PC3S12XF512J0MLMR

厂商：
FREESCALE(飞思卡尔)
封装：
描述：
PC3S12XF512J0MLMR - S12X Microcontrollers - Freescale Semiconductor, Inc

数据手册：

下载PC3S12XF512J0MLMR.pdf

立即购买

数据手册
价格&库存

PC3S12XF512J0MLMR 数据手册

MC9S12XF512 Reference Manual Covers MC9S12XF512 MC9S12XF384 MC9S12XF256 MC9S12XF128 S12X Microcontrollers MC9S12XF512V1RM Rev.1.19 18-May-2010 freescale.com To provide the most up-to-date information, the revision of our documents on the World Wide Web will be the most current. Your printed copy may be an earlier revision. To verify you have the latest information available, refer to: http://freescale.com/ A full list of family members and options is included in the appendices. The following revision history table summarizes changes contained in this document. This document contains information for all constituent modules, with the exception of the S12 CPU. For S12 CPU information please refer to the CPU S12 Reference Manual. Revision History Date 06-Dec-2007 Revision Level 1.12 Description Updated memory map description for family parts (1.1.4 MC9S12XF512 - Address Mapping) Updated derivative differences w.r.t. DFlash size (D.1 Memory Sizes and Package Options S12XF Family) Add FTM BG (384K2/256K2) Remove table for Module Run Supply Currents (A-10) Remove 3.3V columns in Table A-27, 3.0V columns in Table A-28 Add FTM BG (128K2) Fixed typo in detailed register map (SPI1/SPI1DRH) Import updated BGs VREG, ECT, INT, DBG Fixed typo in Table 1-6 Updated ordering info for 112 LQFP Updated NVM timing parameter section for brownout case Speciﬁed time delay from RESET to start of CPU code execution Added NVM patch Part IDs Enhanced ECT GPIO / timer function transitioning description CRG section updated Updated PIM,FTM,XGATE,MSCAN,DBG,BDM,ADC,CRG sections Corrected startup from reset min cycle count Updated ECT section (see ECT revision history table) 12-Dec-2007 08-Jan-2008 1.13 1.14 15-Jan-2008 1.15 05-Mar-2008 02-Oct-2008 1.16 1.17 01-Mar-2010 1.18 18-May-2010 1.19 Freescale™ and the Freescale logo are trademarks of Freescale Semiconductor, Inc. This product incorporates SuperFlash® technology licensed from SST. © Freescale Semiconductor, Inc., 2008,2009,2010. All rights reserved. MC9S12XF - Family Reference Manual, Rev.1.19 2 Freescale Semiconductor Chapter 1 Chapter 2 Chapter 3 Chapter 4 Chapter 5 Chapter 6 Chapter 7 Chapter 8 Chapter 9 Chapter 10 Chapter 11 Chapter 12 Chapter 13 Chapter 14 Chapter 15 Chapter 16 Chapter 17 Chapter 18 Chapter 19 Chapter 20 Chapter 21 Chapter 22 1013 Chapter 23 Chapter 24 Chapter 25 Chapter 26 MC9S12XF-Family Reference Manual. . . . . . . . . . . . . . . . . . . . 23 S12XE Clocks and Reset Generator (S12XECRG) . . . . . . . . . 83 Voltage Regulator (S12VREGL3V3V1) . . . . . . . . . . . . . . . . . . 113 384 KByte Flash Module (S12XFTM384K2V1) . . . . . . . . . . . . 131 Pierce Oscillator (S12OSCLCPV2) . . . . . . . . . . . . . . . . . . . . . 193 Security (S12XFSECV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Interrupt (S12XINTV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 256 KByte Flash Module (S12XFTM256K2XFV1) . . . . . . . . . . 221 512 KByte Flash Module (S12XFTM512K3V1) . . . . . . . . . . . . 281 128 KByte Flash Module (S12XFTM128K2XFV1) . . . . . . . . . . 343 Memory Mapping Control (S12XMMCV4) WITH FLEXRAY . . 403 Clock Generation Module using IPLL (CGMIPLL) . . . . . . . . . 447 FlexRay Communication Controller (FLEXRAY) . . . . . . . . . . 457 XGATE (S12XGATEV3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615 Background Debug Module (S12XBDMV2) . . . . . . . . . . . . . . 731 S12X Debug (S12XDBGV3) Module . . . . . . . . . . . . . . . . . . . . 757 Memory Protection Unit (S12XMPUV2) . . . . . . . . . . . . . . . . . 801 External Bus Interface (S12XEBIV4) . . . . . . . . . . . . . . . . . . . . 815 Port Integration Module (S12XFPIMV2) . . . . . . . . . . . . . . . . . 835 Pulse Width Modulator with Fault Protection (PMF15B6C) . 901 Scalable Controller Area Network (S12MSCANV2) . . . . . . . . 957 Enhanced Programmable Interrupt Timer (S12XEPIT24B8CV1) Serial Communication Interface (S12SCIV5) . . . . . . . . . . . . 1033 Analog-to-Digital Converter (ADC12B16C) . . . . . . . . . . . . . 1069 Serial Peripheral Interface (S12SPIV5) . . . . . . . . . . . . . . . . . 1095 Enhanced Capture Timer (ECT16B8CV3). . . . . . . . . . . . . . . 1125 Appendix A Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 3 Appendix B Package Physical Dimension Information. . . . . . . . . . . . . . 1235 Appendix C PCB Layout Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238 Appendix D Derivative Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242 Appendix E Detailed Register Address Map. . . . . . . . . . . . . . . . . . . . . . . 1244 Appendix F Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288 MC9S12XF - Family Reference Manual, Rev.1.19 4 Freescale Semiconductor Chapter 1 MC9S12XF-Family Reference Manual 1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 1.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 1.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.1.3 Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.1.4 MC9S12XF512 - Address Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1.1.5 Detailed Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.1.6 Part ID Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.2.1 System Pinout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 1.2.2 Signal Properties Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.2.3 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.2.4 EXTAL, XTAL — Oscillator Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.2.5 RESET — External Reset Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.2.6 TEST — Test Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.2.7 BKGD / MODC — Background Debug and Mode Pin . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.2.8 Port Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 1.2.9 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 System Clock Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.4.1 Chip Conﬁguration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 1.4.2 Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 1.4.3 Freeze Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.6.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.6.2 Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 1.6.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 EPIT External Trigger Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 ATD External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 MPU Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 VREG Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.10.1 Temperature Sensor Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 BDM Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 FlexRay IPLL (CGMIPLL) Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.12.1 CGMIPLL function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.12.2 Entry into and exit from low power modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Oscillator Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 Chapter 2 S12XE Clocks and Reset Generator (S12XECRG) 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 2.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 5 2.2 2.3 2.4 2.5 2.6 2.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 2.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 2.2.1 VDDPLL, VSSPLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 2.2.2 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 2.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 2.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 2.4.1 Functional Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 2.4.2 Operation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 2.4.3 Low Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.5.1 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Chapter 3 Voltage Regulator (S12VREGL3V3V1) 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 3.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 3.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 3.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 3.2.1 VDDR — Regulator Power Input Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 3.2.2 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 3.2.3 VDD, VSS — Regulator Output1 (Core Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . 116 3.2.4 VDDF — Regulator Output2 (NVM Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 3.2.5 VDDPLL, VSSPLL — Regulator Output3 (PLL) Pins . . . . . . . . . . . . . . . . . . . . . . . . . 117 3.2.6 VDDX — Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 3.2.7 VREGEN — Optional Regulator Enable Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 3.2.8 VREG_API — Optional Autonomous Periodical Interrupt Output Pin . . . . . . . . . . . . . . 117 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 3.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.4.2 Regulator Core (REG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.4.3 Low-Voltage Detect (LVD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.4.4 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.4.5 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 3.4.6 HTD - High Temperature Detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 3.4.7 Regulator Control (CTRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 3.4.8 Autonomous Periodical Interrupt (API) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 3.4.9 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 MC9S12XF - Family Reference Manual, Rev.1.19 6 Freescale Semiconductor 3.2 3.3 3.4 3.4.10 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 3.4.11 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Chapter 4 384 KByte Flash Module (S12XFTM384K2V1) 4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 4.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 4.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 4.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 4.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 4.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 4.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 4.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 4.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 4.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 4.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 4.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191 4.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 192 4.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 192 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 4.2 4.3 4.4 4.5 4.6 Chapter 5 Pierce Oscillator (S12OSCLCPV2) 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 5.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 5.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 5.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 5.2.1 VDDPLL and VSSPLL — Operating and Ground Voltage Pins . . . . . . . . . . . . . . . . . . . . 194 5.2.2 EXTAL and XTAL — Input and Output Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.4.1 Gain Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.4.2 Clock Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.4.3 Wait Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.4.4 Stop Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196 5.2 5.3 5.4 Chapter 6 Security (S12XFSECV2) 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 7 6.1.1 6.1.2 6.1.3 6.1.4 6.1.5 6.1.6 6.1.7 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Complete Memory Erase (Special Modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 Chapter 7Interrupt (S12XINTV2) 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 7.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 7.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 7.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 7.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 7.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 7.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 7.4.1 S12X Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 7.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 7.4.3 XGATE Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 7.4.4 Priority Decoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 7.4.5 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 7.4.6 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 7.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 7.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 7.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 7.2 7.3 7.4 7.5 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 8.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 8.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 8.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 8.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 8.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 8.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277 8.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 MC9S12XF - Family Reference Manual, Rev.1.19 8 Freescale Semiconductor 8.2 8.3 8.4 8.5 8.6 8.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 8.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 8.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 280 8.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 280 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 9.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 9.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 9.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 9.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 9.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 9.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 9.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 9.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 9.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 9.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339 9.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340 9.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 341 9.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 341 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 9.2 9.3 9.4 9.5 9.6 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 10.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 10.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345 10.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 10.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 10.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 10.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 10.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399 10.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 9 10.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 10.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 10.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401 10.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 402 10.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 402 10.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403 11.1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 11.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 11.1.3 S12X Memory Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405 11.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405 11.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 11.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 11.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 11.4.1 MCU Operating Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 11.4.2 Memory Map Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422 11.4.3 Chip Access Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437 11.4.4 Chip Bus Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438 11.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 11.5.1 CALL and RTC Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439 11.5.2 Port Replacement Registers (PRRs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440 11.5.3 On-Chip ROM Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442 Chapter 12 Clock Generation Module using IPLL (CGMIPLL) Block Description 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447 12.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447 12.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447 12.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 12.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 12.2.1 VDDPLL, VSSPLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448 12.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449 12.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449 12.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449 12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455 12.4.1 Examples of IPLL divider settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455 12.4.2 IPLL Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455 MC9S12XF - Family Reference Manual, Rev.1.19 10 Freescale Semiconductor 12.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456 12.5.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456 Chapter 13FlexRay Communication Controller (FLEXRAY) 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 13.1.1 Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457 13.1.2 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 13.1.3 Color Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 13.1.4 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459 13.1.5 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460 13.1.6 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 13.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 13.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 13.3 Controller Host Interface Clocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464 13.4 Protocol Engine Clocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464 13.4.1 Oscillator Clocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464 13.4.2 PLL Clocking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464 13.4.3 PLL Lock Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 13.5 Memory Map and Register Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 13.5.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465 13.5.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468 13.6 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 13.6.1 Message Buffer Concept . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 13.6.2 Physical Message Buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 13.6.3 Message Buffer Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541 13.6.4 FlexRay Memory Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546 13.6.5 Physical Message Buffer Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548 13.6.6 Individual Message Buffer Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557 13.6.7 Individual Message Buffer Search . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582 13.6.8 Individual Message Buffer Reconﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585 13.6.9 Receive FIFO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586 13.6.10Channel Device Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590 13.6.11External Clock Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 13.6.12Sync Frame ID and Sync Frame Deviation Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 13.6.13MTS Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595 13.6.14Sync Frame and Startup Frame Transmission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596 13.6.15Sync Frame Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597 13.6.16Strobe Signal Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 13.6.17Timer Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 13.6.18Slot Status Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600 13.6.19Interrupt Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 13.6.20Lower Bit Rate Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 13.7 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 13.7.1 Initialization Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 13.7.2 Shut Down Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 11 13.7.3 13.7.4 13.7.5 13.7.6 Number of Usable Message Buffers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 Protocol Control Command Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 Protocol Reset Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 Message Buffer Search on Simple Message Buffer Conﬁguration . . . . . . . . . . . . . . . . 612 Chapter 14 XGATE (S12XGATEV3) 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615 14.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615 14.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616 14.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 14.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 14.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618 14.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618 14.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618 14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635 14.4.1 XGATE RISC Core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636 14.4.2 Programmer’s Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636 14.4.3 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 637 14.4.4 Semaphores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638 14.4.5 Software Error Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640 14.5 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 14.5.1 Incoming Interrupt Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 14.5.2 Outgoing Interrupt Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 14.6 Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 14.6.1 Debug Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 14.6.2 Leaving Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 643 14.7 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 643 14.8 Instruction Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 644 14.8.1 Addressing Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 644 14.8.2 Instruction Summary and Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647 14.8.3 Cycle Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649 14.8.4 Thread Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 14.8.5 Instruction Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 14.8.6 Instruction Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 14.9 Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725 14.9.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725 14.9.2 Code Example (Transmit "Hello World!" on SCI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725 14.9.3 Stack Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728 Chapter 15 Background Debug Module (S12XBDMV2) 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731 15.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731 MC9S12XF - Family Reference Manual, Rev.1.19 12 Freescale Semiconductor 15.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 732 15.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733 15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733 15.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 15.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 15.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 15.3.3 Family ID Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739 15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739 15.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 15.4.2 Enabling and Activating BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 15.4.3 BDM Hardware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741 15.4.4 Standard BDM Firmware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742 15.4.5 BDM Command Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 743 15.4.6 BDM Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 745 15.4.7 Serial Interface Hardware Handshake Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748 15.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750 15.4.9 SYNC — Request Timed Reference Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753 15.4.10Instruction Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 754 15.4.11Serial Communication Time Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 755 Chapter 16 S12X Debug (S12XDBGV3) Module 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 16.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 16.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758 16.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758 16.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 759 16.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 16.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780 16.4.1 S12XDBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780 16.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 781 16.4.3 Trigger Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784 16.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 16.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 16.4.6 Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795 16.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 796 Chapter 17 Memory Protection Unit (S12XMPUV2) 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 801 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 13 17.2 17.3 17.4 17.5 17.1.1 Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 801 17.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 802 17.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803 17.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803 17.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 17.4.1 Protection Descriptors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 17.4.2 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 17.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 Chapter 18 External Bus Interface (S12XEBIV4) 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 18.1.1 Glossary or Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 18.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 18.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 18.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817 18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817 18.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 18.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 18.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822 18.4.1 Operating Modes and External Bus Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822 18.4.2 Internal Visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823 18.4.3 Accesses to Port Replacement Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 18.4.4 Stretched External Bus Accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 18.4.5 Data Select and Data Direction Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 18.4.6 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829 18.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829 18.5.1 Normal Expanded Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830 18.5.2 Emulation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831 Chapter 19 Port Integration Module (S12XFPIMV2) 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835 19.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835 19.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 19.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 841 19.3.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 842 19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 847 MC9S12XF - Family Reference Manual, Rev.1.19 14 Freescale Semiconductor 19.3.3 Port A Data Register (PORTA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 848 19.3.4 Port B Data Register (PORTB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849 19.3.5 Port A Data Direction Register (DDRA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850 19.3.6 Port B Data Direction Register (DDRB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850 19.3.7 Port C Data Register (PORTC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 851 19.3.8 Port D Data Register (PORTD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852 19.3.9 Port C Data Direction Register (DDRC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852 19.3.10Port D Data Direction Register (DDRD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853 19.3.11Port E Data Register (PORTE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 854 19.3.12Port E Data Direction Register (DDRE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 854 19.3.13S12X_EBI ports, BKGD pin Pull-up Control Register (PUCR) . . . . . . . . . . . . . . . . . . 855 19.3.14S12X_EBI ports Reduced Drive Register (RDRIV) . . . . . . . . . . . . . . . . . . . . . . . . . . . 856 19.3.15ECLK Control Register (ECLKCTL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 858 19.3.16PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 19.3.17IRQ Control Register (IRQCR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 19.3.18PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860 19.3.19Port K Data Register (PORTK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860 19.3.20Port K Data Direction Register (DDRK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 861 19.3.21Port T Data Register (PTT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 19.3.22Port T Input Register (PTIT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 19.3.23Port T Data Direction Register (DDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 863 19.3.24Port T Reduced Drive Register (RDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864 19.3.25Port T Pull Device Enable Register (PERT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864 19.3.26Port T Polarity Select Register (PPST) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 865 19.3.27PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 865 19.3.28PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 865 19.3.29Port S Data Register (PTS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 866 19.3.30Port S Input Register (PTIS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867 19.3.31Port S Data Direction Register (DDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867 19.3.32Port S Reduced Drive Register (RDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 868 19.3.33Port S Pull Device Enable Register (PERS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 869 19.3.34Port S Polarity Select Register (PPSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 869 19.3.35Port S Wired-Or Mode Register (WOMS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 870 19.3.36PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 870 19.3.37Port M Data Register (PTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 871 19.3.38Port M Input Register (PTIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 872 19.3.39Port M Data Direction Register (DDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 872 19.3.40Port M Reduced Drive Register (RDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 873 19.3.41Port M Pull Device Enable Register (PERM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 874 19.3.42Port M Polarity Select Register (PPSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 874 19.3.43Port M Wired-Or Mode Register (WOMM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875 19.3.44PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875 19.3.45Port P Data Register (PTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876 19.3.46Port P Input Register (PTIP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876 19.3.47Port P Data Direction Register (DDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 877 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 15 19.3.48Port P Reduced Drive Register (RDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 877 19.3.49Port P Pull Device Enable Register (PERP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 878 19.3.50Port P Polarity Select Register (PPSP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 878 19.3.51PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 879 19.3.52PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 879 19.3.53Port H Data Register (PTH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 880 19.3.54Port H Input Register (PTIH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 881 19.3.55Port H Data Direction Register (DDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 881 19.3.56Port H Reduced Drive Register (RDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883 19.3.57Port H Pull Device Enable Register (PERH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883 19.3.58Port H Polarity Select Register (PPSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 884 19.3.59PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 884 19.3.60PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 884 19.3.61Port J Data Register (PTJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 19.3.62Port J Input Register (PTIJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886 19.3.63Port J Data Direction Register (DDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886 19.3.64Port J Reduced Drive Register (RDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 19.3.65Port J Pull Device Enable Register (PERJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 19.3.66Port J Polarity Select Register (PPSJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 19.3.67PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 19.3.68PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 19.3.69Port AD Data Register 0 (PT0AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 19.3.70Port AD Data Register 1 (PT1AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 19.3.71Port AD Data Direction Register 0 (DDR0AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 19.3.72Port AD Data Direction Register 1 (DDR1AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 19.3.73Port AD Reduced Drive Register 0 (RDR0AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892 19.3.74Port AD Reduced Drive Register 1 (RDR1AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893 19.3.75Port AD Pull Up Enable Register 0 (PER0AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893 19.3.76Port AD Pull Up Enable Register 1 (PER1AD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 19.3.77PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 19.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 19.4.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895 19.4.3 Pins and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 19.5 Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 899 19.5.1 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 899 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901 20.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901 20.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902 20.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902 20.2 Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904 20.2.1 PWM0–PWM5 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904 MC9S12XF - Family Reference Manual, Rev.1.19 16 Freescale Semiconductor 20.3 20.4 20.5 20.6 20.7 20.8 20.2.2 FAULT0–FAULT3 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904 20.2.3 IS0–IS2 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 905 20.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 905 20.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 908 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931 20.4.1 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931 20.4.2 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931 20.4.3 PWM Generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931 20.4.4 Independent or Complementary Channel Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 934 20.4.5 Deadtime Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 936 20.4.6 Software Output Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 944 20.4.7 PWM Generator Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 947 20.4.8 Fault Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 Clocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 Electrical Speciﬁcations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 957 21.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958 21.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958 21.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959 21.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959 21.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960 21.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960 21.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960 21.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960 21.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 961 21.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 961 21.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 21.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981 21.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992 21.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992 21.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992 21.4.3 Identiﬁer Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 995 21.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1001 21.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1003 21.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1007 21.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1007 21.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1009 21.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1009 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 17 Chapter 22 Enhanced Programmable Interrupt Timer (S12XEPIT24B8CV1) 22.1 Revision History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1011 22.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1011 22.2.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1011 22.2.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 22.2.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 22.2.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 22.3 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 22.4 Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 22.5 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1026 22.5.1 Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027 22.5.2 Interrupt Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1029 22.5.3 Hardware Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1029 22.5.4 External Input Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1030 22.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031 22.6.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031 22.6.2 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031 22.6.3 Flag Clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031 22.7 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031 Chapter 23 Serial Communication Interface (S12SCIV5) 23.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1033 23.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1033 23.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1034 23.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1034 23.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035 23.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035 23.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035 23.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035 23.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1036 23.3.1 Module Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1036 23.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1036 23.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 23.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047 23.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048 23.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048 23.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1050 23.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051 23.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056 23.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1064 23.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065 23.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065 MC9S12XF - Family Reference Manual, Rev.1.19 18 Freescale Semiconductor 23.5.1 23.5.2 23.5.3 23.5.4 23.5.5 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1066 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1068 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1068 Chapter 24 Analog-to-Digital Converter (ADC12B16C) Block Description 24.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069 24.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1069 24.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071 24.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072 24.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 24.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 24.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 24.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 24.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076 24.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1092 24.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1092 24.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1092 24.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1093 24.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094 Chapter 25 Serial Peripheral Interface (S12SPIV5) 25.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095 25.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095 25.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1095 25.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096 25.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096 25.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1097 25.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1097 25.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1097 25.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098 25.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098 25.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098 25.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098 25.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099 25.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1110 25.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111 25.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1112 25.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113 25.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 19 25.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119 25.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121 25.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1121 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125 26.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126 26.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126 26.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127 26.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1127 26.2.1 IOC7 — Input Capture and Output Compare Channel 7 . . . . . . . . . . . . . . . . . . . . . . . 1127 26.2.2 IOC6 — Input Capture and Output Compare Channel 6 . . . . . . . . . . . . . . . . . . . . . . . 1127 26.2.3 IOC5 — Input Capture and Output Compare Channel 5 . . . . . . . . . . . . . . . . . . . . . . . 1128 26.2.4 IOC4 — Input Capture and Output Compare Channel 4 . . . . . . . . . . . . . . . . . . . . . . . 1128 26.2.5 IOC3 — Input Capture and Output Compare Channel 3 . . . . . . . . . . . . . . . . . . . . . . . 1128 26.2.6 IOC2 — Input Capture and Output Compare Channel 2 . . . . . . . . . . . . . . . . . . . . . . . 1128 26.2.7 IOC1 — Input Capture and Output Compare Channel 1 . . . . . . . . . . . . . . . . . . . . . . . 1128 26.2.8 IOC0 — Input Capture and Output Compare Channel 0 . . . . . . . . . . . . . . . . . . . . . . . 1128 26.3 Memory Map and Register Deﬁnition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1128 26.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1128 26.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1128 26.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1164 26.4.1 Enhanced Capture Timer Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171 26.4.2 Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1175 26.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1176 Appendix A Electrical Characteristics A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1179 A.1.1 Parameter Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1179 A.1.2 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1179 A.1.3 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1180 A.1.4 Current Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1181 A.1.5 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182 A.1.6 ESD Protection and Latch-up Immunity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182 A.1.7 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1184 A.1.8 Power Dissipation and Thermal Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1185 A.1.9 I/O Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1187 A.1.10 Supply Currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1191 A.2 ATD Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1194 A.2.1 ATD Operating Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1194 A.2.2 Factors Influencing Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1194 A.2.3 ATD Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197 MC9S12XF - Family Reference Manual, Rev.1.19 20 Freescale Semiconductor A.3 NVM, Flash and Emulated EEPROM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1200 A.3.1 Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1200 A.3.2 NVM Reliability Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207 A.4 Voltage Regulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1210 A.5 Output Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1210 A.5.1 Resistive Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1210 A.5.2 Capacitive Loads. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1210 A.5.3 Chip Power-up and Voltage Drops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1211 A.6 Reset, Oscillator and PLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1213 A.6.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1213 A.6.2 Oscillator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1215 A.6.3 Phase Locked Loop. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1216 A.7 External Interface Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218 A.7.1 MSCAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218 A.7.2 SPI Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218 A.7.3 External Bus Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1224 Appendix B Package Physical Dimension Information. B.1 144-Pin LQFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 B.2 112-Pin LQFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236 B.3 64-Pin LQFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1237 Appendix C PCB Layout Guidelines Appendix D Derivative Differences D.1 Memory Sizes and Package Options S12XF - Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242 D.2 Pinout explanations: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1243 Appendix E Detailed Register Address Map Appendix F Ordering Information MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 21 MC9S12XF - Family Reference Manual, Rev.1.19 22 Freescale Semiconductor Chapter 1 MC9S12XF-Family Reference Manual 1.1 Introduction Targeted at actuators, sensors and other distributed nodes in the FlexRay network for Chassis and Body Electronics, the MC9S12XF-Family delivers 32-bit performance with all the advantages and efﬁciencies of a 16-bit MCU. The design goal was to retain the low cost, power consumption, EMC and code-size efﬁciency advantages currently enjoyed by users of Freescale Semiconductor's other 16-bit MC9S12 MCU families. Based around an enhanced S12X core, the MC9S12XF-Family runs 16-bit wide accesses without wait states for all peripherals and memories. The MC9S12XF-Family also features a new ﬂexible interrupt handler, which allows multilevel nested interrupts. The MC9S12XF-Family features the performance boosting enhanced XGATE co-processor. The XGATE is programmable in “C” language and runs at twice the bus frequency of the S12. It’s instruction set is optimized for data movement, logic and bit manipulation instructions. Any peripheral module can be serviced by the XGATE. The MC9S12XF-Family features a Memory Protection Unit (MPU). The MC9S12XF-Family features a FlexRay module for high speed serial communication supporting various bit rates up to 10 Mbit/s. The FlexRay internal clock can be generated from crystals ranging from 4MHz to 40MHz1. The 64-pin LQFP allows interfacing to a single FlexRay channel. The 64-pin LQFP (10mm x 10mm) is intended for those applications challenged by the size constraint of some satellite FlexRay modules. The 112-pin LQFP offers an increase in the number of I/Os as well as 16 A/D channels. In addition to that the 144-pin LQFP provides a full 16-bit wide non-multiplexed external bus interface with the pins usable as general purpose I/O in single-chip modes. The MC9S12XF-Family features the MSCAN module with a FIFO receiver buffer arrangement, and input ﬁlters optimized for Gateway applications handling numerous message identiﬁers. The MC9S12XF-Family provides Flash memory sizes from 128K to 512K plus Data Flash and enhanced EEPROM functionality (EE-Emulation) with built in Error Correcting Code (ECC). The memory uses Freescale Semiconductor's industry-leading, full automotive qualiﬁed SG-Flash. The inclusion of a frequency modulated PLL circuit allows power consumption and performance to be adjusted to suit operational requirements and allows optimization of the radiated emissions (EMC). The ATD now offers 12 Bit resolution at a faster conversion rate down to 3µs per channel. The MC9S12XF512 is available in 144-Pin LQFP, 112-Pin LQFP and 64-Pin LQFP package. 1. 8MHz - 16MHz recommended for low jitter MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 23 Chapter 1 MC9S12XF-Family Reference Manual NOTE The 144-Pin LQFP version will not be qualiﬁed for production and is intended to be used for emulation (development tools) only. See Table 1-9 for information about port and peripheral availability by package option. 1.1.1 Features Features of the MC9S12XF-Family are listed here. Please see Table 1-1 for memory options and Table 12 for the peripheral features that are available on the different family members. The system includes these distinctive features: • 16-Bit CPU12X — Upward compatible with MC9S12 instruction set with the exception of ﬁve Fuzzy instructions (MEM, WAV, WAVR, REV, REVW) which have been removed. — Enhanced indexed addressing — Additional (superset) instructions to improve 32-bit calculations and semaphore handling — Access large data segments independent of PPAGE • Enhanced Interrupt Module — Eight levels of nested interrupts — Flexible assignment of interrupt sources to each interrupt level — One non-maskable high priority interrupt (XIRQ) — Wake-up Interrupt Inputs • Memory Protection Unit (MPU) — 4 address regions deﬁnable per active program task — Address range granularity as low as 256-bytes — Protection Attributes – No write – No execute — Non-maskable interrupt on access violation • XGATE — Programmable, high performance I/O coprocessor module – up to 100 MIPS RISC performance — Transfers data to or from all peripherals and RAM without CPU intervention or CPU wait states — Performs logical, shifts, arithmetic, and bit operations on data — Can interrupt the HCS12X CPU signalling transfer completion — Triggers from any hardware module as well as from the CPU possible — Two interrupt levels to service high priority tasks — Enables Full CAN capability when used in conjunction with MSCAN module MC9S12XF - Family Reference Manual, Rev.1.19 24 Freescale Semiconductor Chapter 1 MC9S12XF-Family Reference Manual • • • — Full LIN master or slave capability when used in conjunction with the integrated LIN SCI module System Integrity Support — Power-on reset (POR) — Illegal address detection with reset — Low-voltage detection with interrupt or reset — Computer Operating Properly (COP) watchdog – Conﬁgurable as window COP for enhanced failure detection – Can be initialized out of reset using option bits located in Flash — Clock monitor supervising the correct function of the oscillator Memory Options — 128K, 256k, 384K and 512K byte Flash — 2K, 4K byte Emulated EEPROM — 16K, 20K, 24K and 32K Byte RAM — Program Flash General Features – 64 data bits plus 8 syndrome ECC (Error Correction Code) bits allow single bit fault correction and double fault detection – Erase sector size 1024 bytes – Automated program and erase algorithm – Security option to prevent unauthorized access – Sense-amp margin level setting for reads — Data Flash General Features – Up to 32K bytes of D-Flash memory with 256-byte sectors for user access. – Dedicated commands to access D-Flash memory over EEE operation – Single bit fault correction and double fault detection within a word during read operations – Automated program and erase algorithm with verify and generation of ECC parity bits – Fast sector erase and word program operation – Ability to program up to four words in a burst sequence — Emulated EEPROM General Features – Automatic EEE ﬁle handling using internal Memory Controller – Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset – Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory – Ability to disable EEE operation and allow priority access to the D-Flash memory – Ability to cancel all pending EEE operations to allow priority access to the D-Flash memory Oscillator (OSC_LCP) — Loop Control Pierce oscillator utilizing a 4MHz to 16MHz crystal — Good noise immunity MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 25 Chapter 1 MC9S12XF-Family Reference Manual • • • • — Full-swing Pierce option utilizing a 2MHz to 40MHz crystal — Transconductance sized for optimum start-up margin for typical crystals Clock and Reset Generator (CRG) — Phase-locked-loop (IPLL) clock frequency multiplier — Internally ﬁltered. No external components required — Conﬁgurable option to spread spectrum for reduced EMC radiation (frequency modulation) — Fast wake up from STOP in self clock mode for power saving and immediate program execution Non-Multiplexed External Bus (144 Pin package only) — 16 data bits wide — Support for external WAIT input or internal wait cycles to adapt MCU speed to peripheral speed requirements — Up to four chip select outputs to select 16K, 768K, 2M and 4MByte address spaces — Supports glue less interface to popular asynchronous RAMs and Flash devices — External address space 4MByte for Data and Program space FlexRay Module (FR) — FlexRay protocol implementation according to FlexRay V2.1 Protocol Implementation document — Optimized programmers model to ﬁt small address footprint — Supports Data Rates of 2.5, 5, 8 and 10MBit/s — The FlexRay clock can be derived from crystals ranging from 4MHz to 40MHz for cost and EMC optimization — FlexRay clocking independent from the CPU and XGATE bus frequency. Clock is generated by a “dedicated” IPLL. — Up to two channels for fault tolerant systems (see Table 1-2 Peripheral Feature Summary of MC9S12XF-Family Members) — Single channel operation on channel A, conﬁgurable to run FlexRay channel A or channel B protocol — 32 conﬁgurable message buffers — Message buffers can be conﬁgured as Receive, single buffered Transmit or double buffered Transmit message buffer — Message buffer header, status and payload data stored in System RAM — 2 independent message buffer segments — Size of message buffer payload data section conﬁgurable from 0 up to 254 bytes — 2 independent receive FIFOs, 1 per channel — Six separate interrupt channels for Receive, receive FIFO channel A, receive FIFO channel B, Transmit, Error and Wake-up — Internal signals can be routed to I/O pins to ease debugging Analog-to-Digital Converter (ATD) MC9S12XF - Family Reference Manual, Rev.1.19 26 Freescale Semiconductor Chapter 1 MC9S12XF-Family Reference Manual • • • • • — 8/10/12 Bit resolution — Multiplexer for 16 analog input channels — 3µs, 12-bit single conversion time — Left or right justiﬁed result data — External and internal conversion trigger capability — Internal oscillator for conversion in Stop Modes — Wake-up from low power modes on analog comparison > or IPL[2:0]). 3. The I bit in the condition code register (CCR) of the CPU must be cleared. 4. There is no access violation interrupt request pending. 5. There is no SYS, SWI, BDM, TRAP, or XIRQ request pending. NOTE All non I bit maskable interrupt requests always have higher priority than I bit maskable interrupt requests. If an I bit maskable interrupt request is interrupted by a non I bit maskable interrupt request, the currently active interrupt processing level (IPL) remains unaffected. It is possible to nest non I bit maskable interrupt requests, e.g., by nesting SWI or TRAP calls. 7.4.2.1 Interrupt Priority Stack The current interrupt processing level (IPL) is stored in the condition code register (CCR) of the CPU. This way the current IPL is automatically pushed to the stack by the standard interrupt stacking procedure. The new IPL is copied to the CCR from the priority level of the highest priority active interrupt request channel which is conﬁgured to be handled by the CPU. The copying takes place when the interrupt vector is fetched. The previous IPL is automatically restored by executing the RTI instruction. MC9S12XF - Family Reference Manual, Rev.1.19 214 Freescale Semiconductor Chapter 7 Interrupt (S12XINTV2) 7.4.3 XGATE Requests If the XGATE module is implemented on the device, the INT module is also used to process all exception requests to be serviced by the XGATE module. The overall priority level of those exceptions is discussed in the subsections below. 7.4.3.1 XGATE Request Prioritization An interrupt request channel is conﬁgured to be handled by the XGATE module, if the RQST bit of the associated conﬁguration register is set to 1 (please refer to Section 7.3.2.4, “Interrupt Request Conﬁguration Data Registers (INT_CFDATA0–7)”). The priority level conﬁguration (PRIOLVL) for this channel becomes the XGATE priority which will be used to determine the highest priority XGATE request to be serviced next by the XGATE module. Additionally, XGATE interrupts may be raised by the XGATE module by setting one or more of the XGATE channel interrupt ﬂags (by using the SIF instruction). This will result in an CPU interrupt with vector address vector base + (2 * channel ID number), where the channel ID number corresponds to the highest set channel interrupt ﬂag, if the XGIE and channel RQST bits are set. The shared interrupt priority for the XGATE interrupt requests is taken from the XGATE interrupt priority conﬁguration register (please refer to Section 7.3.2.2, “XGATE Interrupt Priority Conﬁguration Register (INT_XGPRIO)”). If more than one XGATE interrupt request channel becomes active at the same time, the channel with the highest vector address wins the prioritization. 7.4.4 Priority Decoders The INT module contains priority decoders to determine the priority for all interrupt requests pending for the respective target. There are two priority decoders, one for each interrupt request target, CPU or XGATE. The function of both priority decoders is basically the same with one exception: the priority decoder for the XGATE module does not take the current XGATE thread processing level into account. Instead, XGATE requests are handed to the XGATE module including a 1-bit priority identiﬁer. The XGATE module uses this additional information to decide if the new request can interrupt a currently running thread. The 1-bit priority identiﬁer corresponds to the most signiﬁcant bit of the priority level conﬁguration of the requesting channel. This means that XGATE requests with priority levels 4, 5, 6 or 7 can interrupt running XGATE threads with priority levels 1, 2 and 3. A CPU interrupt vector is not supplied until the CPU requests it. Therefore, it is possible that a higher priority interrupt request could override the original exception which caused the CPU to request the vector. In this case, the CPU will receive the highest priority vector and the system will process this exception instead of the original request. If the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the CPU will default to that of the spurious interrupt vector. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 215 Chapter 7 Interrupt (S12XINTV2) NOTE Care must be taken to ensure that all exception requests remain active until the system begins execution of the applicable service routine; otherwise, the exception request may not get processed at all or the result may be a spurious interrupt request (vector at address (vector base + 0x0010)). 7.4.5 Reset Exception Requests The INT module supports three system reset exception request types (for details please refer to the Clock and Reset Generator module (CRG)): 1. Pin reset, power-on reset, low-voltage reset, or illegal address reset 2. Clock monitor reset request 3. COP watchdog reset request 7.4.6 Exception Priority The priority (from highest to lowest) and address of all exception vectors issued by the INT module upon request by the CPU is shown in Table 7-10. Generally, all non-maskable interrupts have higher priorities than maskable interrupts. Please note that between the three software interrupts (Unimplemented op-code trap request, SWI/BGND request, SYS request) there is no real priority deﬁned because they cannot occur simultaneously (the S12XCPU executes one instruction at a time). Table 7-10. Exception Vector Map and Priority Vector Address(1) 0xFFFE 0xFFFC 0xFFFA (Vector base + 0x00F8) (Vector base + 0x00F6) (Vector base + 0x0012) (Vector base + 0x0018) (Vector base + 0x0016) (Vector base + 0x0014) (Vector base + 0x00F4) (Vector base + 0x00F2) (Vector base + 0x00F0–0x001A) Source Pin reset, power-on reset, low-voltage reset, illegal address reset Clock monitor reset COP watchdog reset Unimplemented op-code trap Software interrupt instruction (SWI) or BDM vector request System call interrupt instruction (SYS) (reserved for future use) XGATE Access violation interrupt request(2) CPU Access violation interrupt request(3) XIRQ interrupt request IRQ interrupt request Device speciﬁc I bit maskable interrupt sources (priority determined by the associated conﬁguration registers, in descending order) (Vector base + 0x0010) Spurious interrupt 1. 16 bits vector address based 2. only implemented if device features both a Memory Protection Unit (MPU) and an XGATE co-processor 3. only implemented if device features a Memory Protection Unit (MPU) MC9S12XF - Family Reference Manual, Rev.1.19 216 Freescale Semiconductor Chapter 7 Interrupt (S12XINTV2) 7.5 7.5.1 Initialization/Application Information Initialization After system reset, software should: • Initialize the interrupt vector base register if the interrupt vector table is not located at the default location (0xFF10–0xFFF9). • Initialize the interrupt processing level conﬁguration data registers (INT_CFADDR, INT_CFDATA0–7) for all interrupt vector requests with the desired priority levels and the request target (CPU or XGATE module). It might be a good idea to disable unused interrupt requests. • If the XGATE module is used, setup the XGATE interrupt priority register (INT_XGPRIO) and conﬁgure the XGATE module (please refer the XGATE Block Guide for details). • Enable I maskable interrupts by clearing the I bit in the CCR. • Enable the X maskable interrupt by clearing the X bit in the CCR (if required). 7.5.2 Interrupt Nesting The interrupt request priority level scheme makes it possible to implement priority based interrupt request nesting for the I bit maskable interrupt requests handled by the CPU. • I bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority, so that there can be up to seven nested I bit maskable interrupt requests at a time (refer to Figure 714 for an example using up to three nested interrupt requests). I bit maskable interrupt requests cannot be interrupted by other I bit maskable interrupt requests per default. In order to make an interrupt service routine (ISR) interruptible, the ISR must explicitly clear the I bit in the CCR (CLI). After clearing the I bit, I bit maskable interrupt requests with higher priority can interrupt the current ISR. An ISR of an interruptible I bit maskable interrupt request could basically look like this: • Service interrupt, e.g., clear interrupt ﬂags, copy data, etc. • Clear I bit in the CCR by executing the instruction CLI (thus allowing interrupt requests with higher priority) • Process data • Return from interrupt by executing the instruction RTI MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 217 Chapter 7 Interrupt (S12XINTV2) 0 Stacked IPL 0 4 0 0 0 IPL in CCR 7 6 5 4 Processing Levels 3 2 1 0 0 4 7 4 3 1 0 L7 RTI RTI L3 (Pending) L4 L1 (Pending) Reset RTI RTI Figure 7-14. Interrupt Processing Example 7.5.3 7.5.3.1 Wake Up from Stop or Wait Mode CPU Wake Up from Stop or Wait Mode Every I bit maskable interrupt request which is conﬁgured to be handled by the CPU is capable of waking the MCU from stop or wait mode. To determine whether an I bit maskable interrupts is qualiﬁed to wake up the CPU or not, the same settings as in normal run mode are applied during stop or wait mode: • If the I bit in the CCR is set, all I bit maskable interrupts are masked from waking up the MCU. • An I bit maskable interrupt is ignored if it is conﬁgured to a priority level below or equal to the current IPL in CCR. • I bit maskable interrupt requests which are conﬁgured to be handled by the XGATE module are not capable of waking up the CPU. The X bit maskable interrupt request can wake up the MCU from stop or wait mode at anytime, even if the X bit in CCR is set. If the X bit maskable interrupt request is used to wake-up the MCU with the X bit in the CCR set, the associated ISR is not called. The CPU then resumes program execution with the instruction following the WAI or STOP instruction. This features works following the same rules like any interrupt request, i.e. care must be taken that the X interrupt request used for wake-up remains active at least until the system begins execution of the instruction following the WAI or STOP instruction; otherwise, wake-up may not occur. MC9S12XF - Family Reference Manual, Rev.1.19 218 Freescale Semiconductor Chapter 7 Interrupt (S12XINTV2) 7.5.3.2 XGATE Wake Up from Stop or Wait Mode Interrupt request channels which are conﬁgured to be handled by the XGATE module are capable of waking up the XGATE module. Interrupt request channels handled by the XGATE module do not affect the state of the CPU. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 219 Chapter 7 Interrupt (S12XINTV2) MC9S12XF - Family Reference Manual, Rev.1.19 220 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-1. Revision History Revision Number V01.00 V01.01 Revision Date 12 Dec 2007 19 Dec 2007 8.4.2/8-257 8.4.2/8-257 8.4.2/8-257 8.4.2/8-257 8.3.1/8-226 8.1.3/8-224 8.1.2.4/8-224 8.3.1/8-226 V01.02 25 Sep 2009 8.1/8-221 8.3.2.1/8-233 8.4.2.4/8-260 8.4.2.6/8-261 8.4.2.11/8-265 8.4.2.11/8-265 8.4.2.11/8-265 8.4.2.19/8-274 Sections Affected - Initial version - Removed Load Data Field command 0x05 - Updated Command Error Handling tables based on parent-child relationship with FTM512K3 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands - Corrected maximum allowed ERPART for Full Partition D-Flash and Partition D-Flash commands - Corrected P-Flash IFR Accessibility table - Corrected Tag RAM size in Block Diagram - Corrected Buffer RAM size in Feature List - Added EEE Resource Field table and Memory Map - Clarify single bit fault correction for P-Flash phrase - Expand FDIV vs OSCCLK Frequency table - Add statement concerning code runaway when executing Read Once command from Flash block containing associated ﬁelds - Add statement concerning code runaway when executing Program Once command from Flash block containing associated ﬁelds - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated ﬁelds - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during reset sequence Description of Changes 8.3.2/8-231 8.3.2.1/8-233 8.4.1.2/8-252 8.6/8-280 8.1 Introduction The FTM256K2XF module implements the following: • 256 Kbytes of P-Flash (Program Flash) memory, consisting of 2 physical Flash blocks, intended primarily for nonvolatile code storage MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 221 • • 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both 2 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both The Flash memory is ideal for single-supply applications allowing for ﬁeld reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or conﬁgure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that speciﬁc Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 8.1.1 Glossary Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications. Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 222 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM. EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once ﬁeld. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register. 8.1.2 8.1.2.1 • • • • • Features P-Flash Features 256 Kbytes of P-Flash memory composed of two 128 Kbyte Flash blocks. The 128 Kbyte Flash blocks are each divided into 128 sectors of 1024 bytes. Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Flexible protection scheme to prevent accidental program or erase of P-Flash memory 8.1.2.2 • • • • • • D-Flash Features Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access Dedicated commands to control access to the D-Flash memory over EEE operation Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Ability to program up to four words in a burst sequence MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 223 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.1.2.3 • • • • • • • Emulated EEPROM Features Up to 2Kbytes of emulated EEPROM (EEE) accessible as 2 Kbytes of RAM Flexible protection scheme to prevent accidental program or erase of data Automatic EEE ﬁle handling using an internal Memory Controller Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory Ability to disable EEE operation and allow priority access to the D-Flash memory Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory 8.1.2.4 • User Buffer RAM Features Up to 2 Kbytes of RAM for user access 8.1.2.5 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 8.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 8-1. MC9S12XF - Family Reference Manual, Rev.1.19 224 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash Block 0 16Kx72 sector 0 sector 1 sector 127 Protection Security Oscillator Clock (XTAL) XGATE Clock Divider FCLK P-Flash Block 1 16Kx72 sector 0 sector 1 sector 127 CPU Memory Controller D-Flash 16Kx22 sector 0 sector 1 sector 127 Scratch RAM 512x16 Buffer RAM 1Kx16 Tag RAM 64x16 Figure 8-1. FTM256K2 Block Diagram 8.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 225 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undeﬁned. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. 8.3.1 Module Memory Map The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 8-2. The P-Flash memory map is shown in Figure 8-2. Table 8-2. P-Flash Memory Addressing Global Address Size (Bytes) 128 K 256 K 128 K Description P-Flash Block 0 Contains Flash Conﬁguration Field (see Table 8-3) No P-Flash Memory P-Flash Block 1 0x7E_0000 – 0x7F_FFFF 0x7A_0000 – 0x7D_FFFF 0x78_0000 – 0x79_FFFF The FPROT register, described in Section 8.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash conﬁguration ﬁeld as described in Table 8-3. Table 8-3. Flash Conﬁguration Field(1) Global Address Size (Bytes) 8 Description Backdoor Comparison Key Refer to Section 8.4.2.11, “Verify Backdoor Access Key Command,” and Section 8.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 8.3.2.9, “P-Flash Protection Register (FPROT)” EEE Protection byte Refer to Section 8.3.2.10, “EEE Protection Register (EPROT)” Flash Nonvolatile byte Refer to Section 8.3.2.14, “Flash Option Register (FOPT)” 0x7F_FF00 – 0x7F_FF07 0x7F_FF08 – 0x7F_FF0B(2) 0x7F_FF0C2 0x7F_FF0D2 0x7F_FF0E2 4 1 1 1 MC9S12XF - Family Reference Manual, Rev.1.19 226 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-3. Flash Conﬁguration Field(1) Global Address 0x7F_FF0F2 Size (Bytes) 1 Description Flash Security byte Refer to Section 8.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved ﬁeld should be programmed to 0xFF. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 227 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) P-Flash START = 0x78_0000 0x79_FFFF Flash Protected/Unprotected Region 224 Kbytes 0x7E_0000 0x7F_8000 0x7F_8400 0x7F_8800 0x7F_9000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_A000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x7F_C000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x7F_F000 0x7F_F800 P-Flash END = 0x7F_FFFF Flash Conﬁguration Field 16 bytes (0x7F_FF00 - 0x7F_FF0F) Figure 8-2. P-Flash Memory Map MC9S12XF - Family Reference Manual, Rev.1.19 228 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-4. Program IFR Fields Global Address (PGMIFRON) 0x40_0000 – 0x40_0007 0x40_0008 – 0x40_00E7 0x40_00E8 – 0x40_00E9 0x40_00EA – 0x40_00FF 0x40_0100 – 0x40_013F 0x40_0140 – 0x40_01FF Size (Bytes) 8 224 2 22 64 192 Device ID Reserved Version ID Reserved Program Once Field Refer to Section 8.4.2.6, “Program Once Command” Reserved Field Description Table 8-5. P-Flash IFR Accessibility Global Address (PGMIFRON) 0x40_0000 – 0x40_01FF 0x40_0200 – 0x40_03FF 0x40_0400 – 0x40_05FF Size (Bytes) 512 512 512 Accessed From XBUS0 (PBLK0)(1) Unimplemented Unimplemented XBUS1 (PBLK1) 0x40_0600 – 0x40_07FF 512 1. Refer to Table 8-4 for more details. Table 8-6. EEE Resource Fields Global Address 0x10_0000 – 0x10_7FFF 0x10_8000 – 0x11_FFFF 0x12_0000 – 0x12_007F 0x12_0080 – 0x12_0FFF 0x12_1000 – 0x12_1F7F 0x12_1F80 – 0x12_1FFF 0x12_2000 – 0x12_3BFF 0x12_3C00 – 0x12_3FFF 0x12_4000 – 0x12_DFFF 0x12_E000 – 0x12_FFFF 0x13_0000 – 0x13_F7FF 0x13_F800 – 0x13_FFFF 1. MMCCTL1 register bit Size (Bytes) 32,768 98,304 128 3,968 3,968 128 7,168 1,024 40,960 8,192 63,488 2,048 Description D-Flash Memory (User and EEE) Reserved EEE Nonvolatile Information Register (EEEIFRON(1) = 1) Reserved Reserved EEE Tag RAM (TMGRAMON1 = 1) Reserved Memory Controller Scratch RAM (TMGRAMON1 = 1) Reserved Reserved Reserved Buffer RAM (User and EEE) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 229 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) D-Flash START = 0x10_0000 D-Flash User Partition D-Flash Memory 32 Kbytes D-Flash EEE Partition D-Flash END = 0x10_7FFF 0x12_0000 0x12_1000 0x12_2000 0x12_4000 EEE Nonvolatile Information Register (EEEIFRON) 128 bytes EEE Tag RAM (TMGRAMON) 128 bytes Memory Controller Scratch RAM (TMGRAMON) 1024 bytes 0x12_E000 0x12_FFFF Buffer RAM START = 0x13_F800 Buffer RAM User Partition 0x13_FE00 0x13_FE40 0x13_FE80 0x13_FEC0 0x13_FF00 0x13_FF40 0x13_FF80 0x13_FFC0 Buffer RAM END = 0x13_FFFF Buffer RAM 2 Kbyte Buffer RAM EEE Partition Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Figure 8-3. EEE Resource Memory Map MC9S12XF - Family Reference Manual, Rev.1.19 230 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) The Full Partition D-Flash command (see Section 8.4.2.14) is used to program the EEE nonvolatile information register ﬁelds where address 0x12_0000 deﬁnes the D-Flash partition for user access and address 0x12_0004 deﬁnes the buffer RAM partition for EEE operations. Table 8-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) 0x12_0000 – 0x12_0001 0x12_0002 – 0x12_0003 0x12_0004 – 0x12_0005 0x12_0006 – 0x12_0007 Size (Bytes) 2 2 2 2 Description D-Flash User Partition (DFPART) Refer to Section 8.4.2.14, “Full Partition D-Flash Command” D-Flash User Partition (duplicate(1)) Buffer RAM EEE Partition (ERPART) Refer to Section 8.4.2.14, “Full Partition D-Flash Command” Buffer RAM EEE Partition (duplicate1) 0x12_0008 – 0x12_007F 120 Reserved 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 8.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 8-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FECCRIX 0x0004 FCNFG R W R W R W R W R CCIE W 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 8-4. FTM256K2XF Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 231 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Address & Name 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C ETAGHI 0x000D ETAGLO 0x000E FECCRHI 0x000F FECCRLO 0x0010 FOPT 0x0011 FRSV0 0x0012 FRSV1 R 7 6 5 4 3 2 1 0 0 ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W R CCIF W R ERSERIF W R FPOPEN W R EPOPEN W R CCOB15 W R CCOB7 W R W R W R W R W R W R W R W 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ETAG7 ETAG6 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 ETAG15 ETAG14 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 RNV6 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 PGMERIF 0 EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 Figure 8-4. FTM256K2XF Register Summary (continued) MC9S12XF - Family Reference Manual, Rev.1.19 232 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Address & Name 0x0013 FRSV2 R W 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-4. FTM256K2XF Register Summary (continued) 8.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIV[6:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table 8-8. FCLKDIV Field Descriptions Field 7 FDIVLD 6–0 FDIV[6:0] Description Clock Divider Loaded 0 FCLKDIV register has not been written 1 FCLKDIV register has been written since the last reset Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 8-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 8.4.1, “Flash Command Operations,” for more information. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 233 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) MIN(1) MAX (2) FDIV[6:0] OSCCLK Frequency (MHz) MIN 1 FDIV[6:0] OSCCLK Frequency (MHz) MIN 1 FDIV[6:0] MAX 2 MAX 2 33.60 1.60 2.40 3.20 4.20 5.25 6.30 7.35 8.40 9.45 10.50 11.55 12.60 13.65 14.70 15.75 16.80 17.85 18.90 19.95 21.00 22.05 23.10 24.15 25.20 26.25 27.30 28.35 29.40 30.45 31.50 2.10 3.15 4.20 5.25 6.30 7.35 8.40 9.45 10.50 11.55 12.60 13.65 14.70 15.75 16.80 17.85 18.90 19.95 21.00 22.05 23.10 24.15 25.20 26.25 27.30 28.35 29.40 30.45 31.50 32.55 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1A 0x1B 0x1C 0x1D 0x1E 34.65 35.70 36.75 37.80 38.85 39.90 40.95 42.00 43.05 44.10 45.15 46.20 47.25 48.30 49.35 50.40 51.45 52.50 53.55 54.60 55.65 56.70 57.75 58.80 59.85 60.90 61.95 63.00 64.05 65.10 34.65 35.70 36.75 37.80 38.85 39.90 40.95 42.00 43.05 44.10 45.15 46.20 47.25 48.30 49.35 50.40 51.45 52.50 53.55 54.60 55.65 56.70 57.75 58.80 59.85 60.90 61.95 63.00 64.05 65.10 66.15 0x20 0x21 0x22 0x23 0x24 0x25 0x26 0x27 0x28 0x29 0x2A 0x2B 0x2C 0x2D 0x2E 0x2F 0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39 0x3A 0x3B 0x3C 0x3D 0x3E 0x3F 67.20 68.25 69.30 70.35 71.40 72.45 73.50 74.55 75.60 76.65 77.70 78.75 79.80 80.85 81.90 82.95 84.00 85.05 86.10 87.15 88.20 89.25 90.30 91.35 92.40 93.45 94.50 95.55 96.60 97.65 98.70 99.75 68.25 69.30 70.35 71.40 72.45 73.50 74.55 75.60 76.65 77.70 78.75 79.80 80.85 81.90 82.95 84.00 85.05 86.10 87.15 88.20 89.25 90.30 91.35 92.40 93.45 94.50 95.55 96.60 97.65 98.70 99.75 100.80 0x40 0x41 0x42 0x43 0x44 0x45 0x46 0x47 0x48 0x49 0x4A 0x4B 0x4C 0x4D 0x4E 0x4F 0x50 0x51 0x52 0x53 0x54 0x55 0x56 0x57 0x58 0x59 0x5A 0x5B 0x5C 0x5D 0x5E 0x5F 32.55 33.60 0x1F 66.15 67.20 1. FDIV shown generates an FCLK frequency of >0.8 MHz MC9S12XF - Family Reference Manual, Rev.1.19 234 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 2. FDIV shown generates an FCLK frequency of 1.05 MHz 8.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F KEYEN[1:0] RNV[5:2] SEC[1:0] F F F F F F F = Unimplemented or Reserved Figure 8-6. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 8-3) as indicated by reset condition F in Figure 8-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 8-10. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits deﬁne the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 8-11. 5–2 RNV[5:2} 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits deﬁne the security state of the MCU as shown in Table 8-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 8-11. Flash KEYEN States KEYEN[1:0] 00 01 10 Status of Backdoor Key Access DISABLED DISABLED(1) ENABLED 11 DISABLED 1. Preferred KEYEN state to disable backdoor key access. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 235 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-12. Flash Security States SEC[1:0] 00 01 10 Status of Security SECURED SECURED(1) UNSECURED 11 SECURED 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 8.5. 8.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 8-13. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 8.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. 8.3.2.4 Flash ECCR Index Register (FECCRIX) The FECCRIX register is used to index the FECCR register for ECC fault reporting. Offset Module Base + 0x0003 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 ECCRIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-8. FECCR Index Register (FECCRIX) ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 236 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-14. FECCRIX Field Descriptions Field Description 2-0 ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is ECCRIX[2:0] being read. See Section 8.3.2.13, “Flash ECC Error Results Register (FECCR),” for more details. 8.3.2.5 Flash Conﬁguration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-9. Flash Conﬁguration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 8-15. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF ﬂag in the FSTAT register is set (see Section 8.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 8.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated 4 IGNSF MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 237 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-15. FCNFG Field Descriptions (continued) Field 1 FDFD Description Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF ﬂag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF ﬂag in the FERSTAT register to be set (see Section 8.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 8.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF ﬂag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF ﬂag in the FERSTAT register to be set (see Section 8.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 8.3.2.6) 0 FSFD 8.3.2.6 Flash Error Conﬁguration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R ERSERIE W Reset 0 0 PGMERIE 0 EPVIOLIE 0 0 ERSVIE1 0 ERSVIE0 0 DFDIE 0 SFDIE 0 = Unimplemented or Reserved Figure 8-10. Flash Error Conﬁguration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 8-16. FERCNFG Field Descriptions Field 7 ERSERIE Description EEE Erase Error Interrupt Enable — The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation. 0 ERSERIF interrupt disabled 1 An interrupt will be requested whenever the ERSERIF ﬂag is set (see Section 8.3.2.8) EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation. 0 PGMERIF interrupt disabled 1 An interrupt will be requested whenever the PGMERIF ﬂag is set (see Section 8.3.2.8) EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition. 0 EPVIOLIF interrupt disabled 1 An interrupt will be requested whenever the EPVIOLIF ﬂag is set (see Section 8.3.2.8) 6 PGMERIE 4 EPVIOLIE MC9S12XF - Family Reference Manual, Rev.1.19 238 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-16. FERCNFG Field Descriptions (continued) Field 3 ERSVIE1 Description EEE Error Type 1 Interrupt Enable — The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation. 0 ERSVIF1 interrupt disabled 1 An interrupt will be requested whenever the ERSVIF1 ﬂag is set (see Section 8.3.2.8) EEE Error Type 0 Interrupt Enable — The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation. 0 ERSVIF0 interrupt disabled 1 An interrupt will be requested whenever the ERSVIF0 ﬂag is set (see Section 8.3.2.8) Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF ﬂag is set (see Section 8.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF ﬂag is set (see Section 8.3.2.8) 1 An interrupt will be requested whenever the SFDIF ﬂag is set (see Section 8.3.2.8) 2 ERSVIE0 1 DFDIE 0 SFDIE 8.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 0(1) 01 = Unimplemented or Reserved Figure 8-11. Flash Status Register (FSTAT) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 8.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 239 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-17. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF ﬂag indicates that a Flash command has completed. The CCIF ﬂag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 8.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF ﬂag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY ﬂag reﬂects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) or is handling internal EEE operations Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT ﬂag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 8.4.2, “Flash Command Description,” and Section 8.6, “Initialization” for details. 8.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reﬂects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R ERSERIF W Reset 0 0 PGMERIF 0 EPVIOLIF 0 0 ERSVIF1 0 ERSVIF0 0 DFDIF 0 SFDIF 0 = Unimplemented or Reserved Figure 8-12. Flash Error Status Register (FERSTAT) All ﬂags in the FERSTAT register are readable and only writable to clear the ﬂag. MC9S12XF - Family Reference Manual, Rev.1.19 240 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-18. FERSTAT Field Descriptions Field 7 ERSERIF Description EEE Erase Error Interrupt Flag — The setting of the ERSERIF ﬂag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF ﬂag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF ﬂag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 Erase command successfully completed on the D-Flash EEE partition 1 Erase command failed on the D-Flash EEE partition EEE Program Error Interrupt Flag — The setting of the PGMERIF ﬂag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF ﬂag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF ﬂag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 Program command successfully completed on the D-Flash EEE partition 1 Program command failed on the D-Flash EEE partition EEE Protection Violation Interrupt Flag —The setting of the EPVIOLIF ﬂag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF ﬂag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF ﬂag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area. 0 No EEE protection violation 1 EEE protection violation detected EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 ﬂag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 ﬂag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 ﬂag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 No EEE sector state change error detected 1 EEE sector state change error detected EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 ﬂag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 ﬂag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 ﬂag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 No EEE sector format error detected 1 EEE sector format error detected Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF ﬂag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF ﬂag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. 0 No double bit fault detected 1 Double bit fault detected or an invalid Flash array read operation attempted Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF ﬂag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF ﬂag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or an invalid Flash array read operation attempted 6 PGMERIF 4 EPVIOLIF 3 ERSVIF1 2 ERSVIF0 1 DFDIF 0 SFDIF 8.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 241 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F RNV6 FPHDIS F F F FPHS[1:0] F FPLDIS F F FPLS[1:0] F = Unimplemented or Reserved Figure 8-13. Flash Protection Register (FPROT) The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 8.3.2.9.1, “P-Flash Protection Restrictions,” and Table 8-23). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 8-3) as indicated by reset condition ‘F’ in Figure 8-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 8-19. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 8-20 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits deﬁne unprotected address ranges as speciﬁed by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range speciﬁed by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a speciﬁc region of the P-Flash memory ending with global address 0x7F_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 8-21. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a speciﬁc region of the P-Flash memory beginning with global address 0x7F_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 8-22. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] MC9S12XF - Family Reference Manual, Rev.1.19 242 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-20. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 FPHDIS 1 1 0 0 1 1 0 FPLDIS 1 0 1 0 1 0 1 Function(1) No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range 0 0 0 Unprotected High and Low Ranges 1. For range sizes, refer to Table 8-21 and Table 8-22. Table 8-21. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x7F_F800–0x7F_FFFF 0x7F_F000–0x7F_FFFF 0x7F_E000–0x7F_FFFF 0x7F_C000–0x7F_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 8-22. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x7F_8000–0x7F_83FF 0x7F_8000–0x7F_87FF 0x7F_8000–0x7F_8FFF 0x7F_8000–0x7F_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 8-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 243 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x7F_8000 0x7F_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] Freescale Semiconductor FPLS[1:0] Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 8-14. P-Flash Protection Scenarios MC9S12XF - Family Reference Manual, Rev.1.19 0x7F_8000 0x7F_FFFF 244 FPHS[1:0] FPLS[1:0] FPOPEN = 0 FPOPEN = 1 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 8-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 8-23. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 X X To Protection Scenario(1) 0 X 1 X X X 2 X 3 X X X X X X X X X X X X 4 5 6 7 X X X X X X X X 7 1. Allowed transitions marked with X, see Figure 8-14 for a deﬁnition of the scenarios. 8.3.2.10 EEE Protection Register (EPROT) The EPROT register deﬁnes which buffer RAM EEE partition areas are protected against writes. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R EPOPEN W Reset F F RNV[6:4] EPDIS F F F F EPS[2:0] F F = Unimplemented or Reserved Figure 8-15. EEE Protection Register (EPROT) All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 8-3) as indicated by reset condition F in Figure 8-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 245 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF ﬂag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF ﬂag in the FERSTAT register will not set. Table 8-24. EPROT Field Descriptions Field 7 EPOPEN 6–4 RNV[6:4] 3 EPDIS Description Enables writes to the Buffer RAM partitioned for EEE 0 The entire buffer RAM EEE partition is protected from writes 1 Unprotected buffer RAM EEE partition areas are enabled for writes Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a speciﬁc region of the buffer RAM EEE partition. 0 Protection enabled 1 Protection disabled Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 8-21. The EPS bits can only be written to while the EPDIS bit is set. 2–0 EPS[2:0] Table 8-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] 000 001 010 011 100 101 110 111 Global Address Range 0x13_FFC0 – 0x13_FFFF 0x13_FF80 – 0x13_FFFF 0x13_FF40 – 0x13_FFFF 0x13_FF00 – 0x13_FFFF 0x13_FEC0 – 0x13_FFFF 0x13_FE80 – 0x13_FFFF 0x13_FE40 – 0x13_FFFF 0x13_FE00 – 0x13_FFFF Protected Size 64 bytes 128 bytes 192 bytes 256 bytes 320 bytes 384 bytes 448 bytes 512 bytes 8.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. MC9S12XF - Family Reference Manual, Rev.1.19 246 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 8-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 8-17. Flash Common Command Object Low Register (FCCOBLO) 8.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 8-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 8-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 8.4.2. Table 8-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO HI 010 LO Data 0 [7:0] Global address [7:0] Data 0 [15:8] 0, Global address [22:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] deﬁning Flash command MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 247 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 1 [15:8] 8.3.2.12 EEE Tag Counter Register (ETAG) The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ETAG[15:8] 0 0 0 0 = Unimplemented or Reserved Figure 8-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ETAG[7:0] 0 0 0 0 = Unimplemented or Reserved Figure 8-19. EEE Tag Counter Low Register (ETAGLO) All ETAG bits are readable but not writable and are cleared by the Memory Controller. 8.3.2.13 Flash ECC Error Results Register (FECCR) The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 8.3.2.4). Once ECC fault information has been stored, no other fault MC9S12XF - Family Reference Manual, Rev.1.19 248 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ECCR[15:8] 0 0 0 0 = Unimplemented or Reserved Figure 8-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ECCR[7:0] 0 0 0 0 = Unimplemented or Reserved Figure 8-21. Flash ECC Error Results Low Register (FECCRLO) All FECCR bits are readable but not writable. Table 8-27. FECCR Index Settings ECCRIX[2:0] Bits [15:8] 000 001 010 011 100 101 110 111 Parity bits read from Flash block FECCR Register Content Bit[7] CPU or XGATE source identity Global address [15:0] Data 0 [15:0] Data 1 [15:0] (P-Flash only) Data 2 [15:0] (P-Flash only) Data 3 [15:0] (P-Flash only) Not used, returns 0x0000 when read Not used, returns 0x0000 when read Bits[6:0] Global address [22:16] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 249 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-28. FECCR Index=000 Bit Descriptions Field 15:8 PAR[7:0] 7 XBUS01 Description ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. Bus Source Identiﬁer — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE. 0 ECC Error happened on the CPU access 1 ECC Error happened on the XGATE access 6–0 Global Address — The GADDR[22:16] ﬁeld contains the upper seven bits of the global address having GADDR[22:16] caused the error. The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010. 8.3.2.14 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F F F F NV[7:0] F F F F = Unimplemented or Reserved Figure 8-22. Flash Option Register (FOPT) All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 8-3) as indicated by reset condition F in Figure 8-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 8-29. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 8.3.2.15 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. MC9S12XF - Family Reference Manual, Rev.1.19 250 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-23. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 8.3.2.16 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-24. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 8.3.2.17 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-25. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 251 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4 8.4.1 Functional Description Flash Command Operations Flash command operations are used to modify Flash memory contents or conﬁgure module resources for EEE operation. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution 8.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz. Table 8-9 shows recommended values for the FDIV ﬁeld based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 8.4.1.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 8.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. MC9S12XF - Family Reference Manual, Rev.1.19 252 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.1.2.1 Deﬁne FCCOB Contents The FCCOB parameter ﬁelds must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter ﬁelds is controlled via the CCOBIX bits in the FCCOBIX register (see Section 8.3.2.3). The contents of the FCCOB parameter ﬁelds are transferred to the Memory Controller when the user clears the CCIF command completion ﬂag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF ﬂag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The ﬂow for a generic command write sequence is shown in Figure 8-26. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 253 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) START Read: FCLKDIV register Clock Register Written Check FDIVLD Set? yes no Write: FCLKDIV register Read: FSTAT register Note: FCLKDIV must be set after each reset FCCOB Availability Check CCIF Set? yes no Results from previous Command yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no Write to FCCOBIX register to identify speciﬁc command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 8-26. Generic Flash Command Write Sequence Flowchart MC9S12XF - Family Reference Manual, Rev.1.19 254 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.1.3 Valid Flash Module Commands Table 8-30. Flash Commands by Mode Unsecured FCMD Command NS (1) Secured NS (5) NX (2) SS(3) ST(4) ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ NX (6) SS(7) ST(8) ∗ ∗ ∗ ∗ 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Reserved Program P-Flash Program Once Erase All Blocks Erase P-Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Full Partition D-Flash Erase Verify D-Flash Section Program D-Flash Erase D-Flash Sector Enable EEPROM Emulation Disable EEPROM Emulation EEPROM Emulation Query ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x20 Partition D-Flash 1. Unsecured Normal Single Chip mode. 2. Unsecured Normal Expanded mode. 3. Unsecured Special Single Chip mode. 4. Unsecured Special Mode. 5. Secured Normal Single Chip mode. 6. Secured Normal Expanded mode. 7. Secured Special Single Chip mode. 8. Secured Special Mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 255 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.1.4 P-Flash Commands Table 8-31 summarizes the valid P-Flash commands along with the effects of the commands on the PFlash block and other resources within the Flash module. Table 8-31. P-Flash Commands FCMD 0x01 0x02 0x03 0x04 0x06 0x07 Command Erase Verify All Blocks Erase Verify Block Erase Verify PFlash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that all P-Flash (and D-Flash) blocks are erased. Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte ﬁeld in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte ﬁeld in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Speciﬁes a user margin read level for all P-Flash blocks. Speciﬁes a ﬁeld margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase P-Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 8.4.1.5 D-Flash and EEE Commands Table 8-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 8-32. D-Flash Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on D-Flash Memory Verify that all D-Flash (and P-Flash) blocks are erased. Verify that the D-Flash block is erased. Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. MC9S12XF - Family Reference Manual, Rev.1.19 256 Freescale Semiconductor 0x08 Erase All Blocks Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-32. D-Flash Commands FCMD 0x0B 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 0x20 Command Unsecure Flash Set User Margin Level Set Field Margin Level Full Partition DFlash Erase Verify DFlash Section Program D-Flash Erase D-Flash Sector Enable EEPROM Emulation Disable EEPROM Emulation EEPROM Emulation Query Partition D-Flash Function on D-Flash Memory Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. Speciﬁes a user margin read level for the D-Flash block. Speciﬁes a ﬁeld margin read level for the D-Flash block (special modes only). Erase the D-Flash block and partition an area of the D-Flash block for user access. Verify that a given number of words starting at the address provided are erased. Program up to four words in the D-Flash block. Erase all bytes in a sector of the D-Flash block. Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. Returns EEE partition and status variables. Partition an area of the D-Flash block for user access. 8.4.2 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 8.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 257 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.2.1 Erase Verify All Blocks Command Table 8-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF ﬂag will set after the Erase Verify All Blocks operation has completed. Table 8-34. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the read(1) Set if any non-correctable errors have been encountered during the read1 FERSTAT EPVIOLIF None 1. As found in the memory map for FTM512K3. 8.4.2.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be veriﬁed. Table 8-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Global address [22:16] of the Flash block to be veriﬁed. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF ﬂag will set after the Erase Verify Block operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 258 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-36. Erase Verify Block Command Error Handling Register Error Bit ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if an invalid global address [22:16] is supplied(1) None Set if any errors have been encountered during the read(2) Set if any non-correctable errors have been encountered during the read2 FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 8.4.2.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. Table 8-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [22:16] of a P-Flash block Global address [15:0] of the ﬁrst phrase to be veriﬁed Number of phrases to be veriﬁed Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF ﬂag will set after the Erase Verify P-Flash Section operation has completed. Table 8-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) ACCERR FSTAT Set if the requested section crosses a 256 Kbyte boundary FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read(2) Set if any non-correctable errors have been encountered during the read2 None Set if an invalid global address [22:0] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 259 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 8.4.2.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 8.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 8-39. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF ﬂag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128 Table 8-40. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None Set if command not available in current mode (see Table 8-30) Set if an invalid phrase index is supplied 8.4.2.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. MC9S12XF - Family Reference Manual, Rev.1.19 260 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 8-41. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x06 FCCOB Parameters Global address [22:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed(1) Word 0 program value Word 1 program value Word 2 program value 101 Word 3 program value 1. Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF ﬂag will set after the Program P-Flash operation has completed. Table 8-42. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 8-30) ACCERR Set if an invalid global address [22:0] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 Set if the global address [22:0] points to a protected area Set if any errors have been encountered during the verify operation(2) Set if any non-correctable errors have been encountered during the verify operation2 FSTAT FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 8.4.2.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 8.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 261 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 8-43. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller ﬁrst veriﬁes that the selected phrase is erased. If erased, then the selected phrase will be programmed and then veriﬁed with read back. The CCIF ﬂag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. Table 8-44. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 8-30) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested phrase has already been programmed(1) None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 8.4.2.7 Erase All Blocks Command The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. MC9S12XF - Family Reference Manual, Rev.1.19 262 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-45. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller veriﬁes that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF ﬂag will set after the Erase All Blocks operation has completed. Table 8-46. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 8-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash memory is protected Set if any errors have been encountered during the verify operation(1) Set if any non-correctable errors have been encountered during the verify operation1 Error Condition Set if CCOBIX[2:0] != 000 at command launch FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected 1. As found in the memory map for FTM512K3. 8.4.2.8 Erase P-Flash Block Command Table 8-47. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [22:16] to identify P-Flash block The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Global address [15:0] in P-Flash block to be erased Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF ﬂag will set after the Erase P-Flash Block operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 263 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-48. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:16] is supplied(1) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected P-Flash block is protected Set if any errors have been encountered during the verify operation(2) Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 8.4.2.9 Erase P-Flash Sector Command Table 8-49. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [22:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 8.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF ﬂag will be set after the Erase P-Flash Sector operation has completed. Table 8-50. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) ACCERR Set if an invalid global address [22:16] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. MC9S12XF - Family Reference Manual, Rev.1.19 264 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.2.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Table 8-51. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller veriﬁes that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF ﬂag is set after the Unsecure Flash operation has completed. Table 8-52. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 8-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash memory is protected Set if any errors have been encountered during the verify operation(1) Set if any non-correctable errors have been encountered during the verify operation1 Error Condition Set if CCOBIX[2:0] != 000 at command launch FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected 1. As found in the memory map for FTM512K3. 8.4.2.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 8-11). The Verify Backdoor Access Key command releases security if usersupplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 83). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 8-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x0C Key 0 Key 1 FCCOB Parameters Not required MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 265 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 011 100 FCCOB Parameters Key 2 Key 3 Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash conﬁguration ﬁeld with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 8-54. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 8.3.2.2) Set if the backdoor key has mismatched since the last reset None None None None 8.4.2.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Table 8-55. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Global address [22:16] to identify the Flash block Margin level setting Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF ﬂag. MC9S12XF - Family Reference Manual, Rev.1.19 266 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Valid margin level settings for the Set User Margin Level command are deﬁned in Table 8-56. Table 8-56. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 Level Description Return to Normal Level User Margin-1 Level(1) 0x0002 User Margin-0 Level(2) 1. Read margin to the erased state 2. Read margin to the programmed state Table 8-57. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid global address [22:16] is supplied(1) Set if an invalid margin level setting is supplied None None None FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 8.4.2.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 8-58. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Global address [22:16] to identify the Flash block Margin level setting MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 267 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the ﬁeld margin level for the targeted block and then set the CCIF ﬂag. Valid margin level settings for the Set Field Margin Level command are deﬁned in Table 8-59. Table 8-59. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 Level Description Return to Normal Level User Margin-1 Level(1) User Margin-0 Level(2) Field Margin-1 Level1 0x0004 Field Margin-0 Level2 1. Read margin to the erased state 2. Read margin to the programmed state Table 8-60. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid global address [22:16] is supplied(1) Set if an invalid margin level setting is supplied None None None FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at ﬁeld margin levels, the Flash memory contents should be erased and reprogrammed. MC9S12XF - Family Reference Manual, Rev.1.19 268 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.2.14 Full Partition D-Flash Command The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. Table 8-61. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x0F FCCOB Parameters Not required Number of 256 byte sectors for the D-Flash user partition (DFPART) Number of 256 byte sectors for buffer RAM EEE partition (ERPART) Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to deﬁne a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART): • Validate the DFPART and ERPART values provided: — DFPART = 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE) • Erase the D-Flash block and the EEE nonvolatile information register • Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 8-7) • Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 8-7) • Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 8-7) • Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 8-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF ﬂag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 269 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-62. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 8-30) Set if an invalid DFPART or ERPART selection is supplied(1) FERSTAT EPVIOLIF None 1. As deﬁned by the maximum ERPART for FTM512K3. 8.4.2.15 Erase Verify D-Flash Section Command The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Table 8-63. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [22:16] to identify the D-Flash block Global address [15:0] of the ﬁrst word to be veriﬁed Number of words to be veriﬁed Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF ﬂag will set after the Erase Verify DFlash Section operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 270 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-64. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) Set if an invalid global address [22:0] is supplied ACCERR FSTAT Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None 8.4.2.16 Program D-Flash Command The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 8-65. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [22:16] to identify the D-Flash block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF ﬂag is set when the operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 271 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-66. Program D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 8-30) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 8.4.2.17 Erase D-Flash Sector Command Table 8-67. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [22:16] to identify D-Flash block The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Global address [15:0] anywhere within the sector to be erased. See Section 8.1.2.2 for D-Flash sector size. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF ﬂag will set after the Erase D-Flash Sector operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 272 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-68. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 8-30) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if the global address [22:0] points to the D-Flash EEE partition None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 8.4.2.18 Enable EEPROM Emulation Command The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Table 8-69. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] 000 0x13 FCCOB Parameters Not required Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF ﬂag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 8-70. Enable EEPROM Emulation Command Error Handling Register Error Bit ACCERR Set if Full Partition D-Flash or Partition D-Flash command not previously run FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Error Condition Set if CCOBIX[2:0] != 000 at command launch MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 273 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.2.19 Disable EEPROM Emulation Command The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Table 8-71. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] 000 0x14 FCCOB Parameters Not required Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF ﬂag. Table 8-72. Disable EEPROM Emulation Command Error Handling Register Error Bit ACCERR Set if Full Partition D-Flash or Partition D-Flash command not previously run FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Error Condition Set if CCOBIX[2:0] != 000 at command launch 8.4.2.20 EEPROM Emulation Query Command Table 8-73. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 0x15 Return DFPART Return ERPART Return ECOUNT(1) Return Ready Sector Count FCCOB Parameters Not required The EEPROM Emulation Query command returns EEE partition and status variables. 100 Return Dead Sector Count 1. Indicates sector erase count Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF ﬂag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash Command Section 8.4.2.14), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. MC9S12XF - Family Reference Manual, Rev.1.19 274 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) Table 8-74. EEPROM Emulation Query Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 8-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Error Condition Set if CCOBIX[2:0] != 000 at command launch 8.4.2.21 Partition D-Flash Command The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 64 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Table 8-75. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x20 FCCOB Parameters Not required Number of 256 byte sectors for the D-Flash user partition (DFPART) Number of 256 byte sectors for buffer RAM EEE partition (ERPART) Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to deﬁne a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART): • Validate the DFPART and ERPART values provided: — DFPART = 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE) • Erase verify the D-Flash block and the EEE nonvolatile information register • Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 8-7) • Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 8-7) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 275 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) • • Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 8-7) Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 8-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF ﬂag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 8-76. Partition D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 8-30) ACCERR Set if partitions have already been deﬁned FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid DFPART or ERPART selection is supplied(1) None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None 1. As deﬁned by the maximum ERPART for FTM512K3. MC9S12XF - Family Reference Manual, Rev.1.19 276 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) 8.4.3 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. Table 8-77. Flash Interrupt Sources Interrupt Source Flash Command Complete Flash EEE Erase Error Flash EEE Program Error Flash EEE Protection Violation Flash EEE Error Type 1 Violation Flash EEE Error Type 0 Violation ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) ERSERIF (FERSTAT register) PGMERIF (FERSTAT register) EPVIOLIF (FERSTAT register) ERSVIF1 (FERSTAT register) ERSVIF0 (FERSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) ERSERIE (FERCNFG register) PGMERIE (FERCNFG register) EPVIOLIE (FERCNFG register) ERSVIE1 (FERCNFG register) ERSVIE0 (FERCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit I Bit I Bit I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 8.4.3.1 Description of Flash Interrupt Operation The Flash module uses the CCIF ﬂag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF ﬂags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 8.3.2.5, “Flash Configuration Register (FCNFG)”, Section 8.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 8.3.2.7, “Flash Status Register (FSTAT)”, and Section 8.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 8-27. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 277 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) CCIE CCIF ERSERIE ERSERIF PGMERIE PGMERIF EPVIOLIE EPVIOLIF ERSVIE1 ERSVIF1 ERSVIE0 ERSVIF0 DFDIE DFDIF SFDIE SFDIF Flash Command Interrupt Request Flash Error Interrupt Request Figure 8-27. Flash Module Interrupts Implementation 8.4.4 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 8.4.3, “Interrupts”). 8.4.5 Stop Mode If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode. 8.5 Security The Flash module provides security information to the MCU. The Flash security state is deﬁned by the SEC bits of the FSEC register (see Table 8-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash conﬁguration ﬁeld at global address 0x7F_FF0F. MC9S12XF - Family Reference Manual, Rev.1.19 278 Freescale Semiconductor Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) The security state out of reset can be permanently changed by programming the security byte of the Flash conﬁguration ﬁeld. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 8.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 8.3.2.2), the Verify Backdoor Access Key command (see Section 8.4.2.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 8-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 8.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 8.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash conﬁguration ﬁeld. The security as deﬁned in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 279 Chapter 8 256 KByte Flash Module (S12XFTM256K2XFV1) (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections deﬁned in the Flash protection register, FPROT. 