.4.6.13/27-10 09 27.3.2.9/27-984 Updated description of protection on Section 27.3.2.9 V01.07 20 aug 2010 Rev.1.01 31 Jan 2011 27.1 Introduction The FTMRG192K2 module implements the following: • 192Kbytes of P-Flash (Program Flash) memory • 4Kbytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 967 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 27.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 27.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 27.1.2 27.1.2.1 • Features P-Flash Features 192 Kbytes of P-Flash memory divided into 384 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 968 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 27.1.2.2 • • • • • • EEPROM Features 4Kbytes of EEPROM memory composed of one 4 Kbyte Flash block divided into 1024 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 27.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 27.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 27-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 969 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 48Kx39 sector 0 sector 1 sector 383 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 2Kx22 sector 0 sector 1 sector 1023 Figure 27-1. FTMRG192K2 Block Diagram 27.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 970 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 27.6 for a complete description of the reset sequence). . Table 27-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_13FF 0x0_4000 – 0x0_7FFF 0x0_4000 – 0x0_FFFF 0x1_0000 – 0x3_FFFF 1 Size (Bytes) 1,024 4,096 16,284 49,152 196,608 Register Space EEPROM Memory Description NVMRES1=1 : NVM Resource area (see Figure 27-3) FTMRG reserved area P-Flash Memory See NVMRES description in Section 27.4.3 27.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x1_0000 and 0x3_FFFF as shown in Table 27-3 .The P-Flash memory map is shown in Figure 27-2. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 971 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-3. P-Flash Memory Addressing Global Address Size (Bytes) 192 K Description P-Flash Block Contains Flash Configuration Field (see Table 27-4). 0x1_0000 – 0x3_FFFF The FPROT register, described in Section 27.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 27-4. Table 27-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 27.4.6.11, “Verify Backdoor Access Key Command,” and Section 27.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 27.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 27.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 27.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 27.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 972 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) P-Flash START = 0x1_0000 Flash Protected/Unprotected Region 160 Kbytes 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x3_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 27-2. P-Flash Memory Map Table 27-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 Size (Bytes) 8 174 2 Reserved Reserved Version ID1 Field Description MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 973 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-5. Program IFR Fields Global Address 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 64 Reserved Field Description Program Once Field Refer to Section 27.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 27.4.2 Table 27-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_5AFF 0x0_5B00 – 0x0_5FFF 0x0_6000 – 0x0_67FF 0x0_6800 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 27-5) Reserved. Reserved 768 1,280 2,048 6,144 Reserved Reserved Reserved Reserved Description NVMRES - See Section 27.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 0x0_4100 0x0_4200 0x0_5800 0x0_5AFF P-Flash IFR 128 bytes (NVMRES=1) Reserved 128 bytes Reserved 5632 bytes Reserved 768 bytes Reserved 3328 bytes 0x0_6800 Reserved 6144 bytes 0x0_7FFF Figure 27-3. Memory Controller Resource Memory Map (NVMRES=1) MC9S12G Family Reference Manual, Rev.1.01 974 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 27.3). A summary of the Flash module registers is given in Figure 27-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W DPS6 DPS5 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 27-4. FTMRG192K2 Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 975 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Address & Name 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R 7 6 5 4 3 2 1 0 CCOB15 W R CCOB7 W R W R W R W R W R W R W R W R W 0 0 0 NV7 0 0 0 0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-4. FTMRG192K2 Register Summary (continued) 27.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. MC9S12G Family Reference Manual, Rev.1.01 976 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 27-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 27-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 27-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 27.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 977 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN1 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. 27.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 27-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 27-4) as MC9S12G Family Reference Manual, Rev.1.01 978 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) indicated by reset condition F in Figure 27-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 27-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 27-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 27-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 27-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. Table 27-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 27.5. 27.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-7. FCCOB Index Register (FCCOBIX) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 979 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 27-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 27.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 27.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 27.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 980 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 27.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 27.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 27.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 27.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 27.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 27.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 27.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 981 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 27.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 27.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 27.3.2.8) 0 SFDIE 27.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 27-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 27.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. Table 27-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 27.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected 5 ACCERR 4 FPVIOL MC9S12G Family Reference Manual, Rev.1.01 982 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-15. FSTAT Field Descriptions (continued) Field 3 MGBUSY 2 RSVD Description Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 27.4.6, “Flash Command Description,” and Section 27.6, “Initialization” for details. 27.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. Table 27-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 983 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 27-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 27.3.2.9.1, “P-Flash Protection Restrictions,” and Table 27-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 27-4) as indicated by reset condition ‘F’ in Figure 27-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 27-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 27-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 27-19. The FPHS bits can only be written to while the FPHDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] MC9S12G Family Reference Manual, Rev.1.01 984 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-17. FPROT Field Descriptions (continued) Field 2 FPLDIS Description Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 27-20. The FPLS bits can only be written to while the FPLDIS bit is set. 1–0 FPLS[1:0] Table 27-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 27-19 and Table 27-20. Table 27-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 27-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 27-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 985 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 27-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 986 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 192 KByte Flash Module (S12FTMRG192K2V1) 27.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 27-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 27-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 27-14 for a definition of the scenarios. 27.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 F1 F1 F1 F1 F1 F1 F1 DPS[6:0] Figure 27-15. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 987 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) P-Flash memory (see Table 27-4) as indicated by reset condition F in Table 27-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 27-22. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[6:0] bits determine the size of the protected area in the EEPROM memory, this size increase in step of 32 bytes, as shown in Table 27-23 . 6–0 DPS[6:0] Table 27-23. EEPROM Protection Address Range DPS[6:0] 0000000 0000001 0000010 0000011 0000100 0000101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 1111111 0x0_0400 – 0x0_13FF 4,096 bytes MC9S12G Family Reference Manual, Rev.1.01 988 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 27-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 27-17. Flash Common Command Object Low Register (FCCOBLO) 27.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 27-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 27-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 27.4.6. Table 27-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 989 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 27.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 27.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 27.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 990 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 27.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 27.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 27-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 27-4) as indicated by reset condition F in Figure 27-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 991 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 27.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 27.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 27.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 992 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 27-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 27.4 27.4.1 Functional Description Modes of Operation The FTMRG192K2 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 27-27). 27.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 27-26. Table 27-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 993 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 27-5. The NVMRES global address map is shown in Table 27-6. 27.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 27.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 27-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 27.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 27.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 994 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 27.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 27-26. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 995 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 27-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 996 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.4.4.3 Valid Flash Module Commands Table 27-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 27-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 27.4.4.4 P-Flash Commands Table 27-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 27-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 997 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 27.4.4.5 EEPROM Commands Table 27-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 27-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 998 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 27.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 27-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 27-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 27.4.6.12 and Section 27.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 999 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 27.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 27.4.6.1 Erase Verify All Blocks Command Table 27-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 27-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the reador if blank check failed . Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 1000 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0]bits determine which block must be verified. Table 27-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 27-34 See Table 27-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM P-Flash P-Flash P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 27-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch. None. Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read1 or if blank check failed. 27.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1001 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 27-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 27-3) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 27.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 27.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 27-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value MC9S12G Family Reference Manual, Rev.1.01 1002 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 27-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 27-27) Set if an invalid phrase index is supplied 27.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 27-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1003 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 27-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 27.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 27.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 27-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 1004 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 27.4.6.7 Erase All Blocks Command Table 27-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 27-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 27-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 27.