8.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods: • Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. • Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF ﬂag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method: • Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU. 8.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 8-30. 8.6 Initialization On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12XF - Family Reference Manual, Rev.1.19 280 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-1. Revision History Revision Number V01.09 Revision Date 14 Nov 2007 Sections Affected 9.5.2/9-341 9.4.2/9-317 Description of Changes - Changed terminology from ‘word program’ to “Program P-Flash’ in the BDM unsecuring description, Section 9.5.2 - Added requirement that user not write any Flash module register during execution of commands ‘Erase All Blocks’, Section 9.4.2.8, and ‘Unsecure Flash’, Section 9.4.2.11 - Added statement that security is released upon successful completion of command ‘Erase All Blocks’, Section 9.4.2.8 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands - Clarify single bit fault correction for P-Flash phrase - Expand FDIV vs OSCCLK Frequency table - Add statement concerning code runaway when executing Read Once command from Flash block containing associated ﬁelds - Add statement concerning code runaway when executing Program Once command from Flash block containing associated ﬁelds - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated ﬁelds - Relate Key 0 to associated Backdoor Comparison Key address - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during reset sequence 9.4.2.8/9-323 V01.10 V01.11 19 Dec 2007 25 Sep 2009 9.4.2/9-317 9.1/9-281 9.3.2.1/9-293 9.4.2.4/9-320 9.4.2.7/9-322 9.4.2.12/9-326 9.4.2.12/9-326 9.4.2.12/9-326 9.4.2.20/9-335 9.3.2/9-291 9.3.2.1/9-293 9.4.1.2/9-312 9.6/9-341 9.1 Introduction The FTM512K3 module implements the following: • 512 Kbytes of P-Flash (Program Flash) memory, consisting of 3 physical Flash blocks, intended primarily for nonvolatile code storage • 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both • 4 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 281 The Flash memory is ideal for single-supply applications allowing for ﬁeld reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or conﬁgure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that speciﬁc Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 9.1.1 Glossary Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications. Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 282 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once ﬁeld. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register. 9.1.2 9.1.2.1 • Features P-Flash Features • • • • • 512 Kbytes of P-Flash memory composed of one 256 Kbyte Flash block and two 128 Kbyte Flash blocks. The 256 Kbyte Flash block consists of two 128 Kbyte sections each divided into 128 sectors of 1024 bytes. The 128 Kbyte Flash blocks are each divided into 128 sectors of 1024 bytes. Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to program up to one phrase in each P-Flash block simultaneously Flexible protection scheme to prevent accidental program or erase of P-Flash memory 9.1.2.2 • • • • • • D-Flash Features Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access Dedicated commands to control access to the D-Flash memory over EEE operation Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Ability to program up to four words in a burst sequence 9.1.2.3 • Emulated EEPROM Features Up to 4 Kbytes of emulated EEPROM (EEE) accessible as 4 Kbytes of RAM MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 283 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) • • • • • • Flexible protection scheme to prevent accidental program or erase of data Automatic EEE ﬁle handling using an internal Memory Controller Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory Ability to disable EEE operation and allow priority access to the D-Flash memory Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory 9.1.2.4 • User Buffer RAM Features Up to 4 Kbytes of RAM for user access 9.1.2.5 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 9.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 9-1. MC9S12XF - Family Reference Manual, Rev.1.19 284 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash Block 0 32Kx72 16Kx72 16Kx72 sector 0 sector 1 sector 127 sector 0 sector 1 sector 127 Protection P-Flash Block 1N 16Kx72 sector 0 sector 1 sector 127 Security Oscillator Clock (XTAL) XGATE Clock Divider FCLK P-Flash Block 1S 16Kx72 sector 0 sector 1 sector 127 CPU Memory Controller D-Flash 16Kx22 sector 0 sector 1 sector 127 Scratch RAM 512x16 Buffer RAM 2Kx16 Tag RAM 128x16 Figure 9-1. FTM512K3 Block Diagram 9.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 285 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undeﬁned. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. 9.3.1 Module Memory Map The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 9-2. The P-Flash memory map is shown in Figure 9-2. Table 9-2. P-Flash Memory Addressing Global Address Size (Bytes) 256 K 128 K 128 K Description P-Flash Block 0 Contains Flash Conﬁguration Field (see Table 9-3) P-Flash Block 1N P-Flash Block 1S 0x7C_0000 – 0x7F_FFFF 0x7A_0000 – 0x7B_FFFF 0x78_0000 – 0x79_FFFF The FPROT register, described in Section 9.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash conﬁguration ﬁeld as described in Table 9-3. Table 9-3. Flash Conﬁguration Field(1) Global Address Size (Bytes) 8 Description Backdoor Comparison Key Refer to Section 9.4.2.12, “Verify Backdoor Access Key Command,” and Section 9.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 9.3.2.9, “P-Flash Protection Register (FPROT)” EEE Protection byte Refer to Section 9.3.2.10, “EEE Protection Register (EPROT)” Flash Nonvolatile byte Refer to Section 9.3.2.14, “Flash Option Register (FOPT)” 0x7F_FF00 – 0x7F_FF07 0x7F_FF08 – 0x7F_FF0B(2) 0x7F_FF0C2 0x7F_FF0D2 0x7F_FF0E2 4 1 1 1 MC9S12XF - Family Reference Manual, Rev.1.19 286 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-3. Flash Conﬁguration Field(1) Global Address 0x7F_FF0F2 Size (Bytes) 1 Description Flash Security byte Refer to Section 9.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved ﬁeld should be programmed to 0xFF. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 287 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) P-Flash START = 0x78_0000 Flash Protected/Unprotected Region 480 Kbytes 0x7F_8000 0x7F_8400 0x7F_8800 0x7F_9000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_A000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x7F_C000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x7F_F000 0x7F_F800 P-Flash END = 0x7F_FFFF Flash Conﬁguration Field 16 bytes (0x7F_FF00 - 0x7F_FF0F) Figure 9-2. P-Flash Memory Map MC9S12XF - Family Reference Manual, Rev.1.19 288 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-4. Program IFR Fields Global Address (PGMIFRON) 0x40_0000 – 0x40_0007 0x40_0008 – 0x40_00E7 0x40_00E8 – 0x40_00E9 0x40_00EA – 0x40_00FF 0x40_0100 – 0x40_013F 0x40_0140 – 0x40_01FF Size (Bytes) 8 224 2 22 64 192 Device ID Reserved Version ID Reserved Program Once Field Refer to Section 9.4.2.7, “Program Once Command” Reserved Field Description Table 9-5. P-Flash IFR Accessibility Global Address (PGMIFRON) 0x40_0000 – 0x40_01FF 0x40_0200 – 0x40_03FF 0x40_0400 – 0x40_05FF Size (Bytes) 512 512 512 Accessed From XBUS0 (PBLK0S)(1) Unimplemented XBUS0 (PBLK1N) XBUS1 (PBLK1S) 0x40_0600 – 0x40_07FF 512 1. Refer to Table 9-4 for more details. Table 9-6. EEE Resource Fields Global Address 0x10_0000 – 0x10_7FFF 0x10_8000 – 0x11_FFFF 0x12_0000 – 0x12_007F 0x12_0080 – 0x12_0FFF 0x12_1000 – 0x12_1EFF 0x12_1F00 – 0x12_1FFF 0x12_2000 – 0x12_3BFF 0x12_3C00 – 0x12_3FFF 0x12_4000 – 0x12_DFFF 0x12_E000 – 0x12_FFFF 0x13_0000 – 0x13_EFFF 0x13_F000 – 0x13_FFFF 1. MMCCTL1 register bit Size (Bytes) 32,768 98,304 128 3,968 3,840 256 7,168 1,024 40,960 8,192 61,440 4,096 Description D-Flash Memory (User and EEE) Reserved EEE Nonvolatile Information Register (EEEIFRON(1) = 1) Reserved Reserved EEE Tag RAM (TMGRAMON1 = 1) Reserved Memory Controller Scratch RAM (TMGRAMON1 = 1) Reserved Reserved Reserved Buffer RAM (User and EEE) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 289 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) D-Flash START = 0x10_0000 D-Flash User Partition D-Flash Memory 32 Kbytes D-Flash EEE Partition D-Flash END = 0x10_7FFF 0x12_0000 0x12_1000 0x12_2000 0x12_4000 EEE Nonvolatile Information Register (EEEIFRON) 128 bytes EEE Tag RAM (TMGRAMON) 256 bytes Memory Controller Scratch RAM (TMGRAMON) 1024 bytes 0x12_E000 0x12_FFFF Buffer RAM START = 0x13_F000 Buffer RAM User Partition 0x13_FE00 0x13_FE40 0x13_FE80 0x13_FEC0 0x13_FF00 0x13_FF40 0x13_FF80 0x13_FFC0 Buffer RAM END = 0x13_FFFF Buffer RAM 4 Kbytes Buffer RAM EEE Partition Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Figure 9-3. EEE Resource Memory Map The Full Partition D-Flash command (see Section 9.4.2.15) is used to program the EEE nonvolatile information register ﬁelds where address 0x12_0000 deﬁnes the D-Flash partition for user access and address 0x12_0004 deﬁnes the buffer RAM partition for EEE operations. MC9S12XF - Family Reference Manual, Rev.1.19 290 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) 0x12_0000 – 0x12_0001 0x12_0002 – 0x12_0003 0x12_0004 – 0x12_0005 0x12_0006 – 0x12_0007 Size (Bytes) 2 2 2 2 Description D-Flash User Partition (DFPART) Refer to Section 9.4.2.15, “Full Partition D-Flash Command” D-Flash User Partition (duplicate(1)) Buffer RAM EEE Partition (ERPART) Refer to Section 9.4.2.15, “Full Partition D-Flash Command” Buffer RAM EEE Partition (duplicate1) 0x12_0008 – 0x12_007F 120 Reserved 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 9.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 9-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FECCRIX 0x0004 FCNFG 0x0005 FERCNFG R W R W R W R W R CCIE W R ERSERIE W PGMERIE 0 EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 9-4. FTM512K3 Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 291 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Address & Name 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C ETAGHI 0x000D ETAGLO 0x000E FECCRHI 0x000F FECCRLO 0x0010 FOPT 0x0011 FRSV0 0x0012 FRSV1 0x0013 FRSV2 R 7 6 0 5 4 3 MGBUSY 2 RSVD 1 MGSTAT1 0 MGSTAT0 CCIF W R ERSERIF W R FPOPEN W R EPOPEN W R CCOB15 W R CCOB7 W R W R W R W R W R W R W R W R W 0 0 0 0 0 0 NV7 NV6 ECCR7 ECCR6 ECCR15 ECCR14 ETAG7 ETAG6 ETAG15 ETAG14 CCOB6 CCOB14 RNV6 RNV6 PGMERIF ACCERR FPVIOL 0 EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Figure 9-4. FTM512K3 Register Summary (continued) MC9S12XF - Family Reference Manual, Rev.1.19 292 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Address & Name 7 6 5 4 3 2 1 0 = Unimplemented or Reserved Figure 9-4. FTM512K3 Register Summary (continued) 9.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIV[6:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table 9-8. FCLKDIV Field Descriptions Field 7 FDIVLD 6–0 FDIV[6:0] Description Clock Divider Loaded 0 FCLKDIV register has not been written 1 FCLKDIV register has been written since the last reset Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 9-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 9.4.1, “Flash Command Operations,” for more information. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 293 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) MIN(1) MAX (2) FDIV[6:0] OSCCLK Frequency (MHz) MIN 1 FDIV[6:0] OSCCLK Frequency (MHz) MIN 1 FDIV[6:0] MAX 2 MAX 2 33.60 1.60 2.40 3.20 4.20 5.25 6.30 7.35 8.40 9.45 10.50 11.55 12.60 13.65 14.70 15.75 16.80 17.85 18.90 19.95 21.00 22.05 23.10 24.15 25.20 26.25 27.30 28.35 29.40 30.45 31.50 2.10 3.15 4.20 5.25 6.30 7.35 8.40 9.45 10.50 11.55 12.60 13.65 14.70 15.75 16.80 17.85 18.90 19.95 21.00 22.05 23.10 24.15 25.20 26.25 27.30 28.35 29.40 30.45 31.50 32.55 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1A 0x1B 0x1C 0x1D 0x1E 34.65 35.70 36.75 37.80 38.85 39.90 40.95 42.00 43.05 44.10 45.15 46.20 47.25 48.30 49.35 50.40 51.45 52.50 53.55 54.60 55.65 56.70 57.75 58.80 59.85 60.90 61.95 63.00 64.05 65.10 34.65 35.70 36.75 37.80 38.85 39.90 40.95 42.00 43.05 44.10 45.15 46.20 47.25 48.30 49.35 50.40 51.45 52.50 53.55 54.60 55.65 56.70 57.75 58.80 59.85 60.90 61.95 63.00 64.05 65.10 66.15 0x20 0x21 0x22 0x23 0x24 0x25 0x26 0x27 0x28 0x29 0x2A 0x2B 0x2C 0x2D 0x2E 0x2F 0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39 0x3A 0x3B 0x3C 0x3D 0x3E 0x3F 67.20 68.25 69.30 70.35 71.40 72.45 73.50 74.55 75.60 76.65 77.70 78.75 79.80 80.85 81.90 82.95 84.00 85.05 86.10 87.15 88.20 89.25 90.30 91.35 92.40 93.45 94.50 95.55 96.60 97.65 98.70 99.75 68.25 69.30 70.35 71.40 72.45 73.50 74.55 75.60 76.65 77.70 78.75 79.80 80.85 81.90 82.95 84.00 85.05 86.10 87.15 88.20 89.25 90.30 91.35 92.40 93.45 94.50 95.55 96.60 97.65 98.70 99.75 100.80 0x40 0x41 0x42 0x43 0x44 0x45 0x46 0x47 0x48 0x49 0x4A 0x4B 0x4C 0x4D 0x4E 0x4F 0x50 0x51 0x52 0x53 0x54 0x55 0x56 0x57 0x58 0x59 0x5A 0x5B 0x5C 0x5D 0x5E 0x5F 32.55 33.60 0x1F 66.15 67.20 1. FDIV shown generates an FCLK frequency of >0.8 MHz MC9S12XF - Family Reference Manual, Rev.1.19 294 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 2. FDIV shown generates an FCLK frequency of 1.05 MHz 9.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F KEYEN[1:0] RNV[5:2] SEC[1:0] F F F F F F F = Unimplemented or Reserved Figure 9-6. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 9-3) as indicated by reset condition F in Figure 9-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 9-10. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits deﬁne the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 9-11. 5–2 RNV[5:2} 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits deﬁne the security state of the MCU as shown in Table 9-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 9-11. Flash KEYEN States KEYEN[1:0] 00 01 10 Status of Backdoor Key Access DISABLED DISABLED(1) ENABLED 11 DISABLED 1. Preferred KEYEN state to disable backdoor key access. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 295 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-12. Flash Security States SEC[1:0] 00 01 10 Status of Security SECURED SECURED(1) UNSECURED 11 SECURED 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 9.5. 9.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 9-13. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 9.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. 9.3.2.4 Flash ECCR Index Register (FECCRIX) The FECCRIX register is used to index the FECCR register for ECC fault reporting. Offset Module Base + 0x0003 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 ECCRIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-8. FECCR Index Register (FECCRIX) ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 296 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-14. FECCRIX Field Descriptions Field Description 2-0 ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is ECCRIX[2:0] being read. See Section 9.3.2.13, “Flash ECC Error Results Register (FECCR),” for more details. 9.3.2.5 Flash Conﬁguration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-9. Flash Conﬁguration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 9-15. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF ﬂag in the FSTAT register is set (see Section 9.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 9.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated 4 IGNSF MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 297 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-15. FCNFG Field Descriptions (continued) Field 1 FDFD Description Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF ﬂag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF ﬂag in the FERSTAT register to be set (see Section 9.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 9.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF ﬂag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF ﬂag in the FERSTAT register to be set (see Section 9.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 9.3.2.6) 0 FSFD 9.3.2.6 Flash Error Conﬁguration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R ERSERIE W Reset 0 0 PGMERIE 0 EPVIOLIE 0 0 ERSVIE1 0 ERSVIE0 0 DFDIE 0 SFDIE 0 = Unimplemented or Reserved Figure 9-10. Flash Error Conﬁguration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 9-16. FERCNFG Field Descriptions Field 7 ERSERIE Description EEE Erase Error Interrupt Enable — The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation. 0 ERSERIF interrupt disabled 1 An interrupt will be requested whenever the ERSERIF ﬂag is set (see Section 9.3.2.8) EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation. 0 PGMERIF interrupt disabled 1 An interrupt will be requested whenever the PGMERIF ﬂag is set (see Section 9.3.2.8) EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition. 0 EPVIOLIF interrupt disabled 1 An interrupt will be requested whenever the EPVIOLIF ﬂag is set (see Section 9.3.2.8) 6 PGMERIE 4 EPVIOLIE MC9S12XF - Family Reference Manual, Rev.1.19 298 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-16. FERCNFG Field Descriptions (continued) Field 3 ERSVIE1 Description EEE Error Type 1 Interrupt Enable — The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation. 0 ERSVIF1 interrupt disabled 1 An interrupt will be requested whenever the ERSVIF1 ﬂag is set (see Section 9.3.2.8) EEE Error Type 0 Interrupt Enable — The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation. 0 ERSVIF0 interrupt disabled 1 An interrupt will be requested whenever the ERSVIF0 ﬂag is set (see Section 9.3.2.8) Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF ﬂag is set (see Section 9.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF ﬂag is set (see Section 9.3.2.8) 1 An interrupt will be requested whenever the SFDIF ﬂag is set (see Section 9.3.2.8) 2 ERSVIE0 1 DFDIE 0 SFDIE 9.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 0(1) 01 = Unimplemented or Reserved Figure 9-11. Flash Status Register (FSTAT) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 9.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 299 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-17. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF ﬂag indicates that a Flash command has completed. The CCIF ﬂag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 9.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF ﬂag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY ﬂag reﬂects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) or is handling internal EEE operations Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT ﬂag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 9.4.2, “Flash Command Description,” and Section 9.6, “Initialization” for details. 9.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reﬂects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R ERSERIF W Reset 0 0 PGMERIF 0 EPVIOLIF 0 0 ERSVIF1 0 ERSVIF0 0 DFDIF 0 SFDIF 0 = Unimplemented or Reserved Figure 9-12. Flash Error Status Register (FERSTAT) All ﬂags in the FERSTAT register are readable and only writable to clear the ﬂag. MC9S12XF - Family Reference Manual, Rev.1.19 300 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-18. FERSTAT Field Descriptions Field 7 ERSERIF Description EEE Erase Error Interrupt Flag — The setting of the ERSERIF ﬂag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF ﬂag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF ﬂag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 Erase command successfully completed on the D-Flash EEE partition 1 Erase command failed on the D-Flash EEE partition EEE Program Error Interrupt Flag — The setting of the PGMERIF ﬂag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF ﬂag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF ﬂag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 Program command successfully completed on the D-Flash EEE partition 1 Program command failed on the D-Flash EEE partition EEE Protection Violation Interrupt Flag —The setting of the EPVIOLIF ﬂag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF ﬂag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF ﬂag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area. 0 No EEE protection violation 1 EEE protection violation detected EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 ﬂag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 ﬂag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 ﬂag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 No EEE sector state change error detected 1 EEE sector state change error detected EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 ﬂag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 ﬂag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 ﬂag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 No EEE sector format error detected 1 EEE sector format error detected Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF ﬂag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF ﬂag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. 0 No double bit fault detected 1 Double bit fault detected or an invalid Flash array read operation attempted Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF ﬂag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF ﬂag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or an invalid Flash array read operation attempted 6 PGMERIF 4 EPVIOLIF 3 ERSVIF1 2 ERSVIF0 1 DFDIF 0 SFDIF 9.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 301 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F RNV6 FPHDIS F F F FPHS[1:0] F FPLDIS F F FPLS[1:0] F = Unimplemented or Reserved Figure 9-13. Flash Protection Register (FPROT) The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 9.3.2.9.1, “P-Flash Protection Restrictions,” and Table 9-23). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 9-3) as indicated by reset condition ‘F’ in Figure 9-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 9-19. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 9-20 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits deﬁne unprotected address ranges as speciﬁed by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range speciﬁed by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a speciﬁc region of the P-Flash memory ending with global address 0x7F_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 9-21. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a speciﬁc region of the P-Flash memory beginning with global address 0x7F_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 9-22. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] MC9S12XF - Family Reference Manual, Rev.1.19 302 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-20. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 FPHDIS 1 1 0 0 1 1 0 FPLDIS 1 0 1 0 1 0 1 Function(1) No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range 0 0 0 Unprotected High and Low Ranges 1. For range sizes, refer to Table 9-21 and Table 9-22. Table 9-21. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x7F_F800–0x7F_FFFF 0x7F_F000–0x7F_FFFF 0x7F_E000–0x7F_FFFF 0x7F_C000–0x7F_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 9-22. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x7F_8000–0x7F_83FF 0x7F_8000–0x7F_87FF 0x7F_8000–0x7F_8FFF 0x7F_8000–0x7F_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 9-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 303 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x7F_8000 0x7F_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] Freescale Semiconductor FPLS[1:0] Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 9-14. P-Flash Protection Scenarios MC9S12XF - Family Reference Manual, Rev.1.19 0x7F_8000 0x7F_FFFF 304 FPHS[1:0] FPLS[1:0] FPOPEN = 0 FPOPEN = 1 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 9-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 9-23. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 X X To Protection Scenario(1) 0 X 1 X X X 2 X 3 X X X X X X X X X X X X 4 5 6 7 X X X X X X X X 7 1. Allowed transitions marked with X, see Figure 9-14 for a deﬁnition of the scenarios. 9.3.2.10 EEE Protection Register (EPROT) The EPROT register deﬁnes which buffer RAM EEE partition areas are protected against writes. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R EPOPEN W Reset F F RNV[6:4] EPDIS F F F F EPS[2:0] F F = Unimplemented or Reserved Figure 9-15. EEE Protection Register (EPROT) All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 9-3) as indicated by reset condition F in Figure 9-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 305 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF ﬂag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF ﬂag in the FERSTAT register will not set. Table 9-24. EPROT Field Descriptions Field 7 EPOPEN 6–4 RNV[6:4] 3 EPDIS Description Enables writes to the Buffer RAM partitioned for EEE 0 The entire buffer RAM EEE partition is protected from writes 1 Unprotected buffer RAM EEE partition areas are enabled for writes Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a speciﬁc region of the buffer RAM EEE partition. 0 Protection enabled 1 Protection disabled Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 9-21. The EPS bits can only be written to while the EPDIS bit is set. 2–0 EPS[2:0] Table 9-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] 000 001 010 011 100 101 110 111 Global Address Range 0x13_FFC0 – 0x13_FFFF 0x13_FF80 – 0x13_FFFF 0x13_FF40 – 0x13_FFFF 0x13_FF00 – 0x13_FFFF 0x13_FEC0 – 0x13_FFFF 0x13_FE80 – 0x13_FFFF 0x13_FE40 – 0x13_FFFF 0x13_FE00 – 0x13_FFFF Protected Size 64 bytes 128 bytes 192 bytes 256 bytes 320 bytes 384 bytes 448 bytes 512 bytes 9.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. MC9S12XF - Family Reference Manual, Rev.1.19 306 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 9-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 9-17. Flash Common Command Object Low Register (FCCOBLO) 9.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 9-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 9-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 9.4.2. Table 9-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO HI 010 LO Data 0 [7:0] Global address [7:0] Data 0 [15:8] 0, Global address [22:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] deﬁning Flash command MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 307 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 1 [15:8] 9.3.2.12 EEE Tag Counter Register (ETAG) The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ETAG[15:8] 0 0 0 0 = Unimplemented or Reserved Figure 9-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ETAG[7:0] 0 0 0 0 = Unimplemented or Reserved Figure 9-19. EEE Tag Counter Low Register (ETAGLO) All ETAG bits are readable but not writable and are cleared by the Memory Controller. 9.3.2.13 Flash ECC Error Results Register (FECCR) The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 9.3.2.4). Once ECC fault information has been stored, no other fault MC9S12XF - Family Reference Manual, Rev.1.19 308 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ECCR[15:8] 0 0 0 0 = Unimplemented or Reserved Figure 9-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ECCR[7:0] 0 0 0 0 = Unimplemented or Reserved Figure 9-21. Flash ECC Error Results Low Register (FECCRLO) All FECCR bits are readable but not writable. Table 9-27. FECCR Index Settings ECCRIX[2:0] Bits [15:8] 000 001 010 011 100 101 110 111 Parity bits read from Flash block FECCR Register Content Bit[7] CPU or XGATE source identity Global address [15:0] Data 0 [15:0] Data 1 [15:0] (P-Flash only) Data 2 [15:0] (P-Flash only) Data 3 [15:0] (P-Flash only) Not used, returns 0x0000 when read Not used, returns 0x0000 when read Bits[6:0] Global address [22:16] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 309 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-28. FECCR Index=000 Bit Descriptions Field 15:8 PAR[7:0] 7 XBUS01 Description ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. Bus Source Identiﬁer — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE. 0 ECC Error happened on the CPU access 1 ECC Error happened on the XGATE access 6–0 Global Address — The GADDR[22:16] ﬁeld contains the upper seven bits of the global address having GADDR[22:16] caused the error. The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010. 9.3.2.14 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F F F F NV[7:0] F F F F = Unimplemented or Reserved Figure 9-22. Flash Option Register (FOPT) All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 9-3) as indicated by reset condition F in Figure 9-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 9-29. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 9.3.2.15 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. MC9S12XF - Family Reference Manual, Rev.1.19 310 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-23. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 9.3.2.16 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-24. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 9.3.2.17 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 9-25. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 311 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4 9.4.1 Functional Description Flash Command Operations Flash command operations are used to modify Flash memory contents or conﬁgure module resources for EEE operation. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution 9.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz. Table 9-9 shows recommended values for the FDIV ﬁeld based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 9.4.1.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 9.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. MC9S12XF - Family Reference Manual, Rev.1.19 312 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4.1.2.1 Deﬁne FCCOB Contents The FCCOB parameter ﬁelds must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter ﬁelds is controlled via the CCOBIX bits in the FCCOBIX register (see Section 9.3.2.3). The contents of the FCCOB parameter ﬁelds are transferred to the Memory Controller when the user clears the CCIF command completion ﬂag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF ﬂag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The ﬂow for a generic command write sequence is shown in Figure 9-26. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 313 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) START Read: FCLKDIV register Clock Register Written Check FDIVLD Set? yes no Write: FCLKDIV register Read: FSTAT register Note: FCLKDIV must be set after each reset FCCOB Availability Check CCIF Set? yes no Results from previous Command yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no Write to FCCOBIX register to identify speciﬁc command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 9-26. Generic Flash Command Write Sequence Flowchart MC9S12XF - Family Reference Manual, Rev.1.19 314 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4.1.3 Valid Flash Module Commands Table 9-30. Flash Commands by Mode Unsecured FCMD Command NS (1) Secured NS (5) NX (2) SS(3) ST(4) ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ NX (6) SS(7) ST(8) ∗ ∗ ∗ ∗ 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Load Data Field Program P-Flash Program Once Erase All Blocks Erase P-Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Full Partition D-Flash Erase Verify D-Flash Section Program D-Flash Erase D-Flash Sector Enable EEPROM Emulation Disable EEPROM Emulation EEPROM Emulation Query ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x20 Partition D-Flash 1. Unsecured Normal Single Chip mode. 2. Unsecured Normal Expanded mode. 3. Unsecured Special Single Chip mode. 4. Unsecured Special Mode. 5. Secured Normal Single Chip mode. 6. Secured Normal Expanded mode. 7. Secured Special Single Chip mode. 8. Secured Special Mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 315 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4.1.4 P-Flash Commands Table 9-31 summarizes the valid P-Flash commands along with the effects of the commands on the PFlash block and other resources within the Flash module. Table 9-31. P-Flash Commands FCMD 0x01 0x02 0x03 0x04 0x05 0x06 0x07 Command Erase Verify All Blocks Erase Verify Block Erase Verify PFlash Section Read Once Load Data Field Program P-Flash Program Once Function on P-Flash Memory Verify that all P-Flash (and D-Flash) blocks are erased. Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte ﬁeld in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. Load data for simultaneous multiple P-Flash block operations. Program a phrase in a P-Flash block and any previously loaded phrases for any other PFlash block (see Load Data Field command). Program a dedicated 64 byte ﬁeld in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Speciﬁes a user margin read level for all P-Flash blocks. Speciﬁes a ﬁeld margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase P-Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 9.4.1.5 D-Flash and EEE Commands Table 9-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 9-32. D-Flash Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on D-Flash Memory Verify that all D-Flash (and P-Flash) blocks are erased. Verify that the D-Flash block is erased. MC9S12XF - Family Reference Manual, Rev.1.19 316 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-32. D-Flash Commands FCMD Command Function on D-Flash Memory Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. Speciﬁes a user margin read level for the D-Flash block. Speciﬁes a ﬁeld margin read level for the D-Flash block (special modes only). Erase the D-Flash block and partition an area of the D-Flash block for user access. Verify that a given number of words starting at the address provided are erased. Program up to four words in the D-Flash block. Erase all bytes in a sector of the D-Flash block. Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. Returns EEE partition and status variables. Partition an area of the D-Flash block for user access. 0x08 Erase All Blocks 0x0B 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 0x20 Unsecure Flash Set User Margin Level Set Field Margin Level Full Partition DFlash Erase Verify DFlash Section Program D-Flash Erase D-Flash Sector Enable EEPROM Emulation Disable EEPROM Emulation EEPROM Emulation Query Partition D-Flash 9.4.2 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 9.3.2.7). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 317 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. 9.4.2.1 Erase Verify All Blocks Command Table 9-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF ﬂag will set after the Erase Verify All Blocks operation has completed. Table 9-34. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR Set if a Load Data Field command sequence is currently active FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None Error Condition Set if CCOBIX[2:0] != 000 at command launch 9.4.2.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be veriﬁed. Table 9-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Global address [22:16] of the Flash block to be veriﬁed. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF ﬂag will set after the Erase Verify Block operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 318 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-36. Erase Verify Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None Set if a Load Data Field command sequence is currently active Set if an invalid global address [22:16] is supplied 9.4.2.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. The section to be verified cannot cross a 256 Kbyte boundary in the P-Flash memory space. Table 9-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [22:16] of a P-Flash block Global address [15:0] of the ﬁrst phrase to be veriﬁed Number of phrases to be veriﬁed Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF ﬂag will set after the Erase Verify P-Flash Section operation has completed. Table 9-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) ACCERR Set if an invalid global address [22:0] is supplied FSTAT Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the requested section crosses a 256 Kbyte boundary FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 319 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-38. Erase Verify P-Flash Section Command Error Handling Register FERSTAT Error Bit EPVIOLIF None Error Condition 9.4.2.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 9.4.2.7. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 9-39. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF ﬂag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128 Table 9-40. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active ACCERR Set if command not available in current mode (see Table 9-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if an invalid phrase index is supplied None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None 9.4.2.5 Load Data Field Command The Load Data Field command is executed to provide FCCOB parameters for multiple P-Flash blocks for a future simultaneous program operation in the P-Flash memory space. MC9S12XF - Family Reference Manual, Rev.1.19 320 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-41. Load Data Field Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 1. Global address [2:0] must be 000 0x05 FCCOB Parameters Global address [22:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed(1) Word 0 Word 1 Word 2 Word 3 Upon clearing CCIF to launch the Load Data Field command, the FCCOB registers will be transferred to the Memory Controller and be programmed in the block speciﬁed at the global address given with a future Program P-Flash command launched on a P-Flash block. The CCIF ﬂag will set after the Load Data Field operation has completed. Note that once a Load Data Field command sequence has been initiated, the Load Data Field command sequence will be cancelled if any command other than Load Data Field or the future Program P-Flash is launched. Similarly, if an error occurs after launching a Load Data Field or Program P-Flash command, the associated Load Data Field command sequence will be cancelled. Table 9-42. Load Data Field Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied ACCERR FSTAT Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if a Load Data Field command sequence is currently active and the selected block has previously been selected in the same command sequence Set if a Load Data Field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if the global address [22:0] points to a protected area None None None 9.4.2.6 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 321 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 9-43. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x06 FCCOB Parameters Global address [22:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed(1) Word 0 program value Word 1 program value Word 2 program value 101 Word 3 program value 1. Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF ﬂag will set after the Program P-Flash operation has completed. Table 9-44. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:0] is supplied ACCERR Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if a Load Data Field command sequence is currently active and the selected block has previously been selected in the same command sequence FSTAT Set if a Load Data Field command sequence is currently active and global address [17:0] does not match that previously supplied in the same command sequence FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if the global address [22:0] points to a protected area Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 9.4.2.7 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 9.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program MC9S12XF - Family Reference Manual, Rev.1.19 322 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 9-45. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller ﬁrst veriﬁes that the selected phrase is erased. If erased, then the selected phrase will be programmed and then veriﬁed with read back. The CCIF ﬂag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. Table 9-46. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if a Load Data Field command sequence is currently active ACCERR Set if command not available in current mode (see Table 9-30) Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested phrase has already been programmed(1) None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 9.4.2.8 Erase All Blocks Command The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 323 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-47. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller veriﬁes that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF ﬂag will set after the Erase All Blocks operation has completed. Table 9-48. Erase All Blocks Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if any area of the P-Flash memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Set if any area of the buffer RAM EEE partition is protected 9.4.2.9 Erase P-Flash Block Command Table 9-49. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [22:16] to identify P-Flash block The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Global address [15:0] in P-Flash block to be erased Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF ﬂag will set after the Erase P-Flash Block operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 324 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-50. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active ACCERR Set if command not available in current mode (see Table 9-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if an invalid global address [22:16] is supplied Set if an area of the selected P-Flash block is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 9.4.2.10 Erase P-Flash Sector Command Table 9-51. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [22:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 9.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF ﬂag will be set after the Erase P-Flash Sector operation has completed. Table 9-52. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active ACCERR Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if a misaligned phrase address is supplied (global address [2:0] != 000) Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 325 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4.2.11 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Table 9-53. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller veriﬁes that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF ﬂag is set after the Unsecure Flash operation has completed. Table 9-54. Unsecure Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if any area of the P-Flash memory is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation Set if any area of the buffer RAM EEE partition is protected 9.4.2.12 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 9-11). The Verify Backdoor Access Key command releases security if usersupplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 93). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 9-55. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x0C Key 0 Key 1 Key 2 Key 3 FCCOB Parameters Not required MC9S12XF - Family Reference Manual, Rev.1.19 326 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash conﬁguration ﬁeld with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 9-56. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if a Load Data Field command sequence is currently active ACCERR FSTAT Set if an incorrect backdoor key is supplied Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 9.3.2.2) Set if the backdoor key has mismatched since the last reset FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None 9.4.2.13 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Table 9-57. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Global address [22:16] to identify the Flash block Margin level setting Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF ﬂag. Valid margin level settings for the Set User Margin Level command are deﬁned in Table 9-58. Table 9-58. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 Level Description Return to Normal Level User Margin-1 Level(1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 327 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-58. Valid Set User Margin Level Settings CCOB (CCOBIX=001) Level Description 0x0002 User Margin-0 Level(2) 1. Read margin to the erased state 2. Read margin to the programmed state Table 9-59. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active ACCERR FSTAT Set if an invalid margin level setting is supplied FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 9.4.2.14 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 9-60. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Global address [22:16] to identify the Flash block Margin level setting Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the ﬁeld margin level for the targeted block and then set the CCIF ﬂag. MC9S12XF - Family Reference Manual, Rev.1.19 328 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Valid margin level settings for the Set Field Margin Level command are deﬁned in Table 9-61. Table 9-61. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 Level Description Return to Normal Level User Margin-1 Level(1) User Margin-0 Level(2) Field Margin-1 Level1 0x0004 Field Margin-0 Level2 1. Read margin to the erased state 2. Read margin to the programmed state Table 9-62. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active ACCERR FSTAT Set if an invalid margin level setting is supplied FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Set if command not available in current mode (see Table 9-30) Set if an invalid global address [22:16] is supplied CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at ﬁeld margin levels, the Flash memory contents should be erased and reprogrammed. 9.4.2.15 Full Partition D-Flash Command The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 329 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-63. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x0F FCCOB Parameters Not required Number of 256 byte sectors for the D-Flash user partition (DFPART) Number of 256 byte sectors for buffer RAM EEE partition (ERPART) Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to deﬁne a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART): • Validate the DFPART and ERPART values provided: — DFPART = 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE) • Erase the D-Flash block and the EEE nonvolatile information register • Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 9-7) • Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 9-7) • Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 9-7) • Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 9-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF ﬂag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). MC9S12XF - Family Reference Manual, Rev.1.19 330 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-64. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active ACCERR Set if command not available in current mode (see Table 9-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if an invalid DFPART or ERPART selection is supplied None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None 9.4.2.16 Erase Verify D-Flash Section Command The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Table 9-65. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [22:16] to identify the D-Flash block Global address [15:0] of the ﬁrst word to be veriﬁed Number of words to be veriﬁed Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF ﬂag will set after the Erase Verify DFlash Section operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 331 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-66. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) ACCERR FSTAT Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None 9.4.2.17 Program D-Flash Command The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 9-67. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [22:16] to identify the D-Flash block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF ﬂag is set when the operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 332 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-68. Program D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 9.4.2.18 Erase D-Flash Sector Command Table 9-69. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [22:16] to identify D-Flash block The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Global address [15:0] anywhere within the sector to be erased. See Section 9.1.2.2 for D-Flash sector size. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF ﬂag will set after the Erase D-Flash Sector operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 333 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-70. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) ACCERR Set if an invalid global address [22:0] is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to the D-Flash EEE partition None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 9.4.2.19 Enable EEPROM Emulation Command The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Table 9-71. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] 000 0x13 FCCOB Parameters Not required Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF ﬂag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 9-72. Enable EEPROM Emulation Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Set if a Load Data Field command sequence is currently active Set if Full Partition D-Flash or Partition D-Flash command not previously run MC9S12XF - Family Reference Manual, Rev.1.19 334 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4.2.20 Disable EEPROM Emulation Command The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Table 9-73. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] 000 0x14 FCCOB Parameters Not required Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF ﬂag. Table 9-74. Disable EEPROM Emulation Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Set if a Load Data Field command sequence is currently active Set if Full Partition D-Flash or Partition D-Flash command not previously run 9.4.2.21 EEPROM Emulation Query Command Table 9-75. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 0x15 Return DFPART Return ERPART Return ECOUNT(1) Return Ready Sector Count FCCOB Parameters Not required The EEPROM Emulation Query command returns EEE partition and status variables. 100 Return Dead Sector Count 1. Indicates sector erase count Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF ﬂag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash Command Section 9.4.2.15), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 335 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) Table 9-76. EEPROM Emulation Query Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 000 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Set if a Load Data Field command sequence is currently active Set if command not available in current mode (see Table 9-30) 9.4.2.22 Partition D-Flash Command The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Table 9-77. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x20 FCCOB Parameters Not required Number of 256 byte sectors for the D-Flash user partition (DFPART) Number of 256 byte sectors for buffer RAM EEE partition (ERPART) Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to deﬁne a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART): • Validate the DFPART and ERPART values provided: — DFPART = 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE) • Erase verify the D-Flash block and the EEE nonvolatile information register • Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 9-7) MC9S12XF - Family Reference Manual, Rev.1.19 336 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) • • • Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 9-7) Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 9-7) Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 9-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF ﬂag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 9-78. Partition D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if a Load Data Field command sequence is currently active ACCERR FSTAT Set if an invalid DFPART or ERPART selection is supplied FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None Set if command not available in current mode (see Table 9-30) Set if partitions have already been deﬁned MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 337 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) 9.4.3 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. Table 9-79. Flash Interrupt Sources Interrupt Source Flash Command Complete Flash EEE Erase Error Flash EEE Program Error Flash EEE Protection Violation Flash EEE Error Type 1 Violation Flash EEE Error Type 0 Violation ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) ERSERIF (FERSTAT register) PGMERIF (FERSTAT register) EPVIOLIF (FERSTAT register) ERSVIF1 (FERSTAT register) ERSVIF0 (FERSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) ERSERIE (FERCNFG register) PGMERIE (FERCNFG register) EPVIOLIE (FERCNFG register) ERSVIE1 (FERCNFG register) ERSVIE0 (FERCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit I Bit I Bit I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 9.4.3.1 Description of Flash Interrupt Operation The Flash module uses the CCIF ﬂag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF ﬂags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 9.3.2.5, “Flash Configuration Register (FCNFG)”, Section 9.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 9.3.2.7, “Flash Status Register (FSTAT)”, and Section 9.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 9-27. MC9S12XF - Family Reference Manual, Rev.1.19 338 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) CCIE CCIF ERSERIE ERSERIF PGMERIE PGMERIF EPVIOLIE EPVIOLIF ERSVIE1 ERSVIF1 ERSVIE0 ERSVIF0 DFDIE DFDIF SFDIE SFDIF Flash Command Interrupt Request Flash Error Interrupt Request Figure 9-27. Flash Module Interrupts Implementation 9.4.4 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 9.4.3, “Interrupts”). 9.4.5 Stop Mode If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode. 9.5 Security The Flash module provides security information to the MCU. The Flash security state is deﬁned by the SEC bits of the FSEC register (see Table 9-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash conﬁguration ﬁeld at global address 0x7F_FF0F. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 339 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) The security state out of reset can be permanently changed by programming the security byte of the Flash conﬁguration ﬁeld. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 9.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 9.3.2.2), the Verify Backdoor Access Key command (see Section 9.4.2.12) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 9-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 9.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 9.4.2.12 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash conﬁguration ﬁeld. The security as deﬁned in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte MC9S12XF - Family Reference Manual, Rev.1.19 340 Freescale Semiconductor Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections deﬁned in the Flash protection register, FPROT. 9.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods: • Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. • Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF ﬂag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method: • Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU. 9.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 9-30. 9.6 Initialization On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 341 Chapter 9 512 KByte Flash Module (S12XFTM512K3V1) MC9S12XF - Family Reference Manual, Rev.1.19 342 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-1. Revision History Revision Number V01.00 V01.01 Revision Date 12 Dec 2007 19 Dec 2007 10.4.2/10-379 10.4.2/10-379 10.4.2/10-379 10.4.2/10-379 10.3.1/10-348 10.1.3/10-346 10.3.1/10-348 10.3.1/10-348 V01.02 25 Sep 2009 Sections Affected - Initial version - Removed Load Data Field command 0x05 - Updated Command Error Handling tables based on parent-child relationship with FTM512K3 - Corrected Error Handling table for Full Partition D-Flash, Partition D-Flash, and EEPROM Emulation Query commands - Corrected maximum allowed ERPART for Full Partition D-Flash and Partition D-Flash commands - Corrected P-Flash IFR Accessibility table - Corrected Buffer RAM size in Feature List - Corrected EEE Resource Memory Map - Corrected P-Flash Memory Map Description of Changes - Change references for D-Flash from 16 Kbytes to 32 Kbytes - Clarify single bit fault correction for P-Flash phrase 10.1/10-344 10.3.2.1/10-355 - Expand FDIV vs OSCCLK Frequency table 10.4.2.4/10-382 - Add statement concerning code runaway when executing Read Once command from Flash block containing associated ﬁelds 10.4.2.6/10-383 - Add statement concerning code runaway when executing Program Once command from Flash block containing associated ﬁelds 10.4.2.11/10- - Add statement concerning code runaway when executing Verify Backdoor Access Key command from Flash block containing associated ﬁelds 387 - Relate Key 0 to associated Backdoor Comparison Key address 10.4.2.11/10- - Change “power down reset” to “reset” - Add ACCERR condition for Disable EEPROM Emulation command 387 10.4.2.11/10- The following changes were made to clarify module behavior related to Flash register access during reset sequence and while Flash commands are active: 387 10.4.2.19/10- - Add caution concerning register writes while command is active - Writes to FCLKDIV are allowed during reset sequence while CCIF is clear 396 - Add caution concerning register writes while command is active - Writes to FCCOBIX, FCCOBHI, FCCOBLO registers are ignored during 10.3.2/10-353 reset sequence 10.3.2.1/10-355 10.4.1.2/10-374 10.6/10-402 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 343 10.1 Introduction The FTM128K2XF module implements the following: • 128 Kbytes of P-Flash (Program Flash) memory, consisting of 2 physical Flash blocks, intended primarily for nonvolatile code storage • 32 Kbytes of D-Flash (Data Flash) memory, consisting of 1 physical Flash block, that can be used as nonvolatile storage to support the built-in hardware scheme for emulated EEPROM, as basic Flash memory primarily intended for nonvolatile data storage, or as a combination of both • 2 Kbytes of buffer RAM, consisting of 1 physical RAM block, that can be used as emulated EEPROM using a built-in hardware scheme, as basic RAM, or as a combination of both The Flash memory is ideal for single-supply applications allowing for ﬁeld reprogramming without requiring external high voltage sources for program or erase operations. The Flash module includes a memory controller that executes commands to modify Flash memory contents or conﬁgure module resources for emulated EEPROM operation. The user interface to the memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is written to with the command, global address, data, and any required command parameters. The memory controller must complete the execution of a command before the FCCOB register can be written to with a new command. CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. The RAM and Flash memory may be read as bytes, aligned words, or misaligned words. Read access time is one bus cycle for bytes and aligned words, and two bus cycles for misaligned words. For Flash memory, an erased bit reads 1 and a programmed bit reads 0. It is not possible to read from a Flash block while any command is executing on that speciﬁc Flash block. It is possible to read from a Flash block while a command is executing on a different Flash block. Both P-Flash and D-Flash memories are implemented with Error Correction Codes (ECC) that can resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is always read by phrase, only one single bit fault in the phrase containing the byte or word accessed will be corrected. 