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1005 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 27-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:16] is supplied Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT 27.4.6.9 Erase P-Flash Sector Command Table 27-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 27.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 1006 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:16] is supplied see Table 27-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 27.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 27-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 27-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 27-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 27.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 27-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1007 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 27-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 27-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 27.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 27.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. Table 27-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 27-34 See Margin level setting. MC9S12G Family Reference Manual, Rev.1.01 1008 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 27-55. Table 27-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 27-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch. ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None None None Set if command not available in current mode (see Table 27-27). Set if an invalid margin level setting is supplied. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 27.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1009 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 27-34 See Margin level setting. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 27-58. Table 27-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 27-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch. ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None None None Set if command not available in current mode (see Table 27-27). Set if an invalid margin level setting is supplied. MC9S12G Family Reference Manual, Rev.1.01 1010 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 27.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 27-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 27-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1011 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 27-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. Table 27-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 27.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 1012 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) Table 27-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 27.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 27-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 27-27) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 27-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 27.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 27-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1013 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 27.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 27.3.2.5, “Flash Configuration Register (FCNFG)”, Section 27.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 27.3.2.7, “Flash Status Register (FSTAT)”, and Section 27.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 27-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 27-27. Flash Module Interrupts Implementation 27.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 27.4.7, “Interrupts”). 27.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. MC9S12G Family Reference Manual, Rev.1.01 1014 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) 27.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 27-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 27.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 27.3.2.2), the Verify Backdoor Access Key command (see Section 27.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 27-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 27.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 27.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1015 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 27.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state 8. Reset the MCU 27.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 27-27. 27.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. MC9S12G Family Reference Manual, Rev.1.01 1016 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1017 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 192 KByte Flash Module (S12FTMRG192K2V1) MC9S12G Family Reference Manual, Rev.1.01 1018 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Chapter 28 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-1. Revision History Revision Number V01.06 Revision Date 23 Jun 2010 Sections Affected Description of Changes 28.4.6.2/28-105 Updated description of the commands RD1BLK, MLOADU and MLOADF 3 28.4.6.12/28-10 60 28.4.6.13/28-10 61 28.4.6.2/28-105 Updated description of the commands RD1BLK, MLOADU and MLOADF 3 28.4.6.12/28-10 60 28.4.6.13/28-10 61 28.3.2.9/28-103 Updated description of protection on Section 28.3.2.9 6 V01.07 20 aug 2010 Rev.1.01 31 Jan 2011 28.1 Introduction The FTMRG240K2 module implements the following: • 240Kbytes of P-Flash (Program Flash) memory • 4Kbytes of EEPROM memory The Flash memory is ideal for single-supply applications allowing for field reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1019 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes and aligned words. For misaligned words access, the CPU has to perform twice the byte read access command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It is not possible to read from EEPROM memory while a command is executing on P-Flash memory. Simultaneous P-Flash and EEPROM operations are discussed in Section 28.4.5. Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte or word accessed will be corrected. 28.1.1 Glossary Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data. EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be erased. The EEPROM sector consists of 4 bytes. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double bit fault detection within each double word. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 512 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version ID, and the Program Once field. 28.1.2 28.1.2.1 • Features P-Flash Features 240 Kbytes of P-Flash memory divided into 480 sectors of 512 bytes MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1020 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) • • • • • Single bit fault correction and double bit fault detection within a 32-bit double word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to read the P-Flash memory while programming a word in the EEPROM memory Flexible protection scheme to prevent accidental program or erase of P-Flash memory 28.1.2.2 • • • • • • EEPROM Features 4 Kbytes of EEPROM memory composed of one 4 Kbyte Flash block divided into 1024 sectors of 4 bytes Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Protection scheme to prevent accidental program or erase of EEPROM memory Ability to program up to four words in a burst sequence 28.1.2.3 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 28.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 28-1. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1021 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash 60Kx39 sector 0 sector 1 sector 479 Protection Security Bus Clock Clock Divider FCLK Memory Controller CPU EEPROM 2Kx22 sector 0 sector 1 sector 1023 Figure 28-1. FTMRG240K2 Block Diagram 28.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12G Family Reference Manual, Rev.1.01 1022 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. CAUTION Writing to the Flash registers while a Flash command is executing (that is indicated when the value of flag CCIF reads as ’0’) is not allowed. If such action is attempted the write operation will not change the register value. Writing to the Flash registers is allowed when the Flash is not busy executing commands (CCIF = 1) and during initialization right after reset, despite the value of flag CCIF in that case (refer to Section 28.6 for a complete description of the reset sequence). . Table 28-2. FTMRG Memory Map Global Address (in Bytes) 0x0_0000 - 0x0_03FF 0x0_0400 – 0x0_13FF 0x0_4000 – 0x0_7FFF 0x0_4000 – 0x0_7FFF 0x0_8000 – 0x3_FFFF 1 Size (Bytes) 1,024 4,096 16,284 16,284 229,376 Register Space EEPROM Memory Description NVMRES=0 : P-Flash Memory area active NVMRES1=1 : NVM Resource area (see Figure 28-3) P-Flash Memory See NVMRES description in Section 28.4.3 28.3.1 Module Memory Map The S12 architecture places the P-Flash memory between global addresses 0x0_4000 and 0x3_FFFF as shown in Table 28-3 .The P-Flash memory map is shown in Figure 28-2. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1023 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-3. P-Flash Memory Addressing Global Address Size (Bytes) 240 K Description P-Flash Block Contains Flash Configuration Field (see Table 28-4). 0x0_4000 – 0x3_FFFF The FPROT register, described in Section 28.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as described in Table 28-4. Table 28-4. Flash Configuration Field Global Address Size (Bytes) 8 4 1 1 1 1 Description Backdoor Comparison Key Refer to Section 28.4.6.11, “Verify Backdoor Access Key Command,” and Section 28.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 28.3.2.9, “P-Flash Protection Register (FPROT)” EEPROM Protection byte. Refer to Section 28.3.2.10, “EEPROM Protection Register (EEPROT)” Flash Nonvolatile byte Refer to Section 28.3.2.16, “Flash Option Register (FOPT)” Flash Security byte Refer to Section 28.3.2.2, “Flash Security Register (FSEC)” 0x3_FF00-0x3_FF07 0x3_FF08-0x3_FF0B1 0x3_FF0C1 0x3_FF0D1 0x3_FF0E1 0x3_FF0F1 1 0x3FF08-0x3_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x3_FF08 - 0x3_FF0B reserved field should be programmed to 0xFF. MC9S12G Family Reference Manual, Rev.1.01 1024 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) P-Flash START = 0x0_4000 Flash Protected/Unprotected Region 208 Kbytes 0x3_8000 0x3_8400 0x3_8800 0x3_9000 Protection Fixed End 0x3_A000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes Protection Movable End 0x3_C000 Protection Fixed End Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x3_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x3_F000 0x3_F800 P-Flash END = 0x3_FFFF Flash Configuration Field 16 bytes (0x3_FF00 - 0x3_FF0F) Figure 28-2. P-Flash Memory Map Table 28-5. Program IFR Fields Global Address 0x0_4000 – 0x0_4007 0x0_4008 – 0x0_40B5 0x0_40B6 – 0x0_40B7 Size (Bytes) 8 174 2 Reserved Reserved Version ID1 Field Description MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1025 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-5. Program IFR Fields Global Address 0x0_40B8 – 0x0_40BF 0x0_40C0 – 0x0_40FF 1 Size (Bytes) 8 64 Reserved Field Description Program Once Field Refer to Section 28.4.6.6, “Program Once Command” Used to track firmware patch versions, see Section 28.4.2 Table 28-6. Memory Controller Resource Fields (NVMRES1=1) Global Address 0x0_4000 – 0x040FF 0x0_4100 – 0x0_41FF 0x0_4200 – 0x0_57FF 0x0_5800 – 0x0_5AFF 0x0_5B00 – 0x0_5FFF 0x0_6000 – 0x0_67FF 0x0_6800 – 0x0_7FFF 1 Size (Bytes) 256 256 P-Flash IFR (see Table 28-5) Reserved. Reserved 768 1,280 2,048 6,144 Reserved Reserved Reserved Reserved Description NVMRES - See Section 28.4.3 for NVMRES (NVM Resource) detail. 0x0_4000 0x0_4100 0x0_4200 0x0_5800 0x0_5AFF P-Flash IFR 128 bytes (NVMRES=1) Reserved 128 bytes Reserved 5632 bytes Reserved 768 bytes Reserved 3328 bytes 0x0_6800 Reserved 6144 bytes 0x0_7FFF Figure 28-3. Memory Controller Resource Memory Map (NVMRES=1) MC9S12G Family Reference Manual, Rev.1.01 1026 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. In the case of the writable registers, the write accesses are forbidden during Fash command execution (for more detail, see Caution note in Section 28.3). A summary of the Flash module registers is given in Figure 28-4 with detailed descriptions in the following subsections. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FRSV0 0x0004 FCNFG 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EEPROT R W R W R W R W R CCIE W R W R CCIF W R W R FPOPEN W R DPOPEN W DPS6 DPS5 DPS4 DPS3 DPS2 DPS1 DPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 0 0 0 0 0 0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 0 0 0 0 0 0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 28-4. FTMRG240K2 Register Summary MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1027 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Address & Name 0x000A FCCOBHI 0x000B FCCOBLO 0x000C FRSV1 0x000D FRSV2 0x000E FRSV3 0x000F FRSV4 0x0010 FOPT 0x0011 FRSV5 0x0012 FRSV6 0x0013 FRSV7 R 7 6 5 4 3 2 1 0 CCOB15 W R CCOB7 W R W R W R W R W R W R W R W R W 0 0 0 NV7 0 0 0 0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-4. FTMRG240K2 Register Summary (continued) 28.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. MC9S12G Family Reference Manual, Rev.1.01 1028 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIVLCK 0 0 0 0 0 FDIV[5:0] 0 0 0 = Unimplemented or Reserved Figure 28-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times but bit 7 remains unwritable. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). Table 28-7. FCLKDIV Field Descriptions Field 7 FDIVLD 6 FDIVLCK Description Clock Divider Loaded 0 FCLKDIV register has not been written since the last reset 1 FCLKDIV register has been written since the last reset Clock Divider Locked 0 FDIV field is open for writing 1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and restore writability to the FDIV field in normal mode. Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events during Flash program and erase algorithms. Table 28-8 shows recommended values for FDIV[5:0] based on the BUSCLK frequency. Please refer to Section 28.4.4, “Flash Command Operations,” for more information. 5–0 FDIV[5:0] MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1029 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-8. FDIV values for various BUSCLK Frequencies BUSCLK Frequency (MHz) MIN1 1.0 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 1 2 FDIV[5:0] BUSCLK Frequency (MHz) MIN 1 FDIV[5:0] MAX2 1.6 2.6 3.6 4.6 5.6 6.6 7.6 8.6 9.6 10.6 11.6 12.6 13.6 14.6 15.6 16.6 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F MAX 2 16.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 17.6 18.6 19.6 20.6 21.6 22.6 23.6 24.6 25.6 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 BUSCLK is Greater Than this value. BUSCLK is Less Than or Equal to this value. 