10.1.1 Glossary Buffer RAM — The buffer RAM constitutes the volatile memory store required for EEE. Memory space in the buffer RAM not required for EEE can be partitioned to provide volatile memory space for applications. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 344 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including program and erase) on the Flash memory. D-Flash Memory — The D-Flash memory constitutes the nonvolatile memory store required for EEE. Memory space in the D-Flash memory not required for EEE can be partitioned to provide nonvolatile memory space for applications. D-Flash Sector — The D-Flash sector is the smallest portion of the D-Flash memory that can be erased. The D-Flash sector consists of four 64 byte rows for a total of 256 bytes. EEE (Emulated EEPROM) — A method to emulate the small sector size features and endurance characteristics associated with an EEPROM. EEE IFR — Nonvolatile information register located in the D-Flash block that contains data required to partition the D-Flash memory and buffer RAM for EEE. The EEE IFR is visible in the global memory map by setting the EEEIFRON bit in the MMCCTL1 register. NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters required for Flash command execution. Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes eight ECC bits for single bit fault correction and double bit fault detection within the phrase. P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications. P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased. Each P-Flash sector contains 1024 bytes. Program IFR — Nonvolatile information register located in the P-Flash block that contains the Device ID, Version ID, and the Program Once ﬁeld. The Program IFR is visible in the global memory map by setting the PGMIFRON bit in the MMCCTL1 register. 10.1.2 10.1.2.1 • • • • • • Features P-Flash Features 128 Kbytes of P-Flash memory composed of two 64 Kbyte Flash blocks. The 64 Kbyte Flash blocks are each divided into 64 sectors of 1024 bytes. Single bit fault correction and double bit fault detection within a 64-bit phrase during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and phrase program operation Ability to program up to one phrase in each P-Flash block simultaneously Flexible protection scheme to prevent accidental program or erase of P-Flash memory 10.1.2.2 • • D-Flash Features Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access Dedicated commands to control access to the D-Flash memory over EEE operation MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 345 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) • • • • Single bit fault correction and double bit fault detection within a word during read operations Automated program and erase algorithm with verify and generation of ECC parity bits Fast sector erase and word program operation Ability to program up to four words in a burst sequence 10.1.2.3 • • • • • • • Emulated EEPROM Features Up to 2 Kbytes of emulated EEPROM (EEE) accessible as 2 Kbytes of RAM Flexible protection scheme to prevent accidental program or erase of data Automatic EEE ﬁle handling using an internal Memory Controller Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory Ability to disable EEE operation and allow priority access to the D-Flash memory Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory 10.1.2.4 • User Buffer RAM Features Up to 2 Kbytes of RAM for user access 10.1.2.5 • • • Other Flash Module Features No external high-voltage power supply required for Flash memory program and erase operations Interrupt generation on Flash command completion and Flash error detection Security mechanism to prevent unauthorized access to the Flash memory 10.1.3 Block Diagram The block diagram of the Flash module is shown in Figure 10-1. MC9S12XF - Family Reference Manual, Rev.1.19 346 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Flash Interface Command Interrupt Request Error Interrupt Request Registers 16bit internal bus P-Flash Block 0 8Kx72 sector 0 sector 1 sector 63 Protection Security Oscillator Clock (XTAL) XGATE Clock Divider FCLK P-Flash Block 1 8Kx72 sector 0 sector 1 sector 63 CPU Memory Controller D-Flash 16Kx22 sector 0 sector 1 sector 127 Scratch RAM 512x16 Buffer RAM 1Kx16 Tag RAM 64x16 Figure 10-1. FTM128K2 Block Diagram 10.2 External Signal Description The Flash module contains no signals that connect off-chip. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 347 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.3 Memory Map and Registers This section describes the memory map and registers for the Flash module. Read data from unimplemented memory space in the Flash module is undeﬁned. Write access to unimplemented or reserved memory space in the Flash module will be ignored by the Flash module. 10.3.1 Module Memory Map The S12X architecture places the P-Flash memory between global addresses 0x78_0000 and 0x7F_FFFF as shown in Table 10-2. The P-Flash memory map is shown in Figure 10-2. Table 10-2. P-Flash Memory Addressing Global Address Size (Bytes) 64 K 384 K 64 K Description P-Flash Block 0 Contains Flash Conﬁguration Field (see Table 10-3) No P-Flash Memory P-Flash Block 1 0x7F_0000 – 0x7F_FFFF 0x79_0000 – 0x7E_FFFF 0x78_0000 – 0x78_FFFF The FPROT register, described in Section 10.3.2.9, can be set to protect regions in the Flash memory from accidental program or erase. Three separate memory regions, one growing upward from global address 0x7F_8000 in the Flash memory (called the lower region), one growing downward from global address 0x7F_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash memory, can be activated for protection. The Flash memory addresses covered by these protectable regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the boot loader code since it covers the vector space. Default protection settings as well as security information that allows the MCU to restrict access to the Flash module are stored in the Flash conﬁguration ﬁeld as described in Table 10-3. Table 10-3. Flash Conﬁguration Field(1) Global Address Size (Bytes) 8 Description Backdoor Comparison Key Refer to Section 10.4.2.11, “Verify Backdoor Access Key Command,” and Section 10.5.1, “Unsecuring the MCU using Backdoor Key Access” Reserved P-Flash Protection byte. Refer to Section 10.3.2.9, “P-Flash Protection Register (FPROT)” EEE Protection byte Refer to Section 10.3.2.10, “EEE Protection Register (EPROT)” Flash Nonvolatile byte Refer to Section 10.3.2.14, “Flash Option Register (FOPT)” 0x7F_FF00 – 0x7F_FF07 0x7F_FF08 – 0x7F_FF0B(2) 0x7F_FF0C2 0x7F_FF0D2 0x7F_FF0E2 4 1 1 1 MC9S12XF - Family Reference Manual, Rev.1.19 348 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-3. Flash Conﬁguration Field(1) Global Address 0x7F_FF0F2 Size (Bytes) 1 Description Flash Security byte Refer to Section 10.3.2.2, “Flash Security Register (FSEC)” 1. Older versions may have swapped protection byte addresses 2. 0x7FF08 - 0x7F_FF0F form a Flash phrase and must be programmed in a single command write sequence. Each byte in the 0x7F_FF08 - 0x7F_FF0B reserved ﬁeld should be programmed to 0xFF. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 349 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) P-Flash START = 0x78_0000 0x78_FFFF Flash Protected/Unprotected Region 96 Kbytes 0x7F_0000 0x7F_8000 0x7F_8400 0x7F_8800 0x7F_9000 Flash Protected/Unprotected Lower Region 1, 2, 4, 8 Kbytes 0x7F_A000 Flash Protected/Unprotected Region 8 Kbytes (up to 29 Kbytes) 0x7F_C000 0x7F_E000 Flash Protected/Unprotected Higher Region 2, 4, 8, 16 Kbytes 0x7F_F000 0x7F_F800 P-Flash END = 0x7F_FFFF Flash Conﬁguration Field 16 bytes (0x7F_FF00 - 0x7F_FF0F) Figure 10-2. P-Flash Memory Map MC9S12XF - Family Reference Manual, Rev.1.19 350 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-4. Program IFR Fields Global Address (PGMIFRON) 0x40_0000 – 0x40_0007 0x40_0008 – 0x40_00E7 0x40_00E8 – 0x40_00E9 0x40_00EA – 0x40_00FF 0x40_0100 – 0x40_013F 0x40_0140 – 0x40_01FF Size (Bytes) 8 224 2 22 64 192 Device ID Reserved Version ID Reserved Program Once Field Refer to Section 10.4.2.6, “Program Once Command” Reserved Field Description Table 10-5. P-Flash IFR Accessibility Global Address (PGMIFRON) 0x40_0000 – 0x40_01FF 0x40_0200 – 0x40_03FF 0x40_0400 – 0x40_05FF Size (Bytes) 512 512 512 Accessed From XBUS0 (PBLK0)(1) Unimplemented Unimplemented XBUS1 (PBLK1) 0x40_0600 – 0x40_07FF 512 1. Refer to Table 10-4 for more details. Table 10-6. EEE Resource Fields Global Address 0x10_0000 – 0x10_7FFF 0x10_8000 – 0x11_FFFF 0x12_0000 – 0x12_007F 0x12_0080 – 0x12_0FFF 0x12_1000 – 0x12_1F7F 0x12_1F80 – 0x12_1FFF 0x12_2000 – 0x12_3BFF 0x12_3C00 – 0x12_3FFF 0x12_4000 – 0x12_DFFF 0x12_E000 – 0x12_FFFF 0x13_0000 – 0x13_F7FF 0x13_F800 – 0x13_FFFF 1. MMCCTL1 register bit Size (Bytes) 32,768 98,304 128 3,968 3,968 128 7,168 1,024 40,960 8,192 63,488 2,048 Description D-Flash Memory (User and EEE) Reserved EEE Nonvolatile Information Register (EEEIFRON(1) = 1) Reserved Reserved EEE Tag RAM (TMGRAMON1 = 1) Reserved Memory Controller Scratch RAM (TMGRAMON1 = 1) Reserved Reserved Reserved Buffer RAM (User and EEE) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 351 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) D-Flash START = 0x10_0000 D-Flash User Partition D-Flash Memory 32 Kbytes D-Flash EEE Partition D-Flash END = 0x10_7FFF 0x12_0000 0x12_1000 0x12_2000 0x12_4000 EEE Nonvolatile Information Register (EEEIFRON) 128 bytes EEE Tag RAM (TMGRAMON) 128 bytes Memory Controller Scratch RAM (TMGRAMON) 1024 bytes 0x12_E000 0x12_FFFF Buffer RAM START = 0x13_F800 Buffer RAM User Partition 0x13_FE00 0x13_FE40 0x13_FE80 0x13_FEC0 0x13_FF00 0x13_FF40 0x13_FF80 0x13_FFC0 Buffer RAM END = 0x13_FFFF Buffer RAM 2 Kbyte Buffer RAM EEE Partition Protectable Region (EEE only) 64, 128, 192, 256, 320, 384, 448, 512 bytes Figure 10-3. EEE Resource Memory Map MC9S12XF - Family Reference Manual, Rev.1.19 352 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) The Full Partition D-Flash command (see Section 10.4.2.14) is used to program the EEE nonvolatile information register ﬁelds where address 0x12_0000 deﬁnes the D-Flash partition for user access and address 0x12_0004 deﬁnes the buffer RAM partition for EEE operations. Table 10-7. EEE Nonvolatile Information Register Fields Global Address (EEEIFRON) 0x12_0000 – 0x12_0001 0x12_0002 – 0x12_0003 0x12_0004 – 0x12_0005 0x12_0006 – 0x12_0007 Size (Bytes) 2 2 2 2 Description D-Flash User Partition (DFPART) Refer to Section 10.4.2.14, “Full Partition D-Flash Command” D-Flash User Partition (duplicate(1)) Buffer RAM EEE Partition (ERPART) Refer to Section 10.4.2.14, “Full Partition D-Flash Command” Buffer RAM EEE Partition (duplicate1) 0x12_0008 – 0x12_007F 120 Reserved 1. Duplicate value used if primary value generates a double bit fault when read during the reset sequence. 10.3.2 Register Descriptions The Flash module contains a set of 20 control and status registers located between Flash module base + 0x0000 and 0x0013. A summary of the Flash module registers is given in Figure 10-4 with detailed descriptions in the following subsections. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. Address & Name 0x0000 FCLKDIV 0x0001 FSEC 0x0002 FCCOBIX 0x0003 FECCRIX 0x0004 FCNFG R W R W R W R W R CCIE W 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 ECCRIX2 ECCRIX1 ECCRIX0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 7 FDIVLD FDIV6 FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 6 5 4 3 2 1 0 Figure 10-4. FTM128K2XF Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 353 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Address & Name 0x0005 FERCNFG 0x0006 FSTAT 0x0007 FERSTAT 0x0008 FPROT 0x0009 EPROT 0x000A FCCOBHI 0x000B FCCOBLO 0x000C ETAGHI 0x000D ETAGLO 0x000E FECCRHI 0x000F FECCRLO 0x0010 FOPT 0x0011 FRSV0 0x0012 FRSV1 R 7 6 5 4 3 2 1 0 0 ERSERIE PGMERIE EPVIOLIE ERSVIE1 ERSVIE0 DFDIE SFDIE W R CCIF W R ERSERIF W R FPOPEN W R EPOPEN W R CCOB15 W R CCOB7 W R W R W R W R W R W R W R W 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 ECCR7 ECCR6 ECCR5 ECCR4 ECCR3 ECCR2 ECCR1 ECCR0 ECCR15 ECCR14 ECCR13 ECCR12 ECCR11 ECCR10 ECCR9 ECCR8 ETAG7 ETAG6 ETAG5 ETAG4 ETAG3 ETAG2 ETAG1 ETAG0 ETAG15 ETAG14 ETAG13 ETAG12 ETAG11 ETAG10 ETAG9 ETAG8 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 CCOB14 CCOB13 CCOB12 CCOB11 CCOB10 CCOB9 CCOB8 RNV6 RNV5 RNV4 EPDIS EPS2 EPS1 EPS0 RNV6 FPHDIS FPHS1 FPHS0 FPLDIS FPLS1 FPLS0 PGMERIF 0 EPVIOLIF ERSVIF1 ERSVIF0 DFDIF SFDIF 0 ACCERR FPVIOL MGBUSY RSVD MGSTAT1 MGSTAT0 Figure 10-4. FTM128K2XF Register Summary (continued) MC9S12XF - Family Reference Manual, Rev.1.19 354 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Address & Name 0x0013 FRSV2 R W 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-4. FTM128K2XF Register Summary (continued) 10.3.2.1 Flash Clock Divider Register (FCLKDIV) The FCLKDIV register is used to control timed events in program and erase algorithms. Offset Module Base + 0x0000 7 6 5 4 3 2 1 0 R W Reset FDIVLD FDIV[6:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-5. Flash Clock Divider Register (FCLKDIV) All bits in the FCLKDIV register are readable, bits 6–0 are write once and bit 7 is not writable. Table 10-8. FCLKDIV Field Descriptions Field 7 FDIVLD 6–0 FDIV[6:0] Description Clock Divider Loaded 0 FCLKDIV register has not been written 1 FCLKDIV register has been written since the last reset Clock Divider Bits — FDIV[6:0] must be set to effectively divide OSCCLK down to generate an internal Flash clock, FCLK, with a target frequency of 1 MHz for use by the Flash module to control timed events during program and erase algorithms. Table 10-9 shows recommended values for FDIV[6:0] based on OSCCLK frequency. Please refer to Section 10.4.1, “Flash Command Operations,” for more information. CAUTION The FCLKDIV register should never be written while a Flash command is executing (CCIF=0). The FCLKDIV register is writable during the Flash reset sequence even though CCIF is clear. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 355 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-9. FDIV vs OSCCLK Frequency OSCCLK Frequency (MHz) MIN(1) MAX (2) FDIV[6:0] OSCCLK Frequency (MHz) MIN 1 FDIV[6:0] OSCCLK Frequency (MHz) MIN 1 FDIV[6:0] MAX 2 MAX 2 33.60 1.60 2.40 3.20 4.20 5.25 6.30 7.35 8.40 9.45 10.50 11.55 12.60 13.65 14.70 15.75 16.80 17.85 18.90 19.95 21.00 22.05 23.10 24.15 25.20 26.25 27.30 28.35 29.40 30.45 31.50 2.10 3.15 4.20 5.25 6.30 7.35 8.40 9.45 10.50 11.55 12.60 13.65 14.70 15.75 16.80 17.85 18.90 19.95 21.00 22.05 23.10 24.15 25.20 26.25 27.30 28.35 29.40 30.45 31.50 32.55 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1A 0x1B 0x1C 0x1D 0x1E 34.65 35.70 36.75 37.80 38.85 39.90 40.95 42.00 43.05 44.10 45.15 46.20 47.25 48.30 49.35 50.40 51.45 52.50 53.55 54.60 55.65 56.70 57.75 58.80 59.85 60.90 61.95 63.00 64.05 65.10 34.65 35.70 36.75 37.80 38.85 39.90 40.95 42.00 43.05 44.10 45.15 46.20 47.25 48.30 49.35 50.40 51.45 52.50 53.55 54.60 55.65 56.70 57.75 58.80 59.85 60.90 61.95 63.00 64.05 65.10 66.15 0x20 0x21 0x22 0x23 0x24 0x25 0x26 0x27 0x28 0x29 0x2A 0x2B 0x2C 0x2D 0x2E 0x2F 0x30 0x31 0x32 0x33 0x34 0x35 0x36 0x37 0x38 0x39 0x3A 0x3B 0x3C 0x3D 0x3E 0x3F 67.20 68.25 69.30 70.35 71.40 72.45 73.50 74.55 75.60 76.65 77.70 78.75 79.80 80.85 81.90 82.95 84.00 85.05 86.10 87.15 88.20 89.25 90.30 91.35 92.40 93.45 94.50 95.55 96.60 97.65 98.70 99.75 68.25 69.30 70.35 71.40 72.45 73.50 74.55 75.60 76.65 77.70 78.75 79.80 80.85 81.90 82.95 84.00 85.05 86.10 87.15 88.20 89.25 90.30 91.35 92.40 93.45 94.50 95.55 96.60 97.65 98.70 99.75 100.80 0x40 0x41 0x42 0x43 0x44 0x45 0x46 0x47 0x48 0x49 0x4A 0x4B 0x4C 0x4D 0x4E 0x4F 0x50 0x51 0x52 0x53 0x54 0x55 0x56 0x57 0x58 0x59 0x5A 0x5B 0x5C 0x5D 0x5E 0x5F 32.55 33.60 0x1F 66.15 67.20 1. FDIV shown generates an FCLK frequency of >0.8 MHz MC9S12XF - Family Reference Manual, Rev.1.19 356 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 2. FDIV shown generates an FCLK frequency of 1.05 MHz 10.3.2.2 Flash Security Register (FSEC) The FSEC register holds all bits associated with the security of the MCU and Flash module. Offset Module Base + 0x0001 7 6 5 4 3 2 1 0 R W Reset F KEYEN[1:0] RNV[5:2] SEC[1:0] F F F F F F F = Unimplemented or Reserved Figure 10-6. Flash Security Register (FSEC) All bits in the FSEC register are readable but not writable. During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the Flash configuration field at global address 0x7F_FF0F located in P-Flash memory (see Table 10-3) as indicated by reset condition F in Figure 10-6. If a double bit fault is detected while reading the P-Flash phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set to leave the Flash module in a secured state with backdoor key access disabled. Table 10-10. FSEC Field Descriptions Field Description 7–6 Backdoor Key Security Enable Bits — The KEYEN[1:0] bits deﬁne the enabling of backdoor key access to the KEYEN[1:0] Flash module as shown in Table 10-11. 5–2 RNV[5:2} 1–0 SEC[1:0] Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements. Flash Security Bits — The SEC[1:0] bits deﬁne the security state of the MCU as shown in Table 10-12. If the Flash module is unsecured using backdoor key access, the SEC bits are forced to 10. Table 10-11. Flash KEYEN States KEYEN[1:0] 00 01 10 Status of Backdoor Key Access DISABLED DISABLED(1) ENABLED 11 DISABLED 1. Preferred KEYEN state to disable backdoor key access. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 357 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-12. Flash Security States SEC[1:0] 00 01 10 Status of Security SECURED SECURED(1) UNSECURED 11 SECURED 1. Preferred SEC state to set MCU to secured state. The security function in the Flash module is described in Section 10.5. 10.3.2.3 Flash CCOB Index Register (FCCOBIX) The FCCOBIX register is used to index the FCCOB register for Flash memory operations. Offset Module Base + 0x0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 CCOBIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-7. FCCOB Index Register (FCCOBIX) CCOBIX bits are readable and writable while remaining bits read 0 and are not writable. Table 10-13. FCCOBIX Field Descriptions Field 2–0 CCOBIX[1:0] Description Common Command Register Index— The CCOBIX bits are used to select which word of the FCCOB register array is being read or written to. See Section 10.3.2.11, “Flash Common Command Object Register (FCCOB),” for more details. 10.3.2.4 Flash ECCR Index Register (FECCRIX) The FECCRIX register is used to index the FECCR register for ECC fault reporting. Offset Module Base + 0x0003 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 ECCRIX[2:0] 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-8. FECCR Index Register (FECCRIX) ECCRIX bits are readable and writable while remaining bits read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 358 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-14. FECCRIX Field Descriptions Field Description 2-0 ECC Error Register Index— The ECCRIX bits are used to select which word of the FECCR register array is ECCRIX[2:0] being read. See Section 10.3.2.13, “Flash ECC Error Results Register (FECCR),” for more details. 10.3.2.5 Flash Conﬁguration Register (FCNFG) The FCNFG register enables the Flash command complete interrupt and forces ECC faults on Flash array read access from the CPU or XGATE. Offset Module Base + 0x0004 7 6 5 4 3 2 1 0 R CCIE W Reset 0 0 0 IGNSF 0 0 FDFD FSFD 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-9. Flash Conﬁguration Register (FCNFG) CCIE, IGNSF, FDFD, and FSFD bits are readable and writable while remaining bits read 0 and are not writable. Table 10-15. FCNFG Field Descriptions Field 7 CCIE Description Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command has completed. 0 Command complete interrupt disabled 1 An interrupt will be requested whenever the CCIF ﬂag in the FSTAT register is set (see Section 10.3.2.7) Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see Section 10.3.2.8). 0 All single bit faults detected during array reads are reported 1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be generated 4 IGNSF MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 359 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-15. FCNFG Field Descriptions (continued) Field 1 FDFD Description Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array read operations and check the associated interrupt routine. The FDFD bit is cleared by writing a 0 to FDFD. The FECCR registers will not be updated during the Flash array read operation with FDFD set unless an actual double bit fault is detected. 0 Flash array read operations will set the DFDIF ﬂag in the FERSTAT register only if a double bit fault is detected 1 Any Flash array read operation will force the DFDIF ﬂag in the FERSTAT register to be set (see Section 10.3.2.7) and an interrupt will be generated as long as the DFDIE interrupt enable in the FERCNFG register is set (see Section 10.3.2.6) Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD. The FECCR registers will not be updated during the Flash array read operation with FSFD set unless an actual single bit fault is detected. 0 Flash array read operations will set the SFDIF ﬂag in the FERSTAT register only if a single bit fault is detected 1 Flash array read operation will force the SFDIF ﬂag in the FERSTAT register to be set (see Section 10.3.2.7) and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see Section 10.3.2.6) 0 FSFD 10.3.2.6 Flash Error Conﬁguration Register (FERCNFG) The FERCNFG register enables the Flash error interrupts for the FERSTAT flags. Offset Module Base + 0x0005 7 6 5 4 3 2 1 0 R ERSERIE W Reset 0 0 PGMERIE 0 EPVIOLIE 0 0 ERSVIE1 0 ERSVIE0 0 DFDIE 0 SFDIE 0 = Unimplemented or Reserved Figure 10-10. Flash Error Conﬁguration Register (FERCNFG) All assigned bits in the FERCNFG register are readable and writable. Table 10-16. FERCNFG Field Descriptions Field 7 ERSERIE Description EEE Erase Error Interrupt Enable — The ERSERIE bit controls interrupt generation when a failure is detected during an EEE erase operation. 0 ERSERIF interrupt disabled 1 An interrupt will be requested whenever the ERSERIF ﬂag is set (see Section 10.3.2.8) EEE Program Error Interrupt Enable — The PGMERIE bit controls interrupt generation when a failure is detected during an EEE program operation. 0 PGMERIF interrupt disabled 1 An interrupt will be requested whenever the PGMERIF ﬂag is set (see Section 10.3.2.8) EEE Protection Violation Interrupt Enable — The EPVIOLIE bit controls interrupt generation when a protection violation is detected during a write to the buffer RAM EEE partition. 0 EPVIOLIF interrupt disabled 1 An interrupt will be requested whenever the EPVIOLIF ﬂag is set (see Section 10.3.2.8) 6 PGMERIE 4 EPVIOLIE MC9S12XF - Family Reference Manual, Rev.1.19 360 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-16. FERCNFG Field Descriptions (continued) Field 3 ERSVIE1 Description EEE Error Type 1 Interrupt Enable — The ERSVIE1 bit controls interrupt generation when a change state error is detected during an EEE operation. 0 ERSVIF1 interrupt disabled 1 An interrupt will be requested whenever the ERSVIF1 ﬂag is set (see Section 10.3.2.8) EEE Error Type 0 Interrupt Enable — The ERSVIE0 bit controls interrupt generation when a sector format error is detected during an EEE operation. 0 ERSVIF0 interrupt disabled 1 An interrupt will be requested whenever the ERSVIF0 ﬂag is set (see Section 10.3.2.8) Double Bit Fault Detect Interrupt Enable — The DFDIE bit controls interrupt generation when a double bit fault is detected during a Flash block read operation. 0 DFDIF interrupt disabled 1 An interrupt will be requested whenever the DFDIF ﬂag is set (see Section 10.3.2.8) Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault is detected during a Flash block read operation. 0 SFDIF interrupt disabled whenever the SFDIF ﬂag is set (see Section 10.3.2.8) 1 An interrupt will be requested whenever the SFDIF ﬂag is set (see Section 10.3.2.8) 2 ERSVIE0 1 DFDIE 0 SFDIE 10.3.2.7 Flash Status Register (FSTAT) The FSTAT register reports the operational status of the Flash module. Offset Module Base + 0x0006 7 6 5 4 3 2 1 0 R CCIF W Reset 1 0 ACCERR 0 0 FPVIOL 0 MGBUSY RSVD MGSTAT[1:0] 0 0 0(1) 01 = Unimplemented or Reserved Figure 10-11. Flash Status Register (FSTAT) 1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 10.6). CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable but not writable, while remaining bits read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 361 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-17. FSTAT Field Descriptions Field 7 CCIF Description Command Complete Interrupt Flag — The CCIF ﬂag indicates that a Flash command has completed. The CCIF ﬂag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command completion or command violation. 0 Flash command in progress 1 Flash command has completed Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory caused by either a violation of the command write sequence (see Section 10.4.1.2) or issuing an illegal Flash command or when errors are encountered while initializing the EEE buffer ram during the reset sequence. While ACCERR is set, the CCIF ﬂag cannot be cleared to launch a command. The ACCERR bit is cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR. 0 No access error detected 1 Access error detected Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an address in a protected area of P-Flash memory during a command write sequence. The FPVIOL bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL is set, it is not possible to launch a command or start a command write sequence. 0 No protection violation detected 1 Protection violation detected Memory Controller Busy Flag — The MGBUSY ﬂag reﬂects the active state of the Memory Controller. 0 Memory Controller is idle 1 Memory Controller is busy executing a Flash command (CCIF = 0) or is handling internal EEE operations Reserved Bit — This bit is reserved and always reads 0. 5 ACCERR 4 FPVIOL 3 MGBUSY 2 RSVD 1–0 Memory Controller Command Completion Status Flag — One or more MGSTAT ﬂag bits are set if an error MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. See Section 10.4.2, “Flash Command Description,” and Section 10.6, “Initialization” for details. 10.3.2.8 Flash Error Status Register (FERSTAT) The FERSTAT register reﬂects the error status of internal Flash operations. Offset Module Base + 0x0007 7 6 5 4 3 2 1 0 R ERSERIF W Reset 0 0 PGMERIF 0 EPVIOLIF 0 0 ERSVIF1 0 ERSVIF0 0 DFDIF 0 SFDIF 0 = Unimplemented or Reserved Figure 10-12. Flash Error Status Register (FERSTAT) All ﬂags in the FERSTAT register are readable and only writable to clear the ﬂag. MC9S12XF - Family Reference Manual, Rev.1.19 362 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-18. FERSTAT Field Descriptions Field 7 ERSERIF Description EEE Erase Error Interrupt Flag — The setting of the ERSERIF ﬂag occurs due to an error in a Flash erase command that resulted in the erase operation not being successful during EEE operations. The ERSERIF ﬂag is cleared by writing a 1 to ERSERIF. Writing a 0 to the ERSERIF ﬂag has no effect on ERSERIF. While ERSERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 Erase command successfully completed on the D-Flash EEE partition 1 Erase command failed on the D-Flash EEE partition EEE Program Error Interrupt Flag — The setting of the PGMERIF ﬂag occurs due to an error in a Flash program command that resulted in the program operation not being successful during EEE operations. The PGMERIF ﬂag is cleared by writing a 1 to PGMERIF. Writing a 0 to the PGMERIF ﬂag has no effect on PGMERIF. While PGMERIF is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 Program command successfully completed on the D-Flash EEE partition 1 Program command failed on the D-Flash EEE partition EEE Protection Violation Interrupt Flag —The setting of the EPVIOLIF ﬂag indicates an attempt was made to write to a protected area of the buffer RAM EEE partition. The EPVIOLIF ﬂag is cleared by writing a 1 to EPVIOLIF. Writing a 0 to the EPVIOLIF ﬂag has no effect on EPVIOLIF. While EPVIOLIF is set, it is possible to write to the buffer RAM EEE partition as long as the address written to is not in a protected area. 0 No EEE protection violation 1 EEE protection violation detected EEE Error Interrupt 1 Flag —The setting of the ERSVIF1 ﬂag indicates that the memory controller was unable to change the state of a D-Flash EEE sector. The ERSVIF1 ﬂag is cleared by writing a 1 to ERSVIF1. Writing a 0 to the ERSVIF1 ﬂag has no effect on ERSVIF1. While ERSVIF1 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 No EEE sector state change error detected 1 EEE sector state change error detected EEE Error Interrupt 0 Flag —The setting of the ERSVIF0 ﬂag indicates that the memory controller was unable to format a D-Flash EEE sector for EEE use. The ERSVIF0 ﬂag is cleared by writing a 1 to ERSVIF0. Writing a 0 to the ERSVIF0 ﬂag has no effect on ERSVIF0. While ERSVIF0 is set, it is possible to write to the buffer RAM EEE partition but the data written will not be transferred to the D-Flash EEE partition. 0 No EEE sector format error detected 1 EEE sector format error detected Double Bit Fault Detect Interrupt Flag — The setting of the DFDIF ﬂag indicates that a double bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The DFDIF ﬂag is cleared by writing a 1 to DFDIF. Writing a 0 to DFDIF has no effect on DFDIF. 0 No double bit fault detected 1 Double bit fault detected or an invalid Flash array read operation attempted Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF ﬂag indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation or that a Flash array read operation was attempted on a Flash block that was under a Flash command operation. The SFDIF ﬂag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on SFDIF. 0 No single bit fault detected 1 Single bit fault detected and corrected or an invalid Flash array read operation attempted 6 PGMERIF 4 EPVIOLIF 3 ERSVIF1 2 ERSVIF0 1 DFDIF 0 SFDIF 10.3.2.9 P-Flash Protection Register (FPROT) The FPROT register defines which P-Flash sectors are protected against program and erase operations. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 363 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Offset Module Base + 0x0008 7 6 5 4 3 2 1 0 R FPOPEN W Reset F RNV6 FPHDIS F F F FPHS[1:0] F FPLDIS F F FPLS[1:0] F = Unimplemented or Reserved Figure 10-13. Flash Protection Register (FPROT) The (unreserved) bits of the FPROT register are writable with the restriction that the size of the protected region can only be increased (see Section 10.3.2.9.1, “P-Flash Protection Restrictions,” and Table 10-23). During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte in the Flash configuration field at global address 0x7F_FF0C located in P-Flash memory (see Table 10-3) as indicated by reset condition ‘F’ in Figure 10-13. To change the P-Flash protection that will be loaded during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected. Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible if any of the P-Flash sectors contained in the same P-Flash block are protected. Table 10-19. FPROT Field Descriptions Field 7 FPOPEN Description Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or erase operations as shown in Table 10-20 for the P-Flash block. 0 When FPOPEN is clear, the FPHDIS and FPLDIS bits deﬁne unprotected address ranges as speciﬁed by the corresponding FPHS and FPLS bits 1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range speciﬁed by the corresponding FPHS and FPLS bits Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements. Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a protected/unprotected area in a speciﬁc region of the P-Flash memory ending with global address 0x7F_FFFF. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area in P-Flash memory as shown inTable 10-21. The FPHS bits can only be written to while the FPHDIS bit is set. Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a protected/unprotected area in a speciﬁc region of the P-Flash memory beginning with global address 0x7F_8000. 0 Protection/Unprotection enabled 1 Protection/Unprotection disabled Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area in P-Flash memory as shown in Table 10-22. The FPLS bits can only be written to while the FPLDIS bit is set. 6 RNV[6] 5 FPHDIS 4–3 FPHS[1:0] 2 FPLDIS 1–0 FPLS[1:0] MC9S12XF - Family Reference Manual, Rev.1.19 364 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-20. P-Flash Protection Function FPOPEN 1 1 1 1 0 0 0 FPHDIS 1 1 0 0 1 1 0 FPLDIS 1 0 1 0 1 0 1 Function(1) No P-Flash Protection Protected Low Range Protected High Range Protected High and Low Ranges Full P-Flash Memory Protected Unprotected Low Range Unprotected High Range 0 0 0 Unprotected High and Low Ranges 1. For range sizes, refer to Table 10-21 and Table 10-22. Table 10-21. P-Flash Protection Higher Address Range FPHS[1:0] 00 01 10 11 Global Address Range 0x7F_F800–0x7F_FFFF 0x7F_F000–0x7F_FFFF 0x7F_E000–0x7F_FFFF 0x7F_C000–0x7F_FFFF Protected Size 2 Kbytes 4 Kbytes 8 Kbytes 16 Kbytes Table 10-22. P-Flash Protection Lower Address Range FPLS[1:0] 00 01 10 11 Global Address Range 0x7F_8000–0x7F_83FF 0x7F_8000–0x7F_87FF 0x7F_8000–0x7F_8FFF 0x7F_8000–0x7F_9FFF Protected Size 1 Kbyte 2 Kbytes 4 Kbytes 8 Kbytes All possible P-Flash protection scenarios are shown in Figure 10-14. Although the protection scheme is loaded from the Flash memory at global address 0x7F_FF0C during the reset sequence, it can be changed by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in single chip mode while providing as much protection as possible if reprogramming is not required. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 365 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) FPHDIS = 1 FPLDIS = 1 FLASH START FPHDIS = 1 FPLDIS = 0 6 FPHDIS = 0 FPLDIS = 1 5 FPHDIS = 0 FPLDIS = 0 4 Scenario 7 0x7F_8000 0x7F_FFFF Scenario FLASH START 3 2 1 0 FPHS[1:0] Freescale Semiconductor FPLS[1:0] Unprotected region Protected region not defined by FPLS, FPHS Protected region with size defined by FPLS Protected region with size defined by FPHS Figure 10-14. P-Flash Protection Scenarios MC9S12XF - Family Reference Manual, Rev.1.19 0x7F_8000 0x7F_FFFF 366 FPHS[1:0] FPLS[1:0] FPOPEN = 0 FPOPEN = 1 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.3.2.9.1 P-Flash Protection Restrictions The general guideline is that P-Flash protection can only be added and not removed. Table 10-23 specifies all valid transitions between P-Flash protection scenarios. Any attempt to write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions. Table 10-23. P-Flash Protection Scenario Transitions From Protection Scenario 0 1 2 3 4 5 6 X X To Protection Scenario(1) 0 X 1 X X X 2 X 3 X X X X X X X X X X X X 4 5 6 7 X X X X X X X X 7 1. Allowed transitions marked with X, see Figure 10-14 for a deﬁnition of the scenarios. 10.3.2.10 EEE Protection Register (EPROT) The EPROT register deﬁnes which buffer RAM EEE partition areas are protected against writes. Offset Module Base + 0x0009 7 6 5 4 3 2 1 0 R EPOPEN W Reset F F RNV[6:4] EPDIS F F F F EPS[2:0] F F = Unimplemented or Reserved Figure 10-15. EEE Protection Register (EPROT) All bits in the EPROT register are readable and writable except for RNV[6:4] which are only readable. The EPOPEN and EPDIS bits can only be written to the protected state. The EPS bits can be written anytime until the EPDIS bit is cleared. If the EPOPEN bit is cleared, the state of the EPDIS and EPS bits is irrelevant. During the reset sequence, the EPROT register is loaded from the EEE protection byte in the Flash configuration field at global address 0x7F_FF0D located in P-Flash memory (see Table 10-3) as indicated by reset condition F in Figure 10-15. To change the EEE protection that will be loaded during the reset sequence, the P-Flash sector containing the EEE protection byte must be unprotected, then the EEE protection byte must be programmed. If a double bit fault is detected while reading the P-Flash phrase MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 367 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) containing the EEE protection byte during the reset sequence, the EPOPEN bit will be cleared and remaining bits in the EPROT register will be set to leave the buffer RAM EEE partition fully protected. Trying to write data to any protected area in the buffer RAM EEE partition will result in a protection violation error and the EPVIOLIF ﬂag will be set in the FERSTAT register. Trying to write data to any protected area in the buffer RAM partitioned for user access will not be prevented and the EPVIOLIF ﬂag in the FERSTAT register will not set. Table 10-24. EPROT Field Descriptions Field 7 EPOPEN 6–4 RNV[6:4] 3 EPDIS Description Enables writes to the Buffer RAM partitioned for EEE 0 The entire buffer RAM EEE partition is protected from writes 1 Unprotected buffer RAM EEE partition areas are enabled for writes Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements Buffer RAM Protection Address Range Disable — The EPDIS bit determines whether there is a protected area in a speciﬁc region of the buffer RAM EEE partition. 0 Protection enabled 1 Protection disabled Buffer RAM Protection Size — The EPS[2:0] bits determine the size of the protected area in the buffer RAM EEE partition as shown inTable 10-21. The EPS bits can only be written to while the EPDIS bit is set. 2–0 EPS[2:0] Table 10-25. Buffer RAM EEE Partition Protection Address Range EPS[2:0] 000 001 010 011 100 101 110 111 Global Address Range 0x13_FFC0 – 0x13_FFFF 0x13_FF80 – 0x13_FFFF 0x13_FF40 – 0x13_FFFF 0x13_FF00 – 0x13_FFFF 0x13_FEC0 – 0x13_FFFF 0x13_FE80 – 0x13_FFFF 0x13_FE40 – 0x13_FFFF 0x13_FE00 – 0x13_FFFF Protected Size 64 bytes 128 bytes 192 bytes 256 bytes 320 bytes 384 bytes 448 bytes 512 bytes 10.3.2.11 Flash Common Command Object Register (FCCOB) The FCCOB is an array of six words addressed via the CCOBIX index found in the FCCOBIX register. Byte wide reads and writes are allowed to the FCCOB register. MC9S12XF - Family Reference Manual, Rev.1.19 368 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Offset Module Base + 0x000A 7 6 5 4 3 2 1 0 R CCOB[15:8] W Reset 0 0 0 0 0 0 0 0 Figure 10-16. Flash Common Command Object High Register (FCCOBHI) Offset Module Base + 0x000B 7 6 5 4 3 2 1 0 R CCOB[7:0] W Reset 0 0 0 0 0 0 0 0 Figure 10-17. Flash Common Command Object Low Register (FCCOBLO) 10.3.2.11.1 FCCOB - NVM Command Mode NVM command mode uses the indexed FCCOB register to provide a command code and its relevant parameters to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the FCCOB register array. The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 10-26. The return values are available for reading after the CCIF flag in the FSTAT register has been returned to 1 by the Memory Controller. Writes to the unimplemented parameter fields (CCOBIX = 110 and CCOBIX = 111) are ignored with reads from these fields returning 0x0000. Table 10-26 shows the generic Flash command format. The high byte of the first word in the CCOB array contains the command code, followed by the parameters for this specific Flash command. For details on the FCCOB settings required by each command, see the Flash command descriptions in Section 10.4.2. Table 10-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 000 LO HI 001 LO HI 010 LO Data 0 [7:0] Global address [7:0] Data 0 [15:8] 0, Global address [22:16] Global address [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) FCMD[7:0] deﬁning Flash command MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 369 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-26. FCCOB - NVM Command Mode (Typical Usage) CCOBIX[2:0] 011 LO HI 100 LO HI 101 LO Data 3 [7:0] Data 2 [7:0] Data 3 [15:8] Data 1 [7:0] Data 2 [15:8] Byte HI FCCOB Parameter Fields (NVM Command Mode) Data 1 [15:8] 10.3.2.12 EEE Tag Counter Register (ETAG) The ETAG register contains the number of outstanding words in the buffer RAM EEE partition that need to be programmed into the D-Flash EEE partition. The ETAG register is decremented prior to the related tagged word being programmed into the D-Flash EEE partition. All tagged words have been programmed into the D-Flash EEE partition once all bits in the ETAG register read 0 and the MGBUSY flag in the FSTAT register reads 0. Offset Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ETAG[15:8] 0 0 0 0 = Unimplemented or Reserved Figure 10-18. EEE Tag Counter High Register (ETAGHI) Offset Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ETAG[7:0] 0 0 0 0 = Unimplemented or Reserved Figure 10-19. EEE Tag Counter Low Register (ETAGLO) All ETAG bits are readable but not writable and are cleared by the Memory Controller. 10.3.2.13 Flash ECC Error Results Register (FECCR) The FECCR registers contain the result of a detected ECC fault for both single bit and double bit faults. The FECCR register provides access to several ECC related fields as defined by the ECCRIX index bits in the FECCRIX register (see Section 10.3.2.4). Once ECC fault information has been stored, no other MC9S12XF - Family Reference Manual, Rev.1.19 370 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) fault information will be recorded until the specific ECC fault flag has been cleared. In the event of simultaneous ECC faults, the priority for fault recording is: 1. Double bit fault over single bit fault 2. CPU over XGATE Offset Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ECCR[15:8] 0 0 0 0 = Unimplemented or Reserved Figure 10-20. Flash ECC Error Results High Register (FECCRHI) Offset Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 ECCR[7:0] 0 0 0 0 = Unimplemented or Reserved Figure 10-21. Flash ECC Error Results Low Register (FECCRLO) All FECCR bits are readable but not writable. Table 10-27. FECCR Index Settings ECCRIX[2:0] Bits [15:8] 000 001 010 011 100 101 110 111 Parity bits read from Flash block FECCR Register Content Bit[7] CPU or XGATE source identity Global address [15:0] Data 0 [15:0] Data 1 [15:0] (P-Flash only) Data 2 [15:0] (P-Flash only) Data 3 [15:0] (P-Flash only) Not used, returns 0x0000 when read Not used, returns 0x0000 when read Bits[6:0] Global address [22:16] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 371 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-28. FECCR Index=000 Bit Descriptions Field 15:8 PAR[7:0] 7 XBUS01 Description ECC Parity Bits — Contains the 8 parity bits from the 72 bit wide P-Flash data word or the 6 parity bits, allocated to PAR[5:0], from the 22 bit wide D-Flash word with PAR[7:6]=00. Bus Source Identiﬁer — The XBUS01 bit determines whether the ECC error was caused by a read access from the CPU or XGATE. 0 ECC Error happened on the CPU access 1 ECC Error happened on the XGATE access 6–0 Global Address — The GADDR[22:16] ﬁeld contains the upper seven bits of the global address having GADDR[22:16] caused the error. The P-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The following four words addressed by ECCRIX = 010 to 101 contain the 64-bit wide data phrase. The four data words and the parity byte are the uncorrected data read from the P-Flash block. The D-Flash word addressed by ECCRIX = 001 contains the lower 16 bits of the global address. The uncorrected 16-bit data word is addressed by ECCRIX = 010. 10.3.2.14 Flash Option Register (FOPT) The FOPT register is the Flash option register. Offset Module Base + 0x0010 7 6 5 4 3 2 1 0 R W Reset F F F F NV[7:0] F F F F = Unimplemented or Reserved Figure 10-22. Flash Option Register (FOPT) All bits in the FOPT register are readable but are not writable. During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash configuration field at global address 0x7F_FF0E located in P-Flash memory (see Table 10-3) as indicated by reset condition F in Figure 10-22. If a double bit fault is detected while reading the P-Flash phrase containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set. Table 10-29. FOPT Field Descriptions Field 7–0 NV[7:0] Description Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device user guide for proper use of the NV bits. 10.3.2.15 Flash Reserved0 Register (FRSV0) This Flash register is reserved for factory testing. MC9S12XF - Family Reference Manual, Rev.1.19 372 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Offset Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-23. Flash Reserved0 Register (FRSV0) All bits in the FRSV0 register read 0 and are not writable. 10.3.2.16 Flash Reserved1 Register (FRSV1) This Flash register is reserved for factory testing. Offset Module Base + 0x0012 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-24. Flash Reserved1 Register (FRSV1) All bits in the FRSV1 register read 0 and are not writable. 10.3.2.17 Flash Reserved2 Register (FRSV2) This Flash register is reserved for factory testing. Offset Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 10-25. Flash Reserved2 Register (FRSV2) All bits in the FRSV2 register read 0 and are not writable. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 373 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4 10.4.1 Functional Description Flash Command Operations Flash command operations are used to modify Flash memory contents or conﬁgure module resources for EEE operation. The next sections describe: • How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from OSCCLK for Flash program and erase command operations • The command write sequence used to set Flash command parameters and launch execution • Valid Flash commands available for execution 10.4.1.1 Writing the FCLKDIV Register Prior to issuing any Flash program or erase command after a reset, the user is required to write the FCLKDIV register to divide OSCCLK down to a target FCLK of 1 MHz. Table 10-9 shows recommended values for the FDIV ﬁeld based on OSCCLK frequency. NOTE Programming or erasing the Flash memory cannot be performed if the bus clock runs at less than 1 MHz. Setting FDIV too high can destroy the Flash memory due to overstress. Setting FDIV too low can result in incomplete programming or erasure of the Flash memory cells. When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written, any Flash program or erase command loaded during a command write sequence will not execute and the ACCERR bit in the FSTAT register will set. 10.4.1.2 Command Write Sequence The Memory Controller will launch all valid Flash commands entered using a command write sequence. Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see Section 10.3.2.7) and the CCIF flag should be tested to determine the status of the current command write sequence. If CCIF is 0, the previous command write sequence is still active, a new command write sequence cannot be started, and all writes to the FCCOB register are ignored. CAUTION Writes to any Flash register must be avoided while a Flash command is active (CCIF=0) to prevent corruption of Flash register contents and Memory Controller behavior. MC9S12XF - Family Reference Manual, Rev.1.19 374 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.1.2.1 Deﬁne FCCOB Contents The FCCOB parameter ﬁelds must be loaded with all required parameters for the Flash command being executed. Access to the FCCOB parameter ﬁelds is controlled via the CCOBIX bits in the FCCOBIX register (see Section 10.3.2.3). The contents of the FCCOB parameter ﬁelds are transferred to the Memory Controller when the user clears the CCIF command completion ﬂag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF ﬂag will remain clear until the Flash command has completed. Upon completion, the Memory Controller will return CCIF to 1 and the FCCOB register will be used to communicate any results. The ﬂow for a generic command write sequence is shown in Figure 10-26. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 375 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) START Read: FCLKDIV register Clock Register Written Check FDIVLD Set? yes no Write: FCLKDIV register Read: FSTAT register Note: FCLKDIV must be set after each reset FCCOB Availability Check CCIF Set? yes no Results from previous Command yes Write: FSTAT register Clear ACCERR/FPVIOL 0x30 Access Error and Protection Violation Check ACCERR/ FPVIOL Set? no Write to FCCOBIX register to identify speciﬁc command parameter to load. Write to FCCOB register to load required command parameter. More Parameters? no yes Write: FSTAT register (to launch command) Clear CCIF 0x80 Read: FSTAT register Bit Polling for Command Completion Check CCIF Set? yes EXIT no Figure 10-26. Generic Flash Command Write Sequence Flowchart MC9S12XF - Family Reference Manual, Rev.1.19 376 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.1.3 Valid Flash Module Commands Table 10-30. Flash Commands by Mode Unsecured FCMD Command NS (1) Secured NS (5) NX (2) SS(3) ST(4) ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ NX (6) SS(7) ST(8) ∗ ∗ ∗ ∗ 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 Erase Verify All Blocks Erase Verify Block Erase Verify P-Flash Section Read Once Reserved Program P-Flash Program Once Erase All Blocks Erase P-Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level Full Partition D-Flash Erase Verify D-Flash Section Program D-Flash Erase D-Flash Sector Enable EEPROM Emulation Disable EEPROM Emulation EEPROM Emulation Query ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ 0x20 Partition D-Flash 1. Unsecured Normal Single Chip mode. 2. Unsecured Normal Expanded mode. 3. Unsecured Special Single Chip mode. 4. Unsecured Special Mode. 5. Secured Normal Single Chip mode. 6. Secured Normal Expanded mode. 7. Secured Special Single Chip mode. 8. Secured Special Mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 377 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.1.4 P-Flash Commands Table 10-31 summarizes the valid P-Flash commands along with the effects of the commands on the PFlash block and other resources within the Flash module. Table 10-31. P-Flash Commands FCMD 0x01 0x02 0x03 0x04 0x06 0x07 Command Erase Verify All Blocks Erase Verify Block Erase Verify PFlash Section Read Once Program P-Flash Program Once Function on P-Flash Memory Verify that all P-Flash (and D-Flash) blocks are erased. Verify that a P-Flash block is erased. Verify that a given number of words starting at the address provided are erased. Read a dedicated 64 byte ﬁeld in the nonvolatile information register in P-Flash block 0 that was previously programmed using the Program Once command. Program a phrase in a P-Flash block. Program a dedicated 64 byte ﬁeld in the nonvolatile information register in P-Flash block 0 that is allowed to be programmed only once. Erase all P-Flash (and D-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. Erase a single P-Flash block. An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN bits in the FPROT register are set prior to launching the command. Erase all bytes in a P-Flash sector. Supports a method of releasing MCU security by erasing all P-Flash (and D-Flash) blocks and verifying that all P-Flash (and D-Flash) blocks are erased. Supports a method of releasing MCU security by verifying a set of security keys. Speciﬁes a user margin read level for all P-Flash blocks. Speciﬁes a ﬁeld margin read level for all P-Flash blocks (special modes only). 0x08 Erase All Blocks 0x09 Erase P-Flash Block Erase P-Flash Sector Unsecure Flash Verify Backdoor Access Key Set User Margin Level Set Field Margin Level 0x0A 0x0B 0x0C 0x0D 0x0E 10.4.1.5 D-Flash and EEE Commands Table 10-32 summarizes the valid D-Flash and EEE commands along with the effects of the commands on the D-Flash block and EEE operation. Table 10-32. D-Flash Commands FCMD 0x01 0x02 Command Erase Verify All Blocks Erase Verify Block Function on D-Flash Memory Verify that all D-Flash (and P-Flash) blocks are erased. Verify that the D-Flash block is erased. Erase all D-Flash (and P-Flash) blocks. An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN bits in the FPROT register and the EPDIS and EPOPEN bits in the EPROT register are set prior to launching the command. MC9S12XF - Family Reference Manual, Rev.1.19 378 Freescale Semiconductor 0x08 Erase All Blocks Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-32. D-Flash Commands FCMD 0x0B 0x0D 0x0E 0x0F 0x10 0x11 0x12 0x13 0x14 0x15 0x20 Command Unsecure Flash Set User Margin Level Set Field Margin Level Full Partition DFlash Erase Verify DFlash Section Program D-Flash Erase D-Flash Sector Enable EEPROM Emulation Disable EEPROM Emulation EEPROM Emulation Query Partition D-Flash Function on D-Flash Memory Supports a method of releasing MCU security by erasing all D-Flash (and P-Flash) blocks and verifying that all D-Flash (and P-Flash) blocks are erased. Speciﬁes a user margin read level for the D-Flash block. Speciﬁes a ﬁeld margin read level for the D-Flash block (special modes only). Erase the D-Flash block and partition an area of the D-Flash block for user access. Verify that a given number of words starting at the address provided are erased. Program up to four words in the D-Flash block. Erase all bytes in a sector of the D-Flash block. Enable EEPROM emulation where writes to the buffer RAM EEE partition will be copied to the D-Flash EEE partition. Suspend all current erase and program activity related to EEPROM emulation but leave current EEE tags set. Returns EEE partition and status variables. Partition an area of the D-Flash block for user access. 10.4.2 Flash Command Description This section provides details of all available Flash commands launched by a command write sequence. The ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following illegal steps are performed, causing the command not to be processed by the Memory Controller: • Starting any command write sequence that programs or erases Flash memory before initializing the FCLKDIV register • Writing an invalid command as part of the command write sequence • For additional possible errors, refer to the error handling table provided for each command If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation will return invalid data. If the SFDIF or DFDIF flags were not previously set when the invalid read operation occurred, both the SFDIF and DFDIF flags will be set and the FECCR registers will be loaded with the global address used in the invalid read operation with the data and parity fields set to all 0. If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting any command write sequence (see Section 10.3.2.7). CAUTION A Flash word or phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash word or phrase is not allowed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 379 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.2.1 Erase Verify All Blocks Command Table 10-33. Erase Verify All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x01 FCCOB Parameters Not required The Erase Verify All Blocks command will verify that all P-Flash and D-Flash blocks have been erased. Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify that the entire Flash memory space is erased. The CCIF ﬂag will set after the Erase Verify All Blocks operation has completed. Table 10-34. Erase Verify All Blocks Command Error Handling Register Error Bit ACCERR FPVIOL FSTAT MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch None Set if any errors have been encountered during the read(1) Set if any non-correctable errors have been encountered during the read1 FERSTAT EPVIOLIF None 1. As found in the memory map for FTM512K3. 10.4.2.2 Erase Verify Block Command The Erase Verify Block command allows the user to verify that an entire P-Flash or D-Flash block has been erased. The FCCOB upper global address bits determine which block must be veriﬁed. Table 10-35. Erase Verify Block Command FCCOB Requirements CCOBIX[2:0] 000 0x02 FCCOB Parameters Global address [22:16] of the Flash block to be veriﬁed. Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that the selected P-Flash or D-Flash block is erased. The CCIF ﬂag will set after the Erase Verify Block operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 380 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-36. Erase Verify Block Command Error Handling Register Error Bit ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Error Condition Set if CCOBIX[2:0] != 000 at command launch Set if an invalid global address [22:16] is supplied(1) None Set if any errors have been encountered during the read(2) Set if any non-correctable errors have been encountered during the read2 FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 10.4.2.3 Erase Verify P-Flash Section Command The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and the number of phrases. Table 10-37. Erase Verify P-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x03 FCCOB Parameters Global address [22:16] of a P-Flash block Global address [15:0] of the ﬁrst phrase to be veriﬁed Number of phrases to be veriﬁed Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will verify the selected section of Flash memory is erased. The CCIF ﬂag will set after the Erase Verify P-Flash Section operation has completed. Table 10-38. Erase Verify P-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) ACCERR FSTAT Set if the requested section crosses a 256 Kbyte boundary FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read(2) Set if any non-correctable errors have been encountered during the read2 None Set if an invalid global address [22:0] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 381 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 10.4.2.4 Read Once Command The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the nonvolatile information register of P-Flash block 0. The Read Once field is programmed using the Program Once command described in Section 10.4.2.6. The Read Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 10-39. Read Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x04 FCCOB Parameters Not Required Read Once phrase index (0x0000 - 0x0007) Read Once word 0 value Read Once word 1 value Read Once word 2 value Read Once word 3 value Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the FCCOB indexed register. The CCIF ﬂag will set after the Read Once operation has completed. Valid phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the Read Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. 128 Table 10-40. Read Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None Set if command not available in current mode (see Table 10-30) Set if an invalid phrase index is supplied 10.4.2.5 Program P-Flash Command The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an embedded algorithm. MC9S12XF - Family Reference Manual, Rev.1.19 382 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) CAUTION A P-Flash phrase must be in the erased state before being programmed. Cumulative programming of bits within a Flash phrase is not allowed. Table 10-41. Program P-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 0x06 FCCOB Parameters Global address [22:16] to identify P-Flash block Global address [15:0] of phrase location to be programmed(1) Word 0 program value Word 1 program value Word 2 program value 101 Word 3 program value 1. Global address [2:0] must be 000 Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the data words to the supplied global address and will then proceed to verify the data words read back as expected. The CCIF ﬂag will set after the Program P-Flash operation has completed. Table 10-42. Program P-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 10-30) ACCERR Set if an invalid global address [22:0] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 Set if the global address [22:0] points to a protected area Set if any errors have been encountered during the verify operation(2) Set if any non-correctable errors have been encountered during the verify operation2 FSTAT FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 10.4.2.6 Program Once Command The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the nonvolatile information register located in P-Flash block 0. The Program Once reserved field can be read using the Read Once command as described in Section 10.4.2.4. The Program Once command must only be issued once since the nonvolatile information register in P-Flash block 0 cannot be erased. The Program MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 383 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Once command must not be executed from the Flash block containing the Program Once reserved field to avoid code runaway. Table 10-43. Program Once Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x07 FCCOB Parameters Not Required Program Once phrase index (0x0000 - 0x0007) Program Once word 0 value Program Once word 1 value Program Once word 2 value Program Once word 3 value Upon clearing CCIF to launch the Program Once command, the Memory Controller ﬁrst veriﬁes that the selected phrase is erased. If erased, then the selected phrase will be programmed and then veriﬁed with read back. The CCIF ﬂag will remain clear, setting only after the Program Once operation has completed. The reserved nonvolatile information register accessed by the Program Once command cannot be erased and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program Once command, any attempt to read addresses within P-Flash block 0 will return invalid data. Table 10-44. Program Once Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 101 at command launch Set if command not available in current mode (see Table 10-30) ACCERR Set if an invalid phrase index is supplied FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if the requested phrase has already been programmed(1) None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FERSTAT EPVIOLIF None 1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will be allowed to execute again on that same phrase. 10.4.2.7 Erase All Blocks Command The Erase All Blocks operation will erase the entire P-Flash and D-Flash memory space including the EEE nonvolatile information register. MC9S12XF - Family Reference Manual, Rev.1.19 384 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-45. Erase All Blocks Command FCCOB Requirements CCOBIX[2:0] 000 0x08 FCCOB Parameters Not required Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire Flash memory space and verify that it is erased. If the Memory Controller veriﬁes that the entire Flash memory space was properly erased, security will be released. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF ﬂag will set after the Erase All Blocks operation has completed. Table 10-46. Erase All Blocks Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 10-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash memory is protected Set if any errors have been encountered during the verify operation(1) Set if any non-correctable errors have been encountered during the verify operation1 Error Condition Set if CCOBIX[2:0] != 000 at command launch FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected 1. As found in the memory map for FTM512K3. 10.4.2.8 Erase P-Flash Block Command Table 10-47. Erase P-Flash Block Command FCCOB Requirements CCOBIX[2:0] 000 001 0x09 FCCOB Parameters Global address [22:16] to identify P-Flash block The Erase P-Flash Block operation will erase all addresses in a P-Flash block. Global address [15:0] in P-Flash block to be erased Upon clearing CCIF to launch the Erase P-Flash Block command, the Memory Controller will erase the selected P-Flash block and verify that it is erased. The CCIF ﬂag will set after the Erase P-Flash Block operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 385 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-48. Erase P-Flash Block Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch ACCERR Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:16] is supplied(1) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an area of the selected P-Flash block is protected Set if any errors have been encountered during the verify operation(2) Set if any non-correctable errors have been encountered during the verify operation2 FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. 2. As found in the memory map for FTM512K3. 10.4.2.9 Erase P-Flash Sector Command Table 10-49. Erase P-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0A FCCOB Parameters Global address [22:16] to identify P-Flash block to be erased The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector. Global address [15:0] anywhere within the sector to be erased. Refer to Section 10.1.2.1 for the P-Flash sector size. Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the selected Flash sector and then verify that it is erased. The CCIF ﬂag will be set after the Erase P-Flash Sector operation has completed. Table 10-50. Erase P-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) ACCERR Set if an invalid global address [22:16] is supplied(1) Set if a misaligned phrase address is supplied (global address [2:0] != 000) FPVIOL MGSTAT1 MGSTAT0 Set if the selected P-Flash sector is protected Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation FSTAT FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. MC9S12XF - Family Reference Manual, Rev.1.19 386 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.2.10 Unsecure Flash Command The Unsecure Flash command will erase the entire P-Flash and D-Flash memory space and, if the erase is successful, will release security. Table 10-51. Unsecure Flash Command FCCOB Requirements CCOBIX[2:0] 000 0x0B FCCOB Parameters Not required Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire P-Flash and D-Flash memory space and verify that it is erased. If the Memory Controller veriﬁes that the entire Flash memory space was properly erased, security will be released. If the erase verify is not successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security state. During the execution of this command (CCIF=0) the user must not write to any Flash module register. The CCIF ﬂag is set after the Unsecure Flash operation has completed. Table 10-52. Unsecure Flash Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 10-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if any area of the P-Flash memory is protected Set if any errors have been encountered during the verify operation(1) Set if any non-correctable errors have been encountered during the verify operation1 Error Condition Set if CCOBIX[2:0] != 000 at command launch FERSTAT EPVIOLIF Set if any area of the buffer RAM EEE partition is protected 1. As found in the memory map for FTM512K3. 10.4.2.11 Verify Backdoor Access Key Command The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the FSEC register (see Table 10-11). The Verify Backdoor Access Key command releases security if usersupplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 103). The Verify Backdoor Access Key command must not be executed from the Flash block containing the backdoor comparison key to avoid code runaway. Table 10-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x0C Key 0 Key 1 FCCOB Parameters Not required MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 387 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-53. Verify Backdoor Access Key Command FCCOB Requirements CCOBIX[2:0] 011 100 FCCOB Parameters Key 2 Key 3 Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash conﬁguration ﬁeld with Key 0 compared to 0x7F_FF00, etc. If the backdoor keys match, security will be released. If the backdoor keys do not match, security is not released and all future attempts to execute the Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is set after the Verify Backdoor Access Key operation has completed. Table 10-54. Verify Backdoor Access Key Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 100 at command launch Set if an incorrect backdoor key is supplied ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see Section 10.3.2.2) Set if the backdoor key has mismatched since the last reset None None None None 10.4.2.12 Set User Margin Level Command The Set User Margin Level command causes the Memory Controller to set the margin level for future read operations of a specific P-Flash or D-Flash block. Table 10-55. Set User Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0D FCCOB Parameters Global address [22:16] to identify the Flash block Margin level setting Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the user margin level for the targeted block and then set the CCIF ﬂag. MC9S12XF - Family Reference Manual, Rev.1.19 388 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Valid margin level settings for the Set User Margin Level command are deﬁned in Table 10-56. Table 10-56. Valid Set User Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 Level Description Return to Normal Level User Margin-1 Level(1) 0x0002 User Margin-0 Level(2) 1. Read margin to the erased state 2. Read margin to the programmed state Table 10-57. Set User Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid global address [22:16] is supplied(1) Set if an invalid margin level setting is supplied None None None FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. NOTE User margin levels can be used to check that Flash memory contents have adequate margin for normal level read operations. If unexpected results are encountered when checking Flash memory contents at user margin levels, a potential loss of information has been detected. 10.4.2.13 Set Field Margin Level Command The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set the margin level specified for future read operations of a specific P-Flash or D-Flash block. Table 10-58. Set Field Margin Level Command FCCOB Requirements CCOBIX[2:0] 000 001 0x0E FCCOB Parameters Global address [22:16] to identify the Flash block Margin level setting MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 389 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the ﬁeld margin level for the targeted block and then set the CCIF ﬂag. Valid margin level settings for the Set Field Margin Level command are deﬁned in Table 10-59. Table 10-59. Valid Set Field Margin Level Settings CCOB (CCOBIX=001) 0x0000 0x0001 0x0002 0x0003 Level Description Return to Normal Level User Margin-1 Level(1) User Margin-0 Level(2) Field Margin-1 Level1 0x0004 Field Margin-0 Level2 1. Read margin to the erased state 2. Read margin to the programmed state Table 10-60. Set Field Margin Level Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid global address [22:16] is supplied(1) Set if an invalid margin level setting is supplied None None None FERSTAT EPVIOLIF None 1. As deﬁned by the memory map for FTM512K3. CAUTION Field margin levels must only be used during verify of the initial factory programming. NOTE Field margin levels can be used to check that Flash memory contents have adequate margin for data retention at the normal level setting. If unexpected results are encountered when checking Flash memory contents at ﬁeld margin levels, the Flash memory contents should be erased and reprogrammed. MC9S12XF - Family Reference Manual, Rev.1.19 390 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.2.14 Full Partition D-Flash Command The Full Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 128 sectors with 256 bytes per sector. Table 10-61. Full Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x0F FCCOB Parameters Not required Number of 256 byte sectors for the D-Flash user partition (DFPART) Number of 256 byte sectors for buffer RAM EEE partition (ERPART) Upon clearing CCIF to launch the Full Partition D-Flash command, the following actions are taken to deﬁne a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART): • Validate the DFPART and ERPART values provided: — DFPART = 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE) • Erase the D-Flash block and the EEE nonvolatile information register • Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 10-7) • Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 10-7) • Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 10-7) • Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 10-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Full Partition D-Flash operation has completed, the CCIF ﬂag will set. Running the Full Partition D-Flash command a second time will result in the previous partition values and the entire D-Flash memory being erased. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 391 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-62. Full Partition D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch ACCERR FSTAT FPVIOL MGSTAT1 MGSTAT0 None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read Set if command not available in current mode (see Table 10-30) Set if an invalid DFPART or ERPART selection is supplied(1) FERSTAT EPVIOLIF None 1. As deﬁned by the maximum ERPART for FTM512K3. 10.4.2.15 Erase Verify D-Flash Section Command The Erase Verify D-Flash Section command will verify that a section of code in the D-Flash user partition is erased. The Erase Verify D-Flash Section command defines the starting point of the data to be verified and the number of words. Table 10-63. Erase Verify D-Flash Section Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x10 FCCOB Parameters Global address [22:16] to identify the D-Flash block Global address [15:0] of the ﬁrst word to be veriﬁed Number of words to be veriﬁed Upon clearing CCIF to launch the Erase Verify D-Flash Section command, the Memory Controller will verify the selected section of D-Flash memory is erased. The CCIF ﬂag will set after the Erase Verify DFlash Section operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 392 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-64. Erase Verify D-Flash Section Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) Set if an invalid global address [22:0] is supplied ACCERR FSTAT Set if a misaligned word address is supplied (global address [0] != 0) Set if the global address [22:0] points to an area of the D-Flash EEE partition Set if the requested section breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read None 10.4.2.16 Program D-Flash Command The Program D-Flash operation programs one to four previously erased words in the D-Flash user partition. The Program D-Flash operation will confirm that the targeted location(s) were successfully programmed upon completion. CAUTION A Flash word must be in the erased state before being programmed. Cumulative programming of bits within a Flash word is not allowed. Table 10-65. Program D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 100 101 0x11 FCCOB Parameters Global address [22:16] to identify the D-Flash block Global address [15:0] of word to be programmed Word 0 program value Word 1 program value, if desired Word 2 program value, if desired Word 3 program value, if desired Upon clearing CCIF to launch the Program D-Flash command, the user-supplied words will be transferred to the Memory Controller and be programmed. The CCOBIX index value at Program D-Flash command launch determines how many words will be programmed in the D-Flash block. No protection checks are made in the Program D-Flash operation on the D-Flash block, only access error checks. The CCIF ﬂag is set when the operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 393 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-66. Program D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] < 010 at command launch Set if CCOBIX[2:0] > 101 at command launch Set if command not available in current mode (see Table 10-30) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT Set if the global address [22:0] points to an area in the D-Flash EEE partition Set if the requested group of words breaches the end of the D-Flash block or goes into the D-Flash EEE partition FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 10.4.2.17 Erase D-Flash Sector Command The Erase D-Flash Sector operation will erase all addresses in a sector of the D-Flash user partition. Table 10-67. Erase D-Flash Sector Command FCCOB Requirements CCOBIX[2:0] 000 001 0x12 FCCOB Parameters Global address [22:16] to identify D-Flash block Global address [15:0] anywhere within the sector to be erased. See Section 10.1.2.2 for D-Flash sector size. Upon clearing CCIF to launch the Erase D-Flash Sector command, the Memory Controller will erase the selected Flash sector and verify that it is erased. The CCIF ﬂag will set after the Erase D-Flash Sector operation has completed. MC9S12XF - Family Reference Manual, Rev.1.19 394 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-68. Erase D-Flash Sector Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 001 at command launch Set if command not available in current mode (see Table 10-30) ACCERR Set if an invalid global address [22:0] is supplied Set if a misaligned word address is supplied (global address [0] != 0) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF Set if the global address [22:0] points to the D-Flash EEE partition None Set if any errors have been encountered during the verify operation Set if any non-correctable errors have been encountered during the verify operation None 10.4.2.18 Enable EEPROM Emulation Command The Enable EEPROM Emulation command causes the Memory Controller to enable EEE activity. EEE activity is disabled after any reset. Table 10-69. Enable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] 000 0x13 FCCOB Parameters Not required Upon clearing CCIF to launch the Enable EEPROM Emulation command, the CCIF ﬂag will set after the Memory Controller enables EEE operations using the contents of the EEE tag RAM and tag counter. The Full Partition D-Flash or the Partition D-Flash command must be run prior to launching the Enable EEPROM Emulation command. Table 10-70. Enable EEPROM Emulation Command Error Handling Register Error Bit ACCERR Set if Full Partition D-Flash or Partition D-Flash command not previously run FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Error Condition Set if CCOBIX[2:0] != 000 at command launch MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 395 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.2.19 Disable EEPROM Emulation Command The Disable EEPROM Emulation command causes the Memory Controller to suspend current EEE activity. Table 10-71. Disable EEPROM Emulation Command FCCOB Requirements CCOBIX[2:0] 000 0x14 FCCOB Parameters Not required Upon clearing CCIF to launch the Disable EEPROM Emulation command, the Memory Controller will halt EEE operations at the next convenient point without clearing the EEE tag RAM or tag counter before setting the CCIF ﬂag. Table 10-72. Disable EEPROM Emulation Command Error Handling Register Error Bit ACCERR Set if Full Partition D-Flash or Partition D-Flash command not previously run FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Error Condition Set if CCOBIX[2:0] != 000 at command launch 10.4.2.20 EEPROM Emulation Query Command The EEPROM Emulation Query command returns EEE partition and status variables. Table 10-73. EEPROM Emulation Query Command FCCOB Requirements CCOBIX[2:0] 000 001 010 011 0x15 Return DFPART Return ERPART Return ECOUNT(1) Return Ready Sector Count FCCOB Parameters Not required 100 Return Dead Sector Count 1. Indicates sector erase count Upon clearing CCIF to launch the EEPROM Emulation Query command, the CCIF ﬂag will set after the EEE partition and status variables are stored in the FCCOBIX register.If the Emulation Query command is executed prior to partitioning (Partition D-Flash Command Section 10.4.2.14), the following reset values are returned: DFPART = 0x_FFFF, ERPART = 0x_FFFF, ECOUNT = 0x_FFFF, Dead Sector Count = 0x_00, Ready Sector Count = 0x_00. MC9S12XF - Family Reference Manual, Rev.1.19 396 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) Table 10-74. EEPROM Emulation Query Command Error Handling Register Error Bit ACCERR Set if command not available in current mode (see Table 10-30) FSTAT FPVIOL MGSTAT1 MGSTAT0 FERSTAT EPVIOLIF None None None None Error Condition Set if CCOBIX[2:0] != 000 at command launch 10.4.2.21 Partition D-Flash Command The Partition D-Flash command allows the user to allocate sectors within the D-Flash block for applications and a partition within the buffer RAM for EEPROM access. The D-Flash block consists of 64 sectors with 256 bytes per sector. The Erase All Blocks command must be run prior to launching the Partition D-Flash command. Table 10-75. Partition D-Flash Command FCCOB Requirements CCOBIX[2:0] 000 001 010 0x20 FCCOB Parameters Not required Number of 256 byte sectors for the D-Flash user partition (DFPART) Number of 256 byte sectors for buffer RAM EEE partition (ERPART) Upon clearing CCIF to launch the Partition D-Flash command, the following actions are taken to deﬁne a partition within the D-Flash block for direct access (DFPART) and a partition within the buffer RAM for EEE use (ERPART): • Validate the DFPART and ERPART values provided: — DFPART = 12 (minimum number of 256 byte sectors in the D-Flash block required to support EEE) — If ERPART > 0, ((128-DFPART)/ERPART) >= 8 (minimum ratio of D-Flash EEE space to buffer RAM EEE space to support EEE) • Erase verify the D-Flash block and the EEE nonvolatile information register • Program DFPART to the EEE nonvolatile information register at global address 0x12_0000 (see Table 10-7) • Program a duplicate DFPART to the EEE nonvolatile information register at global address 0x12_0002 (see Table 10-7) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 397 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) • • Program ERPART to the EEE nonvolatile information register at global address 0x12_0004 (see Table 10-7) Program a duplicate ERPART to the EEE nonvolatile information register at global address 0x12_0006 (see Table 10-7) The D-Flash user partition will start at global address 0x10_0000. The buffer RAM EEE partition will end at global address 0x13_FFFF. After the Partition D-Flash operation has completed, the CCIF ﬂag will set. Running the Partition D-Flash command a second time will result in the ACCERR bit within the FSTAT register being set. The data value written corresponds to the number of 256 byte sectors allocated for either direct D-Flash access (DFPART) or buffer RAM EEE access (ERPART). Table 10-76. Partition D-Flash Command Error Handling Register Error Bit Error Condition Set if CCOBIX[2:0] != 010 at command launch Set if command not available in current mode (see Table 10-30) ACCERR Set if partitions have already been deﬁned FSTAT FPVIOL MGSTAT1 MGSTAT0 Set if an invalid DFPART or ERPART selection is supplied(1) None Set if any errors have been encountered during the read Set if any non-correctable errors have been encountered during the read FERSTAT EPVIOLIF None 1. As deﬁned by the maximum ERPART for FTM512K3. MC9S12XF - Family Reference Manual, Rev.1.19 398 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) 10.4.3 Interrupts The Flash module can generate an interrupt when a Flash command operation has completed or when a Flash command operation has detected an EEE error or an ECC fault. Table 10-77. Flash Interrupt Sources Interrupt Source Flash Command Complete Flash EEE Erase Error Flash EEE Program Error Flash EEE Protection Violation Flash EEE Error Type 1 Violation Flash EEE Error Type 0 Violation ECC Double Bit Fault on Flash Read ECC Single Bit Fault on Flash Read Interrupt Flag CCIF (FSTAT register) ERSERIF (FERSTAT register) PGMERIF (FERSTAT register) EPVIOLIF (FERSTAT register) ERSVIF1 (FERSTAT register) ERSVIF0 (FERSTAT register) DFDIF (FERSTAT register) SFDIF (FERSTAT register) Local Enable CCIE (FCNFG register) ERSERIE (FERCNFG register) PGMERIE (FERCNFG register) EPVIOLIE (FERCNFG register) ERSVIE1 (FERCNFG register) ERSVIE0 (FERCNFG register) DFDIE (FERCNFG register) SFDIE (FERCNFG register) Global (CCR) Mask I Bit I Bit I Bit I Bit I Bit I Bit I Bit I Bit NOTE Vector addresses and their relative interrupt priority are determined at the MCU level. 10.4.3.1 Description of Flash Interrupt Operation The Flash module uses the CCIF ﬂag in combination with the CCIE interrupt enable bit to generate the Flash command interrupt request. The Flash module uses the ERSEIF, PGMEIF, EPVIOLIF, ERSVIF1, ERSVIF0, DFDIF and SFDIF ﬂags in combination with the ERSEIE, PGMEIE, EPVIOLIE, ERSVIE1, ERSVIE0, DFDIE and SFDIE interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register bits involved, refer to Section 10.3.2.5, “Flash Configuration Register (FCNFG)”, Section 10.3.2.6, “Flash Error Configuration Register (FERCNFG)”, Section 10.3.2.7, “Flash Status Register (FSTAT)”, and Section 10.3.2.8, “Flash Error Status Register (FERSTAT)”. The logic used for generating the Flash module interrupts is shown in Figure 10-27. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 399 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) CCIE CCIF ERSERIE ERSERIF PGMERIE PGMERIF EPVIOLIE EPVIOLIF ERSVIE1 ERSVIF1 ERSVIE0 ERSVIF0 DFDIE DFDIF SFDIE SFDIF Flash Command Interrupt Request Flash Error Interrupt Request Figure 10-27. Flash Module Interrupts Implementation 10.4.4 Wait Mode The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU from wait via the CCIF interrupt (see Section 10.4.3, “Interrupts”). 10.4.5 Stop Mode If a Flash command is active (CCIF = 0) or an EE-Emulation operation is pending when the MCU requests stop mode, the current Flash operation will be completed before the CPU is allowed to enter stop mode. 10.5 Security The Flash module provides security information to the MCU. The Flash security state is deﬁned by the SEC bits of the FSEC register (see Table 10-12). During reset, the Flash module initializes the FSEC register using data read from the security byte of the Flash conﬁguration ﬁeld at global address 0x7F_FF0F. MC9S12XF - Family Reference Manual, Rev.1.19 400 Freescale Semiconductor Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) The security state out of reset can be permanently changed by programming the security byte of the Flash conﬁguration ﬁeld. This assumes that you are starting from a mode where the necessary P-Flash erase and program commands are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is successfully programmed, its new value will take affect after the next MCU reset. The following subsections describe these security-related subjects: • Unsecuring the MCU using Backdoor Key Access • Unsecuring the MCU in Special Single Chip Mode using BDM • Mode and Security Effects on Flash Command Availability 10.5.1 Unsecuring the MCU using Backdoor Key Access The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the contents of the backdoor keys (four 16-bit words programmed at addresses 0x7F_FF00–0x7F_FF07). If the KEYEN[1:0] bits are in the enabled state (see Section 10.3.2.2), the Verify Backdoor Access Key command (see Section 10.4.2.11) allows the user to present four prospective keys for comparison to the keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC register (see Table 10-12) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash block 0 will not be available for read access and will return invalid data. The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an external stimulus. This external stimulus would typically be through one of the on-chip serial ports. If the KEYEN[1:0] bits are in the enabled state (see Section 10.3.2.2), the MCU can be unsecured by the backdoor key access sequence described below: 1. Follow the command sequence for the Verify Backdoor Access Key command as explained in Section 10.4.2.11 2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10 The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method to re-enable the Verify Backdoor Access Key command. After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the contents of the backdoor keys by programming addresses 0x7F_FF00–0x7F_FF07 in the Flash conﬁguration ﬁeld. The security as deﬁned in the Flash security byte (0x7F_FF0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor keys stored in addresses 0x7F_FF00–0x7F_FF07 are unaffected by the Verify Backdoor Access Key command sequence. After the next reset of the MCU, the security state of the Flash module is determined by the Flash security byte MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 401 Chapter 10 128 KByte Flash Module (S12XFTM128K2XFV1) (0x7F_FF0F). The Verify Backdoor Access Key command sequence has no effect on the program and erase protections deﬁned in the Flash protection register, FPROT. 10.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM The MCU can be unsecured in special single chip mode by erasing the P-Flash and D-Flash memory by one of the following methods: • Reset the MCU into special single chip mode, delay while the erase test is performed by the BDM, send BDM commands to disable protection in the P-Flash and D-Flash memory, and execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. • Reset the MCU into special expanded wide mode, disable protection in the P-Flash and D-Flash memory and run code from external memory to execute the Erase All Blocks command write sequence to erase the P-Flash and D-Flash memory. After the CCIF ﬂag sets to indicate that the Erase All Blocks operation has completed, reset the MCU into special single chip mode. The BDM will execute the Erase Verify All Blocks command write sequence to verify that the P-Flash and D-Flash memory is erased. If the P-Flash and D-Flash memory are verified as erased the MCU will be unsecured. All BDM commands will be enabled and the Flash security byte may be programmed to the unsecure state by the following method: • Send BDM commands to execute a ‘Program P-Flash’ command sequence to program the Flash security byte to the unsecured state and reset the MCU. 10.5.3 Mode and Security Effects on Flash Command Availability The availability of Flash module commands depends on the MCU operating mode and security state as shown in Table 10-30. 10.6 Initialization On each system reset the Flash module executes a reset sequence which establishes initial values for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the FOPT and FSEC registers. The Flash module reverts to built-in default values that leave the module in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set. The ACCERR bit in the FSTAT register is set if errors are encountered while initializing the EEE buffer ram during the reset sequence. CCIF remains clear throughout the reset sequence. The Flash module holds off all CPU access for the initial portion of the reset sequence. While Flash reads are possible when the hold is removed, writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers are ignored to prevent command activity while the Memory Controller remains busy. Completion of the reset sequence is marked by setting CCIF high which enables writes to the FCCOBIX, FCCOBHI, and FCCOBLO registers to launch any available Flash command. If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The state of the word being programmed or the sector/block being erased is not guaranteed. MC9S12XF - Family Reference Manual, Rev.1.19 402 Freescale Semiconductor Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY Revision History Rev. No. (Item No.) v04.06 v04.07 v04.08 Date (Submitted By) 15-Nov-06 02-Apr-07 04-May-07 Sections Affected Substantial Change(s) - Adding AUTOSAR Compliance concerning illegal CPU accesses - Adapting the MMC context to support S12XS family - Clarifying RPAGE usage for less than 12KB RAMSIZE. - Some Cleanups 11.1 Introduction This section describes the functionality of the module mapping control (MMC) sub-block of the S12X platform. The block diagram of the MMC is shown in Figure 11-1. The MMC module controls the multi-master priority accesses, the selection of internal resources and external space. Internal buses, including internal memories and peripherals, are controlled in this module. The local address space for each master is translated to a global memory space. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 403 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.1.1 Terminology Table 11-1. Acronyms and Abbreviations Logic level “1” Logic level “0” 0x x Byte word local address global address Aligned address Voltage that corresponds to Boolean true state Voltage that corresponds to Boolean false state Represents hexadecimal number Represents logic level ’don’t care’ 8-bit data 16-bit data based on the 64KB Memory Space (16-bit address) based on the 8MB Memory Space (23-bit address) Address on even boundary Address on odd boundary System Clock. Refer to CRG Block Guide. Normal Expanded Mode Emulation Single-Chip Mode Emulation Expanded Mode Special Test Mode Normal Single-Chip Mode Special Single-Chip Mode Emulation Single-Chip Mode Emulation Expanded Mode Normal Single-Chip Mode Normal Expanded Mode Special Single-Chip Mode Special Test Mode Normal Single-Chip Mode Special Single-Chip Mode Normal Expanded Mode Emulation Single-Chip Mode Emulation Expanded Mode Special Test Mode Areas which are accessible by the pages (RPAGE,PPAGE,EPAGE) and not implemented Area which is accessible in the global address range 14_0000 to 3F_FFFF Resources (Emulator, Application) connected to the MCU via the external bus on expanded modes (Unimplemented areas and External Space) Port Replacement Registers Port Replacement Unit located on the emulator side MicroController Unit Non-volatile Memory; Flash, EEPROM or ROM Information Row sector located on the top of NVM. For Test purposes. FlexRay IP Integration module Mis-aligned address Bus Clock expanded modes single-chip modes emulation modes normal modes special modes NS SS NX ES EX ST Unimplemented areas External Space external resource PRR PRU MCU NVM IFR FLEXRAY 11.1.2 Features The main features of this block are: • Paging capability to support a global 8MB memory address space MC9S12XF - Family Reference Manual, Rev.1.19 404 Freescale Semiconductor Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY • • • • • • • • • Bus arbitration between the masters CPU, BDM, FLEXRAY and XGATE Simultaneous accesses to different resources1 (internal, external, and peripherals) (see Figure 111) Resolution of target bus access collision MCU operation mode control MCU security control Separate memory map schemes for each master CPU, BDM, FLEXRAY and XGATE ROM control bits to enable the on-chip FLASH or ROM selection Port replacement registers access control Generation of system reset when CPU accesses an unimplemented address (i.e., an address which does not belong to any of the on-chip modules) in single-chip modes 11.1.3 S12X Memory Mapping The S12X architecture implements a number of memory mapping schemes including • a CPU 8MB global map, deﬁned using a global page (GPAGE) register and dedicated 23-bit address load/store instructions. • a BDM 8MB global map, deﬁned using a global page (BDMGPR) register and dedicated 23-bit address load/store instructions. • a FLEXRAY 8 MByte global map. • a (CPU or BDM) 64KB local map, deﬁned using speciﬁc resource page (RPAGE, EPAGE and PPAGE) registers and the default instruction set. The 64KB visible at any instant can be considered as the local map accessed by the 16-bit (CPU or BDM) address. • The XGATE 64 Kbyte local map. The MMC module performs translation of the different memory mapping schemes to the speciﬁc global (physical) memory implementation. 11.1.4 Modes of Operation This subsection lists and brieﬂy describes all operating modes supported by the MMC. 11.1.4.1 • • • Power Saving Modes Run mode MMC is functional during normal run mode. Wait mode MMC is functional during wait mode. Stop mode MMC is inactive during stop mode. 1. Resources are also called targets. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 405 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.1.4.2 • • Functional Modes • Single chip modes In normal and special single chip mode the internal memory is used. External bus is not active. Expanded modes Address, data, and control signals are activated in normal expanded and special test modes when accessing the external bus. Access to internal resources will not cause activity on the external bus. Emulation modes External bus is active to emulate, via an external tool, the normal expanded or the normal single chip mode. 11.1.5 1 Block Diagram shows a block diagram of the MMC. BDM EEEPROM MMC FLASH Address Decoder & Priority DBG CPU XGATE FLEXRAY Target Bus Controller EBI RAM Peripherals Figure 11-1. MMC Block Diagram 11.2 External Signal Description The user is advised to refer to the SoC Guide for port conﬁguration and location of external bus signals. Some pins may not be bonded out in all implementations. Table 11-2 and Table 11-3 outline the pin names and functions. It also provides a brief description of their operation. 1. Doted blocks and lines are optional. Please refer to the SoC Guide for their availlibilities. MC9S12XF - Family Reference Manual, Rev.1.19 406 Freescale Semiconductor Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY Table 11-2. External Input Signals Associated with the MMC Signal MODC MODB MODA EROMCTL ROMCTL I/O I I I I I Description Mode input Mode input Mode input EROM control input ROM control input Availability Latched after RESET (active low) Latched after RESET (active low) Latched after RESET (active low) Latched after RESET (active low) Latched after RESET (active low) Table 11-3. External Output Signals Associated with the MMC Available in Modes Signal CS0 CS1 CS2 CS3 I/O O O O O Description NS Chip select line 0 Chip select line 1 Chip select line 2 Chip select line 3 SS NX ES EX ST (see Table 11-4) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 407 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.3 11.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the MMC block is shown in Figure 11-2. Detailed descriptions of the registers and bits are given in the subsections that follow. Address 0x000A Register Name MMCCTL0 R W 0x000B MODE R W 0x0010 GPAGE R W 0x0011 DIRECT R W 0x0012 Reserved R W 0x0013 MMCCTL1 R W 0x0014 Reserved R W 0x0015 PPAGE R W 0x0016 RPAGE R W 0x0017 EPAGE R W 0 EROMON Bit 7 CS3E1 6 CS3E0 5 CS2E1 4 CS2E0 0 3 CS1E1 0 2 CS1E0 0 1 CS0E1 0 Bit 0 CS0E0 0 MODC 0 MODB MODA GP6 GP5 GP4 GP3 GP2 GP1 GP0 DP15 0 DP14 0 DP13 0 DP12 0 DP11 0 DP10 0 DP9 0 DP8 0 TGMRAMON 0 EEEIFRON PGMIFRON RAMHM 0 0 0 ROMHM 0 ROMON 0 0 0 PIX7 PIX6 PIX5 PIX4 PIX3 PIX2 PIX1 PIX0 RP7 RP6 RP5 RP4 RP3 RP2 RP1 RP0 EP7 EP6 EP5 EP4 EP3 EP2 EP1 EP0 = Unimplemented or Reserved Figure 11-2. MMC Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 408 Freescale Semiconductor Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.3.2 11.3.2.1 Register Descriptions MMC Control Register (MMCCTL0) Address: 0x000A PRR 7 6 5 4 3 2 1 0 R W Reset CS3E1 0 CS3E0 0 CS2E1 0 CS2E0 0 CS1E1 0 CS1E0 0 CS0E1 0 CS0E0 ROMON1 1. ROMON is bit[0] of the register MMCTL1 (see Figure 11-10) = Unimplemented or Reserved Figure 11-3. MMC Control Register (MMCCTL0) Read: Anytime. In emulation modes read operations will return the data from the external bus. In all other modes the data is read from this register. Write: Anytime. In emulation modes write operations will also be directed to the external bus. Table 11-4. Chip Selects Function Activity Chip Modes Register Bit NS Disabled(1) SS NX (2) ES Disabled EX Enabled ST Disabled CS0E[1:0], CS1E[1:0], Disabled Enabled CS2E[1:0], CS3E[1:0] 1. Disabled: feature always inactive. 2. Enabled: activity is controlled by the appropriate register bit value. The MMCCTL0 register is used to control external bus functions, like: • Availability of chip selects. (See Table 11-4 and Table 11-5) • Control of different external stretch mechanism. For more detail refer to the S12X_EBI BlockGuide. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 409 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY Table 11-5. MMCCTL0 Field Descriptions Field 7–6 CS3E[1:0] Description Chip Select 3 Enables — These bits enable the external chip select CS3 output which is asserted during accesses to speciﬁc external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 3 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes. 00 Chip select 3 is disabled 01,10,11 Chip select 3 is enabled Chip Select 2 Enables — These bits enable the external chip select CS2 output which is asserted during accesses to speciﬁc external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 2 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes. 00 Chip select 2 is disabled 01,10,11 Chip select 2 is enabled Chip Select 1 Enables — These bits enable the external chip select CS1 output which is asserted during accesses to speciﬁc external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 1 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes. 00 Chip select 1 is disabled 01,10,11 Chip select 1 is enabled Chip Select 0 Enables — These bits enable the external chip select CS0 output which is asserted during accesses to speciﬁc external addresses. The associated global address range is shown in Table 11-6 and Figure 11-17. Chip select 0 is only active if enabled in Normal Expanded mode, Emulation Expanded mode. The function disabled in all other operating modes. 00 Chip select 0 is disabled 01,10,11 Chip select 0 is enabled 5–4 CS2E[1:0] 3–2 CS1E[1:0] 1–0 CS0E[1:0] Table 11-6 shows the address boundaries of each chip select and the relationship with the implemented resources (internal) parameters. Table 11-6. Global Chip Selects Memory Space Chip Selects CS3 CS2(2) CS1 CS0(3) Bottom Address 0x00_0800 0x14_0000 0x20_0000 Top Address 0x0F_FFFF minus RAMSIZE(1) 0x1F_FFFF 0x3F_FFFF 0x40_0000 0x7F_FFFF minus FLASHSIZE(4) 1. External RPAGE accesses in (NX, EX) 2. When ROMHM is set (see ROMHM in Table 11-15) the CS2 is asserted in the space occupied by this onchip memory block. 3. When the internal NVM is enabled (see ROMON in Section 11.3.2.5, “MMC Control Register (MMCCTL1)) the CS0 is not asserted in the space occupied by this on-chip memory block. 4. External PPAGE accesses in (NX, EX) MC9S12XF - Family Reference Manual, Rev.1.19 410 Freescale Semiconductor Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.3.2.2 Mode Register (MODE) Address: 0x000B PRR 7 6 5 4 3 2 1 0 R W Reset MODC MODC1 MODB MODB1 MODA MODA1 0 0 0 0 0 0 0 0 0 0 1. External signal (see Table 11-2). = Unimplemented or Reserved Figure 11-4. Mode Register (MODE) Read: Anytime. In emulation modes read operations will return the data read from the external bus. In all other modes the data are read from this register. Write: Only if a transition is allowed (see Figure 11-5). In emulation modes write operations will be also directed to the external bus. The MODE bits of the MODE register are used to establish the MCU operating mode. CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Table 11-7. MODE Field Descriptions Field 7–5 MODC, MODB, MODA Description Mode Select Bits — These bits control the current operating mode during RESET high (inactive). The external mode pins MODC, MODB, and MODA determine the operating mode during RESET low (active). The state of the pins is latched into the respective register bits after the RESET signal goes inactive (see Figure 11-4). Write restrictions exist to disallow transitions between certain modes. Figure 11-5 illustrates all allowed mode changes. Attempting non authorized transitions will not change the MODE bits, but it will block further writes to these register bits except in special modes. Both transitions from normal single-chip mode to normal expanded mode and from emulation single-chip to emulation expanded mode are only executed by writing a value of 3’b101 (write once). Writing any other value will not change the MODE bits, but will block further writes to these register bits. Changes of operating modes are not allowed when the device is secured, but it will block further writes to these register bits except in special modes. In emulation modes reading this address returns data from the external bus which has to be driven by the emulator. It is therefore responsibility of the emulator hardware to provide the expected value (i.e. a value corresponding to normal single chip mode while the device is in emulation single-chip mode or a value corresponding to normal expanded mode while the device is in emulation expanded mode). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 411 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY RESET 010 Special Test (ST) 010 10 10 0 1 1 01 00 1 Normal Expanded (NX) 101 010 000 RESET 100 110 111 Normal Single-Chip (NS) 100 101 101 RESET 001 RESET 10 1 Emulation Single-Chip (ES) 001 101 Emulation Expanded (EX) 011 011 RESET 10 0 Special Single-Chip (SS) 000 000 RESET Transition done by external pins (MODC, MODB, MODA) RESET Transition done by write access to the MODE register 110 111 Illegal (MODC, MODB, MODA) pin values. Do not use. (Reserved for future use). Figure 11-5. Mode Transition Diagram when MCU is Unsecured MC9S12XF - Family Reference Manual, Rev.1.19 412 Freescale Semiconductor 01 00 1 1 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.3.2.3 Global Page Index Register (GPAGE) Address: 0x0010 7 6 5 4 3 2 1 0 R W Reset 0 0 GP6 0 GP5 0 GP4 0 GP3 0 GP2 0 GP1 0 GP0 0 = Unimplemented or Reserved Figure 11-6. Global Page Index Register (GPAGE) Read: Anytime Write: Anytime The global page index register is used to construct a 23 bit address in the global map format. It is only used when the CPU is executing a global instruction (GLDAA, GLDAB, GLDD, GLDS, GLDX, GLDY,GSTAA, GSTAB, GSTD, GSTS, GSTX, GSTY) (see CPU Block Guide). The generated global address is the result of concatenation of the CPU local address [15:0] with the GPAGE register [22:16] (see Figure 11-7). CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Global Address [22:0] Bit22 Bit16 Bit15 Bit 0 GPAGE Register [6:0] CPU Address [15:0] Figure 11-7. GPAGE Address Mapping Table 11-8. GPAGE Field Descriptions Field 6–0 GP[6:0] Description Global Page Index Bits 6–0 — These page index bits are used to select which of the 128 64KB pages is to be accessed. Example 11-1. This example demonstrates usage of the GPAGE register LDX MOVB GLDAA #0x5000 #0x14, GPAGE X ;Set GPAGE offset to the value of 0x5000 ;Initialize GPAGE register with the value of 0x14 ;Load Accu A from the global address 0x14_5000 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 413 Chapter 11 Memory Mapping Control (S12XMMCV4) SUPPORTING FLEXRAY 11.3.2.4 Direct Page Register (DIRECT) Address: 0x0011 7 6 5 4 3 2 1 0 R W Reset DP15 0 DP14 0 DP13 0 DP12 0 DP11 0 DP10 0 DP9 0 DP8 0 Figure 11-8. Direct Register (DIRECT) Read: Anytime Write: anytime in special modes, one time only in other modes. This register determines the position of the 256B direct page within the memory map.It is valid for both global and local mapping scheme. Table 11-9. DIRECT Field Descriptions Field 7–0 DP[15:8] Description Direct Page Index Bits 15–8 — These bits are used by the CPU when performing accesses using the direct addressing mode. The bits from this register form bits [15:8] of the address (see Figure 11-9). CAUTION XGATE write access to this register during an CPU access which makes use of this register could lead to unexpected results. Global Address [22:0] Bit22 Bit16 Bit15 Bit8 Bit7 Bit0 DP [15:8] CPU Address [15:0] Figure 11-9. DIRECT Address Mapping Bits [22:16] of the global address will be formed by the GPAGE[6:0] bits in case the CPU executes a global instruction in direct addressing mode or by the appropriate local address to the global address expansion (refer to Section 11.4.2.1.1, “Expansion of the Local Address Map). Example 11-2. This example demonstrates usage of the Direct Addressing Mode MOVB #0x80,DIRECT ;Set DIRECT register to 0x80. Write once only. ;Global data accesses to the range 0xXX_80XX can be direct. ;Logical data accesses to the range 0x80XX are direct. ;Load the Y index register from 0x8000 (direct access). ;< operator forces direct access on some assemblers but in ;many cases assemblers are “direct page aware” and can MC9S12XF - Family Reference Manual, Rev.1.19 414 Freescale Semiconductor LDY HL Description module vs. application Buffer Subscribed > Message Buffer Disable Buffer Subscribed > Message Buffer Disable Slot or Segment Start > Message Buffer Lock 13.6.6.3.2 Message Reception As a result of the message buffer search, the FlexRay block changes the state of up to two enabled receive message buffers from either idle state Idle or locked state HLck to the either subscribed state CCBs or locked buffer subscribed state HLckCCBs by triggering the buffer subscribed transition BS. If the receive message buffers for the next slot are assigned to both channels, then at most one receive message buffer is changed to a buffer subscribed state. If more than one matching message buffers assigned to a certain channel, then only the message buffer with the lowest message buffer number is in one of the states mentioned above. MC9S12XF - Family Reference Manual, Rev.1.19 570 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) With the start of the next static or dynamic slot the module trigger the slot start transition SLS. This changes the state of the subscribed receive message buffers from either CCBs to CCRx or from HLckCCBs to HLckCCRx, respectively. During the reception slot, the received frame data are written into the shadow buffers. For details on receive shadow buffers, see Section 13.6.6.3.5, “Receive Shadow Buffers Concept”. The data and status of the receive message buffers that are the CCRx or HLckCCRx are not modiﬁed in the reception slot. 13.6.6.3.3 Message Buffer Status Update With the start of the next static or dynamic slot or with the start of the symbol window or NIT, the module trigger the slot or segment start transition SSS. This transition changes the state of the receiving receive message buffers from either CCRx to CCSu or from HLckCCRx to HLck, respectively. If a message buffer was in the locked state HLckCCRx, no update will be performed. The received data are lost. This is indicated by setting the Frame Lost Channel A/B Error Flag FRLA_EF/FRLB_EF in the CHI Error Flag Register (CHIERFR). If a message buffer was in the CCRx state it is now in the CCSu state. After the evaluation of the slot status provided by the PE the message buffer is updated. The message buffer update depends on the slot status bits and the segment the message buffer is assigned to. This is described in Table 13-103. Table 13-103. Receive Message Buffer Update vSS!ValidFrame 1 vRF!Header!NFIndicator 1 Update description Valid non-null frame received. - Message Buffer Data Field updated. - Frame Header Field updated. - Slot Status Field updated. - DUP:= 1 - DVAL:= 1 - MBIF:= 1 Valid null frame received. - Message Buffer Data Field not updated. - Frame Header Field not updated. - Slot Status Field updated. - DUP:= 0 - DVAL not changed - MBIF:= 1 No valid frame received. - Message Buffer Data Field not updated. - Frame Header Field not updated. - Slot Status Field updated. - DUP:= 0 - DVAL not changed. - MBIF:= 1, if the slot was not an empty dynamic slot. Note: An empty dynamic slot is indicated by the following frame and slot status bit values: vSS!ValidFrame = 0 and vSS!SyntaxError = 0 and vSS!ContentError = 0 and vSS!BViolation = 0. 1 0 0 x MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 571 Chapter 13 FlexRay Communication Controller (FLEXRAY) NOTE If the number of the last slot in the current communication cycle on a given channel is n, then all receive message buffers assigned to this channel with MBFIDRn.FID > n will not be updated at all. When the receive message buffer update has ﬁnished the status updated transition SU is triggered, which changes the buffer state from CCSu to Idle. An example receive message buffer timing and state change diagram for a normal frame reception is given in Figure 13-123. BS Idle rt rt sta sta SLS CCBs slot start SSS CCRx message receive to receive shadow buffer slot s+1 SU Idle rt MT sta CCSu slot start slot start MT search[s+1] slot s MT slot s+2 Figure 13-123. Message Reception Timing The amount of message data written into the message buffer data ﬁeld of the receive shadow buffer is determined by the following two items: 1. the message buffer segment that the message buffer is assigned to, as deﬁned by the Message Buffer Segment Size and Utilization Register (MBSSUTR). 2. the message buffer data ﬁeld size, as deﬁned by the related ﬁeld of the Message Buffer Data Size Register (MBDSR) 3. the number of bytes received over the FlexRay bus If the message buffer is assigned to the message buffer segment 1, and the number of received bytes is greater than 2*MBDSR.MBSEG1DS, the FlexRay block writes only 2*MBDSR.MBSEG1DS bytes into the message buffer data ﬁeld of the receive shadow buffer. If the number of received bytes is less than 2*MBDSR.MBSEG1DS, the FlexRay block writes only the received number of bytes and will not change the trailing bytes in the message buffer data ﬁeld of the receive shadow buffer. The same holds for the message buffer segment 2 with MBDSR.MBSEG2DS. 13.6.6.3.4 Received Message Access To access the message data received over the FlexRay bus, the application reads the message data stored in the message buffer data ﬁeld of the corresponding receive message buffer. The access to the message buffer data ﬁeld is described in Section 13.6.3.1, “Individual Message Buffers”. The application can read the message buffer data ﬁeld if the receive message buffer is one of the states HDis, HDisLck, or HLck. If the message buffer is in one of these states, the FlexRay block will not change the content of the message buffer. 13.6.6.3.5 Receive Shadow Buffers Concept The receive shadow buffer concept applies only to individual receive message buffers. The intention of this concept is to ensure that only syntactically and semantically valid received non-null frames are presented MC9S12XF - Family Reference Manual, Rev.1.19 572 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) to the application in a receive message buffer. The basic structure of a receive shadow buffer is described in Section 13.6.3.2, “Receive Shadow Buffers”. The receive shadow buffers temporarily store the received frame header and message data. After the slot boundary the slot status information is generated. If the slot status information indicates the reception of the valid non-null frame (see Table 13-103), the FlexRay block writes the slot status into the slot status ﬁeld of the receive shadow buffer and exchanges the content of the Message Buffer Index Registers (MBIDXRn) with the content of the corresponding internal shadow buffer index register. In all other cases, the FlexRay block writes the slot status into the identiﬁed receive message buffer, depending on the slot status and the FlexRay segment the message buffer is assigned to. The shadow buffer concept, with its index exchange, results in the fact that the FRM located message buffer associated to an individual receive message buffer changes after successful reception of a valid frame. This means that the message buffer area in the FRM accessed by the application for reading the received message is different from the initial setting of the message buffer. Therefore, the application must not rely on the index information written initially into the Message Buffer Index Registers (MBIDXRn). Instead, the index of the message buffer header ﬁeld must be fetched from the Message Buffer Index Registers (MBIDXRn). 13.6.6.4 Double Transmit Message Buffer The section provides a detailed description of the functionality of the double transmit message buffers. Double transmit message buffers are used by the application to provide the FlexRay block with the message data to be transmitted over the FlexRay Bus. The FlexRay block uses this message buffer to provide information to the application about the transmission process, and status information about the slot in which message data was transmitted. In contrast to the single transmit message buffers, the application can provide new transmission data while the transmission of the previously provided message data is running. This scheme is called double buffering and can be considered as a FIFO of depth 2. Double transmit message buffers are implemented by combining two individual message buffers that form the two sides of an double transmit message buffer. One side is called the commit side and will be accessed by the application to provide the message data. The other side is called the transmit side and is used by the FlexRay block to transmit the message data to the FlexRay bus. The two sides are located in adjacent individual message buffers. The message buffer that implements the commit side has an even message buffer number 2n. The transmit side message buffer follows the commit side message buffer and has the message buffer number 2n+1. The basic structure and data ﬂow of a double transmit message buffer is given in Figure 13-124. Application message data Internal Message Transfer message data FlexRay Bus MB# 2n+1 Transmit Side message data MB# 2n Commit Side Figure 13-124. Double Transmit Buffer Structure and Data Flow MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 573 Chapter 13 FlexRay Communication Controller (FLEXRAY) NOTE Both the commit and the transmit side must be conﬁgured with identical values except for the Message Buffer Index Registers (MBIDXRn). 13.6.6.4.1 Access Regions To certain message buffer ﬁelds, both the application and the FlexRay block have access. To ensure data consistency, a message buffer locking scheme is implemented, which controls the exclusive access to the data, control, and status bits of the message buffer. The access scheme for double transmit message buffers is depicted in Figure 13-125. The given regions represent ﬁelds that can be accessed from both the application and the FlexRay block and, thus, require access restrictions. A description of the regions is given in Table 13-104. Commit Side Message Buffer Header Field: Frame Header CFG Transmit Side Message Buffer Header Field: Frame Header CFG Message Buffer Header Field: Data Field Offset MBIDXR[2n].MBIDX MBCCSR[2n]n.CMT ITX Message Buffer Header Field: Data Field Offset MBIDXR[2n+1].MBIDX MBCCSR[2n+1].CMT Message Buffer Data Field: DATA[0-N] TX MSG Message Buffer Data Field: DATA[0-N] Message Buffer Header Field: Slot Status MBCCSR[2n].MBT/MTD MBCCFR[2n].MTM/CHA/CHB/CCF* MBFIDR[2n].FID SS Message Buffer Header Field: Slot Status MBCCSR[2n+1].MBT/MTD MBCCFR[2n+1].MTM/CHA/CHB/CCF* MBFIDR[2n+1].FID SS SR Figure 13-125. Double Transmit Message Buffer Access Regions Layout Table 13-104. Double Transmit Message Buffer Access Regions Description Access Type Region Application CFG MSG ITX SS CFG SR TX read/write read/write read/write Module Commit Side read/write write-only read-only read-only Message Buffer Conﬁguration Message Buffer Data and Control access Internal Message Transfer. Slot Status Update Transmit Side Message Buffer Conﬁguration Message Buffer Search Internal Message Transfer, Message Transmission Description MC9S12XF - Family Reference Manual, Rev.1.19 574 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) Table 13-104. Double Transmit Message Buffer Access Regions Description Access Type Region Application SS Module write-only Slot Status Update Description The trigger bits MBCCSRn.EDT and MBCCSRn.LCKT, and the interrupt enable bit MBCCSRn.MBIE are not under access control and can be accessed from the application at any time. The status bits MBCCSRn.EDS and MBCCSRn.LCKS are not under access control and can be accessed from the FlexRay block at any time. The interrupt ﬂag MBCCSnR.MBIF is not under access control and can be accessed from the application and the FlexRay block at any time. FlexRay block set access has higher priority. The FlexRay block restricts its access to the regions, depending on the current state of the corresponding part of the double transmit message buffer. The application must adhere to these restrictions in order to ensure data consistency. The states for the commit side of a double transmit message buffer are given in Figure 13-126. A description of the states is given in Table 13-106. The states for the transmit side of a double transmit message buffer are given in Figure 13-127. A description of the states is given in Table 13106. The description tables also provide the access scheme for the access regions. The status bits MBCCSRn.EDS and MBCCSRn.LCKS provide the application with the required message buffer status information. The internal status information is not visible to the application. 