28.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F1 KEYEN[1:0] RNV[5:2] SEC[1:0] F1 F1 F1 F1 F1 F1 F1 = Unimplemented or Reserved Figure 28-6. Flash Security Register (FSEC) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x3_FF0F located in P-Flash memory (see Table 28-4) as MC9S12G Family Reference Manual, Rev.1.01 1030 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) indicated by reset condition F in Figure 28-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 28-9. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 28-10. 5–2 RNV[5:2] 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 28-11. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 28-10. Flash KEYEN States KEYEN[1:0] 00 01 10 11 1 Status of Backdoor Key Access DISABLED DISABLED1 ENABLED DISABLED Preferred KEYEN state to disable backdoor key access. Table 28-11. Flash Security States SEC[1:0] 00 01 10 11 1 Status of Security SECURED SECURED1 UNSECURED SECURED Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 28.5. 28.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-7. FCCOB Index Register (FCCOBIX) MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1031 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 28-12. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 28.3.2.11, “Flash Common Command Object Register (FCCOB)“,” for more details. 28.3.2.4 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-8. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 28.3.2.5 Flash Configuration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-9. Flash Configuration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. MC9S12G Family Reference Manual, Rev.1.01 1032 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-13. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 28.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 28.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. 0 Flash array read operations will set the DFDIF flag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF flag in the FERSTAT register to be set (see Section 28.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 28.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. 0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 28.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 28.3.2.6) 4 IGNSF 1 FDFD 0 FSFD 28.3.2.6 Flash Error Configuration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIE SFDIE 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-10. Flash Error Configuration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1033 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-14. FERCNFG Field Descriptions Field 1 DFDIE Description Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF flag is set (see Section 28.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 28.3.2.8) 1 An interrupt will be requested whenever the SFDIF flag is set (see Section 28.3.2.8) 0 SFDIE 28.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 01 01 = Unimplemented or Reserved Figure 28-11. Flash Status Register (FSTAT) 1 Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 28.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. Table 28-15. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 28.4.4.2) or issuing an illegal Flash command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected 5 ACCERR 4 FPVIOL MC9S12G Family Reference Manual, Rev.1.01 1034 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-15. FSTAT Field Descriptions (continued) Field 3 MGBUSY 2 RSVD Description Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) Reserved Bit — This bit is reserved and always reads 0. 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 28.4.6, “Flash Command Description,” and Section 28.6, “Initialization” for details. 28.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reflects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 DFDIF SFDIF 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-12. Flash Error Status Register (FERSTAT) All flags in the FERSTAT register are readable and only writable to clear the flag. Table 28-16. FERSTAT Field Descriptions Field 1 DFDIF Description Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF flag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The DFDIF flag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF.2 0 No double bit fault detected 1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command running Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash command operation.1 The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted while command running 0 SFDIF 1 The single bit fault and double bit fault flags are mutually exclusive for parity errors (an ECC fault occurrence can be either single fault or double fault but never both). A simultaneous access collision (Flash array read operation returning invalid data attempted while command running) is indicated when both SFDIF and DFDIF flags are high. 2 There is a one cycle delay in storing the ECC DFDIF and SFDIF fault flags in this register. At least one NOP is required after a flash memory read before checking FERSTAT for the occurrence of ECC errors. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1035 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F1 RNV6 FPHDIS F1 F1 F1 FPHS[1:0] F1 FPLDIS F1 F1 FPLS[1:0] F1 = Unimplemented or Reserved Figure 28-13. Flash Protection Register (FPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 28.3.2.9.1, “P-Flash Protection Restrictions,” and Table 28-21). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x3_FF0C located in P-Flash memory (see Table 28-4) as indicated by reset condition ‘F’ in Figure 28-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 28-17. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 28-18 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory ending with global address 0x3_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 28-19. The FPHS bits can only be written to while the FPHDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] MC9S12G Family Reference Manual, Rev.1.01 1036 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-17. FPROT Field Descriptions (continued) Field 2 FPLDIS Description Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a specific region of the P-Flash memory beginning with global address 0x3_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 28-20. The FPLS bits can only be written to while the FPLDIS bit is set. 1–0 FPLS[1:0] Table 28-18. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 0 1 FPHDIS 1 1 0 0 1 1 0 0 FPLDIS 1 0 1 0 1 0 1 0 Function1 No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range Unprotected High and Low Ranges For range sizes, refer to Table 28-19 and Table 28-20. Table 28-19. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x3_F800–0x3_FFFF 0x3_F000–0x3_FFFF 0x3_E000–0x3_FFFF 0x3_C000–0x3_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 28-20. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x3_8000–0x3_83FF 0x3_8000–0x3_87FF 0x3_8000–0x3_8FFF 0x3_8000–0x3_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 28-14 . Although the protection scheme is loaded from the Flash memory at global address 0x3_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1037 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x3_8000 0x3_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] FPHS[1:0] FPLS[1:0] FPOPEN = 0 0x3_8000 0x3_FFFF Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 28-14. P-Flash Protection Scenarios MC9S12G Family Reference Manual, Rev.1.01 1038 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. FPLS[1:0] FPOPEN = 1 240 KByte Flash Module (S12FTMRG240K2V1) 28.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 28-21 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 28-21. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 7 1 To Protection Scenario1 0 X 1 X X X 2 X 3 X X X X X X X X X X X X X X X X X X X X X X 4 5 6 7 Allowed transitions marked with X, see Figure 28-14 for a definition of the scenarios. 28.3.2.10 EEPROM Protection Register (EEPROT) The EEPROT register defines which EEPROM sectors are protected against program and erase operations. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R DPOPEN W Reset F1 F1 F1 F1 F1 F1 F1 F1 DPS[6:0] Figure 28-15. EEPROM Protection Register (EEPROT) 1 Loaded from IFR Flash configuration field, during reset sequence. The (unreserved) bits of the EEPROT register are writable with the restriction that protection can be added but not removed. Writes must increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0 (protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. During the reset sequence, fields DPOPEN and DPS of the EEPROT register are loaded with the contents of the EEPROM protection byte in the Flash configuration field at global address 0x3_FF0D located in MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1039 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) P-Flash memory (see Table 28-4) as indicated by reset condition F in Table 28-23. To change the EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM memory fully protected. Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible if any of the EEPROM sectors are protected. Table 28-22. EEPROT Field Descriptions Field 7 DPOPEN Description EEPROM Protection Control 0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS bits 1 Disables EEPROM memory protection from program and erase EEPROM Protection Size — The DPS[6:0] bits determine the size of the protected area in the EEPROM memory, this size increase in step of 32 bytes, as shown in Table 28-23 . 6–0 DPS[6:0] Table 28-23. EEPROM Protection Address Range DPS[6:0] 0000000 0000001 0000010 0000011 0000100 0000101 Global Address Range 0x0_0400 – 0x0_041F 0x0_0400 – 0x0_043F 0x0_0400 – 0x0_045F 0x0_0400 – 0x0_047F 0x0_0400 – 0x0_049F 0x0_0400 – 0x0_04BF Protected Size 32 bytes 64 bytes 96 bytes 128 bytes 160 bytes 192 bytes The Protection Size goes on enlarging in step of 32 bytes, for each DPS value increasing of one. . . . 1111111 0x0_0400 – 0x0_13FF 4,096 bytes MC9S12G Family Reference Manual, Rev.1.01 1040 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 28-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 28-17. Flash Common Command Object Low Register (FCCOBLO) 28.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 28-24. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 28-24 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 28.4.6. Table 28-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO Global address [7:0] 6’h0, Global address [17:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] defining Flash command MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1041 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-24. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 010 LO HI 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Data 0 [7:0] Data 1 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 0 [15:8] 28.3.2.12 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-18. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 28.3.2.13 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-19. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. 28.3.2.14 Flash Reserved3 Register (FRSV3) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 1042 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-20. Flash Reserved3 Register (FRSV3) All bits in the FRSV3 register read 0 and are not writable. 28.3.2.15 Flash Reserved4 Register (FRSV4) This Flash register is reserved for factory testing. Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-21. Flash Reserved4 Register (FRSV4) All bits in the FRSV4 register read 0 and are not writable. 28.3.2.16 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F1 F1 F1 F1 NV[7:0] F1 F1 F1 F1 = Unimplemented or Reserved Figure 28-22. Flash Option Register (FOPT) 1 Loaded from IFR Flash configuration field, during reset sequence. All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x3_FF0E located in P-Flash memory (see Table 28-4) as indicated by reset condition F in Figure 28-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1043 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-25. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 28.3.2.17 Flash Reserved5 Register (FRSV5) This Flash register is reserved for factory testing. Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-23. Flash Reserved5 Register (FRSV5) All bits in the FRSV5 register read 0 and are not writable. 28.3.2.18 Flash Reserved6 Register (FRSV6) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-24. Flash Reserved6 Register (FRSV6) All bits in the FRSV6 register read 0 and are not writable. 28.3.2.19 Flash Reserved7 Register (FRSV7) This Flash register is reserved for factory testing. MC9S12G Family Reference Manual, Rev.1.01 1044 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 28-25. Flash Reserved7 Register (FRSV7) All bits in the FRSV7 register read 0 and are not writable. 28.4 28.4.1 Functional Description Modes of Operation The FTMRG240K2 module provides the modes of operation normal and special . The operating mode is determined by module-level inputs and affects the FCLKDIV, FCNFG, and EEPROT registers (see Table 28-27). 28.4.2 IFR Version ID Word The version ID word is stored in the IFR at address 0x0_40B6. The contents of the word are defined in Table 28-26. Table 28-26. IFR Version ID Fields [15:4] Reserved [3:0] VERNUM • VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111 meaning ‘none’. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1045 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.4.3 Internal NVM resource (NVMRES) IFR is an internal NVM resource readable by CPU , when NVMRES is active. The IFR fields are shown in Table 28-5. The NVMRES global address map is shown in Table 28-6. For FTMRG240K2 the NVMRES address area is shared with 16K space of P-Flash area, as shown in Figure 28-2. 28.4.4 Flash Command Operations Flash command operations are used to modify Flash memory contents. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from BUSCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution, according to MCU functional mode and MCU security state. 28.4.4.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 28-8 shows recommended values for the FDIV field based on BUSCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 28.4.4.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 28.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. MC9S12G Family Reference Manual, Rev.1.01 1046 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.4.4.2.1 Define FCCOB Contents The FCCOB parameter fields must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter fields is controlled via the CCOBIX bits in the FCCOBIX register (see Section 28.3.2.3). The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic command write sequence is shown in Figure 28-26. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1047 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) START Read: FCLKDIV register Clock Divider Value Check no no Read: FSTAT register CCIF Set? yes FDIV Correct? yes FCCOB Availability Check Note: FCLKDIV must be set after each reset Read: FSTAT register no CCIF Set? yes Write: FCLKDIV register Results from previous Command Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Write to FCCOBIX register to identify specific command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 28-26. Generic Flash Command Write Sequence Flowchart MC9S12G Family Reference Manual, Rev.1.01 1048 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.4.4.3 Valid Flash Module Commands Table 28-27 present the valid Flash commands, as enabled by the combination of the functional MCU mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured). Special Singlechip mode is selected by input mmc_ss_mode_ts2 asserted. MCU Secured state is selected by input mmc_secure input asserted. + Table 28-27. Flash Commands by Mode and Security State Unsecured FCMD 0x01 0x02 0x03 0x04 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x10 0x11 0x12 1 2 Secured NS3 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS4 ∗ ∗ Command Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Erase All Blocks Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector NS1 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ SS2 ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ Unsecured Normal Single Chip mode Unsecured Special Single Chip mode. 3 Secured Normal Single Chip mode. 4 Secured Special Single Chip mode. 28.4.4.4 P-Flash Commands Table 28-28 summarizes the valid P-Flash commands along with the effects of the commands on the P-Flash block and other resources within the Flash module. Table 28-28. P-Flash Commands FCMD 0x01 Command Erase Verify All Blocks Function on P-Flash Memory Verify that all P-Flash (and EEPROM) blocks are erased. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1049 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-28. P-Flash Commands FCMD 0x02 0x03 0x04 0x06 0x07 Command Erase Verify Block Erase Verify P-Flash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block that is allowed to be programmed only once. Erase all P-Flash (and EEPROM) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a P-Flash (or EEPROM) block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM) blocks and verifying that all P-Flash (and EEPROM) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Specifies a user margin read level for all P-Flash blocks. Specifies a field margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 28.4.4.5 EEPROM Commands Table 28-29 summarizes the valid EEPROM commands along with the effects of the commands on the EEPROM block. Table 28-29. EEPROM Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on EEPROM Memory Verify that all EEPROM (and P-Flash) blocks are erased. Verify that the EEPROM block is erased. MC9S12G Family Reference Manual, Rev.1.01 1050 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-29. EEPROM Commands FCMD Command Function on EEPROM Memory Erase all EEPROM (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the DPOPEN bit in the EEPROT register are set prior to launching the command. Erase a EEPROM (or P-Flash) block. An erase of the full EEPROM block is only possible when DPOPEN bit in the EEPROT register is set prior to launching the command. Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash) blocks and verifying that all EEPROM (and P-Flash) blocks are erased. Specifies a user margin read level for the EEPROM block. Specifies a field margin read level for the EEPROM block (special modes only). Verify that a given number of words starting at the address provided are erased. Program up to four words in the EEPROM block. Erase all bytes in a sector of the EEPROM block. 0x08 Erase All Blocks 0x09 Erase Flash Block 0x0B 0x0D 0x0E 0x10 0x11 0x12 Unsecure Flash Set User Margin Level Set Field Margin Level Erase Verify EEPROM Section Program EEPROM Erase EEPROM Sector 28.4.5 Allowed Simultaneous P-Flash and EEPROM Operations Only the operations marked ‘OK’ in Table 28-30 are permitted to be run simultaneously on the Program Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain hardware resources are shared by the two memories. The priority has been placed on permitting Program Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while write (EEPROM) functionality. Table 28-30. Allowed P-Flash and EEPROM Simultaneous Operations EEPROM Program Flash Read Margin Read1 Program Sector Erase Mass Erase2 1 Read Margin Read1 OK Program OK Sector Erase OK Mass Erase2 OK A ‘Margin Read’ is any read after executing the margin setting commands ‘Set User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’ level specified. See the Note on margin settings in Section 28.4.6.12 and Section 28.4.6.13. 2 The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase Flash Block’ MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1051 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.4.6 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data if both flags SFDIF and DFDIF are set. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 28.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 28.4.6.1 Erase Verify All Blocks Command Table 28-31. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will be set. Table 28-32. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the reador if blank check failed . Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 1052 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.4.6.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has been erased. The FCCOB FlashBlockSelectionCode[1:0]bits determine which block must be verified. Table 28-33. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Flash block selection code [1:0]. Table 28-34 See Table 28-34. Flash block selection code description Selection code[1:0] 00 Flash block to be verified EEPROM P-Flash P-Flash P-Flash 01 10 11 Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be set. Table 28-35. Erase Verify Block Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch. None. Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read1 or if blank check failed. 28.4.6.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1053 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-36. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [17:16] of a P-Flash block Global address [15:0] of the first phrase to be verified Number of phrases to be verified Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 28-37. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 28-3) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section crosses a the P-Flash address boundary None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. 28.4.6.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once command described in Section 28.4.6.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 28-38. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value MC9S12G Family Reference Manual, Rev.1.01 1054 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block will return invalid data. 8 Table 28-39. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 28-27) Set if an invalid phrase index is supplied 28.4.6.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 28-40. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1 FCCOB Parameters 0x06 Global address [17:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed1 Word 0 program value Word 1 program value Word 2 program value Word 3 program value Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF flag will set after the Program P-Flash operation has completed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1055 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-41. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:0] is supplied see Table 28-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the global address [17:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 28.4.6.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the Read Once command as described in Section 28.4.6.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 28-42. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash will return invalid data. MC9S12G Family Reference Manual, Rev.1.01 1056 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-43. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 1 Set if the requested phrase has already been programmed1 None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 28.4.6.7 Erase All Blocks Command Table 28-44. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space. Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All Blocks operation has completed. Table 28-45. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 28-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 28.4.6.8 Erase Flash Block Command The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1057 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-46. Erase Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [17:16] to identify Flash block Global address [15:0] in Flash block to be erased Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block operation has completed. Table 28-47. Erase Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:16] is supplied Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM address is not word-aligned FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT 28.4.6.9 Erase P-Flash Sector Command Table 28-48. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [17:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 28.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash Sector operation has completed. MC9S12G Family Reference Manual, Rev.1.01 1058 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-49. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:16] is supplied see Table 28-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 28.4.6.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase is successful, will release security. Table 28-50. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF flag is set after the Unsecure Flash operation has completed. Table 28-51. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 28-27) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash or EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Error Condition Set if CCOBIX[2:0] != 000 at command launch 28.4.6.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 28-10). The Verify Backdoor Access Key command releases security if user-supplied keys match those stored in the Flash security bytes of the Flash configuration field (see MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1059 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-4). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 28-52. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash configuration field with Key 0 compared to 0x3_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 28-53. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 28.3.2.2) Set if the backdoor key has mismatched since the last reset None None None 28.4.6.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of the P-Flash or EEPROM block. Table 28-54. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Flash block selection code [1:0]. Table 28-34 See Margin level setting. MC9S12G Family Reference Manual, Rev.1.01 1060 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM user margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash user margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply user margin levels to the P-Flash block only. Valid margin level settings for the Set User Margin Level command are defined in Table 28-55. Table 28-55. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 28-56. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch. ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None None None Set if command not available in current mode (see Table 28-27). Set if an invalid margin level setting is supplied. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 28.4.6.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of the P-Flash or EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1061 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-57. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Flash block selection code [1:0]. Table 28-34 See Margin level setting. Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the field margin level for the targeted block and then set the CCIF flag. NOTE When the EEPROM block is targeted, the EEPROM field margin levels are applied only to the EEPROM reads. However, when the P-Flash block is targeted, the P-Flash field margin levels are applied to both P-Flash and EEPROM reads. It is not possible to apply field margin levels to the P-Flash block only. Valid margin level settings for the Set Field Margin Level command are defined in Table 28-58. Table 28-58. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 0x0004 1 2 Level Description Return to Normal Level User Margin-1 Level1 User Margin-0 Level2 Field Margin-1 Level1 Field Margin-0 Level2 Read margin to the erased state Read margin to the programmed state Table 28-59. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch. ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None None None Set if command not available in current mode (see Table 28-27). Set if an invalid margin level setting is supplied. MC9S12G Family Reference Manual, Rev.1.01 1062 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at field margin levels, the Flash memory contents should be erased and reprogrammed. 28.4.6.14 Erase Verify EEPROM Section Command The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased. The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the number of words. Table 28-60. Erase Verify EEPROM Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of the first word to be verified Number of words to be verified Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT bits will be set. Table 28-61. Erase Verify EEPROM Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested section breaches the end of the EEPROM block None Set if any errors have been encountered during the read or if blank check failed. Set if any non-correctable errors have been encountered during the read or if blank check failed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1063 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.4.6.15 Program EEPROM Command The Program EEPROM operation programs one to four previously erased words in the EEPROM block. The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 28-62. Program EEPROM Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [17:16] to identify the EEPROM block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index value at Program EEPROM command launch determines how many words will be programmed in the EEPROM block. The CCIF flag is set when the operation has completed. Table 28-63. Program EEPROM Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the requested group of words breaches the end of the EEPROM block Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 28.4.6.16 Erase EEPROM Sector Command The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block. MC9S12G Family Reference Manual, Rev.1.01 1064 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) Table 28-64. Erase EEPROM Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [17:16] to identify EEPROM block Global address [15:0] anywhere within the sector to be erased. See Section 28.1.2.2 for EEPROM sector size. Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector operation has completed. Table 28-65. Erase EEPROM Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 28-27) ACCERR Set if an invalid global address [17:0] is suppliedsee Table 28-3) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if a misaligned word address is supplied (global address [0] != 0) Set if the selected area of the EEPROM memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation 28.4.7 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an ECC fault. Table 28-66. Flash Interrupt Sources Interrupt Source Flash Command Complete ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1065 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 28.4.7.1 Description of Flash Interrupt Operation The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the DFDIF and SFDIF flags in combination with the DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 28.3.2.5, “Flash Configuration Register (FCNFG)”, Section 28.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 28.3.2.7, “Flash Status Register (FSTAT)”, and Section 28.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 28-27. CCIE CCIF Flash Command Interrupt Request DFDIE DFDIF Flash Error Interrupt Request SFDIE SFDIF Figure 28-27. Flash Module Interrupts Implementation 28.4.8 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 28.4.7, “Interrupts”). 28.4.9 Stop Mode If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation will be completed before the MCU is allowed to enter stop mode. MC9S12G Family Reference Manual, Rev.1.01 1066 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) 28.5 Security The Flash module provides security information to the MCU. The Flash security state is defined by the SEC bits of the FSEC register (see Table 28-11). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash configuration field at global address 0x3_FF0F. The security state out of reset can be permanently changed by programming the security byte assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 28.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x3_FF00-0x3_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 28.3.2.2), the Verify Backdoor Access Key command (see Section 28.4.6.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 28-11) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash memory and EEPROM memory will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 28.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 28.4.6.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte (0x3_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x3_FF00-0x3_FF07 are unaffected by the Verify Backdoor Access Key command sequence. The Verify Backdoor Access Key command sequence has no effect on the program and erase protections defined in the Flash protection register, FPROT. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1067 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x3_FF00-0x3_FF07 in the Flash configuration field. 28.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM A secured MCU can be unsecured in special single chip mode by using the following method to erase the P-Flash and EEPROM memory: 1. Reset the MCU into special single chip mode 2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if the P-Flash and EEPROM memories are erased 3. Send BDM commands to disable protection in the P-Flash and EEPROM memory 4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below are skeeped. 5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode 6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that the P-Flash and EEPROM memory are erased If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM commands will now be enabled and the Flash security byte may be programmed to the unsecure state by continuing with the following steps: 7. Send BDM commands to execute the Program P-Flash command write sequence to program the Flash security byte to the unsecured state 8. Reset the MCU 28.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 28-27. 28.6 Initialization On each system reset the flash module executes an initialization sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and EEPROT protection registers, and the FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the initialization sequence is marked by setting CCIF high which enables user commands. MC9S12G Family Reference Manual, Rev.1.01 1068 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1069 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. 240 KByte Flash Module (S12FTMRG240K2V1) MC9S12G Family Reference Manual, Rev.1.01 1070 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. How to Reach Us: USA/Europe/Locations not listed: Freescale Semiconductor Literature Distribution P.O. Box 5405, Denver, Colorado 80217 1-800-521-6274 or 480-768-2130 Japan: Freescale Semiconductor Japan Ltd. SPS, Technical Information Center 3-20-1, Minami-Azabu Minato-ku Tokyo 106-8573, Japan 81-3-3440-3569 Asia/Pacific: Freescale Semiconductor H.K. Ltd. 2 Dai King Street Tai Po Industrial Estate Tai Po, N.T. Hong Kong 852-26668334 Learn More: For more information about Freescale Semiconductor products, please visit http://www.freescale.com Information in this document is provided solely to enable system and software implementers to use Freescale Semiconductor products. There are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. Freescale Semiconductor reserves the right to make changes without further notice to any products herein. Freescale Semiconductor makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does Freescale Semiconductor assume any liability arising out of the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation consequential or incidental damages. “Typical” parameters which may be provided in Freescale Semiconductor data sheets and/or specifications can and do vary in different applications and actual performance may vary over time. All operating parameters, including “Typicals” must be validated for each customer application by customer’s technical experts. Freescale Semiconductor does not convey any license under its patent rights nor the rights of others. Freescale Semiconductor products are not designed, intended, or authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other application in which the failure of the Freescale Semiconductor product could create a situation where personal injury or death may occur. Should Buyer purchase or use Freescale Semiconductor products for any such unintended or unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor and its officers, employees, subsidiaries, affiliates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that Freescale Semiconductor was negligent regarding the design or manufacture of the part. Freescale™ and the Freescale logo are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. © Freescale Semiconductor, Inc. 2006 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Appendix A Electrical Characteristics Revision History Version Number Rev 0.14 Rev 0.15 Revision Date 8-Nov-2010 3-Dec-2010 • Updated Table A-12 • Updated Table A-22 • • • • • Updated Table A-4 Updated Table A-5 Updated Table A-12 Updated Table A-13 Updated Table A-34 Description of Changes Rev 0.16 Rev 0.16 14-Dec-2010 20-Dec-2010 • Updated Table A-9 • Updated Section A.8, “Electrical Characteristics for the IRC1M” • • • • Corrected Table A-4 Updated Table A-11, Table A-12, and Table A-13 Updated Table A-33, and Table A-33 Updated Section A.6.1, “Timing Parameters” Rev 0.17 Rev 0.18 3-Jan-2011 17-Jan-2011 • Updated Section A.6.1, “Timing Parameters” • Typos and formating • Updated Table A-10 • Updated Table A-11 • Updated Table A-22 • • • • • • • Updated Table A-11 Updated Table A-12 Updated Table A-22 Updated Section A.6.1, “Timing Parameters” Updated Table A-23 Updated Table A-32 Updated Table A-33 Rev 0.19 19-Jan-2011 Rev 0.20 Rev 0.21 Rev 0.22 21-Feb-2011 4-Mar-2011 1-Apr-2011 • Updated Section A.14, “SPI Timing” • Updated Table A-22” • Updated Table A-29 • Updated Table A-11 • Updated Table A-12 • Updated Table A-13 • • • • • Updated Table A-5 Updated Table A-6 Updated Table A-7 Updated Table A-16 Updated Table A-18 Rev 0.23 13-Apr-2011 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1073 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Version Number Rev 0.24 Revision Date 19-Apr-2011 • • • • • • • Updated Table A-11 Updated Table A-16 Updated Table A-17 Updated Table A-18 Updated Table A-19 Updated Table A-25 Updated Table A-28 Description of Changes Rev 0.25 Rev 0.29 21-Apr-2011 11-Mar-2011 • Clean-up • Updated Table A-27 A.1 General This supplement contains the most accurate electrical information for the MC9S12G microcontroller available at the time of publication. This introduction is intended to give an overview on several common topics like power supply, current injection etc. A.1.1 Parameter Classification The electrical parameters shown in this supplement are guaranteed by various methods. To give the customer a better understanding the following classification is used and the parameters are tagged accordingly in the tables where appropriate. NOTE This classification is shown in the column labeled “C” in the parameter tables where appropriate. P: C: T: Those parameters are guaranteed during production testing on each individual device. Those parameters are achieved by the design characterization by measuring a statistically relevant sample size across process variations. Those parameters are achieved by design characterization on a small sample size from typical devices under typical conditions unless otherwise noted. All values shown in the typical column are within this category. Those parameters are derived mainly from simulations. D: A.1.2 Power Supply The VDDA, VSSA pin pairs supply the A/D converter and parts of the internal voltage regulator. The VDDX, VSSX pin pairs [3:1] supply the I/O pins. VDDR supplies the internal voltage regulator. The VDDF, VSS1 pin pair supplies the internal NVM logic. All VDDX pins are internally connected by metal. MC9S12G Family Reference Manual, Rev.1.01 1074 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics All VSSX pins are internally connected by metal. VDDA, VDDX and VSSA, VSSX are connected by diodes for ESD protection. NOTE In the following context VDD35 is used for either VDDA, VDDR, and VDDX; VSS35 is used for either VSSA and VSSX unless otherwise noted. IDD35 denotes the sum of the currents flowing into the VDDA, VDDX and VDDR pins. A.1.3 Pins There are four groups of functional pins. A.1.3.1 I/O Pins The I/O pins have a level in the range of 3.13V to 5.5V. This class of pins is comprised of all port I/O pins, the analog inputs, BKGD and the RESET pins. Some functionality may be disabled. A.1.3.2 Analog Reference This group consists of the VRH pin. A.1.3.3 Oscillator The pins EXTAL, XTAL dedicated to the oscillator have a nominal 1.8V level. A.1.3.4 TEST This pin is used for production testing only. The TEST pin must be tied to ground in all applications. A.1.4 Current Injection Power supply must maintain regulation within operating VDD35 or VDD range during instantaneous and operating maximum current conditions. If positive injection current (Vin > VDD35) is greater than IDD35, the injection current may flow out of VDD35 and could result in external power supply going out of regulation. Ensure external VDD35 load will shunt current greater than maximum injection current. This will be the greatest risk when the MCU is not consuming power; e.g., if no system clock is present, or if clock rate is very low which would reduce overall power consumption. A.1.5 Absolute Maximum Ratings Absolute maximum ratings are stress ratings only. A functional operation under or outside those maxima is not guaranteed. Stress beyond those limits may affect the reliability or cause permanent damage of the device. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1075 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics This device contains circuitry protecting against damage due to high static voltage or electrical fields; however, it is advised that normal precautions be taken to avoid application of any voltages higher than maximum-rated voltages to this high-impedance circuit. Reliability of operation is enhanced if unused inputs are tied to an appropriate logic voltage level (e.g., either VSS35 or VDD35). Table A-1. Absolute Maximum Ratings1 Num 1 2 3 4 5 6 7 8 9 1 2 Rating I/O, regulator and analog supply voltage Voltage difference VDDX to VDDA Voltage difference VSSX to VSSA Digital I/O input voltage Analog reference EXTAL, XTAL Instantaneous maximum current Single pin limit for all digital I/O pins2 Instantaneous maximum current Single pin limit for EXTAL, XTAL Storage temperature range Symbol VDD35 ∆VDDX ∆VSSX VIN VRH VILV ID I DL Min –0.3 –6.0 –0.3 –0.3 –0.3 –0.3 –25 –25 –65 Max 6.0 0.3 0.3 6.0 6.0 2.16 +25 +25 155 Unit V V V V V V mA mA °C Tstg Beyond absolute maximum ratings device might be damaged. All digital I/O pins are internally clamped to VSSX and VDDX, or VSSA and VDDA. A.1.6 ESD Protection and Latch-up Immunity All ESD testing is in conformity with CDF-AEC-Q100 stress test qualification for automotive grade integrated circuits. During the device qualification ESD stresses were performed for the Human Body Model (HBM) and the Charge Device Model. A device will be defined as a failure if after exposure to ESD pulses the device no longer meets the device specification. Complete DC parametric and functional testing is performed per the applicable device specification at room temperature followed by hot temperature, unless specified otherwise in the device specification. Table A-2. ESD and Latch-up Test Conditions Model Description Symbol Value Unit Series Resistance Storage Capacitance Human Body Number of Pulse per pin positive negative R1 C - 1500 100 3 3 Ω pF MC9S12G Family Reference Manual, Rev.1.01 1076 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-3. ESD and Latch-Up Protection Characteristics Num 1 2 3 C C C C Rating Symbol Min Max Unit Human Body Model (HBM) Charge Device Model (CDM) Charge Device Model (CDM) (Corner Pins) VHBM VCDM VCDM 2000 500 750 - V V V A.1.7 Operating Conditions This section describes the operating conditions of the device. Unless otherwise noted those conditions apply to all the following data. NOTE Please refer to the temperature rating of the device (C, V, M) with regards to the ambient temperature TA and the junction temperature TJ. For power dissipation calculations refer to Section A.1.8, “Power Dissipation and Thermal Characteristics”. Table A-4. Operating Conditions Rating I/O, regulator and analog supply voltage Oscillator Bus frequency Temperature Option C Operating ambient temperature range1 Operating junction temperature range Temperature Option V Operating ambient temperature range1 Operating junction temperature range Temperature Option M Operating ambient temperature range1 Operating junction temperature range 1 Symbol VDD35 fosc fbus TA TJ TA TJ TA TJ Min 3.13 4 0.5 –40 –40 –40 –40 –40 –40 Typ 5 — — 27 — 27 — 27 — Max 5.5 16 25 85 105 Unit V MHz MHz °C °C 105 125 °C 125 150 Please refer to Section A.1.8, “Power Dissipation and Thermal Characteristics” for more details about the relation between ambient temperature TA and device junction temperature TJ. NOTE Operation is guaranteed when powering down until low voltage reset assertion. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1077 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.1.8 Power Dissipation and Thermal Characteristics Power dissipation and thermal characteristics are closely related. The user must assure that the maximum operating junction temperature is not exceeded. The average chip-junction temperature (TJ) in °C can be obtained from: T T T J A D = Junction Temperature, [ ° C ] = Ambient Temperature, [ ° C ] = Total Chip Power Dissipation, [W] = Package Thermal Resistance, [ ° C/W] J = T + (P • Θ ) A D JA P Θ JA The total power dissipation can be calculated from: P P D =P INT +P IO INT = Chip Internal Power Dissipation, [W] 2 = ⋅I P R IO DSON IO i i ∑ PIO is the sum of all output currents on I/O ports associated with VDDX, whereby R V OL = ----------- ;for outputs driven low DSON I OL R V –V DD35 OH = --------------------------------------- ;for outputs driven high DSON I OH P INT =I DDR ⋅V DDR +I DDA ⋅V DDA MC9S12G Family Reference Manual, Rev.1.01 1078 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1079 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-5. Thermal Package Characteristics1 S12GN32, S12GN16 S12G240, S12G64, S12G128, S12GA240, Unit S12G48, S12G192, S12G96 S12GN48 S12GA192 Num C Rating Symbol 20-pin TSSOP 1 2 3 4 5 6 7 D D D D Thermal resistance single sided PCB, natural convection2 Thermal resistance single sided PCB @ 200 ft/min3 Thermal resistance double sided PCB with 2 internal planes, natural convection3 Thermal resistance double sided PCB with 2 internal planes @ 200 ft/min3 θJA θJMA θJA θJMA θJB θJC 6 91 72 58 51 29 20 4 °C/W °C/W °C/W °C/W °C/W °C/W °C/W D Junction to Board4 D Junction to Case 5 D Junction to Package Top ΨJT 32-pin LQFP 8 9 10 11 12 13 14 D D D D Thermal resistance single sided PCB, natural convection2 Thermal resistance single sided PCB @ 200 ft/min3 Thermal resistance double sided PCB with 2 internal planes, natural convection3 Thermal resistance double sided PCB with 2 internal planes @ 200 ft/min3 θJA θJMA θJA θJMA θJB θJC 81 68 57 50 35 25 8 84 70 56 49 32 23 6 °C/W °C/W °C/W °C/W °C/W °C/W °C/W D Junction to Board4 D Junction to Case 5 6 D Junction to Package Top ΨJT 48-pin LQFP 15 16 17 18 19 20 21 D D D D Thermal resistance single sided PCB, natural convection2 Thermal resistance single sided PCB @ 200 ft/min3 Thermal resistance double sided PCB with 2 internal planes, natural convection3 Thermal resistance double sided PCB with 2 internal planes @ 200 ft/min3 θJA θJMA θJA θJMA θJB θJC 81 68 57 50 35 25 8 80 67 56 50 34 24 6 79 66 56 49 33 21 4 tbd tbd tbd tbd tbd tbd tbd °C/W °C/W °C/W °C/W °C/W °C/W °C/W D Junction to Board4 D Junction to Case 5 6 D Junction to Package Top ΨJT MC9S12G Family Reference Manual, Rev.1.01 1080 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-5. Thermal Package Characteristics1 S12GN32, S12GN16 S12G240, S12G64, S12G128, S12GA240, Unit S12G48, S12G192, S12G96 S12GN48 S12GA192 Num C Rating Symbol 48-pin QFN 22 23 24 25 26 27 28 D D D D Thermal resistance single sided PCB, natural convection2 Thermal resistance single sided PCB @ 200 ft/min3 Thermal resistance double sided PCB with 2 internal planes, natural convection3 Thermal resistance double sided PCB with 2 internal planes @ 200 ft/min3 θJA θJMA θJA θJMA θJB θJC 6 tbd 67 28 23 11 N/A 4 °C/W °C/W °C/W °C/W °C/W °C/W °C/W D Junction to Board4 D Junction to Case 5 D Junction to Package Top ΨJT 64-pin LQFP 29 30 31 32 33 34 35 D D D D Thermal resistance single sided PCB, natural convection2 Thermal resistance single sided PCB @ 200 ft/min3 Thermal resistance double sided PCB with 2 internal planes, natural convection3 Thermal resistance double sided PCB with 2 internal planes @ 200 ft/min3 θJA θJMA θJA θJMA θJB θJC 70 59 52 46 34 20 5 70 58 52 46 34 18 4 tbd tbd tbd tbd tbd tbd tbd °C/W °C/W °C/W °C/W °C/W °C/W °C/W D Junction to Board4 D Junction to Case 5 6 D Junction to Package Top ΨJT 100-pin LQFP 36 37 38 39 40 41 42 1 D D D D Thermal resistance single sided PCB, natural convection2 Thermal resistance single sided PCB @ 200 ft/min3 Thermal resistance double sided PCB with 2 internal planes, natural convection3 Thermal resistance double sided PCB with 2 internal planes @ 200 ft/min3 θJA θJMA θJA θJMA θJB θJC 61 51 49 43 34 16 3 tbd tbd tbd tbd tbd tbd tbd °C/W °C/W °C/W °C/W °C/W °C/W °C/W D Junction to Board4 D Junction to Case 5 6 D Junction to Package Top ΨJT The values for thermal resistance are achieved by package simulations MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1081 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics 2 3 Per JEDEC JESD51-2 with the single layer board (JESD51-3) horizontal.J Per JEDEC JESD51-6 with the board (JESD51-7) horizontal. 4 .Thermal resistance between the die and the printed circuit board per JEDEC JESD51-8. Board temperature is measured in simulation on the top surface of the board near the package. 5 Thermal resistance between the die and the case top surface as measured in simulation by the cold plate method (MIL SPEC-883 Method 1012.1). 6 Thermal characterization parameter indicating the temperature difference between package top and the junction temperature per JEDEC JESD51-2. ΨJT is a useful value to use to estimate junction temperature in a steady state customer enviroment. A.2 I/O Characteristics This section describes the characteristics of all I/O pins except EXTAL, XTAL, TEST, and supply pins. Table A-6. 3.3-V I/O Characteristics ALL 3.3V RANGE I/O PARAMETERS ARE SUBJECT TO CHANGE FOLLOWING CHARACTERIZATION Conditions are 3.15 V < VDD35 < 3.6 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C 1 2 3 4 5 6 P Input high voltage T Input high voltage P Input low voltage T Input low voltage C Input hysteresis Input leakage current (pins in high impedance input mode)1 Vin = VDD35 or VSS35 P M temperature range V temperature range C temperature range C Input leakage current (pins in high impedance input mode)1 Vin = VDD35 or VSS35 27°C P Output high voltage (pins in output mode) IOH = –1.75 mA C Output low voltage (pins in output mode) IOL = +1.75 mA P Internal pull up device current VIH min > input voltage > VIL max P Internal pull down device current VIH min > input voltage > VIL max D Input capacitance T Injection current Single pin limit Total device limit, sum of all injected currents P Port J, P, AD interrupt input pulse filtered (STOP)3 P Port J, P, AD interrupt input pulse passed (STOP) 3 2 Rating Symbol VIH VIH VIL VIL VHYS I in Min 0.65V*VDD35 — — VSS35 – 0.3 0.06V*VDD35 Typ — — — — — Max — VDD35+0.3 0.35*VDD35 — 0.3V*VDD35 Unit V V V V mV µA -1 -0.5 -0.4 Iin — — — 1 0.5 0.4 µA 7 1 VOH V OL 8 9 10 11 12 13 VDD35-0.4 — — — — — 7 — — V V µA µA pF mA 0.4 –70 70 — 2.5 25 IPUL IPDH Cin IICS IICP tP_MASK tP_PASS -1 1 — –2.5 –25 — 10 14 15 — — 3 — µs µs MC9S12G Family Reference Manual, Rev.1.01 1082 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-6. 3.3-V I/O Characteristics ALL 3.3V RANGE I/O PARAMETERS ARE SUBJECT TO CHANGE FOLLOWING CHARACTERIZATION Conditions are 3.15 V < VDD35 < 3.6 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C 16 17 18 1 Rating Symbol nP_MASK nP_PASS nIRQ Min — 4 1 Typ — — — Max 3 — — Unit D Port J, P, AD interrupt input pulse filtered (STOP) in number of bus clock cycles of period 1/fbus D Port J, P, AD interrupt input pulse passed (STOP) in number of bus clock cycles of period 1/fbus D IRQ pulse width, edge-sensitive mode (STOP) in number of bus clock cycles of period 1/fbus Maximum leakage current occurs at maximum operating temperature. Current decreases by approximately one-half for each 8°C to 12 C in the temperature range from 50°C to 125°C. ° 2 Refer to Section A.1.4, “Current Injection” for more details 3 Parameter only applies in stop or pseudo stop mode. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1083 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-7. 5-V I/O Characteristics ALL 5V RANGE I/O PARAMETERS ARE SUBJECT TO CHANGE FOLLOWING CHARACTERIZATION Conditions are 4.5 V < VDD35 < 5.5 V junction temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C 1 2 3 4 5 6 P Input high voltage T Input high voltage P Input low voltage T Input low voltage C Input hysteresis Input leakage current (pins in high impedance input mode)1 Vin = VDD35 or VSS35 P M temperature range V temperature range C temperature range C Input leakage current (pins in high impedance input mode)1 Vin = VDD35 or VSS35 27°C P Output high voltage (pins in output mode) IOH = –4 mA P Output low voltage (pins in output mode) IOL = +4mA P Internal pull up current VIH min > input voltage > VIL max P Internal pull down current VIH min > input voltage > VIL max D Input capacitance T Injection current Single pin limit Total device Limit, sum of all injected currents P Port J, P, AD interrupt input pulse filtered (STOP)3 P Port J, P, AD interrupt input pulse passed (STOP) 3 2 Rating Symbol V IH Min 0.65*VDD35 — — VSSRX–0.3 0.06V*VDD35 Typ — — — — — Max — VDD35+0.3 0.35*VDD35 — 0.3V*VDD35 Unit V V V V mV µA VIH VIL VIL VHYS I in -1 -0.5 -0.4 Iin — — — 1 0.5 0.4 µA 7 1 VOH V OL 8 9 10 11 12 13 VDD35 – 0.8 — -10 10 — –2.5 –25 — 10 — 4 1 — — — — 7 — — 0.8 -130 130 — 2.5 25 V V µA µA pF mA IPUL IPDH Cin IICS IICP tP_MASK tP_PASS nP_MASK nP_PASS nIRQ 14 15 16 17 18 1 — — — — — 3 — 3 — — µs µs D Port J, P, AD interrupt input pulse filtered (STOP) in number of bus clock cycles of period 1/fbus D Port J, P, AD interrupt input pulse passed (STOP) in number of bus clock cycles of period 1/fbus D IRQ pulse width, edge-sensitive mode (STOP) in number of bus clock cycles of period 1/fbus Maximum leakage current occurs at maximum operating temperature. Current decreases by approximately one-half for each 8°C to 12 C in the temperature range from 50°C to 125°C. ° 2 Refer to Section A.1.4, “Current Injection” for more details 3 Parameter only applies in stop or pseudo stop mode. MC9S12G Family Reference Manual, Rev.1.01 1084 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.2.1 Supply Currents This section describes the current consumption characteristics of the device as well as the conditions for the measurements. A.2.1.1 Measurement Conditions Run current is measured on VDDR pin. It does not include the current to drive external loads. Unless otherwise noted the currents are measured in special single chip mode and the CPU code is executed from RAM. For Run and Wait current measurements PLL is on and the reference clock is the IRC1M trimmed to 1MHz. The bus frequency is 25MHz and the CPU frequency is 50MHz. Table A-8., Table A-9. and Table A-10. show the configuration of the CPMU module and the peripherals for Run, Wait and Stop current measurement. Table A-8. CPMU Configuration for Pseudo Stop Current Measurement CPMU REGISTER CPMUCLKS CPMUOSC CPMURTI CPMUCOP Bit settings/Conditions PLLSEL=0, PSTP=1, PRE=PCE=RTIOSCSEL=COPOSCSEL=1 OSCE=1, External Square wave on EXTAL fEXTAL=4MHz, VIH= 1.8V, VIL=0V RTDEC=0, RTR[6:4]=111, RTR[3:0]=1111; WCOP=1, CR[2:0]=111 Table A-9. CPMU Configuration for Run/Wait and Full Stop Current Measurement CPMU REGISTER CPMUSYNR CPMUPOSTDIV CPMUCLKS CPMUOSC Bit settings/Conditions VCOFRQ[1:0]=01,SYNDIV[5:0] = 24 POSTDIV[4:0]=0 PLLSEL=1 OSCE=0, Reference clock for PLL is fref=firc1m trimmed to 1MHz API settings for STOP current measurement CPMUAPICTL CPMUAPITR CPMUAPIRH/RL APIEA=0, APIFE=1, APIE=0 trimmed to 10Khz set to $FFFF MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1085 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-10. Peripheral Configurations for Run & Wait Current Measurement Peripheral MSCAN SPI SCI PWM ADC Configuration Configured to loop-back mode using a bit rate of 1Mbit/s Configured to master mode, continuously transmit data (0x55 or 0xAA) at 1Mbit/s Configured into loop mode, continuously transmit data (0x55) at speed of 57600 baud Configured to toggle its pins at the rate of 40kHz The peripheral is configured to operate at its maximum specified frequency and to continuously convert voltages on all input channels in sequence. The module is enabled and the comparators are configured to trigger in outside range.The range covers all the code executed by the core. The peripheral shall be configured to output compare mode, pulse accumulator and modulus counter enabled. Both modules are enabled. The module is enabled with analog output on. The ACMPP and ACMPM are toggling with 0-1 and 1-0. DAC0 and DAC1 is buffered at full voltage range (DACxCTL = $87). The module is enabled and ADC is running at 6.25MHz with maximum bus freq DBG TIM COP & RTI ACMP1 DAC2 RVA3 1 2 Onlly available on S12GN16, S12GN32, S12GN48, S12G48, and S12G64 Only available on S12G192, S12GA192, S12G340, and S12GA240 3 Only available on S12GA192 and S12GA240 MC9S12G Family Reference Manual, Rev.1.01 1086 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-11. Run and Wait Current Characteristics Conditions are: VDDR=5.5V, TA=125°C, see Table A-9. and Table A-10. Num C Rating Symbol Min Typ Max Unit S12GN16, S12GN32 1 2 3 4 5 6 7 8 9 10 11 12 P C P P C P P C P P C P IDD Run Current (code execution from RAM) IDD Run Current (code execution from flash) IDD Wait Current IDD Run Current (code execution from RAM) IDD Run Current (code execution from flash) IDD Wait Current IDD Run Current (code execution from RAM) IDD Run Current (code execution from flash) IDD Wait Current IDD Run Current (code execution from RAM) IDD Run Current (code execution from flash) IDD Wait Current IDDRr IDDRf IDDW IDDRr IDDRf IDDW IDDRr IDDRf IDDW IDDRr IDDRf IDDW 12 tbd 7 tbd tbd tbd 16 17 10 tbd tbd tbd tbd 14 tbd tbd 23 9 tbd 16 mA mA mA mA mA mA mA mA mA mA mA mA S12GN48, S12G48, S12G64 S12G96, S12G128 S12G192, S12GA192, S12G240, S12GA240 MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1087 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-12. Full Stop Current Characteristics Conditions are: Typ: VDDX,VDDR,VDDA=5V, Max: VDDX,VDDR,VDDA=5.5V API see Table A-9. Num C Rating Symbol Min Typ Max Unit S12GN16, S12GN32 Stop Current API disabled 1 2 3 4 5 6 P P P C C C -40°C 25°C 150°C -40°C 25°C 150°C IDDS IDDS IDDS Stop Current API enabled IDDS IDDS IDDS Stop Current API disabled 7 8 9 10 11 12 P P P C C C -40°C 25°C 150°C -40°C 25°C 150°C IDDS IDDS IDDS Stop Current API enabled IDDS IDDS IDDS Stop Current API disabled 13 14 15 16 17 18 P P P C C C -40°C 25°C 150°C -40°C 25°C 150°C IDDS IDDS IDDS Stop Current API enabled IDDS IDDS IDDS Stop Current API disabled 19 20 21 22 23 24 P P P C C C -40°C 25°C 150°C -40°C 25°C 150°C IDDS IDDS IDDS Stop Current API enabled IDDS IDDS IDDS tbd tbd tbd µA µA µA tbd tbd tbd tbd tbd tbd µA µA µA 20 23 278 µA µA µA 16 18 270 29 30 772 µA µA µA tbd tbd tbd µA µA µA tbd tbd tbd tbd tbd tbd µA µA µA 19 23 116 µA µA µA 15 19 76 24 28 566 µA µA µA S12GN48, S12G48, S12G64 S12G96, S12G128 S12G192, S12GA192, S12G240, S12GA240 MC9S12G Family Reference Manual, Rev.1.01 1088 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-13. Pseudo Stop Current Characteristics Conditions are: VDDX=5V, VDDR=5V, VDDA=5V, RTI and COP and API enabled, see Table A-8. Num C -40°C 25°C 150°C -40°C 25°C 150°C -40°C 25°C 150°C -40°C 25°C 150°C Rating Symbol Min Typ Max Unit µA µA µA µA µA µA µA µA µA µA µA µA S12GN16, S12GN32 1 2 3 4 5 6 7 8 9 10 11 12 C C C C C C C C C C C C IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS IDDPS 297 312 417 tbd tbd tbd 403 406 1021 tbd tbd tbd S12GN48, S12G48, S12G64 S12G96, S12G128 S12G192, S12GA192, S12G240, S12GA240 A.3 ADC Characteristics This section describes the characteristics of the analog-to-digital converter. A.3.1 ATD Operating Characteristics The Table A-14 and Table A-15 show conditions under which the ATD operates. The following constraints exist to obtain full-scale, full range results: VSSA ≤ VRL ≤ VIN ≤ VRH ≤ VDDA. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1089 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics This constraint exists since the sample buffer amplifier can not drive beyond the power supply levels that it ties to. If the input level goes outside of this range it will effectively be clipped. Table A-14. ATD Operating Characteristics Supply voltage 3.13 V < VDDA < 5.5 V, -40oC < TJ < 150oC Num C 1 D Reference potential Low High D Voltage difference VDDX to VDDA D Voltage difference VSSX to VSSA C Differential reference voltage 1 Rating Symbol VRL VRH ∆VDDX ∆VSSX VRH-VRL fATDCLk NCONV12 NCONV10 NCONV8 Min VSSA VDDA/2 –2.35 –0.1 3.13 0.25 Typ — — 0 0 5.0 Max VDDA/2 VDDA 0.1 0.1 5.5 8.0 Unit V V V V V MHz 2 3 4 5 C ATD Clock Frequency (derived from bus clock via the prescaler bus) ATD Conversion Period2 12 bit resolution: D 10 bit resolution: 8 bit resolution: 8 20 19 17 42 41 39 ATD clock Cycles 1 2 Full accuracy is not guaranteed when differential voltage is less than 4.50 V The minimum time assumes a sample time of 4 ATD clock cycles. The maximum time assumes a sample time of 24 ATD clock cycles and the discharge feature (SMP_DIS) enabled, which adds 2 ATD clock cycles. A.3.2 Factors Influencing Accuracy Source resistance, source capacitance and current injection have an influence on the accuracy of the ATD. A further factor is that PortAD pins that are configured as output drivers switching. A.3.2.1 Port AD Output Drivers Switching PortAD output drivers switching can adversely affect the ATD accuracy whilst converting the analog voltage on other PortAD pins because the output drivers are supplied from the VDDA/VSSA ATD supply pins. Although internal design measures are implemented to minimize the affect of output driver noise, it is recommended to configure PortAD pins as outputs only for low frequency, low load outputs. The impact on ATD accuracy is load dependent and not specified. The values specified are valid under condition that no PortAD output drivers switch during conversion. A.3.2.2 Source Resistance Due to the input pin leakage current as specified in conjunction with the source resistance there will be a voltage drop from the signal source to the ATD input. The maximum source resistance RS specifies results in an error (10-bit resolution) of less than 1/2 LSB (2.5 mV) at the maximum leakage current. If device or operating conditions are less than worst case or leakage-induced error is acceptable, larger values of source resistance of up to 10Kohm are allowed. MC9S12G Family Reference Manual, Rev.1.01 1090 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.3.2.3 Source Capacitance When sampling an additional internal capacitor is switched to the input. This can cause a voltage drop due to charge sharing with the external and the pin capacitance. For a maximum sampling error of the input voltage ≤ 1LSB (10-bit resilution), then the external filter capacitor, Cf ≥ 1024 * (CINS–CINN). A.3.2.4 Current Injection There are two cases to consider. 1. A current is injected into the channel being converted. The channel being stressed has conversion values of $3FF (in 10-bit mode) for analog inputs greater than VRH and $000 for values less than VRL unless the current is higher than specified as disruptive condition. 2. Current is injected into pins in the neighborhood of the channel being converted. A portion of this current is picked up by the channel (coupling ratio K), This additional current impacts the accuracy of the conversion depending on the source resistance. The additional input voltage error on the converted channel can be calculated as: VERR = K * RS * IINJ with IINJ being the sum of the currents injected into the two pins adjacent to the converted channel. Table A-15. ATD Electrical Characteristics Supply voltage 3.13 V < VDDA < 5.5 V, -40oC < TJ < 150oC Num C 1 2 3 4 5 6 1 Rating Symbol RS CINN CINS RINA INA Kp Kn Min — — — -2.5 — — Typ — — — 5 — — — Max 1 10 16 15 2.5 1E-4 5E-3 Unit KΩ pF kΩ mA A/A A/A C Max input source resistance1 D Total input capacitance Non sampling Total input capacitance Sampling D Input internal Resistance C Disruptive analog input current C Coupling ratio positive current injection C Coupling ratio negative current injection 1 Refer to A.3.2.2 for further information concerning source resistance A.3.3 ATD Accuracy Table A-16 and Table A-18 specifies the ATD conversion performance excluding any errors due to current injection, input capacitance and source resistance. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1091 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.3.3.1 ATD Accuracy Definitions For the following definitions see also Figure A-1. Differential non-linearity (DNL) is defined as the difference between two adjacent switching steps. V –V i i–1 DNL ( i ) = ------------------------- – 1 1LSB The integral non-linearity (INL) is defined as the sum of all DNLs: INL ( n ) = i=1 ∑ n V –V n 0 DNL ( i ) = -------------------- – n 1LSB MC9S12G Family Reference Manual, Rev.1.01 1092 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics DNL Vi-1 $3FF $3FE $3FD $3FC $3FB $3FA $3F9 $3F8 $3F7 $3F6 $3F5 $3F4 10-Bit Resolution $3F3 LSB 10-Bit Absolute Error Boundary Vi 8-Bit Absolute Error Boundary $FF $FE $FD 8-Bit Resolution Vin mV 9 8 7 6 5 4 3 2 1 0 5 10 15 20 25 30 35 40 45 55 60 Ideal Transfer Curve 2 10-Bit Transfer Curve 1 8-Bit Transfer Curve 65 70 75 80 85 90 95 100 105 110 115 120 5000 + Figure A-1. ATD Accuracy Definitions NOTE Figure A-1 shows only definitions, for specification values refer to Table A-16 and Table A-18. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1093 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-16. ADC Conversion Performance 5V range S12GA192 and S12GA240 Supply voltage VDDA =5.12 V, -40oC < TJ < 150oC. VREF = VRH - VRL = 5.12V. fATDCLK = 8.0MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Num C 1 2 3 4 5 6 7 8 9 10 11 12 1 2 3 4 5 6 Rating1 12-Bit 12-Bit 12-Bit 12-Bit 12-Bit4 10-Bit 10-Bit 10-Bit 10-Bit 10-Bit6 8-Bit 8-Bit 8-Bit 8-Bit 5 3 Symbol LSB DNL INL AE LSB DNL INL AE LSB DNL INL AE Min Typ 1.25 Max Unit mV P Resolution P Differential Nonlinearity P Integral Nonlinearity P Absolute Error2 -4 -5 -7 TBD ±2 ±2.5 ±4 ±4 5 ±0.5 ±1 ±2 ±2 20 ±0.3 ±0.5 ±1 4 5 7 TBD counts counts counts mV C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error2 2 -1 -2 -3 TBD 1 2 3 TBD counts counts counts mV -0.5 -1 -1.5 0.5 1 1.5 counts counts counts The 8-bit and 10-bit mode operation is structurally tested in production test. Absolute values are tested in 12-bit mode. These values include the quantization error which is inherently 1/2 count for any A/D converter. LQFP 64 and bigger QFN/LQFP 48 and smaller LQFP 48 and bigger LQFP 32 and smaller MC9S12G Family Reference Manual, Rev.1.01 1094 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-17. ADC Conversion Performance 5V range S12GN16, S12GN32, S12GN48, S12G48, GS48, , S12G64, S12G96, S12G128, S12G192, and S12G240 Supply voltage VDDA =5.12 V, -40oC < TJ < 150oC. VREF = VRH - VRL = 5.12V. fATDCLK = 8.0MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Num C P Resolution P Differential Nonlinearity P Integral Nonlinearity P Absolute Error C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error 1 2 2 2 Rating1 10-Bit 10-Bit 10-Bit 10-Bit3 10-Bit4 8-Bit 8-Bit 8-Bit 8-Bit Symbol LSB DNL INL AE LSB DNL INL AE Min Typ 5 Max Unit mV -1 -2 -3 TBD ±0.5 ±1 ±2 ±2 20 ±0.3 ±0.5 ±1 1 2 3 TBD counts counts counts mV -0.5 -1 -1.5 0.5 1 1.5 counts counts counts The 8-bit mode operation is structurally tested in production test. Absolute values are tested in 10-bit mode. These values include the quantization error which is inherently 1/2 count for any A/D converter. 3 LQFP 48 and bigger 4 LQFP 32 and smaller Table A-18. ADC Conversion Performance 3.3V range S12GA192 and S12GA240 Supply voltage VDDA = 3.3V, -40oC < TJ < 150oC. VREF = VRH - VRL = 3.3V. fATDCLK = 8.0MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Num C 1 2 3 4 5 6 7 8 9 10 11 12 P Resolution P Differential Nonlinearity P Integral Nonlinearity P Absolute Error2 C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error2 C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error 2 Rating1 12-Bit 12-Bit 12-Bit 12-Bit3 12-Bit4 10-Bit 10-Bit 10-Bit 10-Bit5 10-Bit6 8-Bit 8-Bit 8-Bit 8-Bit Symbol LSB DNL INL AE LSB DNL INL AE LSB DNL INL AE Min Typ 0.80 Max Unit mV -6 -7 -8 TBD ±3 ±3 ±4 ±4 3.22 ±1 ±1 ±2 ±2 12.89 ±0.3 ±0.5 ±1 6 7 8 TBD counts counts counts mV -1.5 -2 -3 TBD 1.5 2 3 TBD counts counts counts mV -0.5 -1 -1.5 0.5 1 1.5 counts counts counts MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1095 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics 1 2 3 4 5 6 The 8-bit and 10-bit mode operation is structurally tested in production test. Absolute values are tested in 12-bit mode. These values include the quantization error which is inherently 1/2 count for any A/D converter. LQFP 64 and bigger QFN/LQFP 48 and smaller LQFP 48 and bigger LQFP 32 and smaller Table A-19. ADC Conversion Performance 3.3V range S12GN16, S12GN32, S12GN48, S12G48, GS48, , S12G64, S12G96, S12G128, S12G192, and S12G240 Supply voltage VDDA = 3.3V, -40oC < TJ < 150oC. VREF = VRH - VRL = 3.3V. fATDCLK = 8.0MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Num C 5 6 7 8 9 10 11 12 1 2 Rating1 10-Bit 10-Bit 10-Bit 10-Bit3 10-Bit4 8-Bit 8-Bit 8-Bit 8-Bit Symbol LSB DNL INL AE LSB DNL INL AE Min Typ 3.22 Max Unit mV P Resolution P Differential Nonlinearity P Integral Nonlinearity P Absolute Error C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error2 2 -1.5 -2 -3 TBD ±1 ±1 ±2 ±2 12.89 ±0.3 ±0.5 ±1 1.5 2 3 TBD counts counts counts mV -0.5 -1 -1.5 0.5 1 1.5 counts counts counts The 8-bit mode operation is structurally tested in production test. Absolute values are tested in 10-bit mode. These values include the quantization error which is inherently 1/2 count for any A/D converter. 3 LQFP 48 and bigger 4 LQFP 32 and smaller MC9S12G Family Reference Manual, Rev.1.01 1096 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-20. ATD Conversion Performance 5V range, RVA enabled Supply voltage VDDA =5.0 V, -40oC < TJ < 150oC. VRH = 5.0V. fATDCLK = 0.25 .. 2MHz 1 The values are tested to be valid with no PortAD/C output drivers switching simultaneous with conversions. Num C 1 2 3 4 5 6 7 8 9 10 1 2 Rating 12-Bit 12-Bit 12-Bit 12-Bit Symbol LSB DNL INL AE Vvrh_int Vvrl_int Vvrh_drift Vvrl_drift tsettling_on tsettling_off Min Typ 0.61 Max Unit mV P Resolution P Differential Nonlinearity P Integral Nonlinearity C Absolute Error 2 tbd tbd tbd tbd tbd tbd tbd ±3 ±3.5 tbd tbd tbd tbd tbd tbd tbd 2.5 1 counts counts counts V V µV µV µs µs P internal VRH reference voltage P internal VRL reference voltage C VRH_INT drift vs temperature3 C VRL_INT drift vs temperature C rva turn on settling time C rva turn off settling time Upper limit of fATDCLK is restricted when rva attenuation mode is enaged. These values include the quantization error which is inherently 1/2 count for any A/D converter. 3 Please note: although different in value, drift of vrh_int and vrl_int will go in the same direction. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1097 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.4 ACMP Characteristics Table A-21. ACMP Electrical Characteristics This section describes the electrical characteristics of the analog comparator. Characteristics noted under conditions 3.13V = 50MΩ) Output Voltage (DRIVE bit = 0)1 buffered range A (load >= 100KΩ to VSSA) buffered range A (load >= 100KΩ to VDDA) buffered range B (load >= 100KΩ to VSSA) buffered range B (load >= 100KΩ to VDDA) 0...255/256(VRH-VRL)+VRL 32...287/320(VRH-VRL)+VRL full DAC Range A or B 0 0.15 VDDA-0.15 VDDA V Vout full DAC Range B 10 P Output Voltage (DRIVE bit = 1)2 buffered range B with 6.4KΩ load into resistor divider of 800Ω /6.56KΩ between VDDA and VSSA. (equivalent load is >= 65KΩ to VSSA) or (equivalent load is >= 7.5KΩ to VDDA) Buffer Output Capacitive load Buffer Output Offset Settling time Reverence voltage high Vout full DAC Range B V 11 12 13 14 1 2 D P P D Cload Voffset tdelay Vrefh 0 -30 VDDA-0.1V 3 VDDA 100 +30 5 VDDA+0.1V pF mV µs V DRIVE bit = 1 is not recomended in this case. DRIVE bit = 0 is not allowed with this high load. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1099 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.6 A.6.1 NVM Timing Parameters The time base for all NVM program or erase operations is derived from the bus clock using the FCLKDIV register. The frequency of this derived clock must be set within the limits specified as fNVMOP. The NVM module does not have any means to monitor the frequency and will not prevent program or erase operation at frequencies above or below the specified minimum. When attempting to program or erase the NVM module at a lower frequency, a full program or erase transition is not assured. The following sections provide equations which can be used to determine the time required to execute specific flash commands. All timing parameters are a function of the bus clock frequency, fNVMBUS. All program and erase times are also a function of the NVM operating frequency, fNVMOP. A summary of key timing parameters can be found in Table A-23. A.6.1.1 Erase Verify All Blocks (Blank Check) (FCMD=0x01) The time required to perform a blank check on all blocks is dependent on the location of the first non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming that no non-blank location is found, then the time to erase verify all blocks is given by: FTMRG240K2, FTMRG192K2: 1 t check = 64400 ⋅ -------------------f NVMBUS FTMRG128K1,FTMRG96K1: 1 t check = 33600 ⋅ -------------------f NVMBUS FTMRG64K1, FTMRG48K1: 1 t check = 18000 ⋅ -------------------f NVMBUS FTMRG32K1,FTMRG16K1: 1 t check = 9300 ⋅ -------------------f NVMBUS A.6.1.2 Erase Verify Block (Blank Check) (FCMD=0x02) The time required to perform a blank check is dependent on the location of the first non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. MC9S12G Family Reference Manual, Rev.1.01 1100 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Assuming that no non-blank location is found, then the time to erase verify a P-Flash block is given by: FTMRG240K2, FTMRG192K2: 1 t pcheck = 62200 ⋅ -------------------f NVMBUS FTMRG128K1, FTMRG96K1: 1 t pcheck = 33400 ⋅ -------------------f NVMBUS FTMRG64K1, FTMRG48K1: 1 t pcheck = 16700 ⋅ -------------------f NVMBUS FTMRG32K1, FTMRG16K1: 1 t pcheck = 33400 ⋅ -------------------f NVMBUS Assuming that no non-blank location is found, then the time to erase verify a EEPROM block is given by: FTMRG240K2, FTMRG192K2: 1 t dcheck = 2620 ⋅ -------------------f NVMBUS FTMRG128K1, FTMRG96K1: 1 t dcheck = 2620 ⋅ -------------------f NVMBUS FTMRG64K1, FTMRG48K1: 1 t dcheck = 1540 ⋅ -------------------f NVMBUS MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1101 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics FTMRG32K1, FTMRG16K1: 1 t dcheck = 2620 ⋅ -------------------f NVMBUS A.6.1.3 Erase Verify P-Flash Section (FCMD=0x03) The maximum time to erase verify a section of P-Flash depends on the number of phrases being verified (NVP) and is given by: 1 t ≈ ( 550 + N VP ) ⋅ -------------------f NVMBUS A.6.1.4 Read Once (FCMD=0x04) The maximum read once time is given by: 1 t = 550 ⋅ -------------------f NVMBUS A.6.1.5 Program P-Flash (FCMD=0x06) The programming time for a single phrase of four P-Flash words and the two seven-bit ECC fields is dependent on the bus frequency, fNVMBUS, as well as on the NVM operating frequency, fNVMOP. The typical phrase programming time is given by: 1 1 t ppgm ≈ 62 ⋅ ----------------- + 2900 ⋅ -------------------f NVMBUS f NVMOP The maximum phrase programming time is given by: 1 1 t ppgm ≈ 62 ⋅ ----------------- + 3100 ⋅ -------------------f NVMBUS f NVMOP A.6.1.6 Program Once (FCMD=0x07) The maximum time required to program a P-Flash Program Once field is given by: 1 1 t ≈ 62 ⋅ ----------------- + 2900 ⋅ -------------------f NVMBUS f NVMOP A.6.1.7 Erase All Blocks (FCMD=0x08) The time required to erase all blocks is given by: MC9S12G Family Reference Manual, Rev.1.01 1102 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics FTMRG240K2, FTMRG192K2: 1 1 t mass ≈ 200130 ⋅ ----------------- + 65000 ⋅ -------------------f NVMBUS f NVMOP FTMRG128K1, FTMRG96K1: 1 1 t mass ≈ 100068 ⋅ ----------------- + 33500 ⋅ -------------------f NVMBUS f NVMOP FTMRG64K1, FTMRG48K1: 1 1 t mass ≈ 100068 ⋅ ----------------- + 18300 ⋅ -------------------f NVMBUS f NVMOP FTMRG32K1, FTMRG16K1: 1 1 t mass ≈ 100068 ⋅ ----------------- + 9600 ⋅ -------------------f NVMBUS f NVMOP A.6.1.8 Erase P-Flash Block (FCMD=0x09) The time required to erase the P-Flash block is given by: FTMRG240K2, FTMRG192K1: 1 1 t pmass ≈ 200124 ⋅ ----------------- + 62700 ⋅ -------------------f NVMBUS f NVMOP FTMRG128K1, FTMRG96K1: 1 1 t pmass ≈ 100062 ⋅ ----------------- + 31300 ⋅ -------------------f NVMBUS f NVMOP FTMRG64K1, FTMRG64K1: 1 1 t pmass ≈ 100062 ⋅ ----------------- + 17100 ⋅ -------------------f NVMBUS f NVMOP FTMRG32K1, FTMRG16K1: 1 1 t pmass ≈ 100062 ⋅ ----------------- + 9000 ⋅ -------------------f NVMBUS f NVMOP MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1103 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.6.1.9 Erase P-Flash Sector (FCMD=0x0A) The typical time to erase a 512-byte P-Flash sector is given by: 1 1 t pera ≈ 20400 ⋅ ----------------- + 720 ⋅ -------------------f NVMOP f NVMBUS The maximum time to erase a 512-byte P-Flash sector is given by: 1 1 t pera ≈ 20400 ⋅ ----------------- + 1700 ⋅ -------------------f NVMBUS f NVMOP A.6.1.10 Unsecure Flash (FCMD=0x0B) The maximum time required to erase and unsecure the Flash is given by: FTMRG240K2, FTMRG192K2: 1 1 t uns ≈ 200130 ⋅ ----------------- + 65100 ⋅ -------------------f NVMBUS f NVMOP FTMRG128K1, FTMRG96K1: 1 1 t uns ≈ 100070 ⋅ ----------------- + 33500 ⋅ -------------------f NVMBUS f NVMOP FTMRG64K1, FTMRG48K1: 1 1 t uns ≈ 100070 ⋅ ----------------- + 18300 ⋅ -------------------f NVMBUS f NVMOP FTMRG32K1, FTMRG16K1: 1 1 t uns ≈ 100070 ⋅ ----------------- + 9600 ⋅ -------------------f NVMBUS f NVMOP A.6.1.11 Verify Backdoor Access Key (FCMD=0x0C) The maximum verify backdoor access key time is given by: 1 t = 520 ⋅ -------------------f NVMBUS A.6.1.12 Set User Margin Level (FCMD=0x0D) The maximum set user margin level time is given by: MC9S12G Family Reference Manual, Rev.1.01 1104 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics 1 t = 500 ⋅ -------------------f NVMBUS A.6.1.13 Set Field Margin Level (FCMD=0x0E) The maximum set field margin level time is given by: 1 t = 510 ⋅ -------------------f NVMBUS A.6.1.14 Erase Verify EEPROM Section (FCMD=0x10) The time required to Erase Verify EEPROM for a given number of words NW is given by: 1 t dcheck ≈ ( 520 + N W ) ⋅ -------------------f NVMBUS A.6.1.15 Program EEPROM (FCMD=0x11) EEPROM programming time is dependent on the number of words being programmed and their location with respect to a row boundary since programming across a row boundary requires extra steps. The typical EEPROM programming time is given by the following equation, where NW denotes the number of words: 1 1 t dpgm ≈ ⎛ ( 34 ⋅ N W ) ⋅ ----------------- ⎞ + ⎛ ( 600 + ( 940 ⋅ N W ) ) ⋅ -------------------- ⎞ ⎝ f NVMOP ⎠ ⎝ f NVMBUS ⎠ The maximum EEPROM programming time is given by: 1 1 t dpgm ≈ ⎛ ( 34 ⋅ N W ) ⋅ ----------------- ⎞ + ⎛ ( 600 + ( 1020 ⋅ N W ) ) ⋅ -------------------- ⎞ -⎠ ⎝ ⎝ f NVMOP f NVMBUS ⎠ A.6.1.16 Erase EEPROM Sector (FCMD=0x12) Typical EEPROM sector erase times, expected on a new device where no margin verify fails occur, is given by: 1 1 t dera ≈ 5025 ⋅ ----------------- + 710 ⋅ -------------------f NVMBUS f NVMOP MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1105 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Maximum EEPROM sector erase times is given by: 1 1 t dera ≈ 20400 ⋅ ----------------- + 750 ⋅ -------------------f NVMBUS f NVMOP The EEPROM sector erase time is ~5ms on a new device and can extend to ~20ms as the flash is cycled. MC9S12G Family Reference Manual, Rev.1.01 1106 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-23. NVM Timing Characteristics Num C 1 2 3 Bus frequency Operating frequency D Erase all blocks (mass erase) time (FTMRG240K2, TMRG192K2) Erase all blocks (mass erase) time (FTMRG128K1, FTMRG96K1) Erase all blocks (mass erase) time (FTMRG128K1, FTMRG96K1) Erase all blocks (mass erase) time (FTMRG32K1, FTMRG16K1 4 D Erase verify all blocks (blank check) time (FTMRG240K2, TMRG192K2) Erase verify all blocks (blank check) time (FTMRG128K1, FTMRG96K1) Erase verify all blocks (blank check) time (FTMRG64K1, FTMRG48K1) Erase verify all blocks (blank check) time (FTMRG32K1, FTMRG16K1) 5 D Unsecure Flash time (FTMRG240K2, TMRG192K2) Unsecure Flash time (FTMRG128K1, FTMRG96K1) Unsecure Flash time (FTMRG64K1, FTMRG48K1) Unsecure Flash time (FTMRG32K1, FTMRG16K1) 6 D P-Flash block erase time (FTMRG240K2, TMRG192K2) P-Flash block erase time (FTMRG128K1, FTMRG96K1) P-Flash block erase time (FTMRG64K1, FTMRG48K1) P-Flash block erase time (FTMRG32K1, FTMRG16K1) 7 D P-Flash erase verify (blank check) time (FTMRG240K2, FTMRG192K2) P-Flash erase verify (blank check) time (FTMRG128K1, FTMRG96K1) P-Flash erase verify (blank check) time (FTMRG64K1, FTMRG48K1) P-Flash erase verify (blank check) time (FTMRG32K1, FTMRG16K1) Rating Symbol fNVMBUS fNVMOP tmass tmass tmass tmass tcheck tcheck tcheck tcheck tuns tuns tuns tuns tpmass tpmass tpmass tpmass tpcheck tpcheck tpcheck tpcheck Min 1 0.8 — — — — — — — — — — — — — — — — — — — — Typ1 — 1.0 200 100 100 100 — — — — 200 100 100 100 200 100 100 100 — — — — Max2 25 1.05 260 130 130 130 64400 33600 18000 9300 260 130 130 130 260 130 130 130 62200 33400 16700 33400 Unit3 MHz MHz ms ms ms ms tcyc tcyc tcyc tcyc ms ms ms ms ms ms ms ms tcyc tcyc tcyc tcyc MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1107 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Num C 8 9 10 11 Rating Symbol tpera tppgm tdera tdcheck tdcheck tdcheck tdcheck tdpgm1 tdpgm2 Min — — — — — — — — — Typ1 20 185 5 4 Max2 26 200 26 2620 2620 1540 1030 106 154 Unit3 ms µs ms tcyc tcyc tcyc tcyc µs µs D P-Flash sector erase time D P-Flash phrase programming time D EEPROM sector erase time D EEPROM erase verify (blank check) time (FTMRG240K2, TMRG192K2) EEPROM erase verify (blank check) time (FTMRG128K1, FTMRG96K1) EEPROM erase verify (blank check) time (FTMRG64K1, FTMRG48K1) EEPROM erase verify (blank check) time (FTMRG32K1, FTMRG16K1) — — — — 97 140 12a 12b 1 2 D EEPROM one word programming time D EEPROM two word programming time Typical program and erase times are based on typical fNVMOP and maximum fNVMBUS Maximum program and erase times are based on minimum fNVMOP and maximum fNVMBUS 3t cyc = 1 / fNVMBUS 4 Typical value for a new device A.6.2 NVM Reliability Parameters The reliability of the NVM blocks is guaranteed by stress test during qualification, constant process monitors and burn-in to screen early life failures. The data retention and program/erase cycling failure rates are specified at the operating conditions noted. The program/erase cycle count on the sector is incremented every time a sector or mass erase event is executed. MC9S12G Family Reference Manual, Rev.1.01 1108 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics Table A-24. NVM Reliability Characteristics Conditions are shown in Table A-11 unless otherwise noted NUM C Rating Program Flash Arrays 1 2 C Data retention at an average junction temperature of TJavg = 85°C1 after up to 10,000 program/erase cycles C Program Flash number of program/erase cycles (-40°C ≤ Tj ≤ 150°C) EEPROM Array 3 4 5 6 1 2 Symbol Min Typ Max Unit tNVMRET nFLPE 20 10K 1002 100K3 — — Years Cycles C Data retention at an average junction temperature of TJavg = 85°C1 after up to 100,000 program/erase cycles C Data retention at an average junction temperature of TJavg = 85°C1 after up to 10,000 program/erase cycles C Data retention at an average junction temperature of TJavg = 85°C1 after less than 100 program/erase cycles C EEPROM number of program/erase cycles (-40°C ≤ Tj ≤ 150°C) tNVMRET tNVMRET tNVMRET nFLPE 5 10 20 100K 1002 1002 1002 500K3 — — — — Years Years Years Cycles TJavg does not exceed 85°C in a typical temperature profile over the lifetime of a consumer, industrial or automotive application. Typical data retention values are based on intrinsic capability of the technology measured at high temperature and de-rated to 25°C using the Arrhenius equation. For additional information on how Freescale defines Typical Data Retention, please refer to Engineering Bulletin EB618 3 Spec table quotes typical endurance evaluated at 25°C for this product family. For additional information on how Freescale defines Typical Endurance, please refer to Engineering Bulletin EB619. A.7 A.7.1 Phase Locked Loop Jitter Definitions With each transition of the feedback clock, the deviation from the reference clock is measured and input voltage to the VCO is adjusted accordingly.The adjustment is done continuously with no abrupt changes in the VCOCLK frequency. Noise, voltage, temperature and other factors cause slight variations in the control loop resulting in a clock jitter. This jitter affects the real minimum and maximum clock periods as illustrated in Figure A-3. MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1109 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics 0 1 2 3 N-1 N tmin1 tnom tmax1 tminN tmaxN Figure A-3. Jitter Definitions The relative deviation of tnom is at its maximum for one clock period, and decreases towards zero for larger number of clock periods (N). Defining the jitter as: t (N) t (N) ⎞ ⎛ max min J ( N ) = max ⎜ 1 – ---------------------- , 1 – ---------------------- ⎟ N⋅t N⋅t ⎝ nom nom ⎠ For N < 100, the following equation is a good fit for the maximum jitter: j 1 J ( N ) = ------N J(N) 1 5 10 20 N Figure A-4. Maximum Bus Clock Jitter Approximation NOTE On timers and serial modules a prescaler will eliminate the effect of the jitter to a large extent. MC9S12G Family Reference Manual, Rev.1.01 1110 Freescale Semiconductor This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.7.2 Electrical Characteristics for the PLL Table A-25. PLL Characteristics Conditions are shown in Table A-11 unless otherwise noted Num C 1 2 3 4 5 6 7 8 1 2 Rating Symbol fVCORST fVCO fREF |∆Lock| |∆unl| tlock jirc jext Min 8 32 1 0 0.5 Typ Max 25 50 Unit MHz MHz MHz D VCO frequency during system reset C VCO locking range C Reference Clock D Lock Detection D Un-Lock Detection C Time to lock C Jitter fit parameter 12 IRC as reference clock source C Jitter fit parameter 13 XOSCLCP as reference clock source 1.5 2.5 150 + 256/fREF 1.4 1.0 %1 %1 µs % % % deviation from target frequency fREF = 1MHz (IRC), fBUS = 25MHz equivalent fPLL = 50MHz, CPMUSYNR=0x58, CPMUREFDIV=0x00, CPMUPOSTDIV=0x00 3f REF = 4MHz (XOSCLCP), fBUS = 24MHz equivalent fPLL = 48MHz, CPMUSYNR=0x05, CPMUREFDIV=0x40, CPMUPOSTDIV=0x00 A.8 Electrical Characteristics for the IRC1M Table A-26. IRC1M Characteristics Conditions are: Temperature option M, C, or V (see Table A-4) Num C 1 Rating Symbol fIRC1M_TRIM Min 0.987 Typ 1 Max 1.013 Unit MHz P Internal Reference Frequency, factory trimmed MC9S12G Family Reference Manual, Rev.1.01 Freescale Semiconductor 1111 This document is valid for the S12G96 and the S12G128 device. All information related to other devices is preliminary. Electrical Characteristics A.9 Electrical Characteristics for the Oscillator (XOSCLCP) Table A-27. XOSCLCP Characteristics Conditions are shown in Table A-11 unless otherwise noted Num C 1 2 3a 3b 3c 4 5 6 7 8 1 2 Rating Symbol fOSC iOSC tUPOSC tUPOSC tUPOSC fCMFA CIN VHYS,EXTAL VPP,EXTAL Min 4.0 100 — — — 200 Typ Max 16 Unit MHz µA C Nominal crystal or resonator frequency P Startup Current C Oscillator start-up time (4MHz)1 C Oscillator start-up time (8MHz)1 C Oscillator start-up time 2 1.6 1 450 7 10 8 5 1200 ms ms ms KHz pF (16MHz)1 P Clock Monitor Failure Assert Frequency D Input Capacitance (EXTAL, XTAL pins) C EXTAL Pin Input Hysteresis C — — 0.8 120 1.0 — — — 1.5 mV V EXTAL Pin oscillation amplitude (loop controlled Pierce) D EXTAL Pin oscillation required amplitude2 VPP,EXTAL V These values apply for carefully designed PCB layouts with capacitors that match the crystal/resonator requirements. Needs to be measured at room temperature on the application board using a probe with very low (