13.6.6.4.2 Message Buffer States This section describes the transmit message buffer states and provides a state diagram. RESET_STATE HD HDis HE HL HU HL IS Idle IE HDisLck HE CCITx HD HU HLck Figure 13-126. Double Transmit Message Buffer State Diagram (Commit Side) A description of the states of the commit side of a double transmit message buffer is given in Table 13-105. Table 13-105. Double Transmit Message Buffer State Description (Sheet 1 of 2)(Commit Side) MBCCSR[2n] State EDS common states LCKS Appl. Module Access Region Description MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 575 Chapter 13 FlexRay Communication Controller (FLEXRAY) Table 13-105. Double Transmit Message Buffer State Description (Sheet 2 of 2)(Commit Side) MBCCSR[2n] State EDS HDis CCITx 0 1 LCKS 0 0 Appl. CFG – Module – ITX Disabled - Message Buffer under conﬁguration. Commit Side can not be used for internal message transfer. Internal Message Transfer - Message Buffer Data transferred from commit side to transmit side. Idle - Message Buffer Commit Side is idle. Commit Side can be used for internal message transfer. Disabled and Locked - Message Buffer under conﬁguration. Commit Side can not be used for internal message transfer. Locked - Applications access to data, control, and status. Commit Side can not be used for internal message transfer. Access Region Description commit side speciﬁc states Idle HDisLck HLck 1 0 1 0 1 1 – CFG SS MSG SS ITX, SS RESET_STATE HD HDis HE IS Idle SA MA SU CCSu DSS SSS CCSa IS STS CCTx IE IE SSS DSS STS TX CCITx CCSaCCITx CCNf IS CCMa IS IE IE CCNfCCITx CCMaCCITx Figure 13-127. Double Transmit Message Buffer State Diagram (Transmit Side) A description of the states of the transmit side of a double transmit message buffer is given in Table 13-106. Table 13-106. Double Transmit Message Buffer State Description (Transmit Side) (Sheet 1 of 2) MBCCSRn State EDS common states HDis CCITx 0 1 0 0 CFG – – TX Disabled - Message Buffer under conﬁguration. Excluded from message buffer search. Internal Message Transfer - Message Buffer Data transferred from commit side to transmit side. Idle - Message Buffer Transmit Side is idle. Transmit Side is included in message buffer search. LCKS Appl. Module Access Region Description transmit side speciﬁc states Idle 1 0 – SR MC9S12XF - Family Reference Manual, Rev.1.19 576 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) Table 13-106. Double Transmit Message Buffer State Description (Transmit Side) (Sheet 2 of 2) MBCCSRn State EDS CCSa CCSaCCITx 1 1 LCKS 0 0 Appl. – – Module – TX Slot Assigned - Message buffer assigned to next static slot. Ready for Null Frame transmission. Slot Assigned and Internal Message Transfer - Message buffer assigned to next static slot and Message Buffer Data transferred from commit side to transmit side. Null Frame Transmission Header is used for null frame transmission. Null Frame Transmission and Internal Message Transfer Header is used for null frame transmission and Message Buffer Data transferred from commit side to transmit side. Message Available - Message buffer is assigned to next slot and cycle counter ﬁlter matches. Message Available and Internal Message Transfer - Message buffer is assigned to next slot and cycle counter ﬁlter matches and Message Buffer Data transferred from commit side to transmit side. Message Transmission - Message buffer data transmit. Payload data from buffer transmitted Status Update - Message buffer status update. Update of status ﬂags, the slot status ﬁeld, and the header index. Note: The slot status ﬁeld of the commit side is updated too, even if the application has locked the commit side. Access Region Description CCNf CCNfCCITx 1 1 0 0 – – TX TX CCMa CCMaCCITx 1 1 0 0 – – – – CCTx CCSu 1 1 0 0 – – TX SS 13.6.6.4.3 Message Buffer Transitions Application Transitions The application transitions that can be triggered by the application using the commands described in Table 13-107. The application issues the commands by writing to the Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn). Only one command can be issued with one write access. Each command is executed immediately. If the command is ignored, it must be issued again. The enable and disable commands can be issued on the transmit side only. Any enable or disable command issued on the commit side will be ignored without notiﬁcation. The transitions that will be triggered depends on the value of the EDS bit. The enable and disable commands will affect both the commit side and the transmit side at the same time. If the application triggers the disable transition HD while the transmit side is in one of the states CCSa, CCSaCCITx, CCNf, CCNfCCITx, CCMa, CCMaCCITx, CCTx, or CCSu, the disable transition has no effect (command is ignored) and the message buffer state is not changed. No notiﬁcation is given to the application. The lock and unlock commands can be issued on the commit side only. Any lock or unlock command issued on the transmit side will be ignored and the double transmit buffer lock error ﬂag DBL_EF in the CHI Error Flag Register (CHIERFR) will be set. The transitions that will be triggered depends on the current value of the LCKS bit. The lock and unlock commands will only affect the commit side. If the application triggers the lock transition HL while the commit side is in the state CCITx, the message buffer state will not be changed and the message buffer lock error ﬂag LCK_EF in the CHI Error Flag Register (CHIERFR) will be set. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 577 Chapter 13 FlexRay Communication Controller (FLEXRAY) Table 13-107. Double Transmit Message Buffer Host Transitions Transition HE HD HL HU Host Command MBCCSR[2n+1].EDT:= 1 MBCCSR[2n].LCKT:= 1 Condition Description MBCCSR[2n+1].EDS = 0 Application triggers message buffer enable. MBCCSR[2n+1].EDS = 1 Application triggers message buffer disable. MBCCSR[2n].LCKS = 0 Application triggers message buffer lock. MBCCSR[2n].LCKS = 1 Application triggers message buffer unlock. Module Transitions The module transitions that can be triggered by the FlexRay block are described in Table 13-108. The transitions C1 and C2 apply to both sides of the message buffer and are applied at the same time. All other FlexRay block transitions apply to the transmit side only. Table 13-108. Double Transmit Message Buffer Module Transitions Transition common transitions IS IE see Section 13.6.6.4.5, “Internal Message Transfer Internal Message Transfer Start - Start transfer of message data from commit side to transmit side. Internal Message Transfer End - Stop transfer of message data from commit side to transmit side. Note: The internal message transfer is stopped before the slot or segment start. Slot Assigned - Message buffer is assigned to next static slot. Message Available - Message buffer is assigned to next slot and cycle counter ﬁlter matches. Condition Description transmit side speciﬁc transitions SA MA TX SU STS slot match and static slot slot match and CycleCounter match slot start and Transmission Slot Start - Slot Start and commit bit CMT is set. MBCCSR[2n+1].CMT = 1 In case of a dynamic slot, pLatestTx is not exceeded. status updated static slot start dynamic slot start or symbol window start or NIT start slot start or symbol window start or NIT start Status Updated - Slot Status ﬁeld and message buffer status ﬂags updated. Interrupt ﬂag set. Static Slot Start - Start of static slot. Dynamic Slot or Segment Start. - Start of dynamic slot or symbol window or NIT. Slot or Segment Start - Start of static slot or dynamic slot or symbol window or NIT. DSS SSS Transition Priorities The application can trigger only one transition at a time. There is no need to specify priorities among them. As shown in the ﬁrst part of Table 13-109, the module transitions have a higher priority than the application transitions. The priorities among the FlexRay block transitions and the related states are given in the second part of Table 13-109. These priorities apply only to the transmit side. The internal message transmit start transition IS has tho lowest priority. MC9S12XF - Family Reference Manual, Rev.1.19 578 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) Table 13-109. Double Transmit Message Buffer Transition Priorities State Idle Priority IS > HD IS > HL MA > SA TX > STS TX > DSS Description module vs. application Internal Message Transfer Start > Message Buffer Disable Internal Message Transfer Start > Message Buffer Lock module internal Idle CCMa Message Available > Slot Assigned Transmission Slot Start > Static Slot Start Transmission Slot Start > Dynamic Slot Start 13.6.6.4.4 Message Preparation The application provides the message data through the commit side. The transmission itself is executed from the transmit side. The transfer of the message data from the commit side to the transmit side is done by the Internal Message Transfer, which is described in Section 13.6.6.4.5, “Internal Message Transfer To transmit a message over the FlexRay bus, the application writes the message data into the message buffer data ﬁeld of the commit side and sets the commit bit CMT in the Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn). The physical access to the message buffer data ﬁeld is described in Section 13.6.3.1, “Individual Message Buffers”. As indicated by Table 13-105, the application shall write to the message buffer data ﬁeld and change the commit bit CMT only if the transmit message buffer is in one of the states HDis, HDisLck, or HLck. The application can change the state of a message buffer if it issues the appropriate commands shown in Table 13-107. The state change is indicated through the MBCCSRn.EDS and MBCCSRn.LCKS status bits. 13.6.6.4.5 Internal Message Transfer The internal message transfer transfers the message data from the commit side to the transmit side. The internal message transfer is implemented as the swapping of the content of the Message Buffer Index Registers (MBIDXRn) of the commit side and the transmit side. After the swapping, the commit side CMT bit is cleared, the commit side interrupt ﬂag MBIF is set, the transmit side CMT bit is set, and the transmit side DVAL bit is cleared. The conditions and the point in time when the internal message transfer is started are controlled by the message buffer commit mode bit MCM in the Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn). The MCM bit conﬁgures the message buffer for either the streaming commit mode or the immediate commit mode. A detailed description is given in Streaming Commit Mode and Immediate Commit Mode. The Internal Message Transfer is triggered with the transition IS. Both sides of the message buffer enter one of the CCITx states. The internal message transfer is ﬁnished with the transition IE. Streaming Commit Mode The intention of the streaming commit mode is to ensure that each committed message is transmitted at least once. The FlexRay block will not start the Internal Message Transfer for a message buffer as long as the message data on the transmit side is not transmitted at least once. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 579 Chapter 13 FlexRay Communication Controller (FLEXRAY) The streaming commit mode is conﬁgured by clearing the message buffer commit mode bit MCM in the Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn). In this mode, the internal message transfer from the commit side to the transmit side is started for a double transmit message buffer when all of the following conditions are fulﬁlled 1. the commit side is in the Idle state 2. the commit site message data are valid, i.e. MBCCSR[2n].CMT = 1 3. the transmit side is in one of the states Idle, CCSa, or CCMa 4. the transmit side contains either no valid message data, i.e. MBCCSR[2n+1].CMT = 0 or the message data were transmitted at least once, i.e. MBCCSR[2n+1].DVAL = 1 An example of a streaming commit mode state change diagram is given in Figure 13-128. In this example, both the commit and the transmit side do not contain valid message data and the application provides two messages. The message buffer does not match the next slot. HL Commit Side HU HLck Idle Idle IS CCITx CCITx IE Idle HL HLck HU Idle no internal message transfer, until message transmitted Idle Transmit Side Idle slot start slot start slot s+1 slot start search[s+1] slot s slot s+2 Figure 13-128. Internal Message Transfer in Streaming Commit Mode Immediate Commit Mode The intention of the immediate commit mode is to transmit the latest data provided by the application. This implies that it is not guaranteed that each provided message will be transmitted at least once. The immediate commit mode is conﬁgured by setting the message buffer commit mode bit MCM in the Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn). In this mode, the internal message transfer from the commit side to the transmit side is started for one double transmit message buffer when all of the following conditions are fulﬁlled 1. the commit side is in the Idle state 2. the commit site message data are valid, i.e. MBCCSR[2n].CMT = 1 3. the transmit side is in one of the states Idle, CCSa, or CCMa It is not checked whether the transmit side contains no valid message data or valid message data were transmitted at least once. If message data are valid and not transmitted, they may be overwritten. An example of a streaming commit mode state change diagram is given in Figure 13-129. In this example, both the commit and the transmit side do not contain valid message data, and the application provides two messages and the ﬁrst message is gets overwritten. The message buffer does not match the next slot. MC9S12XF - Family Reference Manual, Rev.1.19 580 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) HL Commit Side HU HLck Idle Idle IS CCITx CCITx IE Idle HL HLck Idle slot start HU Idle IS CCITx CCITx IE Idle Idle slot start Idle Transmit Side internal message transfer overwrites non-transmitted message slot start search[s+1] slot s slot s+1 slot s+2 Figure 13-129. Internal Message Transfer in Immediate Commit Mode 13.6.6.4.6 Message Transmission For double transmit message buffers, the message buffer search checks only the transmit side part. The internal scheduling ensures, that the internal message transfer is stopped on the message buffer search start. Thus, the transmit side of message buffer, that is not in its transmission or status update slot, is always in the Idle state. The message transmit behavior and transmission state changes of the transmit side of a double transmit message buffer are the same as for single buffered transmit buffers, except that the transmit side of double buffers can not be locked by the application, i.e. the HU and HL transition do not exist. Therefore, refer to Section 13.6.6.2.5, “Message Transmission” 13.6.6.4.7 Message Buffer Status Update The message buffer status update behavior of the transmit side of a double transmit message buffer is the same as for single transmit message buffers which is described in Section 13.6.6.2.7, “Message Buffer Status Update”. Additionally, the slot status ﬁeld of the commit side is update after the update of the slot status ﬁeld of the transmit side, even if the commit side is locked by the application. This is implemented to provide the slot status of the most recent transmission slot. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 581 Chapter 13 FlexRay Communication Controller (FLEXRAY) 13.6.7 Individual Message Buffer Search This section provides a detailed description of the message buffer search algorithm. The message buffer search determines for each enabled channel if a slot s in a communication cycle c is assigned for frame or null frame transmission or if it is subscribed for frame reception on that channel. The message buffer search is a sequential algorithm which is invoked at the following protocol related events: 1. NIT start 2. slot start in the static segment 3. minislot start in the dynamic segment The message buffer search within the NIT searches for message buffers assigned or subscribed to slot 1. The message buffer search within slot n searches for message buffers assigned or subscribed to slot n+1. In general, the message buffer search for the next slot n considers only message buffers which are 1. enabled, i.e. MBCCSRn.EDS = 1, and 2. matches the next slot n, i.e. MBFIDRn.FID = n, and 3. are the transmit side buffer in case of a double transmit message buffer. On top of that, for the static segment only those message buffers are considered, that match the condition of at least one row of Table 13-110. For the dynamic segment only those message buffers are considered, that match the condition of at least one row of Table 13-111. These message buffers are called matching message buffers. For each enabled channel the message buffer search may identify multiple matching message buffers. Among all matching message buffers the message buffers with highest priority according to Table 13-110 for the static segment and according to Table 13-111 for the dynamic segment are selected. Table 13-110. Message Buffer Search Priority (static segment) Priority (highest) 0 1 2 3 MTD 1 1 1 1 0 LCKS 0 1 0 CMT 1 0 n/a CCFM (1) Description transmit buffer, matches cycle count, not locked and committed transmit buffer, matches cycle count, not committed transmit buffer, matches cycle count, locked transmit buffer receive buffer, matches cycle count, not locked Transition MA SA SA SA SB SB 1 1 1 1 (lowest) 4 0 1 n/a 1 receive buffer, matches cycle count, locked 1. Cycle Counter Filter Match, see Section 13.6.7.1, “Message Buffer Cycle Counter Filtering” MC9S12XF - Family Reference Manual, Rev.1.19 582 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) Table 13-111. Message Buffer Search Priority (dynamic segment) Priority (highest) 0 1 MTD 1 0 LCKS 0 0 CMT 1 n/a CCFM (1) Description transmit buffer, matches cycle count, not locked and committed receive buffer, matches cycle count, not locked Transition MA SB SB 1 1 (lowest) 2 0 1 n/a 1 receive buffer, matches cycle count, locked 1. Cycle Counter Filter Match, see Section 13.6.7.1, “Message Buffer Cycle Counter Filtering” If there are multiple message buffer with highest priority, the message buffer with the lowest message buffer number is selected. All message buffer which have the highest priority must have a consistent channel assignment as speciﬁed in Section 13.6.7.2, “Message Buffer Channel Assignment Consistency”. Depending on the message buffer channel assignment the same message buffer can be found for both channel A and channel B. In this case, this message buffer is used as described in Section 13.6.3.1, “Individual Message Buffers”. 13.6.7.1 Message Buffer Cycle Counter Filtering The message buffer cycle counter ﬁlter is a value-mask ﬁlter deﬁned by the CCFE, CCFMSK, and CCFVAL ﬁelds in the Message Buffer Cycle Counter Filter Registers (MBCCFRn). This ﬁlter determines a set of communication cycles in which the message buffer is considered for message reception or message transmission. If the cycle counter ﬁlter is disabled, i.e. CCFE = 0, this set of cycles consists of all communication cycles. If the cycle counter ﬁlter of a message buffer does not match a certain communication cycle number, this message buffer is not considered for message transmission or reception in that communication cycle. In case of a transmit message buffer assigned to a slot in the static segment, though, this buffer is added to the matching message buffers to indicate the slot assignment and to trigger the null frame transmission. The cycle counter ﬁlter of a message buffer matches the communication cycle with the number CYCCNT if at least one of the following conditions evaluates to true: MBCCFRn [ CCFE ] = 0 CYCCNT ∧ MBCCFRn [ CCFMSK ] = MBCCFRn [ CCFVAL ] ∧ MBCCFRn [ CCFMSK ] Eqn. 13-9 Eqn. 13-10 13.6.7.2 Message Buffer Channel Assignment Consistency The message buffer channel assignment given by the CHA and CHB bits in the Message Buffer Cycle Counter Filter Registers (MBCCFRn) deﬁnes the channels on which the message buffer will receive or transmit. The message buffer with number n transmits or receives on channel A if MBCCFRn[CHA] = 1 and transmits or receives on channel B if MBCCFRn[CHB] = 1. To ensure correct message buffer operation, all message buffers assigned to the same slot and with the same priority must have a consistent channel assignment. That means they must be either assigned to one channel only, or must be assigned to both channels. The behavior of the message buffer search is not MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 583 Chapter 13 FlexRay Communication Controller (FLEXRAY) deﬁned, if both types of channel assignments occur for one slot and priority. An inconsistent channel assignment for message buffer 0 and message buffer 1 is depicted in Figure 13-130. MB0 MBFIDR0[FID] = 10 MBCCFR0[CHA] = 1, MBCCFR0[CHB] = 0 MBFIDR1[FID] = 10 MBCCFR1[CHA] = 1, MBCCFR1[CHB] = 1 single channel assignment dual channel assignment MB1 Figure 13-130. Inconsistent Channel Assignment 13.6.7.3 Node Related Slot Multiplexing The term Node Related Slot Multiplexing applies to the dynamic segment only and refers to the functionality if there are transmit as well as receive message buffers are conﬁgured for the same slot. According to Table 13-111 the transmit buffer is only found if the cycle counter ﬁlter matches, and the buffer is not locked and committed. In all other cases, the receive buffer will be found. Thus, if the block has no data to transmit in a dynamic slot, it is able to receive frames on that slot. 13.6.7.4 Message Buffer Search Error If the message buffer search is running while the next message buffer search start event appears, the message buffer search is stopped and the Message Buffer Search Error Flag MSB_EF is set in the CHI Error Flag Register (CHIERFR). This appears only if the CHI frequency is too low to search through all message buffers within the NIT or a minislot. The message buffer result is not deﬁned in this case. For more details see Section 13.7.3, “Number of Usable Message Buffers”. MC9S12XF - Family Reference Manual, Rev.1.19 584 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) 13.6.8 Individual Message Buffer Reconﬁguration The initial conﬁguration of each individual message buffer can be changed even when the protocol is not in the POC:conﬁg state. This is referred to as individual message buffer reconﬁguration. The conﬁguration bits and ﬁelds that can be changed are given in the section on Speciﬁc Conﬁguration Data. The common conﬁguration data given in the section on Speciﬁc Conﬁguration Data can not be reconﬁgured when the protocol is out of the POC:conﬁg state. 13.6.8.1 Reconﬁguration Schemes Depending on the target and destination basic state of the message buffer that is to be reconﬁgured, there are three reconﬁguration schemes. 13.6.8.1.1 Basic Type Not Changed (RC1) A reconﬁguration will not change the basic type of the individual message buffer, if both the message buffer transfer direction bit MBCCSn.MTD and the message buffer type bit MBCCSn.MBT are not changed. This type of reconﬁguration is denoted by RC1 in Figure 13-131. Single transmit and receive message buffers can be RC1-reconﬁgured when in the HDis or HDisLck state. Double transmit message buffers can be RC1-reconﬁgured if both the transmit side and the commit side are in the HDis state. 13.6.8.1.2 Buffer Type Not Changed (RC2) A reconﬁguration will not change the buffer type of the individual message buffer if the message buffer buffer type bit MBCCSRn.MBT is not changed. This type of reconﬁguration is denoted by RC2 in Figure 13-131. It applies only to single transmit and receive message buffers. Single transmit and receive message buffers can be RC2-reconﬁgured when in the HDis or HDisLck state. 13.6.8.1.3 Buffer Type Changed (RC3) A reconﬁguration will change the buffer type of the individual message buffer if the message buffer type bit MBCCSRn.MBT is changed. This type of reconﬁguration is denoted by RC3 in Figure 13-131. The RC3 reconﬁguration splits one double buffer into two single buffers or combines two single buffer into one double buffer. In the later case, the two single message buffers must have consecutive message buffer numbers and the smaller one must be even. Message Buffers can be RC3 reconﬁgured if they are in the HDis state. RC2 RC1 RC1 single RX single TX RC3 double TX (commit side) double TX (transmit side) RC3 RC1 Figure 13-131. Message Buffer Reconﬁguration Scheme MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 585 Chapter 13 FlexRay Communication Controller (FLEXRAY) 13.6.9 Receive FIFO This section provides a detailed description of the two receive FIFOs. 13.6.9.1 Overview The receive FIFOs implement the queued receive buffer deﬁned by the FlexRay Communications System Protocol Speciﬁcation, Version 2.1 Rev A. One receive FIFO is assigned to channel A, the other receive FIFO is assigned to channel B. Both FIFOs work completely independent from each other. The message buffer structure of each FIFO is described in Section 13.6.3.3, “Receive FIFO”. The area in the FRM for each of the two receive FIFOs is characterized by: • The index of the ﬁrst FIFO entry given by Receive FIFO Start Index Register (RFSIR) • The number of FIFO entries and the length of each FIFO entry as given by Receive FIFO Depth and Size Register (RFDSR) 13.6.9.2 Receive FIFO Conﬁguration The receive FIFO control and conﬁguration data are given in Section 13.6.3.7, “Receive FIFO Control and Conﬁguration Data”. The conﬁguration of the receive FIFOs consists of two steps. The ﬁrst step is the allocation of the required amount of FRM for the FlexRay window. This includes the allocation of the message buffer header area and the allocation of the message buffer data ﬁelds. For more details see Section 13.6.4, “FlexRay Memory Layout”. The second step is the programming of the conﬁguration data register while the PE is in POC:conﬁg. The following steps conﬁgure the layout of the FIFO. • The number of the ﬁrst message buffer header index that belongs to the FIFO is written into the Receive FIFO Start Index Register (RFSIR). • The depth of the FIFO is written into the FIFO_DEPTH ﬁeld in the Receive FIFO Depth and Size Register (RFDSR). • The length of the message buffer data ﬁeld for the FIFO is written into the ENTRY_SIZE ﬁeld in the Receive FIFO Depth and Size Register (RFDSR). NOTE To ensure, that the read index RDIDX always points to a message buffer that contains valid data, the receive FIFO must have at least 2 entries. The FIFO ﬁlters are conﬁgured through the ﬁfo ﬁlter registers. 13.6.9.3 Receive FIFO Reception The frame reception to the receive FIFO is enabled, if for a certain slots no message buffer is assigned or subscribed. In this case the FIFO ﬁlter path shown in Figure 13-132 is activated. When the receive FIFO ﬁlter path indicates that the received frame must be appended to the FIFO, the FlexRay block writes the received frame header and slot status into the message buffer header ﬁeld MC9S12XF - Family Reference Manual, Rev.1.19 586 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) indicated by the internal FIFO header write index. The payload data are written in the message buffer data ﬁeld. If the status of the received frame indicates a valid frame, the internal FIFO header write index is updated and the ﬁfo not-empty interrupt ﬂag FNEAIF/FNEBIF in the Global Interrupt Flag and Enable Register (GIFER) is set. 13.6.9.4 Receive FIFO Message Access If the ﬁfo not-empty interrupt ﬂag FNEAIF/FNEBIF in the Global Interrupt Flag and Enable Register (GIFER) is set, the receive FIFO contains valid received messages, which can be accessed by the application. The receive FIFO does not require locking to access the message buffers. To access the message the application ﬁrst reads the receive FIFO read index RDIDX from the Receive FIFO A Read Index Register (RFARIR) or Receive FIFO B Read Index Register (RFBRIR), respectively. This index points to the message buffer header ﬁeld of the next message buffer that contains valid data. The application can access the message data as described in Section 13.6.3.3, “Receive FIFO”. When the application has read all message buffer data and status information, it writes 1 to the ﬁfo not-empty interrupt ﬂags FNEAIF or FNEBIF. This clears the interrupt ﬂag and updates the RDIDX ﬁeld in the Receive FIFO A Read Index Register (RFARIR) or Receive FIFO B Read Index Register (RFBRIR), respectively.When the RDIDX value has reached the last message buffer header ﬁeld that belongs to the ﬁfo, it wraps around to the index of the ﬁrst message buffer header ﬁeld that belongs to the ﬁfo. This value is provided by the SIDX ﬁeld in the Receive FIFO Start Index Register (RFSIR). 13.6.9.5 Receive FIFO ﬁltering The receive FIFO ﬁltering is activated after all enabled individual receive message buffers have been searched without success for a message buffer to receive the current frame. The FlexRay block provides three sets of FIFO ﬁlters. The FIFO ﬁlters are applied to valid non-null frames only. The FIFO will not receive invalid or null-frames. For each FIFO ﬁlter, the pass criteria is speciﬁed in the related section given below. Only frames that have passed all ﬁlters will be appended to the FIFO. The FIFO ﬁlter path is depicted in Figure 13-132. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 587 Chapter 13 FlexRay Communication Controller (FLEXRAY) valid frame received (vRF) store into message buffer (vRF) yes individual message buffer found no null frame (vRF!Header!NFIndicator=0) no Frame ID Value-Mask rejection ﬁlter passed Frame ID Range rejection ﬁlter passed Frame ID Range acceptance ﬁlter passed yes else else else no frame received in dynamic segment yes no message ID (vRF!Header!PPIndicator=1) yes Message ID acceptance ﬁlter passed else append to FIFO (vRF) no FIFO full yes set ﬁfo overﬂow interrupt ﬂag ignore frame Figure 13-132. Received Frame FIFO Filter Path A received frame passes the FIFO ﬁltering if it has passed all three type of ﬁlter. 13.6.9.5.1 RX FIFO Frame ID Value-Mask Rejection Filter The frame ID value-mask rejection ﬁlter is a value-mask ﬁlter and is deﬁned by the ﬁelds in the Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR) and the Receive FIFO Frame ID Rejection Filter Mask Register (RFFIDRFMR). Each received frame with a frame ID FID that does not match the value-mask ﬁlter value passes the ﬁlter, i.e. is not rejected. Consequently, a received valid frame with the frame ID FID passes the RX FIFO Frame ID Value-Mask Rejection Filter if Equation 13-11 is fulﬁlled. FID ∧ RFFIDRFMR [ FIDRFMSK ] ≠ RFFIDRFVR [ FIDRFVAL ] ∧ RFFIDRFMR [ FIDRFMSK ] Eqn. 13-11 MC9S12XF - Family Reference Manual, Rev.1.19 588 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) The RX FIFO Frame ID Value-Mask Rejection Filter can be conﬁgured to pass all frames by the following settings. • RFFIDRFVR.FIDRFVAL:= 0x000 and RFFIDRFMR.FIDRFMSK:= 0x7FF Using the settings above, only the frame with frame ID 0 will be rejected, which is an invalid frame. All other frames will pass. The RX FIFO Frame ID Value-Mask Rejection Filter can be conﬁgured to reject all frames by the following settings. • RFFIDRFMR.FIDRFMSK:= 0x000 Using the settings above, Equation 13-11 can never be fulﬁlled (0!= 0) and thus all frames are rejected; no frame will pass. This is the reset value for the RX FIFO. 13.6.9.5.2 RX FIFO Frame ID Range Rejection Filter Each of the four RX FIFO Frame ID Range ﬁlters can be conﬁgured as a rejection ﬁlter. The ﬁlters are conﬁgured by the Receive FIFO Range Filter Conﬁguration Register (RFRFCFR) and controlled by the Receive FIFO Range Filter Control Register (RFRFCTR). The RX FIFO Frame ID range ﬁlters apply to all received valid frames. A received frame with the frame ID FID passes the RX FIFO Frame ID Range rejection ﬁlters if either no rejection ﬁlter is enabled, or, for all of the enabled RX FIFO Frame ID Range rejection ﬁlters, i.e. RFRFCTR.FiMD = 1 and RFRFCTR.FiEN = 1, Equation 13-12 is fulﬁlled. ( FID < RFRFCFR SEL [ SID IBD = 0 ] ) or ( RFRFCFR SEL [ SID IBD = 1 ] < FID ) Eqn. 13-12 Consequently, all frames with a frame ID that fulﬁlls Equation 13-13 for at least one of the enabled rejection ﬁlters will be rejected and thus not pass. RFRFCFR SEL [ SID IBD = 0 ] ≤ FID ≤ RFRFCFR SEL [ SID IBD = 1 ] Eqn. 13-13 13.6.9.5.3 RX FIFO Frame ID Range Acceptance ﬁlter Each of the four RX FIFO Frame ID Range ﬁlters can be conﬁgured as an acceptance ﬁlter. The ﬁlters are conﬁgured by the Receive FIFO Range Filter Conﬁguration Register (RFRFCFR) and controlled by the Receive FIFO Range Filter Control Register (RFRFCTR). The RX FIFO Frame ID range ﬁlters apply to all received valid frames. A received frame with the frame ID FID passes the RX FIFO Frame ID Range acceptance ﬁlters if either no acceptance ﬁlter is enabled, or, for at least one of the enabled RX FIFO Frame ID Range acceptance ﬁlters, i.e. RFRFCTR.FiMD = 0 and RFRFCTR.FiEN = 1, Equation 13-14 is fulﬁlled. RFRFCFR SEL [ SID IBD = 0 ] ≤ FID ≤ RFRFCFR SEL [ SID IBD = 1 ] Eqn. 13-14 13.6.9.5.4 RX FIFO Message ID Acceptance Filter The RX FIFO Message ID Acceptance Filter is a value-mask ﬁlter and is deﬁned by the Receive FIFO Message ID Acceptance Filter Value Register (RFMIDAFVR) and the Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR). This ﬁlter applies only to valid frames received in the dynamic segment with the payload preamble indicator bit PPI set to 1. All other frames will pass this ﬁlter. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 589 Chapter 13 FlexRay Communication Controller (FLEXRAY) A received valid frame in the dynamic segment with the payload preamble indicator bit PPI set to 1 and with the message ID MID (the ﬁrst two bytes of the payload) will pass the RX FIFO Message ID Acceptance Filter if Equation 13-15 is fulﬁlled. MID ∧ RFMIDAFMR [ MIDAFMSK ] = RFMIDAFMR [ MIDAFVAL ] ∧ RFMIDAFMR [ MIDAFMSK ] Eqn. 13-15 The RX FIFO Message ID Acceptance Filter can be conﬁgured to accept all frames by setting • RFMIDAFMR.MIDAFMSK:= 0x000 Using the settings above, Equation 13-15 is always fulﬁlled and all frames will pass. 13.6.10 Channel Device Modes This section describes the two FlexRay channel device modes that are supported by the FlexRay block. 13.6.10.1 Dual Channel Device Mode In the dual channel device mode, both FlexRay ports are connected to physical FlexRay bus lines. The FlexRay port consisting of RXD_A, TXD_A, and TXE_A is connected to the physical bus channel A and the FlexRay port consisting of RXD_B, TXD_B, and TXE_A is connected to the physical bus channel B. The dual channel system is shown in Figure 13-133. FLEXRAY CHI PE RXD_A TXD_A TXE_A reg(A) channel 0 cfg(A) FlexRay Bus Driver Channel A FlexRay Channel A cCrcInit[A] reg(B) channel 1 cfg(B) RXD_B TXD_B TXE_B FlexRay Bus Driver Channel B FlexRay Channel B cCrcInit[B] Figure 13-133. Dual Channel Device Mode 13.6.10.2 Single Channel Device Mode The single channel device mode supports devices that have only one FlexRay port available. This FlexRay port consists of the signals RXD_A, TXD_A, and TXE_A and can be connected to either the physical bus channel A (shown in Figure 13-134) or the physical bus channel B (shown in Figure 13-135). MC9S12XF - Family Reference Manual, Rev.1.19 590 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) If the device is conﬁgured as a single channel device by setting MCR.SCD to 1, only the internal channel A and the FlexRay Port A is used. Depending on the setting of MCR.CHA and MCR.CHB, the internal channel A behaves either as a FlexRay Channel A or FlexRay Channel B. The bit MCR.CHA must be set, if the FlexRay Port A is connected to a FlexRay Channel A. The bit MCR.CHB must be set if the FlexRay Port A is connected to a FlexRay Channel B. The two FlexRay channels differ only in the initial value for the frame CRC cCrcInit. For a single channel device, the application can access and conﬁgure only the registers related to internal channel A. FLEXRAY CHI PE RXD_A TXD_A TXE_A reg(A) channel A cfg(A) FlexRay Bus Driver Channel A FlexRay Channel A cCrcInit[A] reg(B) channel B cfg(B) RXD_B TXD_B TXE_B cCrcInit[B] Figure 13-134. Single Channel Device Mode (Channel A) FLEXRAY CHI PE RXD_A TXD_A TXE_A reg(A) channel A cfg(A) FlexRay Bus Driver Channel A FlexRay Channel B cCrcInit[A] Init Value for Frame CRC is cCrcInit[B] RXD_B TXD_B TXE_B reg(B) channel B cfg(B) cCrcInit[B] Figure 13-135. Single Channel Device Mode (Channel B) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 591 Chapter 13 FlexRay Communication Controller (FLEXRAY) 13.6.11 External Clock Synchronization The application of the external rate and offset correction is triggered when the application writes to the EOC_AP and ERC_AP ﬁelds in the Protocol Operation Control Register (POCR). The PE applies the external correction values in the next even-odd cycle pair as shown in Figure 13-136 and Figure 13-137. NOTE The values provided in the EOC_AP and ERC_AP ﬁelds are the values that were written from the application most recently. If these value were already applied, they will not be applied in the current cycle pair again. If the offset correction applied in the NIT of cycle 2n+1 shall be affect by the external offset correction, the EOC_AP ﬁeld must be written to after the start of cycle 2n and before the end of the static segment of cycle 2n+1. If this ﬁeld is written to after the end of the static segment of cycle 2n+1, it is not guaranteed that the external correction value is applied in cycle 2n+1. If the value is not applied in cycle 2n+1, then the value will be applied in the cycle 2n+3. Refer to Figure 13-136 for timing details. EOC_AP write window EOC_AP application static segment NIT static segment NIT cycle 2n cycle 2n+1 Figure 13-136. External Offset Correction Write and Application Timing If the rate correction for the cycle pair [2n+2, 2n+3] shall be affect by the external offset correction, the ERC_AP ﬁeld must be written to after the start of cycle 2n and before the end of the static segment start of cycle 2n+1. If this ﬁeld is written to after the end of the static segment of cycle 2n+1, it is not guaranteed that the external correction value is applied in cycle pair [2n+2, 2n+3]. If the value is not applied for cycle pair [2n+2, 2n+3], then the value will be applied for cycle pair [2n+4, 2n+5]. Refer to Figure 13-137 for details. ERC_AP write window ERC_AP application static segment NIT static segment NIT static segment NIT static segment NIT cycle 2n cycle 2n+1 cycle 2n+2 cycle 2n+3 Figure 13-137. External Rate Correction Write and Application Timing 13.6.12 Sync Frame ID and Sync Frame Deviation Tables The FlexRay protocol requires the provision of a snapshot of the Synchronization Frame ID tables for the even and odd communication cycle for both channels. The FlexRay block provides the means to write a copy of these internal tables into the FRM and ensures application access to consistent tables by means of table locking. Once the application has locked the table successfully, the FlexRay block will not overwrite these tables and the application can read a consistent snapshot. MC9S12XF - Family Reference Manual, Rev.1.19 592 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) NOTE Only synchronization frames that have passed the synchronization frame ﬁlters are considered for clock synchronization and appear in the sync frame tables. 13.6.12.1 Sync Frame ID Table Content The Sync Frame ID Table is a snapshot of the protocol related variables vsSyncIdListA and vsSyncIdListB for each even and odd communication cycle. This table provides a list of the frame IDs of the synchronization frames received on the corresponding channel and cycle that are used for the clock synchronization. 13.6.12.2 Sync Frame Deviation Table Content The Sync Frame Deviation Table is a snapshot of the protocol related variable zsDev(id)(oe)(ch)!Value. Each Sync Frame Deviation Table entry provides the deviation value for the sync frame, with the frame ID presented in the corresponding entry in the Sync Frame ID Table. SFTOR EVEN Offset + $00 Offset + $02 Offset + $04 Offset + $06 Offset + $08 Offset + $0A Offset + $0C Offset + $0E Offset + $10 Offset + $12 Offset + $14 Offset + $16 Offset + $18 Offset + $1A Offset + $1C Offset + $1E Offset + $20 Offset + $22 Offset + $24 Offset + $26 Offset + $28 Offset + $2A Offset + $2C Offset + $2E Offset + $30 Offset + $32 Offset + $34 Offset + $36 Offset + $38 Offset + $3A SFTOR + 60 SFTOR +120 ODD SFTOR + 180 EVEN ODD Sync Deviation ChA 1 Sync Deviation ChA 2 Sync Deviation ChA 3 Sync Deviation ChA 4 Sync Deviation ChA 5 Sync Deviation ChA 6 Sync Deviation ChA 7 Sync Deviation ChA 8 Sync Deviation ChA 9 Sync Deviation ChA 10 Sync Deviation ChA 11 Sync Deviation ChA 12 Sync Deviation ChA 13 Sync Deviation ChA 14 Sync Deviation ChA 15 Sync Deviation ChB 1 Sync Deviation ChB 2 Sync Deviation ChB 3 Sync Deviation ChB 4 Sync Deviation ChB 5 Sync Deviation ChB 6 Sync Deviation ChB 7 Sync Deviation ChB 8 Sync Deviation ChB 9 Sync Deviation ChB 10 Sync Deviation ChB 11 Sync Deviation ChB 12 Sync Deviation ChB 13 Sync Deviation ChB 14 Sync Deviation ChB 15 SFCNTR SFEVA SFEVB SFCNTR SFODA SFODB Sync Frame ID ChA 1 Sync Frame ID ChA 2 Sync Frame ID ChA 3 Sync Frame ID ChA 4 Sync Frame ID ChA 5 Sync Frame ID ChA 6 Sync Frame ID ChA 7 Sync Frame ID ChA 8 Sync Frame ID ChA 9 Sync Frame ID ChA 10 Sync Frame ID ChA 11 Sync Frame ID ChA 12 Sync Frame ID ChA 13 Sync Frame ID ChA 14 Sync Frame ID ChA 15 Sync Frame ID ChB 1 Sync Frame ID ChB 2 Sync Frame ID ChB 3 Sync Frame ID ChB 4 Sync Frame ID ChB 5 Sync Frame ID ChB 6 Sync Frame ID ChB 7 Sync Frame ID ChB 8 Sync Frame ID ChB 9 Sync Frame ID ChB 10 Sync Frame ID ChB 11 Sync Frame ID ChB 12 Sync Frame ID ChB 13 Sync Frame ID ChB 14 Sync Frame ID ChB 15 Sync Frame ID ChA 1 Sync Frame ID ChA 2 Sync Frame ID ChA 3 Sync Frame ID ChA 4 Sync Frame ID ChA 5 Sync Frame ID ChA 6 Sync Frame ID ChA 7 Sync Frame ID ChA 8 Sync Frame ID ChA 9 Sync Frame ID ChA 10 Sync Frame ID ChA 11 Sync Frame ID ChA 12 Sync Frame ID ChA 13 Sync Frame ID ChA 14 Sync Frame ID ChA 15 Sync Frame ID ChB 1 Sync Frame ID ChB 2 Sync Frame ID ChB 3 Sync Frame ID ChB 4 Sync Frame ID ChB 5 Sync Frame ID ChB 6 Sync Frame ID ChB 7 Sync Frame ID ChB 8 Sync Frame ID ChB 9 Sync Frame ID ChB 10 Sync Frame ID ChB 11 Sync Frame ID ChB 12 Sync Frame ID ChB 13 Sync Frame ID ChB 14 Sync Frame ID ChB 15 Sync Deviation ChA 1 Sync Deviation ChA 2 Sync Deviation ChA 3 Sync Deviation ChA 4 Sync Deviation ChA 5 Sync Deviation ChA 6 Sync Deviation ChA 7 Sync Deviation ChA 8 Sync Deviation ChA 9 Sync Deviation ChA 10 Sync Deviation ChA 11 Sync Deviation ChA 12 Sync Deviation ChA 13 Sync Deviation ChA 14 Sync Deviation ChA 15 Sync Deviation ChB 1 Sync Deviation ChB 2 Sync Deviation ChB 3 Sync Deviation ChB 4 Sync Deviation ChB 5 Sync Deviation ChB 6 Sync Deviation ChB 7 Sync Deviation ChB 8 Sync Deviation ChB 9 Sync Deviation ChB 10 Sync Deviation ChB 11 Sync Deviation ChB 12 Sync Deviation ChB 13 Sync Deviation ChB 14 Sync Deviation ChB 15 Figure 13-138. Sync Table Memory Layout MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 593 Chapter 13 FlexRay Communication Controller (FLEXRAY) 13.6.12.3 Sync Frame ID and Sync Frame Deviation Table Setup The FlexRay block writes a copy of the internal synchronization frame ID and deviation tables into the FRM if requested by the application. The application must provide the appropriate amount of FRM for the tables. The memory layout of the tables is given in Figure 13-138. Each table occupies 120 16-bit entries. While the protocol is in POC:conﬁg state, the application must program the offsets for the tables into the Sync Frame Table Offset Register (SFTOR). 13.6.12.4 Sync Frame ID and Sync Frame Deviation Table Generation The application controls the generation process of the Sync Frame ID and Sync Frame Deviation Tables into the FRM using the Sync Frame Table Conﬁguration, Control, Status Register (SFTCCSR). A summary of the copy modes is given in Table 13-112. Table 13-112. Sync Frame Table Generation Modes SFTCCSR Description OPT 0 0 0 0 1 1 0 1 SDVEN 0 0 1 1 0 0 1 1 SIDEN 0 1 0 1 0 1 0 1 No Sync Frame Table copy Sync Frame ID Tables will be copied continuously Reserved Sync Frame ID Tables and Sync Frame Deviation Tables will be copied continuously No Sync Frame Table copy Sync Frame ID Tables for next even-odd-cycle pair will be copied Reserved Sync Frame ID Tables and Sync Frame Deviation Tables for next even-odd-cycle pair will be copied The Sync Frame Table generation process is described in the following for the even cycle. The same sequence applies to the odd cycle. If the application has enabled the sync frame table generation by setting SFTCCSR.SIDEN to 1, the FlexRay block starts the update of the even cycle related tables after the start of the NIT of the next even cycle. The FlexRay block checks if the application has locked the tables by reading the SFTCCSR.ELKS lock status bit. If this bit is set, the FlexRay block will not update the table in this cycle. If this bit is cleared, the FlexRay block locks this table and starts the table update. To indicate that these tables are currently updated and may contain inconsistent data, the FlexRay block clears the even table valid status bit SFTCCSR.EVAL. Once all table entries related to the even cycle have been transferred into the FRM, the FlexRay block sets the even table valid bit SFTCCSR.EVAL and the Even Cycle Table Written Interrupt Flag EVT_IF in the Protocol Interrupt Flag Register 1 (PIFR1). If the interrupt enable ﬂag EVT_IE is set, an interrupt request is generated. To read the generated tables, the application must lock the tables to prevent the FlexRay block from updating these tables. The locking is initiated by writing a 1 to the even table lock trigger SFTCCSR.ELKT. When the even table is not currently updated by the FlexRay block, the lock is granted and the even table lock status bit SFTCCSR.ELKS is set. This indicates that the application has successfully locked the even sync tables and the corresponding status information ﬁelds SFRA, SFRB in MC9S12XF - Family Reference Manual, Rev.1.19 594 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) the Sync Frame Counter Register (SFCNTR). The value in the SFTCCSR.CYCNUM ﬁeld provides the number of the cycle that this table is related to. The number of available table entries per channel is provided in the SFCNTR.SFEVA and SFCNTR.SFEVB ﬁelds. The application can now start to read the sync table data from the locations given in Figure 13-138. After reading all the data from the locked tables, the application must unlock the table by writing to the even table lock trigger SFTCCSR.ELKT again. The even table lock status bit SFTCCSR.ELKS is reset immediately. If the sync frame table generation is disabled, the table valid bits SFTCCSR.EVAL and SFTCCSR.EVAL are reset when the counter values in the Sync Frame Counter Register (SFCNTR) are updated. This is done because the tables stored in the FRM are no longer related to the values in the Sync Frame Counter Register (SFCNTR). even table write SFTCCSR.[OPT,SIDEN,SDVEN] write window odd table write static segment NIT static segment NIT static segment NIT cycle 2n-1 cycle 2n cycle 2n+1 Figure 13-139. Sync Frame Table Trigger and Generation Timing 13.6.12.5 Sync Frame Table Access The sync frame tables will be transferred into the FRM during the table write windows shown in Figure 13139. During the table write, the application can not lock the table that is currently written. If the application locks the table outside of the table write window, the lock is granted immediately. 13.6.12.5.1 Sync Frame Table Locking and Unlocking The application locks the even/odd sync frame table by writing 1 to the lock trigger bit ELKT/OLKT in the Sync Frame Table Conﬁguration, Control, Status Register (SFTCCSR). If the affected table is not currently written to the FRM, the lock is granted immediately, and the lock status bit ELKS/OLKS is set. If the affected table is currently written to the FRM, the lock is not granted. In this case, the application must issue the lock request again until the lock is granted. The application unlocks the even/odd sync frame table by writing 1 to the lock trigger bit ELKT/OLKT. The lock status bit ELKS/OLKS is cleared immediately. 13.6.13 MTS Generation The FlexRay block provides a ﬂexible means to request the transmission of the Media Access Test Symbol MTS in the symbol window on channel A or channel B. The application can conﬁgure the set of communication cycles in which the MTS will be transmitted over the FlexRay bus by programming the CYCCNTMSK and CYCCNTVAL ﬁelds in the MTS A Conﬁguration Register (MTSACFR) and MTS B Conﬁguration Register (MTSBCFR). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 595 Chapter 13 FlexRay Communication Controller (FLEXRAY) The application enables or disables the generation of the MTS on either channel by setting or clearing the MTE control bit in the MTS A Conﬁguration Register (MTSACFR) or MTS B Conﬁguration Register (MTSBCFR). If an MTS is to be transmitted in a certain communication cycle, the application must set the MTE control bit during the static segment of the preceding communication cycle. The MTS is transmitted over channel A in the communication cycle with number CYCCNT, if Equation 13-17, Equation 13-18, and Equation 13-18 are fulﬁlled. PSR0 [ PROTSTATE ] = POC:normal active MTSACRF [ MTE ] = 1 Eqn. 13-16 Eqn. 13-17 CYCCNT ∧ MTSACFR [ CYCCNTMSK ] = MTSACFR [ CYCCNTVAL ] ∧ MTSACFR [ CYCCNTMSK ] Eqn. 13-18 The MTS is transmitted over channel B in the communication cycle with number CYCCNT, if Equation 13-16, Equation 13-19, and Equation 13-20 are fulﬁlled. MTSBCRF [ MTE ] = 1 Eqn. 13-19 CYCCNT ∧ MTSBCFR [ CYCCNTMSK ] = MTSBCFR [ CYCCNTVAL ] ∧ MTSBCFR [ CYCCNTMSK ] Eqn. 13-20 13.6.14 Sync Frame and Startup Frame Transmission The transmission of sync frames and startup frames is controlled by the following register ﬁelds: • PCR18.key_slot_id: provides the number of the slot for sync or startup frame transmission • PCR11.key_slot_used_for_sync: indicates sync frame transmission • PCR11.key_slot_used_for_startup: indicates startup frame transmission • PCR12.key_slot_header_crc: provides header crc for sync frame or startup frame • Message Buffer with message buffer number n=PCR18.key_slot_id The generation of the sync or startup frames depends on the current protocol state. In the POC:startup state, the generation is independent of the message buffer setup; in the POC:normal active state, the generation is affected by the current message buffer setup. 13.6.14.1 Sync Frame and Startup Frame Transmission in POC:startup In the POC:startup state, the sync and startup frame transmission is independent of the message buffer setup. If at least one of the indication bits PCR11.key_slot_used_for_sync or PCR11.key_slot_used_for_startup is set, a Null Frame will be transmitted in the slot with slot number PCR18.key_slot_id. The header CRC for this Null Frame is taken from PCR12.key_slot_header_crc. The settings of the sync and startup frame indicators are taken from PCR11.key_slot_used_for_sync and PCR11.key_slot_used_for_startup. 13.6.14.2 Sync Frame and Startup Frame Transmission in POC:normal active In the POC:normal active state, the sync and startup frame transmission depends on the message buffer setup. If at least one of the indication bits PCR11.key_slot_used_for_sync or MC9S12XF - Family Reference Manual, Rev.1.19 596 Freescale Semiconductor Chapter 13 FlexRay Communication Controller (FLEXRAY) PCR11.key_slot_used_for_startup is set, or if a transmit message buffer with MBFIDRn.FID == PCR18.key_slot_id is conﬁgured and enabled, a Null Frame or Data Frame will be transmitted in the slot with slot number PCR18.key_slot_id. The header CRC for this frame is taken from PCR12.key_slot_header_crc, the settings of the sync and startup frame indicators are taken from PCR11.key_slot_used_for_sync and PCR11.key_slot_used_for_startup. A data frame will be transmitted if the message buffer is unlocked and committed and the cycle counter ﬁlter matches the current cycle. 13.6.15 Sync Frame Filtering Each received synchronization frame must pass the Sync Frame Acceptance Filter and the Sync Frame Rejection Filter before it is considered for clock synchronization. If the synchronization frame ﬁltering is globally disabled, i.e. the SFFE control bit in the Module Conﬁguration Register (MCR) is cleared, all received synchronization frames are considered for clock synchronization. If a received synchronization frame did not pass at least one of the two ﬁlters, this frame is processed as a normal frame and is not considered for clock synchronization. 13.6.15.1 Sync Frame Acceptance Filtering The synchronization frame acceptance ﬁlter is implemented as a value-mask ﬁlter. The value is conﬁgured in the Sync Frame ID Acceptance Filter Value Register (SFIDAFVR) and the mask is conﬁgured in the Sync Frame ID Acceptance Filter Mask Register (SFIDAFMR). A received synchronization frame with the frame ID FID passes the sync frame acceptance ﬁlter, if Equation 13-21 or Equation 13-22evaluates to true. MCR [ SFFE ] = 0 FID [ 9:0 ] ∧ SFIDAFMR [ FMSK [ 9:0 ] ] = SFIDAFVR [ FVAL [ 9:0 ] ] ∧ SFIDAFMR [ FMSK [ 9:0 ] ] Eqn. 13-21 Eqn. 13-22 NOTE Sync frames are transmitted in the static segment only. Thus FID R5 14.8.1.9 Triadic Addressing (TRI) In this mode the result of an operation between two or three registers is stored into a third one. RD = RS1 ∗ RS2 is the general format used in the order RD, RS1, RS1. RD, RS1, RS2 can be any of the 8 general purpose registers R0 … R7. If R0 is used as the destination register RD, only the condition code ﬂags are updated. This addressing mode is used for all arithmetic and logical operations. Examples: ADC SUB R5,R6,R7 R5,R6,R7 ; R5 = R6 + R7 + Carry ; R5 = R6 - R7 14.8.1.10 Relative Addressing 9-Bit Wide (REL9) A 9-bit signed word address offset is included in the instruction word. This addressing mode is used for conditional branch instructions. Examples: BCC BEQ REL9 REL9 ; PC = PC + 2 + (REL9 R2;arithmetic shift register R4 right by the amount ; of bits contained in R2[3:0]. MC9S12XF - Family Reference Manual, Rev.1.19 648 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) 14.8.2.5 Bit Field Operations This addressing mode is used to identify the position and size of a bit ﬁeld for insertion or extraction. The width and offset are coded in the lower byte of the source register 2, RS2. The content of the upper byte is ignored. An offset of 0 denotes the right most position and a width of 0 denotes 1 bit. These instructions are very useful to extract, insert, clear, set or toggle portions of a 16 bit word 7 15 43 W4 O4 5 2 W4=3, O4=2 0 RS2 0 RS1 Bit Field Extract Bit Field Insert 15 3 0 RD Figure 14-26. Bit Field Addressing BFEXT R3,R4,R5 ; R5: W4+1 bits with offset O4, will be extracted from R4 into R3 14.8.2.6 Special Instructions for DMA Usage The XGATE offers a number of additional instructions for ﬂag manipulation, program ﬂow control and debugging: 1. SIF: Set a channel interrupt flag 2. SSEM: Test and set a hardware semaphore 3. CSEM: Clear a hardware semaphore 4. BRK: Software breakpoint 5. NOP: No Operation 6. RTS: Terminate the current thread 14.8.3 Cycle Notation Table 14-23 show the XGATE access detail notation. Each code letter equals one XGATE cycle. Each letter implies additional wait cycles if memories or peripherals are not accessible. Memories or peripherals are not accessible if they are blocked by the S12X_CPU. In addition to this Peripherals are only accessible every other XGATE cycle. Uppercase letters denote 16 bit operations. Lowercase letters denote 8 bit operations. The XGATE is able to perform two bus or wait cycles per S12X_CPU cycle. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 649 Chapter 14 XGATE (S12XGATEV3) Table 14-23. Access Detail Notation V — Vector fetch: always an aligned word read, lasts for at least one RISC core cycle P — Program word fetch: always an aligned word read, lasts for at least one RISC core cycle r — 8 bit data read: lasts for at least one RISC core cycle R — 16 bit data read: lasts for at least one RISC core cycle w — 8 bit data write: lasts for at least one RISC core cycle W — 16 bit data write: lasts for at least one RISC core cycle A — Alignment cycle: no read or write, lasts for zero or one RISC core cycles f — Free cycle: no read or write, lasts for one RISC core cycles Special Cases PP/P — Branch: PP if branch taken, P if not 14.8.4 Thread Execution When the RISC core is triggered by an interrupt request (see Figure 14-1) it ﬁrst executes a vector fetch sequence which performs three bus accesses: 1. A V-cycle to fetch the initial content of the program counter. 2. A V-cycle to fetch the initial content of the data segment pointer (R1). 3. A P-cycle to load the initial opcode. Afterwards a sequence of instructions (thread) is executed which is terminated by an "RTS" instruction. If further interrupt requests are pending after a thread has been terminated, a new vector fetch will be performed. Otherwise the RISC core will either resume a previous thread (beginning with a P-cycle to refetch the interrupted opcode) or it will become idle until a new interrupt request is received. A thread can only be interrupted by an interrupt request of higher priority. 14.8.5 Instruction Glossary This section describes the XGATE instruction set in alphabetical order. MC9S12XF - Family Reference Manual, Rev.1.19 650 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) ADC Operation RS1 + RS2 + C ⇒ RD Add with Carry ADC Adds the content of register RS1, the content of register RS2 and the value of the Carry bit using binary addition and stores the result in the destination register RD. The Zero Flag is also carried forward from the previous operation allowing 32 and more bit additions. Example: ADD ADC BCC R6,R2,R2 R7,R3,R3 ; R7:R6 = R5:R4 + R3:R2 ; conditional branch on 32 bit addition CCR Effects N Z V C ∆ N: Z: V: C: ∆ ∆ ∆ Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000 and Z was set before this operation; cleared otherwise. Set if a two´s complement overﬂow resulted from the operation; cleared otherwise. RS1[15] & RS2[15] & RD[15]new | RS1[15] & RS2[15] & RD[15]new Set if there is a carry from bit 15 of the result; cleared otherwise. RS1[15] & RS2[15] | RS1[15] & RD[15]new | RS2[15] & RD[15]new Code and CPU Cycles Source Form ADC RD, RS1, RS2 Address Mode TRI 0 0 0 1 1 Machine Code RD RS1 RS2 1 1 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 651 Chapter 14 XGATE (S12XGATEV3) ADD Operation Add without Carry ADD RS1 + RS2 ⇒ RD RD + IMM16 ⇒ RD (translates to ADDL RD, #IMM16[7:0]; ADDH RD, #IMM16[15:8]) Performs a 16 bit addition and stores the result in the destination register RD. NOTE When using immediate addressing mode (ADD RD, #IMM16), the V-ﬂag and the C-Flag of the ﬁrst instruction (ADDL RD, #IMM16[7:0]) are not considered by the second instruction (ADDH RD, #IMM16[15:8]). ⇒ Don’t rely on the V-Flag if RD + IMM16[7:0] ≥ 215. ⇒ Don’t rely on the C-Flag if RD + IMM16[7:0] ≥ 216. CCR Effects N Z V C ∆ N: Z: V: ∆ ∆ ∆ C: Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overﬂow resulted from the operation; cleared otherwise. RS1[15] & RS2[15] & RD[15]new | RS1[15] & RS2[15] & RD[15]new Refer to ADDH instruction for #IMM16 operations. Set if there is a carry from bit 15 of the result; cleared otherwise. RS1[15] & RS2[15] | RS1[15] & RD[15]new | RS2[15] & RD[15]new Refer to ADDH instruction for #IMM16 operations. Code and CPU Cycles Source Form ADD RD, RS1, RS2 ADD RD, #IMM16 Address Mode TRI IMM8 IMM8 0 1 1 0 1 1 0 1 1 1 0 0 1 0 1 Machine Code RD RD RD RS1 RS2 IMM16[7:0] IMM16[15:8] 1 0 Cycles P P P MC9S12XF - Family Reference Manual, Rev.1.19 652 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) ADDH Operation RD + IMM8:$00 ⇒ RD Add Immediate 8 bit Constant (High Byte) ADDH Adds the content of high byte of register RD and a signed immediate 8 bit constant using binary addition and stores the result in the high byte of the destination register RD. This instruction can be used after an ADDL for a 16 bit immediate addition. Example: ADDL ADDH R2,#LOWBYTE R2,#HIGHBYTE ; R2 = R2 + 16 bit immediate CCR Effects N Z V C ∆ N: Z: V: C: ∆ ∆ ∆ Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overﬂow resulted from the operation; cleared otherwise. RD[15]old & IMM8[7] & RD[15]new | RD[15]old & IMM8[7] & RD[15]new Set if there is a carry from the bit 15 of the result; cleared otherwise. RD[15]old & IMM8[7] | RD[15]old & RD[15]new | IMM8[7] & RD[15]new Code and CPU Cycles Source Form ADDH RD, #IMM8 Address Mode IMM8 1 1 1 0 1 Machine Code RD IMM8 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 653 Chapter 14 XGATE (S12XGATEV3) ADDL Operation RD + $00:IMM8 ⇒ RD Add Immediate 8 bit Constant (Low Byte) ADDL Adds the content of register RD and an unsigned immediate 8 bit constant using binary addition and stores the result in the destination register RD. This instruction must be used ﬁrst for a 16 bit immediate addition in conjunction with the ADDH instruction. CCR Effects N Z V C ∆ N: Z: V: C: ∆ ∆ ∆ Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overﬂow resulted from the 8 bit operation; cleared otherwise. RD[15]old & RD[15]new Set if there is a carry from the bit 15 of the result; cleared otherwise. RD[15]old & RD[15]new Code and CPU Cycles Source Form ADDL RD, #IMM8 Address Mode IMM8 1 1 1 0 0 Machine Code RD IMM8 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 654 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) AND Operation Logical AND AND RS1 & RS2 ⇒ RD RD & IMM16 ⇒ RD (translates to ANDL RD, #IMM16[7:0]; ANDH RD, #IMM16[15:8]) Performs a bit wise logical AND of two 16 bit values and stores the result in the destination register RD. NOTE When using immediate addressing mode (AND RD, #IMM16), the Z-ﬂag of the ﬁrst instruction (ANDL RD, #IMM16[7:0]) is not considered by the second instruction (ANDH RD, #IMM16[15:8]). ⇒ Don’t rely on the Z-Flag. CCR Effects N Z V C ∆ N: Z: V: C: ∆ 0 — Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Refer to ANDH instruction for #IMM16 operations. 0; cleared. Not affected. Code and CPU Cycles Source Form AND RD, RS1, RS2 AND RD, #IMM16 Address Mode TRI IMM8 IMM8 0 1 1 0 0 0 0 0 0 1 0 0 0 0 1 Machine Code RD RD RD RS1 RS2 IMM16[7:0] IMM16[15:8] 0 0 Cycles P P P MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 655 Chapter 14 XGATE (S12XGATEV3) ANDH Operation RD.H & IMM8 ⇒ RD.H Logical AND Immediate 8 bit Constant (High Byte) ANDH Performs a bit wise logical AND between the high byte of register RD and an immediate 8 bit constant and stores the result in the destination register RD.H. The low byte of RD is not affected. CCR Effects N Z V C ∆ N: Z: V: C: ∆ 0 — Set if bit 15 of the result is set; cleared otherwise. Set if the 8 bit result is $00; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form ANDH RD, #IMM8 Address Mode IMM8 1 0 0 0 1 Machine Code RD IMM8 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 656 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) ANDL Operation RD.L & IMM8 ⇒ RD.L Logical AND Immediate 8 bit Constant (Low Byte) ANDL Performs a bit wise logical AND between the low byte of register RD and an immediate 8 bit constant and stores the result in the destination register RD.L. The high byte of RD is not affected. CCR Effects N Z V C ∆ N: Z: V: C: ∆ 0 — Set if bit 7 of the result is set; cleared otherwise. Set if the 8 bit result is $00; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form ANDL RD, #IMM8 Address Mode IMM8 1 0 0 0 0 Machine Code RD IMM8 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 657 Chapter 14 XGATE (S12XGATEV3) ASR Operation b15 Arithmetic Shift Right ASR C n RD n = RS or IMM4 Shifts the bits in register RD n positions to the right. The higher n bits of the register RD become ﬁlled with the sign bit (RD[15]). The carry ﬂag will be updated to the bit contained in RD[n-1] before the shift for n > 0. n can range from 0 to 16. In immediate address mode, n is determined by the operand IMM4. n is considered to be 16 if IMM4 is equal to 0. In dyadic address mode, n is determined by the content of RS. n is considered to be 16 if the content of RS is greater than 15. CCR Effects N Z V C ∆ N: Z: V: C: ∆ ∆ ∆ Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. Set if a two´s complement overﬂow resulted from the operation; cleared otherwise. RD[15]old ^ RD[15]new Set if n > 0 and RD[n-1] = 1; if n = 0 unaffected. Code and CPU Cycles Source Form ASR RD, #IMM4 ASR RD, RS Address Mode IMM4 DYA 0 0 0 0 0 0 0 0 1 1 Machine Code RD RD IMM4 RS 1 1 0 0 0 0 0 1 1 Cycles P P MC9S12XF - Family Reference Manual, Rev.1.19 658 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) BCC Operation Branch if Carry Cleared (Same as BHS) BCC If C = 0, then PC + $0002 + (REL9 15 the upper bits are ignored. Using R0 as a RS1, this command can be used to set bits. 15 7 W4 15 3 4 3 O4 0 RS1 Inverted Bit Field Insert 15 5 2 0 RD 0 RS2 W4=3, O4=2 CCR Effects N Z V C ∆ N: Z: V: C: ∆ 0 — Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form BFINSI RD, RS1, RS2 Address Mode TRI 0 1 1 1 0 Machine Code RD RS1 RS2 1 1 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 665 Chapter 14 XGATE (S12XGATEV3) BFINSX Operation Bit Field Insert and XNOR BFINSX !(RS1[w:0] ^ RD[w+o:o]) ⇒ RD[w+o:o]; w = (RS2[7:4]) o = (RS2[3:0]) Extracts w+1 bits from register RS1 starting at position 0, performs an XNOR with RD[w+o:o] and writes the bits back to RD. The remaining bits in RD are not affected. If (o+w) > 15 the upper bits are ignored. Using R0 as a RS1, this command can be used to toggle bits. 15 7 W4 15 3 4 3 O4 0 RS1 Bit Field Insert XNOR 15 5 2 0 RD 0 RS2 W4=3, O4=2 CCR Effects N Z V C ∆ N: Z: V: C: ∆ 0 — Set if bit 15 of the result is set; cleared otherwise. Set if the result is $0000; cleared otherwise. 0; cleared. Not affected. Code and CPU Cycles Source Form BFINSX RD, RS1, RS2 Address Mode TRI 0 1 1 1 1 Machine Code RD RS1 RS2 1 1 Cycles P MC9S12XF - Family Reference Manual, Rev.1.19 666 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) BGE Operation Branch if RS1 ≥ RS2: SUB BGE Branch if Greater than or Equal to Zero BGE If N ^ V = 0, then PC + $0002 + (REL9 RS2: SUB BGT R0,RS1,RS2 REL9 Branch if Greater than Zero BGT If Z | (N ^ V) = 0, then PC + $0002 + (REL9 RS2: SUB BHI R0,RS1,RS2 REL9 Branch if Higher BHI If C | Z = 0, then PC + $0002 + (REL9 1) ;########################################### ;# INITIALIZE XGATE # ;########################################### MOVW #XGMCTL_CLEAR, XGMCTL ;clear all XGMCTL bits TST BNE LDX LDD STD STD STD STD STD STD STD STD XGCHID ;wait until current thread is finished INIT_XGATE_BUSY_LOOP #XGIF #$FFFF 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ 2,X+ ;clear all channel interrupt flags INIT_SCI INIT_INT INIT_XGATE INIT_XGATE_BUSY_LOOP CLR XGISPSEL ;set vector base register MOVW #XGATE_VECTORS_XG, XGVBR MOVW #$FF00, XGSWT ;clear all software triggers ;########################################### ;# INITIALIZE XGATE VECTOR TABLE # ;########################################### LDAA #128 ;build XGATE vector table LDY #XGATE_VECTORS MOVW #XGATE_DUMMY_ISR_XG, 4,Y+ DBNE A, INIT_XGATE_VECTAB_LOOP MOVW #XGATE_CODE_XG, RAM_START+(2*SCI_VEC) MOVW #XGATE_DATA_XG, RAM_START+(2*SCI_VEC)+2 ;########################################### ;# COPY XGATE CODE # ;########################################### LDX #XGATE_DATA_FLASH MOVW 2,X+, 2,Y+ INIT_XGATE_VECTAB_LOOP COPY_XGATE_CODE COPY_XGATE_CODE_LOOP MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 727 Chapter 14 XGATE (S12XGATEV3) MOVW MOVW MOVW CPX BLS 2,X+, 2,Y+ 2,X+, 2,Y+ 2,X+, 2,Y+ #XGATE_CODE_FLASH_END COPY_XGATE_CODE_LOOP START_XGATE ;########################################### ;# START XGATE # ;########################################### MOVW #XGMCTL_ENABLE, XGMCTL ;enable XGATE BRA * ;########################################### ;# DUMMY INTERRUPT SERVICE ROUTINE # ;########################################### RTI CPU XGATE ;########################################### ;# XGATE DATA # ;########################################### ALIGN 1 EQU * EQU *-XGATE_DATA_FLASH DW SCI_REGS ;pointer to SCI register space EQU *-XGATE_DATA_FLASH DB XGATE_DATA_MSG ;string pointer EQU *-XGATE_DATA_FLASH FCC "Hello World! ;ASCII string DB $0D ;CR ;########################################### ;# XGATE CODE # ;########################################### ALIGN 1 LDW R2,(R1,#XGATE_DATA_SCI) ;SCI -> R2 LDB R3,(R1,#XGATE_DATA_IDX) ;msg -> R3 LDB R4,(R1,R3+) ;curr. char -> R4 STB R3,(R1,#XGATE_DATA_IDX) ;R3 -> idx LDB R0,(R2,#(SCISR1-SCI_REGS)) ;initiate SCI transmit STB R4,(R2,#(SCIDRL-SCI_REGS)) ;initiate SCI transmit CMPL R4,#$0D BEQ XGATE_CODE_DONE RTS LDL R4,#$00 ;disable SCI interrupts STB R4,(R2,#(SCICR2-SCI_REGS)) LDL R3,#XGATE_DATA_MSG;reset R3 STB R3,(R1,#XGATE_DATA_IDX) RTS EQU (XGATE_CODE_FLASH_END-XGATE_CODE_FLASH)+XGATE_CODE_XG DUMMY_ISR XGATE_DATA_FLASH XGATE_DATA_SCI XGATE_DATA_IDX XGATE_DATA_MSG XGATE_CODE_FLASH XGATE_CODE_DONE XGATE_CODE_FLASH_END XGATE_DUMMY_ISR_XG 14.9.3 Stack Support To simplify the implementation of a program stack the XGATE can be conﬁgured to set RISC core register R7 to the beginning of a stack region before executing a thread. Two separate stack regions can be deﬁned: One for threads of priority level 7 to 4 (refer to Section 14.3.1.5, “XGATE Initial Stack Pointer for MC9S12XF - Family Reference Manual, Rev.1.19 728 Freescale Semiconductor Chapter 14 XGATE (S12XGATEV3) Interrupt Priorities 7 to 4 (XGISP74)”) and one for threads of priority level 3 to 1 (refer to Section 14.3.1.6, “XGATE Initial Stack Pointer for Interrupt Priorities 3 to 1 (XGISP31)”). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 729 Chapter 14 XGATE (S12XGATEV3) MC9S12XF - Family Reference Manual, Rev.1.19 730 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) Table 15-1. Revision History Revision Number V02.00 V02.01 Revision Date 07 Mar 2006 14 May 2008 Sections Affected Description of Changes - First version of S12XBDMV2 - Introduced standardized Revision History Table 15.1 Introduction This section describes the functionality of the background debug module (BDM) sub-block of the HCS12X core platform. The background debug module (BDM) sub-block is a single-wire, background debug system implemented in on-chip hardware for minimal CPU intervention. All interfacing with the BDM is done via the BKGD pin. The BDM has enhanced capability for maintaining synchronization between the target and host while allowing more ﬂexibility in clock rates. This includes a sync signal to determine the communication rate and a handshake signal to indicate when an operation is complete. The system is backwards compatible to the BDM of the S12 family with the following exceptions: • TAGGO command no longer supported by BDM • External instruction tagging feature now part of DBG module • BDM register map and register content extended/modiﬁed • Global page access functionality • Enabled but not active out of reset in emulation modes (if modes available) • CLKSW bit set out of reset in emulation modes (if modes available). • Family ID readable from ﬁrmware ROM at global address 0x7FFF0F (value for HCS12X devices is 0xC1) 15.1.1 Features The BDM includes these distinctive features: • Single-wire communication with host development system • Enhanced capability for allowing more ﬂexibility in clock rates • SYNC command to determine communication rate • GO_UNTIL command • Hardware handshake protocol to increase the performance of the serial communication MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 731 Chapter 15 Background Debug Module (S12XBDMV2) • • • • • • • • • • • • Active out of reset in special single chip mode Nine hardware commands using free cycles, if available, for minimal CPU intervention Hardware commands not requiring active BDM 14 ﬁrmware commands execute from the standard BDM ﬁrmware lookup table Software control of BDM operation during wait mode Software selectable clocks Global page access functionality Enabled but not active out of reset in emulation modes (if modes available) CLKSW bit set out of reset in emulation modes (if modes available). When secured, hardware commands are allowed to access the register space in special single chip mode, if the non-volatile memory erase test fail. Family ID readable from ﬁrmware ROM at global address 0x7FFF0F (value for HCS12X devices is 0xC1) BDM hardware commands are operational until system stop mode is entered (all bus masters are in stop mode) 15.1.2 Modes of Operation BDM is available in all operating modes but must be enabled before ﬁrmware commands are executed. Some systems may have a control bit that allows suspending thefunction during background debug mode. 15.1.2.1 Regular Run Modes All of these operations refer to the part in run mode and not being secured. The BDM does not provide controls to conserve power during run mode. • Normal modes General operation of the BDM is available and operates the same in all normal modes. • Special single chip mode In special single chip mode, background operation is enabled and active out of reset. This allows programming a system with blank memory. • Emulation modes (if modes available) In emulation mode, background operation is enabled but not active out of reset. This allows debugging and programming a system in this mode more easily. 15.1.2.2 Secure Mode Operation If the device is in secure mode, the operation of the BDM is reduced to a small subset of its regular run mode operation. Secure operation prevents BDM and CPU accesses to non-volatile memory (Flash and/or EEPROM) other than allowing erasure. For more information please see Section 15.4.1, “Security”. MC9S12XF - Family Reference Manual, Rev.1.19 732 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) 15.1.2.3 Low-Power Modes The BDM can be used until all bus masters (e.g., CPU or XGATE or others depending on which masters are available on the SOC) are in stop mode. When CPU is in a low power mode (wait or stop mode) all BDM ﬁrmware commands as well as the hardware BACKGROUND command can not be used respectively are ignored. In this case the CPU can not enter BDM active mode, and only hardware read and write commands are available. Also the CPU can not enter a low power mode during BDM active mode. If all bus masters are in stop mode, the BDM clocks are stopped as well. When BDM clocks are disabled and one of the bus masters exits from stop mode the BDM clocks will restart and BDM will have a soft reset (clearing the instruction register, any command in progress and disable the ACK function). The BDM is now ready to receive a new command. 15.1.3 Block Diagram A block diagram of the BDM is shown in Figure 15-1. Host System Serial Interface Data Control Register Block Address TRACE BDMACT Instruction Code and Execution Bus Interface and Control Logic Data Control Clocks 16-Bit Shift Register BKGD ENBDM SDV Standard BDM Firmware LOOKUP TABLE Secured BDM Firmware LOOKUP TABLE UNSEC CLKSW BDMSTS Register Figure 15-1. BDM Block Diagram 15.2 External Signal Description A single-wire interface pin called the background debug interface (BKGD) pin is used to communicate with the BDM system. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the background debug mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 733 Chapter 15 Background Debug Module (S12XBDMV2) 15.3 15.3.1 Memory Map and Register Deﬁnition Module Memory Map Table 15-2. BDM Memory Map Global Address 0x7FFF00–0x7FFF0B 0x7FFF0C–0x7FFF0E 0x7FFF0F 0x7FFF10–0x7FFFFF Module BDM registers BDM ﬁrmware ROM Family ID (part of BDM ﬁrmware ROM) BDM ﬁrmware ROM Size (Bytes) 12 3 1 240 Table 15-2 shows the BDM memory map when BDM is active. 15.3.2 Register Descriptions A summary of the registers associated with the BDM is shown in Figure 15-2. Registers are accessed by host-driven communications to the BDM hardware using READ_BD and WRITE_BD commands. Global Address 0x7FFF00 Register Name Reserved R W 0x7FFF01 BDMSTS R W 0x7FFF02 Reserved R W 0x7FFF03 Reserved R W 0x7FFF04 Reserved R W 0x7FFF05 Reserved R W 0x7FFF06 BDMCCRL R W CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 X X X X X X X X X X X X X X X X X X X X X X X X ENBDM X BDMACT 0 SDV TRACE CLKSW X UNSEC 0 Bit 7 X 6 X 5 X 4 X 3 X 2 X 1 0 Bit 0 0 X X X X X X = Unimplemented, Reserved X = Indeterminate 0 = Implemented (do not alter) = Always read zero Figure 15-2. BDM Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 734 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) Global Address 0x7FFF07 Register Name BDMCCRH R W Bit 7 0 6 0 5 0 4 0 3 0 2 CCR10 1 CCR9 Bit 0 CCR8 0x7FFF08 BDMGPR R W BGAE 0 BGP6 0 BGP5 0 BGP4 0 BGP3 0 BGP2 0 BGP1 0 BGP0 0 0x7FFF09 Reserved R W 0x7FFF0A Reserved R W 0 0 0 0 0 0 0 0 0x7FFF0B Reserved R W 0 0 0 0 0 0 0 0 = Unimplemented, Reserved X = Indeterminate 0 = Implemented (do not alter) = Always read zero Figure 15-2. BDM Register Summary (continued) 15.3.2.1 BDM Status Register (BDMSTS) Register Global Address 0x7FFF01 7 6 5 4 3 2 1 0 R W Reset Special Single-Chip Mode Emulation Modes (if modes available) ENBDM BDMACT 0 SDV TRACE CLKSW UNSEC 0 0(1) 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1(2) 0 0(3) 0 0 0 0 0 All Other Modes = Unimplemented, Reserved = Implemented (do not alter) 0 = Always read zero 1. ENBDM is read as 1 by a debugging environment in special single chip mode when the device is not secured or secured but fully erased (non-volatile memory). This is because the ENBDM bit is set by the standard ﬁrmware before a BDM command can be fully transmitted and executed. 2. CLKSW is read as 1 by a debugging environment in emulation modes when the device is not secured and read as 0 when secured if emulation modes available. 3. UNSEC is read as 1 by a debugging environment in special single chip mode when the device is secured and fully erased, else it is 0 and can only be read if not secure (see also bit description). Figure 15-3. BDM Status Register (BDMSTS) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 735 Chapter 15 Background Debug Module (S12XBDMV2) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured, but subject to the following: — ENBDM should only be set via a BDM hardware command if the BDM ﬁrmware commands are needed. (This does not apply in special single chip and emulation modes). — BDMACT can only be set by BDM hardware upon entry into BDM. It can only be cleared by the standard BDM ﬁrmware lookup table upon exit from BDM active mode. — CLKSW can only be written via BDM hardware WRITE_BD commands. — All other bits, while writable via BDM hardware or standard BDM ﬁrmware write commands, should only be altered by the BDM hardware or standard ﬁrmware lookup table as part of BDM command execution. Table 15-3. BDMSTS Field Descriptions Field 7 ENBDM Description Enable BDM — This bit controls whether the BDM is enabled or disabled. When enabled, BDM can be made active to allow ﬁrmware commands to be executed. When disabled, BDM cannot be made active but BDM hardware commands are still allowed. 0 BDM disabled 1 BDM enabled Note: ENBDM is set by the ﬁrmware out of reset in special single chip mode. In emulation modes (if modes available) the ENBDM bit is set by BDM hardware out of reset. In special single chip mode with the device secured, this bit will not be set by the ﬁrmware until after the non-volatile memory erase verify tests are complete. In emulation modes (if modes available) with the device secured, the BDM operations are blocked. BDM Active Status — This bit becomes set upon entering BDM. The standard BDM ﬁrmware lookup table is then enabled and put into the memory map. BDMACT is cleared by a carefully timed store instruction in the standard BDM ﬁrmware as part of the exit sequence to return to user code and remove the BDM memory from the map. 0 BDM not active 1 BDM active Shift Data Valid — This bit is set and cleared by the BDM hardware. It is set after data has been transmitted as part of a ﬁrmware or hardware read command or after data has been received as part of a ﬁrmware or hardware write command. It is cleared when the next BDM command has been received or BDM is exited. SDV is used by the standard BDM ﬁrmware to control program ﬂow execution. 0 Data phase of command not complete 1 Data phase of command is complete TRACE1 BDM Firmware Command is Being Executed — This bit gets set when a BDM TRACE1 ﬁrmware command is ﬁrst recognized. It will stay set until BDM ﬁrmware is exited by one of the following BDM commands: GO or GO_UNTIL. 0 TRACE1 command is not being executed 1 TRACE1 command is being executed 6 BDMACT 4 SDV 3 TRACE MC9S12XF - Family Reference Manual, Rev.1.19 736 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) Table 15-3. BDMSTS Field Descriptions (continued) Field 2 CLKSW Description Clock Switch — The CLKSW bit controls which clock the BDM operates with. It is only writable from a hardware BDM command. A minimum delay of 150 cycles at the clock speed that is active during the data portion of the command send to change the clock source should occur before the next command can be send. The delay should be obtained no matter which bit is modiﬁed to effectively change the clock source (either PLLSEL bit or CLKSW bit). This guarantees that the start of the next BDM command uses the new clock for timing subsequent BDM communications. Table 15-4 shows the resulting BDM clock source based on the CLKSW and the PLLSEL (PLL select in the CRG module, the bit is part of the CLKSEL register) bits. Note: The BDM alternate clock source can only be selected when CLKSW = 0 and PLLSEL = 1. The BDM serial interface is now fully synchronized to the alternate clock source, when enabled. This eliminates frequency restriction on the alternate clock which was required on previous versions. Refer to the device speciﬁcation to determine which clock connects to the alternate clock source input. Note: If the acknowledge function is turned on, changing the CLKSW bit will cause the ACK to be at the new rate for the write command which changes it. Note: In emulation modes (if modes available), the CLKSW bit will be set out of RESET. Unsecure — If the device is secured this bit is only writable in special single chip mode from the BDM secure ﬁrmware. It is in a zero state as secure mode is entered so that the secure BDM ﬁrmware lookup table is enabled and put into the memory map overlapping the standard BDM ﬁrmware lookup table. The secure BDM ﬁrmware lookup table veriﬁes that the non-volatile memories (e.g. on-chip EEPROM and/or Flash EEPROM) are erased. This being the case, the UNSEC bit is set and the BDM program jumps to the start of the standard BDM ﬁrmware lookup table and the secure BDM ﬁrmware lookup table is turned off. If the erase test fails, the UNSEC bit will not be asserted. 0 System is in a secured mode. 1 System is in a unsecured mode. Note: When UNSEC is set, security is off and the user can change the state of the secure bits in the on-chip Flash EEPROM. Note that if the user does not change the state of the bits to “unsecured” mode, the system will be secured again when it is next taken out of reset.After reset this bit has no meaning or effect when the security byte in the Flash EEPROM is conﬁgured for unsecure mode. 1 UNSEC Table 15-4. BDM Clock Sources PLLSEL 0 0 1 1 CLKSW 0 1 0 1 Bus clock dependent on oscillator Bus clock dependent on oscillator Alternate clock (refer to the device speciﬁcation to determine the alternate clock source) Bus clock dependent on the PLL BDMCLK MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 737 Chapter 15 Background Debug Module (S12XBDMV2) 15.3.2.2 BDM CCR LOW Holding Register (BDMCCRL) Register Global Address 0x7FFF06 7 6 5 4 3 2 1 0 R W Reset Special Single-Chip Mode All Other Modes CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 1 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 Figure 15-4. BDM CCR LOW Holding Register (BDMCCRL) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured NOTE When BDM is made active, the CPU stores the content of its CCRL register in the BDMCCRL register. However, out of special single-chip reset, the BDMCCRL is set to 0xD8 and not 0xD0 which is the reset value of the CCRL register in this CPU mode. Out of reset in all other modes the BDMCCRL register is read zero. When entering background debug mode, the BDM CCR LOW holding register is used to save the low byte of the condition code register of the user’s program. It is also used for temporary storage in the standard BDM ﬁrmware mode. The BDM CCR LOW holding register can be written to modify the CCR value. 15.3.2.3 BDM CCR HIGH Holding Register (BDMCCRH) Register Global Address 0x7FFF07 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 CCR10 0 CCR9 0 CCR8 0 = Unimplemented or Reserved Figure 15-5. BDM CCR HIGH Holding Register (BDMCCRH) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured When entering background debug mode, the BDM CCR HIGH holding register is used to save the high byte of the condition code register of the user’s program. The BDM CCR HIGH holding register can be written to modify the CCR value. MC9S12XF - Family Reference Manual, Rev.1.19 738 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) 15.3.2.4 BDM Global Page Index Register (BDMGPR) Register Global Address 0x7FFF08 7 R W Reset BGAE 0 6 BGP6 0 5 BGP5 0 4 BGP4 0 3 BGP3 0 2 BGP2 0 1 BGP1 0 0 BGP0 0 Figure 15-6. BDM Global Page Register (BDMGPR) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured Table 15-5. BDMGPR Field Descriptions Field 7 BGAE Description BDM Global Page Access Enable Bit — BGAE enables global page access for BDM hardware and ﬁrmware read/write instructions The BDM hardware commands used to access the BDM registers (READ_BD_ and WRITE_BD_) can not be used for global accesses even if the BGAE bit is set. 0 BDM Global Access disabled 1 BDM Global Access enabled BDM Global Page Index Bits 6–0 — These bits deﬁne the extended address bits from 22 to 16. For more detailed information regarding the global page window scheme, please refer to the S12X_MMC Block Guide. 6–0 BGP[6:0] 15.3.3 Family ID Assignment The family ID is a 8-bit value located in the ﬁrmware ROM (at global address: 0x7FFF0F). The read-only value is a unique family ID which is 0xC1 for S12X devices. 15.4 Functional Description The BDM receives and executes commands from a host via a single wire serial interface. There are two types of BDM commands: hardware and ﬁrmware commands. Hardware commands are used to read and write target system memory locations and to enter active background debug mode, see Section 15.4.3, “BDM Hardware Commands”. Target system memory includes all memory that is accessible by the CPU. Firmware commands are used to read and write CPU resources and to exit from active background debug mode, see Section 15.4.4, “Standard BDM Firmware Commands”. The CPU resources referred to are the accumulator (D), X index register (X), Y index register (Y), stack pointer (SP), and program counter (PC). Hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted (see Section 15.4.3, “BDM Hardware Commands”) and in secure mode (see Section 15.4.1, “Security”). Firmware commands can only be executed when the system is not secure and is in active background debug mode (BDM). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 739 Chapter 15 Background Debug Module (S12XBDMV2) 15.4.1 Security If the user resets into special single chip mode with the system secured, a secured mode BDM ﬁrmware lookup table is brought into the map overlapping a portion of the standard BDM ﬁrmware lookup table. The secure BDM ﬁrmware veriﬁes that the on-chip non-volatile memory (e.g. EEPROM and Flash EEPROM) is erased. This being the case, the UNSEC and ENBDM bit will get set. The BDM program jumps to the start of the standard BDM ﬁrmware and the secured mode BDM ﬁrmware is turned off and all BDM commands are allowed. If the non-volatile memory does not verify as erased, the BDM ﬁrmware sets the ENBDM bit, without asserting UNSEC, and the ﬁrmware enters a loop. This causes the BDM hardware commands to become enabled, but does not enable the ﬁrmware commands. This allows the BDM hardware to be used to erase the non-volatile memory. BDM operation is not possible in any other mode than special single chip mode when the device is secured. The device can be unsecured via BDM serial interface in special single chip mode only. For more information regarding security, please see the S12X_9SEC Block Guide. 15.4.2 Enabling and Activating BDM The system must be in active BDM to execute standard BDM ﬁrmware commands. BDM can be activated only after being enabled. BDM is enabled by setting the ENBDM bit in the BDM status (BDMSTS) register. The ENBDM bit is set by writing to the BDM status (BDMSTS) register, via the single-wire interface, using a hardware command such as WRITE_BD_BYTE. After being enabled, BDM is activated by one of the following1: • Hardware BACKGROUND command • CPU BGND instruction • External instruction tagging mechanism2 • Breakpoint force or tag mechanism2 When BDM is activated, the CPU ﬁnishes executing the current instruction and then begins executing the ﬁrmware in the standard BDM ﬁrmware lookup table. When BDM is activated by a breakpoint, the type of breakpoint used determines if BDM becomes active before or after execution of the next instruction. NOTE If an attempt is made to activate BDM before being enabled, the CPU resumes normal instruction execution after a brief delay. If BDM is not enabled, any hardware BACKGROUND commands issued are ignored by the BDM and the CPU is not delayed. In active BDM, the BDM registers and standard BDM ﬁrmware lookup table are mapped to addresses 0x7FFF00 to 0x7FFFFF. BDM registers are mapped to addresses 0x7FFF00 to 0x7FFF0B. The BDM uses these registers which are readable anytime by the BDM. However, these registers are not readable by user programs. 1. BDM is enabled and active immediately out of special single-chip reset. 2. This method is provided by the S12X_DBG module. MC9S12XF - Family Reference Manual, Rev.1.19 740 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) 15.4.3 BDM Hardware Commands Hardware commands are used to read and write target system memory locations and to enter active background debug mode. Target system memory includes all memory that is accessible by the CPU on the SOC which can be on-chip RAM, non-volatile memory (e.g. EEPROM, Flash EEPROM), I/O and control registers, and all external memory. Hardware commands are executed with minimal or no CPU intervention and do not require the system to be in active BDM for execution, although, they can still be executed in this mode. When executing a hardware command, the BDM sub-block waits for a free bus cycle so that the background access does not disturb the running application program. If a free cycle is not found within 128 clock cycles, the CPU is momentarily frozen so that the BDM can steal a cycle. When the BDM ﬁnds a free cycle, the operation does not intrude on normal CPU operation provided that it can be completed in a single cycle. However, if an operation requires multiple cycles the CPU is frozen until the operation is complete, even though the BDM found a free cycle. The BDM hardware commands are listed in Table 15-6. The READ_BD and WRITE_BD commands allow access to the BDM register locations. These locations are not normally in the system memory map but share addresses with the application in memory. To distinguish between physical memory locations that share the same address, BDM memory resources are enabled just for the READ_BD and WRITE_BD access cycle. This allows the BDM to access BDM locations unobtrusively, even if the addresses conﬂict with the application memory map. Table 15-6. Hardware Commands Command BACKGROUND ACK_ENABLE ACK_DISABLE READ_BD_BYTE READ_BD_WORD READ_BYTE READ_WORD WRITE_BD_BYTE WRITE_BD_WORD WRITE_BYTE Opcode (hex) 90 D5 D6 E4 EC E0 E8 C4 CC C0 Data None None None Description Enter background mode if ﬁrmware is enabled. If enabled, an ACK will be issued when the part enters active background mode. Enable Handshake. Issues an ACK pulse after the command is executed. Disable Handshake. This command does not issue an ACK pulse. 16-bit address Read from memory with standard BDM ﬁrmware lookup table in map. 16-bit data out Odd address data on low byte; even address data on high byte. 16-bit address Read from memory with standard BDM ﬁrmware lookup table in map. 16-bit data out Must be aligned access. 16-bit address Read from memory with standard BDM ﬁrmware lookup table out of map. 16-bit data out Odd address data on low byte; even address data on high byte. 16-bit address Read from memory with standard BDM ﬁrmware lookup table out of map. 16-bit data out Must be aligned access. 16-bit address Write to memory with standard BDM ﬁrmware lookup table in map. 16-bit data in Odd address data on low byte; even address data on high byte. 16-bit address Write to memory with standard BDM ﬁrmware lookup table in map. 16-bit data in Must be aligned access. 16-bit address Write to memory with standard BDM ﬁrmware lookup table out of map. 16-bit data in Odd address data on low byte; even address data on high byte. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 741 Chapter 15 Background Debug Module (S12XBDMV2) Table 15-6. Hardware Commands (continued) Command WRITE_WORD Opcode (hex) C8 Data Description 16-bit address Write to memory with standard BDM ﬁrmware lookup table out of map. 16-bit data in Must be aligned access. NOTE: If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 15.4.4 Standard BDM Firmware Commands Firmware commands are used to access and manipulate CPU resources. The system must be in active BDM to execute standard BDM ﬁrmware commands, see Section 15.4.2, “Enabling and Activating BDM”. Normal instruction execution is suspended while the CPU executes the ﬁrmware located in the standard BDM ﬁrmware lookup table. The hardware command BACKGROUND is the usual way to activate BDM. As the system enters active BDM, the standard BDM ﬁrmware lookup table and BDM registers become visible in the on-chip memory map at 0x7FFF00–0x7FFFFF, and the CPU begins executing the standard BDM ﬁrmware. The standard BDM ﬁrmware watches for serial commands and executes them as they are received. The ﬁrmware commands are shown in Table 15-7. MC9S12XF - Family Reference Manual, Rev.1.19 742 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) Table 15-7. Firmware Commands Command(1) READ_NEXT(2) READ_PC READ_D READ_X READ_Y READ_SP WRITE_NEXT WRITE_PC WRITE_D WRITE_X WRITE_Y WRITE_SP GO GO_UNTIL(3) TRACE1 TAGGO -> GO Opcode (hex) 62 63 64 65 66 67 42 43 44 45 46 47 08 0C 10 18 Data Description 16-bit data out Increment X index register by 2 (X = X + 2), then read word X points to. 16-bit data out Read program counter. 16-bit data out Read D accumulator. 16-bit data out Read X index register. 16-bit data out Read Y index register. 16-bit data out Read stack pointer. 16-bit data in 16-bit data in 16-bit data in 16-bit data in 16-bit data in 16-bit data in none none none none Increment X index register by 2 (X = X + 2), then write word to location pointed to by X. Write program counter. Write D accumulator. Write X index register. Write Y index register. Write stack pointer. Go to user program. If enabled, ACK will occur when leaving active background mode. Go to user program. If enabled, ACK will occur upon returning to active background mode. Execute one user instruction then return to active BDM. If enabled, ACK will occur upon returning to active background mode. (Previous enable tagging and go to user program.) This command will be deprecated and should not be used anymore. Opcode will be executed as a GO command. 1. If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 2. When the ﬁrmware command READ_NEXT or WRITE_NEXT is used to access the BDM address space the BDM resources are accessed rather than user code. Writing BDM ﬁrmware is not possible. 3. System stop disables the ACK function and ignored commands will not have an ACK-pulse (e.g., CPU in stop or wait mode). The GO_UNTIL command will not get an Acknowledge if CPU executes the wait or stop instruction before the “UNTIL” condition (BDM active again) is reached (see Section 15.4.7, “Serial Interface Hardware Handshake Protocol” last Note). 15.4.5 BDM Command Structure Hardware and ﬁrmware BDM commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word depending on the command. All the read commands return 16 bits of data despite the byte or word implication in the command name. 8-bit reads return 16-bits of data, of which, only one byte will contain valid data. If reading an even address, the valid data will appear in the MSB. If reading an odd address, the valid data will appear in the LSB. 16-bit misaligned reads and writes are generally not allowed. If attempted by BDM hardware command, the BDM will ignore the least signiﬁcant bit of the address and will assume an even address from the remaining bits. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 743 Chapter 15 Background Debug Module (S12XBDMV2) For devices with external bus: The following cycle count information is only valid when the external wait function is not used (see wait bit of EBI sub-block). During an external wait the BDM can not steal a cycle. Hence be careful with the external wait function if the BDM serial interface is much faster than the bus, because of the BDM soft-reset after time-out (see Section 15.4.11, “Serial Communication Time Out”). For hardware data read commands, the external host must wait at least 150 bus clock cycles after sending the address before attempting to obtain the read data. This is to be certain that valid data is available in the BDM shift register, ready to be shifted out. For hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the BDM waits for a free cycle before stealing a cycle. For ﬁrmware read commands, the external host should wait at least 48 bus clock cycles after sending the command opcode and before attempting to obtain the read data. This includes the potential of extra cycles when the access is external and stretched (+1 to maximum +7 cycles) or to registers of the PRU (port replacement unit) in emulation modes (if modes available). The 48 cycle wait allows enough time for the requested data to be made available in the BDM shift register, ready to be shifted out. NOTE This timing has increased from previous BDM modules due to the new capability in which the BDM serial interface can potentially run faster than the bus. On previous BDM modules this extra time could be hidden within the serial time. For ﬁrmware write commands, the external host must wait 36 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The external host should wait at least for 76 bus clock cycles after a TRACE1 or GO command before starting any new serial command. This is to allow the CPU to exit gracefully from the standard BDM ﬁrmware lookup table and resume execution of the user code. Disturbing the BDM shift register prematurely may adversely affect the exit from the standard BDM ﬁrmware lookup table. NOTE If the bus rate of the target processor is unknown or could be changing or the external wait function is used, it is recommended that the ACK (acknowledge function) is used to indicate when an operation is complete. When using ACK, the delay times are automated. Figure 15-7 represents the BDM command structure. The command blocks illustrate a series of eight bit times starting with a falling edge. The bar across the top of the blocks indicates that the BKGD line idles in the high state. The time for an 8-bit command is 8 × 16 target clock cycles.1 1. Target clock cycles are cycles measured using the target MCU’s serial clock rate. See Section 15.4.6, “BDM Serial Interface” and Section 15.3.2.1, “BDM Status Register (BDMSTS)” for information on how serial clock rate is selected. MC9S12XF - Family Reference Manual, Rev.1.19 744 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) 8 Bits AT ~16 TC/Bit Hardware Read Command 16 Bits AT ~16 TC/Bit Address 150-BC Delay 16 Bits AT ~16 TC/Bit Data 150-BC Delay Next Command Hardware Write Command 48-BC DELAY Address Data Next Command Firmware Read Command Data 36-BC DELAY Next Command Firmware Write Command 76-BC Delay Data Next Command GO, TRACE Command Next Command BC = Bus Clock Cycles TC = Target Clock Cycles Figure 15-7. BDM Command Structure 15.4.6 BDM Serial Interface The BDM communicates with external devices serially via the BKGD pin. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the BDM. The BDM serial interface is timed using the clock selected by the CLKSW bit in the status register see Section 15.3.2.1, “BDM Status Register (BDMSTS)”. This clock will be referred to as the target clock in the following explanation. The BDM serial interface uses a clocking scheme in which the external host generates a falling edge on the BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is transmitted or received. Data is transferred most signiﬁcant bit (MSB) ﬁrst at 16 target clock cycles per bit. The interface times out if 512 clock cycles occur between falling edges from the host. The BKGD pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times. It is assumed that there is an external pull-up and that drivers connected to BKGD do not typically drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host for transmit cases and the target for receive cases. The timing for host-to-target is shown in Figure 15-8 and that of target-to-host in Figure 15-9 and Figure 15-10. All four cases begin when the host drives the BKGD pin low to generate a falling edge. Since the host and target are operating from separate clocks, it can take the target system up to one full clock cycle to recognize this edge. The target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove BKGD low to start the bit up to one target clock cycle MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 745 Chapter 15 Background Debug Module (S12XBDMV2) earlier. Synchronization between the host and target is established in this manner at the start of every bit time. Figure 15-8 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. BDM Clock (Target MCU) Host Transmit 1 Host Transmit 0 Perceived Start of Bit Time 10 Cycles Synchronization Uncertainty Target Senses Bit Earliest Start of Next Bit Figure 15-8. BDM Host-to-Target Serial Bit Timing The receive cases are more complicated. Figure 15-9 shows the host receiving a logic 1 from the target system. Since the host is asynchronous to the target, there is up to one clock-cycle delay from the hostgenerated falling edge on BKGD to the perceived start of the bit time in the target. The host holds the BKGD pin low long enough for the target to recognize it (at least two target clock cycles). The host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock cycles after it started the bit time. MC9S12XF - Family Reference Manual, Rev.1.19 746 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) BDM Clock (Target MCU) Host Drive to BKGD Pin Target System Speedup Pulse Perceived Start of Bit Time R-C Rise BKGD Pin High-Impedance High-Impedance High-Impedance 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 15-9. BDM Target-to-Host Serial Bit Timing (Logic 1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 747 Chapter 15 Background Debug Module (S12XBDMV2) Figure 15-10 shows the host receiving a logic 0 from the target. Since the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on BKGD to the start of the bit time as perceived by the target. The host initiates the bit time but the target ﬁnishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target clock cycles then brieﬂy drives it high to speed up the rising edge. The host samples the bit level about 10 target clock cycles after starting the bit time. BDM Clock (Target MCU) Host Drive to BKGD Pin Target System Drive and Speedup Pulse Perceived Start of Bit Time BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit High-Impedance Speedup Pulse Figure 15-10. BDM Target-to-Host Serial Bit Timing (Logic 0) 15.4.7 Serial Interface Hardware Handshake Protocol BDM commands that require CPU execution are ultimately treated at the MCU bus rate. Since the BDM clock source can be asynchronously related to the bus frequency, when CLKSW = 0, it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the CPU. The alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. This sub-section will describe the hardware handshake protocol. The hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. This protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the BKGD pin. This pulse is generated by the target MCU when a command, issued by the host, has been successfully executed (see Figure 15-11). This pulse is referred to as the ACK pulse. After the ACK pulse has ﬁnished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (BACKGROUND, GO, GO_UNTIL or TRACE1). The ACK pulse is not issued earlier than 32 serial clock cycles after the BDM command was issued. The end of the BDM command is assumed to be the 16th tick of the last bit. This minimum delay assures enough time for the host to perceive the ACK pulse. Note also that, there is no upper limit for the delay between the command and the related ACK pulse, since the command execution depends upon the CPU bus frequency, which in some cases could be very slow MC9S12XF - Family Reference Manual, Rev.1.19 748 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) compared to the serial communication rate. This protocol allows a great ﬂexibility for the POD designers, since it does not rely on any accurate time measurement or short response time to any event in the serial communication. BDM Clock (Target MCU) 16 Cycles Target Transmits ACK Pulse High-Impedance 32 Cycles Speedup Pulse Minimum Delay From the BDM Command BKGD Pin Earliest Start of Next Bit High-Impedance 16th Tick of the Last Command Bit Figure 15-11. Target Acknowledge Pulse (ACK) NOTE If the ACK pulse was issued by the target, the host assumes the previous command was executed. If the CPU enters wait or stop prior to executing a hardware command, the ACK pulse will not be issued meaning that the BDM command was not executed. After entering wait or stop mode, the BDM command is no longer pending. Figure 15-12 shows the ACK handshake protocol in a command level timing diagram. The READ_BYTE instruction is used as an example. First, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. The target BDM decodes the instruction. A bus cycle is grabbed (free or stolen) by the BDM and it executes the READ_BYTE operation. Having retrieved the data, the BDM issues an ACK pulse to the host controller, indicating that the addressed byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the byte retrieval process. Note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. Target BKGD Pin READ_BYTE Host Byte Address Target Host New BDM Command Host BDM Issues the ACK Pulse (out of scale) BDM Executes the READ_BYTE Command Target (2) Bytes are Retrieved BDM Decodes the Command Figure 15-12. Handshake Protocol at Command Level MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 749 Chapter 15 Background Debug Module (S12XBDMV2) Differently from the normal bit transfer (where the host initiates the transmission), the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative edge in the BKGD pin. The hardware handshake protocol in Figure 15-11 speciﬁes the timing when the BKGD pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical conﬂict in the BKGD pin. NOTE The only place the BKGD pin can have an electrical conﬂict is when one side is driving low and the other side is issuing a speedup pulse (high). Other “highs” are pulled rather than driven. However, at low rates the time of the speedup pulse can become lengthy and so the potential conﬂict time becomes longer as well. The ACK handshake protocol does not support nested ACK pulses. If a BDM command is not acknowledge by an ACK pulse, the host needs to abort the pending command ﬁrst in order to be able to issue a new BDM command. When the CPU enters wait or stop while the host issues a hardware command (e.g., WRITE_BYTE), the target discards the incoming command due to the wait or stop being detected. Therefore, the command is not acknowledged by the target, which means that the ACK pulse will not be issued in this case. After a certain time the host (not aware of stop or wait) should decide to abort any possible pending ACK pulse in order to be sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command, and its corresponding ACK, can be aborted. NOTE The ACK pulse does not provide a time out. This means for the GO_UNTIL command that it can not be distinguished if a stop or wait has been executed (command discarded and ACK not issued) or if the “UNTIL” condition (BDM active) is just not reached yet. Hence in any case where the ACK pulse of a command is not issued the possible pending command should be aborted before issuing a new command. See the handshake abort procedure described in Section 15.4.8, “Hardware Handshake Abort Procedure”. 15.4.8 Hardware Handshake Abort Procedure The abort procedure is based on the SYNC command. In order to abort a command, which had not issued the corresponding ACK pulse, the host controller should generate a low pulse in the BKGD pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse. By detecting this long low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 15.4.9, “SYNC — Request Timed Reference Pulse”, and assumes that the pending command and therefore the related ACK pulse, are being aborted. Therefore, after the SYNC protocol has been completed the host is free to issue new BDM commands. For Firmware READ or WRITE commands it can not be guaranteed that the pending command is aborted when issuing a SYNC before the corresponding ACK pulse. There is a short latency time from the time the READ or WRITE access begins until it is ﬁnished and the corresponding ACK pulse is issued. The latency time depends on the ﬁrmware READ or WRITE command that is issued and if the serial interface is running on a different clock rate than the bus. When the SYNC command starts during this latency time the READ or WRITE command will not be aborted, but the corresponding ACK pulse will be aborted. A pending GO, TRACE1 or MC9S12XF - Family Reference Manual, Rev.1.19 750 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) GO_UNTIL command can not be aborted. Only the corresponding ACK pulse can be aborted by the SYNC command. Although it is not recommended, the host could abort a pending BDM command by issuing a low pulse in the BKGD pin shorter than 128 serial clock cycles, which will not be interpreted as the SYNC command. The ACK is actually aborted when a negative edge is perceived by the target in the BKGD pin. The short abort pulse should have at least 4 clock cycles keeping the BKGD pin low, in order to allow the negative edge to be detected by the target. In this case, the target will not execute the SYNC protocol but the pending command will be aborted along with the ACK pulse. The potential problem with this abort procedure is when there is a conﬂict between the ACK pulse and the short abort pulse. In this case, the target may not perceive the abort pulse. The worst case is when the pending command is a read command (i.e., READ_BYTE). If the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. In this case, host and target will run out of synchronism. However, if the command to be aborted is not a read command the short abort pulse could be used. After a command is aborted the target assumes the next negative edge, after the abort pulse, is the ﬁrst bit of a new BDM command. NOTE The details about the short abort pulse are being provided only as a reference for the reader to better understand the BDM internal behavior. It is not recommended that this procedure be used in a real application. Since the host knows the target serial clock frequency, the SYNC command (used to abort a command) does not need to consider the lower possible target frequency. In this case, the host could issue a SYNC very close to the 128 serial clock cycles length. Providing a small overhead on the pulse length in order to assure the SYNC pulse will not be misinterpreted by the target. See Section 15.4.9, “SYNC — Request Timed Reference Pulse”. Figure 15-13 shows a SYNC command being issued after a READ_BYTE, which aborts the READ_BYTE command. Note that, after the command is aborted a new command could be issued by the host computer. READ_BYTE CMD is Aborted by the SYNC Request (Out of Scale) BKGD Pin READ_BYTE Host Memory Address Target SYNC Response From the Target (Out of Scale) READ_STATUS Host Target New BDM Command Host Target BDM Decode and Starts to Execute the READ_BYTE Command New BDM Command Figure 15-13. ACK Abort Procedure at the Command Level NOTE Figure 15-13 does not represent the signals in a true timing scale MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 751 Chapter 15 Background Debug Module (S12XBDMV2) Figure 15-14 shows a conﬂict between the ACK pulse and the SYNC request pulse. This conﬂict could occur if a POD device is connected to the target BKGD pin and the target is already in debug active mode. Consider that the target CPU is executing a pending BDM command at the exact moment the POD is being connected to the BKGD pin. In this case, an ACK pulse is issued along with the SYNC command. In this case, there is an electrical conﬂict between the ACK speedup pulse and the SYNC pulse. Since this is not a probable situation, the protocol does not prevent this conﬂict from happening. At Least 128 Cycles BDM Clock (Target MCU) ACK Pulse Target MCU Drives to BKGD Pin Host Drives SYNC To BKGD Pin Host and Target Drive to BKGD Pin Host SYNC Request Pulse BKGD Pin 16 Cycles High-Impedance Electrical Conﬂict Speedup Pulse Figure 15-14. ACK Pulse and SYNC Request Conﬂict NOTE This information is being provided so that the MCU integrator will be aware that such a conﬂict could eventually occur. The hardware handshake protocol is enabled by the ACK_ENABLE and disabled by the ACK_DISABLE BDM commands. This provides backwards compatibility with the existing POD devices which are not able to execute the hardware handshake protocol. It also allows for new POD devices, that support the hardware handshake protocol, to freely communicate with the target device. If desired, without the need for waiting for the ACK pulse. The commands are described as follows: • ACK_ENABLE — enables the hardware handshake protocol. The target will issue the ACK pulse when a CPU command is executed by the CPU. The ACK_ENABLE command itself also has the ACK pulse as a response. • ACK_DISABLE — disables the ACK pulse protocol. In this case, the host needs to use the worst case delay time at the appropriate places in the protocol. The default state of the BDM after reset is hardware handshake protocol disabled. All the read commands will ACK (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the BKGD serial pin. All the write commands will ACK (if enabled) after the data has been received by the BDM through the BKGD serial pin and when the data bus cycle is complete. See Section 15.4.3, “BDM Hardware Commands” and Section 15.4.4, “Standard BDM Firmware Commands” for more information on the BDM commands. MC9S12XF - Family Reference Manual, Rev.1.19 752 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) The ACK_ENABLE sends an ACK pulse when the command has been completed. This feature could be used by the host to evaluate if the target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. If the target does not support the hardware handshake protocol the ACK pulse is not issued. In this case, the ACK_ENABLE command is ignored by the target since it is not recognized as a valid command. The BACKGROUND command will issue an ACK pulse when the CPU changes from normal to background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO command will issue an ACK pulse when the CPU exits from background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO_UNTIL command is equivalent to a GO command with exception that the ACK pulse, in this case, is issued when the CPU enters into background mode. This command is an alternative to the GO command and should be used when the host wants to trace if a breakpoint match occurs and causes the CPU to enter active background mode. Note that the ACK is issued whenever the CPU enters BDM, which could be caused by a breakpoint match or by a BGND instruction being executed. The ACK pulse related to this command could be aborted using the SYNC command. The TRACE1 command has the related ACK pulse issued when the CPU enters background active mode after one instruction of the application program is executed. The ACK pulse related to this command could be aborted using the SYNC command. 15.4.9 SYNC — Request Timed Reference Pulse The SYNC command is unlike other BDM commands because the host does not necessarily know the correct communication speed to use for BDM communications until after it has analyzed the response to the SYNC command. To issue a SYNC command, the host should perform the following steps: 1. Drive the BKGD pin low for at least 128 cycles at the lowest possible BDM serial communication frequency (the lowest serial communication frequency is determined by the crystal oscillator or the clock chosen by CLKSW.) 2. Drive BKGD high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. Remove all drive to the BKGD pin so it reverts to high impedance. 4. Listen to the BKGD pin for the sync response pulse. Upon detecting the SYNC request from the host, the target performs the following steps: 1. Discards any incomplete command received or bit retrieved. 2. Waits for BKGD to return to a logic one. 3. Delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. Drives BKGD low for 128 cycles at the current BDM serial communication frequency. 5. Drives a one-cycle high speedup pulse to force a fast rise time on BKGD. 6. Removes all drive to the BKGD pin so it reverts to high impedance. The host measures the low time of this 128 cycle SYNC response pulse and determines the correct speed for subsequent BDM communications. Typically, the host can determine the correct communication speed MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 753 Chapter 15 Background Debug Module (S12XBDMV2) within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. As soon as the SYNC request is detected by the target, any partially received command or bit retrieved is discarded. This is referred to as a soft-reset, equivalent to a time-out in the serial communication. After the SYNC response, the target will consider the next negative edge (issued by the host) as the start of a new BDM command or the start of new SYNC request. Another use of the SYNC command pulse is to abort a pending ACK pulse. The behavior is exactly the same as in a regular SYNC command. Note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. In this case, the command may not have been understood by the target and so an ACK response pulse will not be issued. 15.4.10 Instruction Tracing When a TRACE1 command is issued to the BDM in active BDM, the CPU exits the standard BDM ﬁrmware and executes a single instruction in the user code. Once this has occurred, the CPU is forced to return to the standard BDM ﬁrmware and the BDM is active and ready to receive a new command. If the TRACE1 command is issued again, the next user instruction will be executed. This facilitates stepping or tracing through the user code one instruction at a time. If an interrupt is pending when a TRACE1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. Once back in standard BDM ﬁrmware execution, the program counter points to the ﬁrst instruction in the interrupt service routine. Be aware when tracing through the user code that the execution of the user code is done step by step but all peripherals are free running. Hence possible timing relations between CPU code execution and occurrence of events of other peripherals no longer exist. Do not trace the CPU instruction BGND used for soft breakpoints. Tracing the BGND instruction will result in a return address pointing to BDM ﬁrmware address space. When tracing through user code which contains stop or wait instructions the following will happen when the stop or wait instruction is traced: The CPU enters stop or wait mode and the TRACE1 command can not be ﬁnished before leaving the low power mode. This is the case because BDM active mode can not be entered after CPU executed the stop instruction. However all BDM hardware commands except the BACKGROUND command are operational after tracing a stop or wait instruction and still being in stop or wait mode. If system stop mode is entered (all bus masters are in stop mode) no BDM command is operational. As soon as stop or wait mode is exited the CPU enters BDM active mode and the saved PC value points to the entry of the corresponding interrupt service routine. In case the handshake feature is enabled the corresponding ACK pulse of the TRACE1 command will be discarded when tracing a stop or wait instruction. Hence there is no ACK pulse when BDM active mode is entered as part of the TRACE1 command after CPU exited from stop or wait mode. All valid commands sent during CPU being in stop or wait mode or after CPU exited from stop or wait mode will have an ACK pulse. The handshake feature becomes disabled only when system MC9S12XF - Family Reference Manual, Rev.1.19 754 Freescale Semiconductor Chapter 15 Background Debug Module (S12XBDMV2) stop mode has been reached. Hence after a system stop mode the handshake feature must be enabled again by sending the ACK_ENABLE command. 15.4.11 Serial Communication Time Out The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command was issued. In this case, the target will keep waiting for a rising edge on BKGD in order to answer the SYNC request pulse. If the rising edge is not detected, the target will keep waiting forever without any time-out limit. Consider now the case where the host returns BKGD to logic one before 128 cycles. This is interpreted as a valid bit transmission, and not as a SYNC request. The target will keep waiting for another falling edge marking the start of a new bit. If, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a time-out occurs and the current command is discarded without affecting memory or the operating mode of the MCU. This is referred to as a soft-reset. If a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occur causing the command to be disregarded. The data is not available for retrieval after the time-out has occurred. This is the expected behavior if the handshake protocol is not enabled. However, consider the behavior where the BDM is running in a frequency much greater than the CPU frequency. In this case, the command could time out before the data is ready to be retrieved. In order to allow the data to be retrieved even with a large clock frequency mismatch (between BDM and CPU) when the hardware handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. Therefore, the host could wait for more then 512 serial clock cycles and still be able to retrieve the data from an issued read command. However, once the handshake pulse (ACK pulse) is issued, the time-out feature is reactivated, meaning that the target will time out after 512 clock cycles. Therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ACK pulse had been issued. After that period, the read command is discarded and the data is no longer available for retrieval. Any negative edge in the BKGD pin after the time-out period is considered to be a new command or a SYNC request. Note that whenever a partially issued command, or partially retrieved data, has occurred the time out in the serial communication is active. This means that if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. The next negative edge in the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDM command, or the start of a SYNC request pulse. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 755 Chapter 15 Background Debug Module (S12XBDMV2) MC9S12XF - Family Reference Manual, Rev.1.19 756 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module Revision History Revision Number 03.17 03.18 03.17 Date 20.MAR.2007 20.APR.2007 24.APR.2007 Author Summary of Changes Tabulated glossary Renamed S12XCPU to CPU12X Added “Data Bus Comparison NDB Dependency” section Clariﬁed effect TRIG has on state sequencer Clariﬁed simultaneous arm and disarm effect 16.1 Introduction The S12XDBG module provides an on-chip trace buffer with ﬂexible triggering capability to allow nonintrusive debug of application software. The S12XDBG module is optimized for the S12X 16-bit architecture and allows debugging of CPU12Xand XGATE module operations. Typically the S12XDBG module is used in conjunction with the S12XBDM module, whereby the user conﬁgures the S12XDBG module for a debugging session over the BDM interface. Once conﬁgured the S12XDBG module is armed and the device leaves BDM Mode returning control to the user program, which is then monitored by the S12XDBG module. Alternatively the S12XDBG module can be conﬁgured over a serial interface using SWI routines. 16.1.1 Term Glossary Table 16-1. Glossary Of Terms Deﬁnition COF BDM DUG WORD Change Of Flow. Change in the program ﬂow due to a conditional branch, indexed jump or interrupt Background Debug Mode Device User Guide, describing the features of the device into which the DBG is integrated 16 bit data entity MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 757 Chapter 16 S12X Debug (S12XDBGV3) Module Table 16-1. Glossary Of Terms Term Deﬁnition Data Line CPU Tag 64 bit data entity CPU12X module Tags can be attached to XGATE or CPU opcodes as they enter the instruction pipe. If the tagged opcode reaches the execution stage a tag hit occurs. 16.1.2 Overview The comparators monitor the bus activity of the CPU12X and XGATE. When a match occurs the control logic can trigger the state sequencer to a new state. On a transition to the Final State, bus tracing is triggered and/or a breakpoint can be generated. Independent of comparator matches a transition to Final State with associated tracing and breakpoint can be triggered by the external TAGHI and TAGLO signals, or by an XGATE module S/W breakpoint request or by writing to the TRIG control bit. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. Tracing is disabled when the MCU system is secured. 16.1.3 • Features • • • Four comparators (A, B, C, and D) — Comparators A and C compare the full address bus and full 16-bit data bus — Comparators A and C feature a data bus mask register — Comparators B and D compare the full address bus only — Each comparator can be conﬁgured to monitor CPU12X or XGATE buses — Each comparator features selection of read or write access cycles — Comparators B and D allow selection of byte or word access cycles — Comparisons can be used as triggers for the state sequencer Three comparator modes — Simple address/data comparator match mode — Inside address range mode, Addmin ≤ Address ≤ Addmax — Outside address range match mode, Address < Addmin or Address > Addmax Two types of triggers — Tagged — This triggers just before a speciﬁc instruction begins execution — Force — This triggers on the ﬁrst instruction boundary after a match occurs. The following types of breakpoints — CPU12X breakpoint entering BDM on breakpoint (BDM) — CPU12X breakpoint executing SWI on breakpoint (SWI) — XGATE breakpoint MC9S12XF - Family Reference Manual, Rev.1.19 758 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module • • • • • External CPU12X instruction tagging trigger independent of comparators XGATE S/W breakpoint request trigger independent of comparators TRIG Immediate software trigger independent of comparators Four trace modes — Normal: change of ﬂow (COF) PC information is stored (see Section 16.4.5.2.1) for change of ﬂow deﬁnition. — Loop1: same as Normal but inhibits consecutive duplicate source address entries — Detail: address and data for all cycles except free cycles and opcode fetches are stored — Pure PC: All program counter addresses are stored. 4-stage state sequencer for trace buffer control — Tracing session trigger linked to Final State of state sequencer — Begin, End, and Mid alignment of tracing to trigger 16.1.4 Modes of Operation The S12XDBG module can be used in all MCU functional modes. During BDM hardware accesses and whilst the BDM module is active, CPU12X monitoring is disabled. Thus breakpoints, comparators, and CPU12X bus tracing are disabled but XGATE bus monitoring accessing the S12XDBG registers, including comparator registers, is still possible. While in active BDM or during hardware BDM accesses, XGATE activity can still be compared, traced and can be used to generate a breakpoint to the XGATE module. When the CPU12X enters active BDM Mode through a BACKGROUND command, with the S12XDBG module armed, the S12XDBG remains armed. The S12XDBG module tracing is disabled if the MCU is secure. However, breakpoints can still be generated if the MCU is secure. Table 16-2. Mode Dependent Restriction Summary BDM Enable x 0 0 1 1 BDM Active x 0 1 0 1 MCU Secure 1 0 0 0 0 Yes XGATE only Comparator Matches Enabled Yes Yes Breakpoints Possible Yes Only SWI Yes XGATE only Tagging Possible Yes Yes Yes XGATE only Tracing Possible No Yes Yes XGATE only Active BDM not possible when not enabled MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 759 Chapter 16 S12X Debug (S12XDBGV3) Module 16.1.5 Block Diagram TAGS BREAKPOINT REQUESTS CPU12X & XGATE TAGHITS EXTERNAL TAGHI / TAGLO XGATE S/W BREAKPOINT REQUEST SECURE COMPARATOR A COMPARATOR B COMPARATOR C COMPARATOR D MATCH0 COMPARATOR MATCH CONTROL MATCH1 MATCH2 MATCH3 TAG & TRIGGER CONTROL LOGIC TRIGGER STATE STATE SEQUENCER STATE CPU12X BUS XGATE BUS BUS INTERFACE TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 16-1. Debug Module Block Diagram 16.2 External Signal Description The S12XDBG sub-module features two external tag input signals. See Device User Guide (DUG) for the mapping of these signals to device pins. These tag pins may be used for the external tagging in emulation modes only. Table 16-3. External System Pins Associated With S12XDBG Pin Name TAGHI (See DUG) TAGLO (See DUG) TAGLO (See DUG) Pin Functions TAGHI TAGLO Unconditional Tagging Enable Description When instruction tagging is on, tags the high half of the instruction word being read into the instruction queue. When instruction tagging is on, tags the low half of the instruction word being read into the instruction queue. In emulation modes, a low assertion on this pin in the 7th or 8th cycle after the end of reset enables the Unconditional Tagging function. 16.3 16.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the S12XDBG sub-block is shown in Table 16-2. Detailed descriptions of the registers and bits are given in the subsections that follow. MC9S12XF - Family Reference Manual, Rev.1.19 760 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module Address 0x0020 Name DBGC1 R W R W R W R W R W R W R W R W R W Bit 7 ARM TBF 6 0 TRIG EXTF 5 XGSBPE 0 4 BDM 0 3 DBGBRK 0 2 1 Bit 0 COMRV 0x0021 DBGSR SSF2 SSF1 SSF0 0x0022 DBGTCR TSOURCE 0 0 0 TRANGE 0 TRCMOD TALIGN 0x0023 DBGC2 CDCM Bit 11 Bit 10 Bit 9 ABCM Bit 8 0x0024 DBGTBH Bit 15 Bit 14 Bit 13 Bit 12 0x0025 DBGTBL Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0026 DBGCNT 0 CNT 0x0027 0x0027 0x00281 0x00282 DBGSCRX DBGMFR 0 0 0 0 0 0 0 0 SC3 MC3 SC2 MC2 SC1 MC1 SC0 MC0 DBGXCTL R (COMPA/C) W DBGXCTL R (COMPB/D) W DBGXAH R W R W R W R W R W R W 0 NDB SZ TAG TAG BRK BRK RW RW RWE RWE SRC SRC COMPE COMPE SZE 0 0x0029 Bit 22 21 20 19 18 17 Bit 16 0x002A DBGXAM Bit 15 14 13 12 11 10 9 Bit 8 0x002B DBGXAL Bit 7 6 5 4 3 2 1 Bit 0 0x002C DBGXDH Bit 15 14 13 12 11 10 9 Bit 8 0x002D DBGXDL Bit 7 6 5 4 3 2 1 Bit 0 0x002E DBGXDHM Bit 15 14 13 12 11 10 9 Bit 8 R Bit 7 6 5 4 3 2 W 1 This represents the contents if the Comparator A or C control register is blended into this address. 2 This represents the contents if the Comparator B or D control register is blended into this address 0x002F DBGXDLM 1 Bit 0 Figure 16-2. Quick Reference to S12XDBG Registers MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 761 Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2 Register Descriptions This section consists of the S12XDBG control and trace buffer register descriptions in address order. Each comparator has a bank of registers that are visible through an 8-byte window between 0x0028 and 0x002F in the S12XDBG module register address map. When ARM is set in DBGC1, the only bits in the S12XDBG module registers that can be written are ARM, TRIG, and COMRV[1:0] 16.3.2.1 Debug Control Register 1 (DBGC1) Address: 0x0020 7 6 5 4 3 2 1 0 R W Reset ARM 0 0 TRIG 0 XGSBPE 0 BDM 0 0 DBGBRK 0 0 COMRV 0 Figure 16-3. Debug Control Register (DBGC1) Read: Anytime Write: Bits 7, 1, 0 anytime Bit 6 can be written anytime but always reads back as 0. Bits 5:2 anytime S12XDBG is not armed. NOTE If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. NOTE When disarming the S12XDBG by clearing ARM with software, the contents of bits[5:2] are not affected by the write, since up until the write operation, ARM = 1 preventing these bits from being written. These bits must be cleared using a second write if required. Table 16-4. DBGC1 Field Descriptions Field 7 ARM Description Arm Bit — The ARM bit controls whether the S12XDBG module is armed. This bit can be set and cleared by user software and is automatically cleared on completion of a tracing session, or if a breakpoint is generated with tracing not enabled. On setting this bit the state sequencer enters State1. 0 Debugger disarmed 1 Debugger armed Immediate Trigger Request Bit — This bit when written to 1 requests an immediate trigger independent of comparator or external tag signal status. When tracing is complete a forced breakpoint may be generated depending upon DBGBRK and BDM bit settings. This bit always reads back a 0. Writing a 0 to this bit has no effect. If TSOURCE are clear no tracing is carried out. If tracing has already commenced using BEGIN- or MID trigger alignment, it continues until the end of the tracing session as deﬁned by the TALIGN bit settings, thus TRIG has no affect. In secure mode tracing is disabled and writing to this bit has no effect. 0 Do not trigger until the state sequencer enters the Final State. 1 Trigger immediately . 6 TRIG MC9S12XF - Family Reference Manual, Rev.1.19 762 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module Table 16-4. DBGC1 Field Descriptions (continued) Field 5 XGSBPE Description XGATE S/W Breakpoint Enable — The XGSBPE bit controls whether an XGATE S/W breakpoint request is passed to the CPU12X. The XGATE S/W breakpoint request is handled by the S12XDBG module, which can request an CPU12X breakpoint depending on the state of this bit. 0 XGATE S/W breakpoint request is disabled 1 XGATE S/W breakpoint request is enabled Background Debug Mode Enable — This bit determines if an S12X breakpoint causes the system to enter Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDM is not enabled by the ENBDM bit in the BDM module, then breakpoints default to SWI. 0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint. 1 Breakpoint to BDM, if BDM enabled. Otherwise breakpoint to SWI S12XDBG Breakpoint Enable Bits — The DBGBRK bits control whether the debugger will request a breakpoint to either CPU12X or XGATE or both upon reaching the state sequencer Final State. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If tracing is not enabled, the breakpoint is generated immediately. Please refer to Section 16.4.7 for further details. XGATE software breakpoints are independent of the DBGBRK bits. XGATE software breakpoints force a breakpoint to the CPU12X independent of the DBGBRK bit ﬁeld conﬁguration. See Table 16-5. Comparator Register Visibility Bits — These bits determine which bank of comparator register is visible in the 8-byte window of the S12XDBG module address map, located between 0x0028 to 0x002F. Furthermore these bits determine which register is visible at the address 0x0027. See Table 16-6. 4 BDM 3–2 DBGBRK 1–0 COMRV Table 16-5. DBGBRK Encoding DBGBRK 00 01 10 11 Resource Halted by Breakpoint No breakpoint generated XGATE breakpoint generated CPU12X breakpoint generated Breakpoints generated for CPU12X and XGATE Table 16-6. COMRV Encoding COMRV 00 01 10 11 Visible Comparator Comparator A Comparator B Comparator C Comparator D Visible Register at 0x0027 DBGSCR1 DBGSCR2 DBGSCR3 DBGMFR 16.3.2.2 Debug Status Register (DBGSR) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 763 Chapter 16 S12X Debug (S12XDBGV3) Module Address: 0x0021 7 6 5 4 3 2 1 0 R W Reset POR TBF — 0 EXTF 0 0 0 0 0 0 0 0 0 0 0 SSF2 0 0 SSF1 0 0 SSF0 0 0 = Unimplemented or Reserved Figure 16-4. Debug Status Register (DBGSR) Read: Anytime Write: Never Table 16-7. DBGSR Field Descriptions Field 7 TBF Description Trace Buffer Full — The TBF bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines will be valid data, regardless of the value of DBGCNT bits CNT[6:0]. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit External Tag Hit Flag — The EXTF bit indicates if a tag hit condition from an external TAGHI/TAGLO tag was met since arming. This bit is cleared when ARM in DBGC1 is written to a one. 0 External tag hit has not occurred 1 External tag hit has occurred State Sequencer Flag Bits — The SSF bits indicate in which state the State Sequencer is currently in. During a debug session on each transition to a new state these bits are updated. If the debug session is ended by software clearing the ARM bit, then these bits retain their value to reﬂect the last state of the state sequencer before disarming. If a debug session is ended by an internal trigger, then the state sequencer returns to state0 and these bits are cleared to indicate that state0 was entered during the session. On arming the module the state sequencer enters state1 and these bits are forced to SSF[2:0] = 001. See Table 16-8. 6 EXTF 2–0 SSF[2:0] Table 16-8. SSF[2:0] — State Sequence Flag Bit Encoding SSF[2:0] 000 001 010 011 100 101,110,111 Current State State0 (disarmed) State1 State2 State3 Final State Reserved MC9S12XF - Family Reference Manual, Rev.1.19 764 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.3 Debug Trace Control Register (DBGTCR) Address: 0x0022 7 6 5 4 3 2 1 0 R W Reset 0 TSOURCE 0 0 TRANGE 0 0 TRCMOD 0 0 TALIGN 0 Figure 16-5. Debug Trace Control Register (DBGTCR) Read: Anytime Write: Bits 7:6 only when S12XDBG is neither secure nor armed. Bits 5:0 anytime the module is disarmed. Table 16-9. DBGTCR Field Descriptions Field 7–6 TSOURCE 5–4 TRANGE Description Trace Source Control Bits — The TSOURCE bits select the data source for the tracing session. If the MCU system is secured, these bits cannot be set and tracing is inhibited. See Table 16-10. Trace Range Bits — The TRANGE bits allow ﬁltering of trace information from a selected address range when tracing from the CPU12X in Detail Mode. The XGATE tracing range cannot be narrowed using these bits. To use a comparator for range ﬁltering, the corresponding COMPE and SRC bits must remain cleared. If the COMPE bit is not clear then the comparator will also be used to generate state sequence triggers. If the corresponding SRC bit is set the comparator is mapped to the XGATE buses, the TRANGE bits have no effect on the valid address range, memory accesses within the whole memory map are traced. See Table 16-11. Trace Mode Bits — See Section 16.4.5.2 for detailed Trace Mode descriptions. In Normal Mode, change of ﬂow information is stored. In Loop1 Mode, change of ﬂow information is stored but redundant entries into trace memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. See Table 16-12. Trigger Align Bits — These bits control whether the trigger is aligned to the beginning, end or the middle of a tracing session. See Table 16-13. 3–2 TRCMOD 1–0 TALIGN Table 16-10. TSOURCE — Trace Source Bit Encoding TSOURCE 00 01 10(1) 1,(2) Tracing Source No tracing requested CPU12X XGATE Both CPU12X and XGATE 11 1. No range limitations are allowed. Thus tracing operates as if TRANGE = 00. 2. No Detail Mode tracing supported. If TRCMOD = 10, no information is stored. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 765 Chapter 16 S12X Debug (S12XDBGV3) Module Table 16-11. TRANGE Trace Range Encoding TRANGE 00 01 10 11 Tracing Range Trace from all addresses (No ﬁlter) Trace only in address range from $00000 to Comparator D Trace only in address range from Comparator C to $7FFFFF Trace only in range from Comparator C to Comparator D Table 16-12. TRCMOD Trace Mode Bit Encoding TRCMOD 00 01 10 11 Description Normal Loop1 Detail Pure PC Table 16-13. TALIGN Trace Alignment Encoding TALIGN 00 01 10 11 Description Trigger at end of stored data Trigger before storing data Trace buffer entries before and after trigger Reserved MC9S12XF - Family Reference Manual, Rev.1.19 766 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.4 Debug Control Register2 (DBGC2) Address: 0x0023 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 CDCM 0 0 ABCM 0 = Unimplemented or Reserved Figure 16-6. Debug Control Register2 (DBGC2) Read: Anytime Write: Anytime the module is disarmed. This register conﬁgures the comparators for range matching. Table 16-14. DBGC2 Field Descriptions Field 3–2 CDCM[1:0] 1–0 ABCM[1:0] Description C and D Comparator Match Control — These bits determine the C and D comparator match mapping as described in Table 16-15. A and B Comparator Match Control — These bits determine the A and B comparator match mapping as described in Table 16-16. Table 16-15. CDCM Encoding CDCM 00 01 10 Description Match2 mapped to comparator C match....... Match3 mapped to comparator D match. Match2 mapped to comparator C/D inside range....... Match3 disabled. Match2 mapped to comparator C/D outside range....... Match3 disabled. 11 Reserved(1) 1. Currently defaults to Match2 mapped to comparator C : Match3 mapped to comparator D Table 16-16. ABCM Encoding ABCM 00 01 10 Description Match0 mapped to comparator A match....... Match1 mapped to comparator B match. Match 0 mapped to comparator A/B inside range....... Match1 disabled. Match 0 mapped to comparator A/B outside range....... Match1 disabled. 11 Reserved(1) 1. Currently defaults to Match0 mapped to comparator A : Match1 mapped to comparator B MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 767 Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.5 Debug Trace Buffer Register (DBGTBH:DBGTBL) Address: 0x0024, 0x0025 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W POR Other Resets Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 X — X — X — X — X — X — X — Bit 8 X — Bit 7 X — Bit 6 X — Bit 5 X — Bit 4 X — Bit 3 X — Bit 2 X — Bit 1 X — Bit 0 X — Figure 16-7. Debug Trace Buffer Register (DBGTB) Read: Only when unlocked AND not secured AND not armed AND with a TSOURCE bit set. Write: Aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. Table 16-17. DBGTB Field Descriptions Field 15–0 Bit[15:0] Description Trace Buffer Data Bits — The Trace Buffer Register is a window through which the 64-bit wide data lines of the Trace Buffer may be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to the next address to be read. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module is disarmed. The DBGTB register can be read only as an aligned word, any byte reads or misaligned access of these registers will return 0 and will not cause the trace buffer pointer to increment to the next trace buffer address. The same is true for word reads while the debugger is armed. The POR state is undeﬁned Other resets do not affect the trace buffer contents. . MC9S12XF - Family Reference Manual, Rev.1.19 768 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.6 Debug Count Register (DBGCNT) Address: 0x0026 7 6 5 4 3 2 1 0 R W Reset POR 0 0 0 — 0 — 0 — 0 CNT — 0 — 0 — 0 — 0 = Unimplemented or Reserved Figure 16-8. Debug Count Register (DBGCNT) Read: Anytime Write: Never Table 16-18. DBGCNT Field Descriptions Field 6–0 CNT[6:0] Description Count Value — The CNT bits [6:0] indicate the number of valid data 64-bit data lines stored in the Trace Buffer. Table 16-19 shows the correlation between the CNT bits and the number of valid data lines in the Trace Buffer. When the CNT rolls over to zero, the TBF bit in DBGSR is set and incrementing of CNT will continue in endtrigger or mid-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by power-on-reset initialization but is not cleared by other system resets. Thus should a reset occur during a debug session, the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. The DBGCNT register is not decremented when reading from the trace buffer. Table 16-19. CNT Decoding Table TBF (DBGSR) 0 0 0 CNT[6:0] 0000000 0000001 0000010 0000100 0000110 .. 1111100 1111110 0000000 Description No data valid 32 bits of one line valid(1) 1 line valid 2 lines valid 3 lines valid .. 62 lines valid 63 lines valid 64 lines valid; if using Begin trigger alignment, ARM bit will be cleared and the tracing session ends. 0 1 1 64 lines valid, 0000010 oldest data has been overwritten by most recent data .. .. 1111110 1. This applies to Normal/Loop1/PurePC Modes when tracing from either CPU12X or XGATE only. 16.3.2.7 Debug State Control Registers There is a dedicated control register for each of the state sequencer states 1 to 3 that determines if transitions from that state are allowed, depending upon comparator matches or tag hits, and deﬁnes the MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 769 Chapter 16 S12X Debug (S12XDBGV3) Module next state for the state sequencer following a match. The three debug state control registers are located at the same address in the register address map (0x0027). Each register can be accessed using the COMRV bits in DBGC1 to blend in the required register. The COMRV = 11 value blends in the match ﬂag register (DBGMFR). Table 16-20. State Control Register Access Encoding COMRV 00 01 10 11 Visible State Control Register DBGSCR1 DBGSCR2 DBGSCR3 DBGMFR MC9S12XF - Family Reference Manual, Rev.1.19 770 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.7.1 Address: 0x0027 7 Debug State Control Register 1 (DBGSCR1) 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 SC3 0 SC2 0 SC1 0 SC0 0 = Unimplemented or Reserved Figure 16-9. Debug State Control Register 1 (DBGSCR1) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 00. The state control register 1 selects the targeted next state whilst in State1. The matches refer to the match channels of the comparator match control logic as depicted in Figure 16-1 and described in Section 16.3.2.8.1”. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 16-21. DBGSCR1 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State1, based upon the match event. Table 16-22. State1 Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state2 Any match triggers to state3 Any match triggers to Final State Match2 triggers to State2....... Other matches have no effect Match2 triggers to State3....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match0 triggers to State2....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State2....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State2....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers to Final State....... Other matches have no effect Match3 has no effect....... All other matches (M0,M1,M2) trigger to State2 Reserved Reserved Reserved The trigger priorities described in Table 16-41 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to ﬁnal state has priority over all other matches. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 771 Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.7.2 Address: 0x0027 7 Debug State Control Register 2 (DBGSCR2) 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 SC3 0 SC2 0 SC1 0 SC0 0 = Unimplemented or Reserved Figure 16-10. Debug State Control Register 2 (DBGSCR2) Read: If COMRV[1:0] = 01 Write: If COMRV[1:0] = 01 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 01. The state control register 2 selects the targeted next state whilst in State2. The matches refer to the match channels of the comparator match control logic as depicted in Figure 16-1 and described in Section 16.3.2.8.1”. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 16-23. DBGSCR2 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State2, based upon the match event. Table 16-24. State2 —Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state1 Any match triggers to state3 Any match triggers to Final State Match3 triggers to State1....... Other matches have no effect Match3 triggers to State3....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Match0 triggers to State1....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State1....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers Final State....... Other matches have no effect Match2 triggers to State1..... Match3 trigger to Final State Match2 has no affect, all other matches (M0,M1,M3) trigger to Final State Reserved Reserved The trigger priorities described in Table 16-41 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to ﬁnal state has priority over all other matches. MC9S12XF - Family Reference Manual, Rev.1.19 772 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.7.3 Address: 0x0027 7 Debug State Control Register 3 (DBGSCR3) 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 SC3 0 SC2 0 SC1 0 SC0 0 = Unimplemented or Reserved Figure 16-11. Debug State Control Register 3 (DBGSCR3) Read: If COMRV[1:0] = 10 Write: If COMRV[1:0] = 10 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 10. The state control register three selects the targeted next state whilst in State3. The matches refer to the match channels of the comparator match control logic as depicted in Figure 16-1 and described in Section 16.3.2.8.1”. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 16-25. DBGSCR3 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State3, based upon the match event. Table 16-26. State3 — Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state1 Any match triggers to state2 Any match triggers to Final State Match0 triggers to State1....... Other matches have no effect Match0 triggers to State2....... Other matches have no effect Match0 triggers to Final State.......Match1 triggers to State1 Match1 triggers to State1....... Other matches have no effect Match1 triggers to State2....... Other matches have no effect Match1 triggers to Final State....... Other matches have no effect Match2 triggers to State2....... Match0 triggers to Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State2....... Other matches have no effect Match3 triggers to State2....... Match1 triggers to Final State....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Reserved Reserved The trigger priorities described in Table 16-41 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 773 Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.7.4 Address: 0x0027 7 Debug Match Flag Register (DBGMFR) 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 MC3 0 MC2 0 MC1 0 MC0 0 = Unimplemented or Reserved Figure 16-12. Debug Match Flag Register (DBGMFR) Read: If COMRV[1:0] = 11 Write: Never DBGMFR is visible at 0x0027 only with COMRV[1:0] = 11. It features four ﬂag bits each mapped directly to a channel. Should a match occur on the channel during the debug session, then the corresponding ﬂag is set and remains set until the next time the module is armed by writing to the ARM bit. Thus the contents are retained after a debug session for evaluation purposes. These ﬂags cannot be cleared by software, they are cleared only when arming the module. A set ﬂag does not inhibit the setting of other ﬂags. Once a ﬂag is set, further triggers on the same channel have no affect. 16.3.2.8 Comparator Register Descriptions Each comparator has a bank of registers that are visible through an 8-byte window in the S12XDBG module register address map. Comparators A and C consist of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). Comparators B and D consist of four register bytes (three address bus compare registers and a control register). Each set of comparator registers is accessible in the same 8-byte window of the register address map and can be accessed using the COMRV bits in the DBGC1 register. If the Comparators B or D are accessed through the 8-byte window, then only the address and control bytes are visible, the 4 bytes associated with data bus and data bus masking read as zero and cannot be written. Furthermore the control registers for comparators B and D differ from those of comparators A and C. Table 16-27. Comparator Register Layout 0x0028 0x0029 0x002A 0x002B 0x002C 0x002D 0x002E 0x002F CONTROL ADDRESS HIGH ADDRESS MEDIUM ADDRESS LOW DATA HIGH COMPARATOR DATA LOW COMPARATOR DATA HIGH MASK DATA LOW MASK Read/Write Read/Write Read/Write Read/Write Read/Write Read/Write Read/Write Read/Write Comparators A,B,C,D Comparators A,B,C,D Comparators A,B,C,D Comparators A,B,C,D Comparator A and C only Comparator A and C only Comparator A and C only Comparator A and C only MC9S12XF - Family Reference Manual, Rev.1.19 774 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.8.1 Debug Comparator Control Register (DBGXCTL) The contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the DBG module register address map. Address: 0x0028 7 6 5 4 3 2 1 0 R W Reset 0 0 NDB 0 TAG 0 BRK 0 RW 0 RWE 0 SRC 0 COMPE 0 = Unimplemented or Reserved Figure 16-13. Debug Comparator Control Register (Comparators A and C) Address: 0x0028 7 6 5 4 3 2 1 0 R W Reset SZE 0 SZ 0 TAG 0 BRK 0 RW 0 RWE 0 SRC 0 COMPE 0 Figure 16-14. Debug Comparator Control Register (Comparators B and D) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. The DBGC1_COMRV bits determine which comparator control, address, data and datamask registers are visible in the 8-byte window from 0x0028 to 0x002F as shown in Section Table 16-28. Table 16-28. Comparator Address Register Visibility COMRV 00 01 10 11 Visible Comparator DBGACTL, DBGAAH ,DBGAAM, DBGAAL, DBGADH, DBGADL, DBGADHM, DBGADLM DBGBCTL, DBGBAH, DBGBAM, DBGBAL DBGCCTL, DBGCAH, DBGCAM, DBGCAL, DBGCDH, DBGCDL, DBGCDHM, DBGCDLM DBGDCTL, DBGDAH, DBGDAM, DBGDAL Table 16-29. DBGXCTL Field Descriptions Field 7 SZE (Comparators B nd D) 6 NDB (Comparators A and C Description Size Comparator Enable Bit — The SZE bit controls whether access size comparison is enabled for the associated comparator. This bit is ignored if the TAG bit in the same register is set. 0 Word/Byte access size is not used in comparison 1 Word/Byte access size is used in comparison Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator register value or when the data bus differs from the register value. Furthermore data bus bits can be individually masked using the comparator data mask registers. This bit is only available for comparators A and C. This bit is ignored if the TAG bit in the same register is set. This bit position has an SZ functionality for comparators B and D. 0 Match on data bus equivalence to comparator register contents 1 Match on data bus difference to comparator register contents MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 775 Chapter 16 S12X Debug (S12XDBGV3) Module Table 16-29. DBGXCTL Field Descriptions (continued) Field 6 SZ (Comparators B and D) 5 TAG Description Size Comparator Value Bit — The SZ bit selects either word or byte access size in comparison for the associated comparator. This bit is ignored if the SZE bit is cleared or if the TAG bit in the same register is set. This bit position has NDB functionality for comparators A and C 0 Word access size will be compared 1 Byte access size will be compared Tag Select — This bit controls whether the comparator match will cause a trigger or tag the opcode at the matched address. Tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 Trigger immediately on match 1 On match, tag the opcode. If the opcode is about to be executed a trigger is generated Break — This bit controls whether a channel match terminates a debug session immediately, independent of state sequencer state. To generate an immediate breakpoint the module breakpoints must be enabled using DBGBRK. 0 The debug session termination is dependent upon the state sequencer and trigger conditions. 1 A match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the associated comparator . The RW bit is not used if RWE = 0. 0 Write cycle will be matched 1 Read cycle will be matched Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the associated comparator. This bit is not used for tagged operations. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison Determines mapping of comparator to CPU12X or XGATE 0 The comparator is mapped to CPU12X buses 1 The comparator is mapped to XGATE address and data buses Determines if comparator is enabled 0 The comparator is not enabled 1 The comparator is enabled for state sequence triggers or tag generation 4 BRK 3 RW 2 RWE 1 SRC 0 COMPE Table 16-30 shows the effect for RWE and RW on the comparison conditions. These bits are not useful for tagged operations since the trigger occurs based on the tagged opcode reaching the execution stage of the instruction queue. Thus these bits are ignored if tagged triggering is selected. Table 16-30. Read or Write Comparison Logic Table RWE Bit 0 0 1 1 1 1 RW Bit x x 0 0 1 1 RW Signal 0 1 0 1 0 1 Comment RW not used in comparison RW not used in comparison Write No match No match Read MC9S12XF - Family Reference Manual, Rev.1.19 776 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.8.2 Address: 0x0029 7 Debug Comparator Address High Register (DBGXAH) 6 5 4 3 2 1 0 R W Reset 0 0 Bit 22 0 Bit 21 0 Bit 20 0 Bit 19 0 Bit 18 0 Bit 17 0 Bit 16 0 = Unimplemented or Reserved Figure 16-15. Debug Comparator Address High Register (DBGXAH) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-31. DBGXAH Field Descriptions Field 6–0 Bit[22:16] Description Comparator Address High Compare Bits — The Comparator address high compare bits control whether the selected comparator will compare the address bus bits [22:16] to a logic one or logic zero. This register byte is ignored for XGATE compares. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 16.3.2.8.3 Address: 0x002A 7 Debug Comparator Address Mid Register (DBGXAM) 6 5 4 3 2 1 0 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 16-16. Debug Comparator Address Mid Register (DBGXAM) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-32. DBGXAM Field Descriptions Field 7–0 Bit[15:8] Description Comparator Address Mid Compare Bits— The Comparator address mid compare bits control whether the selected comparator will compare the address bus bits [15:8] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 777 Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.8.4 Address: 0x002B 7 Debug Comparator Address Low Register (DBGXAL) 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 16-17. Debug Comparator Address Low Register (DBGXAL) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-33. DBGXAL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Address Low Compare Bits — The Comparator address low compare bits control whether the selected comparator will compare the address bus bits [7:0] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 16.3.2.8.5 Address: 0x002C 7 Debug Comparator Data High Register (DBGXDH) 6 5 4 3 2 1 0 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 16-18. Debug Comparator Data High Register (DBGXDH) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-34. DBGXAH Field Descriptions Field 7–0 Bits[15:8] Description Comparator Data High Compare Bits — The Comparator data high compare bits control whether the selected comparator compares the data bus bits [15:8] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparators A and C. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one MC9S12XF - Family Reference Manual, Rev.1.19 778 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.8.6 Address: 0x002D 7 Debug Comparator Data Low Register (DBGXDL) 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 16-19. Debug Comparator Data Low Register (DBGXDL) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-35. DBGXDL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Data Low Compare Bits — The Comparator data low compare bits control whether the selected comparator compares the data bus bits [7:0] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparators A and C. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one 16.3.2.8.7 Address: 0x002E 7 Debug Comparator Data High Mask Register (DBGXDHM) 6 5 4 3 2 1 0 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 16-20. Debug Comparator Data High Mask Register (DBGXDHM) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-36. DBGXDHM Field Descriptions Field 7–0 Bits[15:8] Description Comparator Data High Mask Bits — The Comparator data high mask bits control whether the selected comparator compares the data bus bits [15:8] to the corresponding comparator data compare bits. This register is available only for comparators A and C. 0 Do not compare corresponding data bit 1 Compare corresponding data bit MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 779 Chapter 16 S12X Debug (S12XDBGV3) Module 16.3.2.8.8 Address: 0x002F 7 Debug Comparator Data Low Mask Register (DBGXDLM) 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 16-21. Debug Comparator Data Low Mask Register (DBGXDLM) Read: Anytime. See Table 16-28 for visible register encoding. Write: If DBG not armed. See Table 16-28 for visible register encoding. Table 16-37. DBGXDLM Field Descriptions Field 7–0 Bits[7:0] Description Comparator Data Low Mask Bits — The Comparator data low mask bits control whether the selected comparator compares the data bus bits [7:0] to the corresponding comparator data compare bits. This register is available only for comparators A and C. 0 Do not compare corresponding data bit 1 Compare corresponding data bit 16.4 Functional Description This section provides a complete functional description of the S12XDBG module. If the part is in secure mode, the S12XDBG module can generate breakpoints but tracing is not possible. 16.4.1 S12XDBG Operation Arming the S12XDBG module by setting ARM in DBGC1 allows triggering, and storing of data in the trace buffer and can be used to cause breakpoints to the CPU12X or the XGATE module. The DBG module is made up of four main blocks, the comparators, control logic, the state sequencer, and the trace buffer. The comparators monitor the bus activity of the CPU12X and XGATE. Comparators can be conﬁgured to monitor address and databus. Comparators can also be conﬁgured to mask out individual data bus bits during a compare and to use R/W and word/byte access qualiﬁcation in the comparison. When a match with a comparator register value occurs the associated control logic can trigger the state sequencer to another state (see Figure 16-22). Either forced or tagged triggers are possible. Using a forced trigger, the trigger is generated immediately on a comparator match. Using a tagged trigger, at a comparator match, the instruction opcode is tagged and only if the instruction reaches the execution stage of the instruction queue is a trigger generated. In the case of a transition to Final State, bus tracing is triggered and/or a breakpoint can be generated. Tracing of both CPU12X and/or XGATE bus activity is possible. Independent of the state sequencer, a breakpoint can be triggered by the external TAGHI / TAGLO signals or by an XGATE S/W breakpoint request or by writing to the TRIG bit in the DBGC1 control register. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. MC9S12XF - Family Reference Manual, Rev.1.19 780 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.2 Comparator Modes The S12XDBG contains four comparators, A, B, C, and D. Each comparator can be conﬁgured to monitor CPU12X or XGATE buses. Each comparator compares the selected address bus with the address stored in DBGXAH, DBGXAM, and DBGXAL. Furthermore, comparators A and C also compare the data buses to the data stored in DBGXDH, DBGXDL and allow masking of individual data bus bits. S12X comparator matches are disabled in BDM and during BDM accesses. The comparator match control logic conﬁgures comparators to monitor the buses for an exact address or an address range, whereby either an access inside or outside the speciﬁed range generates a match condition. The comparator conﬁguration is controlled by the control register contents and the range control by the DBGC2 contents. On a match a trigger can initiate a transition to another state sequencer state (see Section 16.4.3”). The comparator control register also allows the type of access to be included in the comparison through the use of the RWE, RW, SZE, and SZ bits. The RWE bit controls whether read or write comparison is enabled for the associated comparator and the RW bit selects either a read or write access for a valid match. Similarly the SZE and SZ bits allows the size of access (word or byte) to be considered in the compare. Only comparators B and D feature SZE and SZ. The TAG bit in each comparator control register is used to determine the triggering condition. By setting TAG, the comparator will qualify a match with the output of opcode tracking logic and a trigger occurs before the tagged instruction executes (tagged-type trigger). Whilst tagging, the RW, RWE, SZE, and SZ bits are ignored and the comparator register must be loaded with the exact opcode address. If the TAG bit is clear (forced type trigger) a comparator match is generated when the selected address appears on the system address bus. If the selected address is an opcode address, the match is generated when the opcode is fetched from the memory. This precedes the instruction execution by an indeﬁnite number of cycles due to instruction pipe lining. For a comparator match of an opcode at an odd address when TAG = 0, the corresponding even address must be contained in the comparator register. Thus for an opcode at odd address (n), the comparator register must contain address (n–1). Once a successful comparator match has occurred, the condition that caused the original match is not veriﬁed again on subsequent matches. Thus if a particular data value is veriﬁed at a given address, this address may not still contain that data value when a subsequent match occurs. Comparators C and D can also be used to select an address range to trace from. This is determined by the TRANGE bits in the DBGTCR register. The TRANGE encoding is shown in Table 16-11. If the TRANGE bits select a range deﬁnition using comparator D, then comparator D is conﬁgured for trace range deﬁnition and cannot be used for address bus comparisons. Similarly if the TRANGE bits select a range deﬁnition using comparator C, then comparator C is conﬁgured for trace range deﬁnition and cannot be used for address bus comparisons. Match[0, 1, 2, 3] map directly to Comparators[A, B, C, D] respectively, except in range modes (see Section 16.3.2.4”). Comparator priority rules are described in the trigger priority section (Section 16.4.3.6”). MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 781 Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.2.1 Exact Address Comparator Match (Comparators A and C) With range comparisons disabled, the match condition is an exact equivalence of address/data bus with the value stored in the comparator address/data registers. Further qualiﬁcation of the type of access (R/W, word/byte) is possible. Comparators A and C do not feature SZE or SZ control bits, thus the access size is not compared. The exact address is compared, thus with the comparator address register loaded with address (n) a word access of address (n–1) also accesses (n) but does not cause a match. Table 16-39 lists access considerations without data bus compare. Table 16-38 lists access considerations with data bus comparison. To compare byte accesses DBGXDH must be loaded with the data byte, the low byte must be masked out using the DBGXDLM mask register. On word accesses the data byte of the lower address is mapped to DBGXDH. Table 16-38. Comparator A and C Data Bus Considerations Access Word Byte Word Word Address ADDR[n] ADDR[n] ADDR[n] ADDR[n] DBGxDH Data[n] Data[n] Data[n] x DBGxDL Data[n+1] x x Data[n+1] DBGxDHM $FF $FF $FF $00 DBGxDLM $FF $00 $00 $FF Example Valid Match MOVW #$WORD ADDR[n] MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] MOVW #$WORD ADDR[n] Comparators A and C feature an NDB control bit to determine if a match occurs when the data bus differs to comparator register contents or when the data bus is equivalent to the comparator register contents. 16.4.2.2 Exact Address Comparator Match (Comparators B and D) Comparators B and D feature SZ and SZE control bits. If SZE is clear, then the comparator address match qualiﬁcation functions the same as for comparators A and C. If the SZE bit is set the access size (word or byte) is compared with the SZ bit value such that only the speciﬁed type of access causes a match. Thus if conﬁgured for a byte access of a particular address, a word access covering the same address does not lead to match. Table 16-39. Comparator Access Size Considerations Comparator Comparators A and C Comparators B and D Comparators B and D Address ADDR[n] SZE — SZ8 — Condition For Valid Match Word and byte accesses of ADDR[n](1) MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Word and byte accesses of ADDR[n]1 MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Word accesses of ADDR[n]1 MOVW #$WORD ADDR[n] ADDR[n] 0 X ADDR[n] 1 0 Comparators ADDR[n] 1 1 Byte accesses of ADDR[n] B and D MOVB #$BYTE ADDR[n] 1. A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address used in the code. MC9S12XF - Family Reference Manual, Rev.1.19 782 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.2.3 Data Bus Comparison NDB Dependency Comparators A and C each feature an NDB control bit, which allows data bus comparators to be conﬁgured to either trigger on equivalence or trigger on difference. This allows monitoring of a difference in the contents of an address location from an expected value. When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by clearing the corresponding mask bit (DBGxDHM/DBGxDLM), so that it is ignored in the comparison. A match occurs when all data bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is based on the address bus only, the data bus is ignored. When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored and prevents a match because no difference can be detected. In this case address bus equivalence does not cause a match. Table 16-40. NDB and MASK bit dependency NDB 0 0 1 1 DBGxDHM[n] / DBGxDLM[n] 0 1 0 1 Comment Do not compare data bus bit. Compare data bus bit. Match on equivalence. Do not compare data bus bit. Compare data bus bit. Match on difference. 16.4.2.4 Range Comparisons When using the AB comparator pair for a range comparison, the data bus can also be used for qualiﬁcation by using the comparator A data and data mask registers. Furthermore the DBGACTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access. The corresponding DBGBCTL bits are ignored. Similarly when using the CD comparator pair for a range comparison, the data bus can also be used for qualiﬁcation by using the comparator C data and data mask registers. Furthermore the DBGCCTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access if tagging is not selected. The corresponding DBGDCTL bits are ignored. The SZE and SZ control bits are ignored in range mode. The comparator A and C TAG bits are used to tag range comparisons for the AB and CD ranges respectively. The comparator B and D TAG bits are ignored in range modes. In order for a range comparison using comparators A and B, both COMPEA and COMPEB must be set; to disable range comparisons both must be cleared. Similarly for a range CD comparison, both COMPEC and COMPED must be set. If a range mode is selected SRCA and SRCC select the source (S12X or XGATE), SRCB and SRCD are ignored. The comparator A and C BRK bits are used for the AB and CD ranges respectively, the comparator B and D BRK bits are ignored in range mode. When conﬁgured for range comparisons and tagging, the ranges are accurate only to word boundaries. 16.4.2.4.1 Inside Range (CompAC_Addr ≤ address ≤ CompBD_Addr) In the Inside Range comparator mode, either comparator pair A and B or comparator pair C and D can be conﬁgured for range comparisons by the control register (DBGC2). The match condition requires that a valid match for both comparators happens on the same bus cycle. A match condition on only one MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 783 Chapter 16 S12X Debug (S12XDBGV3) Module comparator is not valid. An aligned word access which straddles the range boundary will cause a trigger only if the aligned address is inside the range. 16.4.2.4.2 Outside Range (address < CompAC_Addr or address > CompBD_Addr) In the Outside Range comparator mode, either comparator pair A and B or comparator pair C and D can be conﬁgured for range comparisons. A single match condition on either of the comparators is recognized as valid. An aligned word access which straddles the range boundary will cause a trigger only if the aligned address is outside the range. Outside range mode in combination with tagged triggers can be used to detect if the opcode fetches are from an unexpected range. In forced trigger modes the outside range trigger would typically be activated at any interrupt vector fetch or register access. This can be avoided by setting the upper range limit to $7FFFFF or lower range limit to $000000 respectively. When comparing the XGATE address bus in outside range mode, the initial vector fetch as determined by the vector contained in the XGATE XGVBR register should be taken into consideration. The XGVBR register and hence vector address can be modiﬁed. 16.4.3 Trigger Modes Trigger modes are used as qualiﬁers for a state sequencer change of state. The control logic determines the trigger mode and provides a trigger to the state sequencer. The individual trigger modes are described in the following sections. 16.4.3.1 Forced Trigger On Comparator Match If a forced trigger comparator match occurs, the trigger immediately initiates a transition to the next state sequencer state whereby the corresponding ﬂags in DBGSR are set. The state control register for the current state determines the next state for each trigger. Forced triggers are generated as soon as the matching address appears on the address bus, which in the case of opcode fetches occurs several cycles before the opcode execution. For this reason a forced trigger of an opcode address precedes a tagged trigger at the same address by several cycles. 16.4.3.2 Trigger On Comparator Related Taghit If a CPU12X or XGATE taghit occurs, a transition to another state sequencer state is initiated and the corresponding DBGSR ﬂags are set. For a comparator related taghit to occur, the S12XDBG must ﬁrst generate tags based on comparator matches. When the tagged instruction reaches the execution stage of the instruction queue a taghit is generated by the CPU12X/XGATE. The state control register for the current state determines the next state for each trigger. 16.4.3.3 External Tagging Trigger In external tagging trigger mode, the TAGLO and TAGHI pins (mapped to device pins) are used to tag an instruction. This function can be used as another breakpoint source. When the tagged opcode reaches the execution stage of the instruction queue a transition to the disarmed state0 occurs, ending the debug session MC9S12XF - Family Reference Manual, Rev.1.19 784 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module and generating a breakpoint, if breakpoints are enabled. External tagging is only possible in device emulation modes. 16.4.3.4 Trigger On XGATE S/W Breakpoint Request The XGATE S/W breakpoint request issues a forced breakpoint request to the CPU12X immediately independent of S12XDBG settings and triggers the state sequencer into the disarmed state. Active tracing sessions are terminated immediately, thus if tracing has not yet begun, no trace information is stored. XGATE generated breakpoints are independent of the DBGBRK bits. The XGSBPE bit in DBGC1 determines if the XGATE S/W breakpoint function is enabled. The BDM bit in DBGC1 determines if the XGATE requested breakpoint causes the system to enter BDM Mode or initiate a software interrupt (SWI). 16.4.3.5 TRIG Immediate Trigger Independent of comparator matches or external tag signals it is possible to initiate a tracing session and/or breakpoint by writing the TRIG bit in DBGC1 to a logic “1”. If conﬁgured for begin or mid aligned tracing, this triggers the state sequencer into the Final State, if conﬁgured for end alignment, setting the TRIG bit disarms the module, ending the session. If breakpoints are enabled, a forced breakpoint request is issued immediately (end alignment) or when tracing has completed (begin or mid alignment). 16.4.3.6 Trigger Priorities In case of simultaneous triggers, the priority is resolved according to Table 16-41. The lower priority trigger is suppressed. It is thus possible to miss a lower priority trigger if it occurs simultaneously with a trigger of a higher priority. The trigger priorities described in Table 16-41 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to ﬁnal state has priority over all other matches independent of current state sequencer state. When conﬁgured for range modes a simultaneous match of comparators A and C generates an active match0 whilst match2 is suppressed. If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. Table 16-41. Trigger Priorities Priority Highest Source XGATE TRIG External TAGHI/TAGLO Match0 (force or tag hit) Match1 (force or tag hit) Match2 (force or tag hit) Lowest Match3 (force or tag hit) Action Immediate forced breakpoint......(Tracing terminated immediately). Trigger immediately to ﬁnal state (begin or mid aligned tracing enabled) Trigger immediately to state 0 (end aligned or no tracing enabled) Enter State0 Trigger to next state as deﬁned by state control registers Trigger to next state as deﬁned by state control registers Trigger to next state as deﬁned by state control registers Trigger to next state as deﬁned by state control registers MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 785 Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.4 State Sequence Control ARM = 0 State 0 (Disarmed) ARM = 1 State1 ARM = 0 Session Complete (Disarm) Final State ARM = 0 State3 State2 Figure 16-22. State Sequencer Diagram The state sequencer allows a deﬁned sequence of events to provide a trigger point for tracing of data in the trace buffer. Once the S12XDBG module has been armed by setting the ARM bit in the DBGC1 register, then state1 of the state sequencer is entered. Further transitions between the states are then controlled by the state control registers and depend upon a selected trigger mode condition being met. From Final State the only permitted transition is back to the disarmed state0. Transition between any of the states 1 to 3 is not restricted. Each transition updates the SSF[2:0] ﬂags in DBGSR accordingly to indicate the current state. Alternatively by setting the TRIG bit in DBGSC1, the state machine can be triggered to state0 or Final State depending on tracing alignment. A tag hit through TAGHI/TAGLO brings the state sequencer immediately into state0, causes a breakpoint, if breakpoints are enabled, and ends tracing immediately independent of the trigger alignment bits TALIGN[1:0]. Independent of the state sequencer, each comparator channel can be individually conﬁgured to generate an immediate breakpoint when a match occurs through the use of the BRK bits in the DBGxCTL registers. Thus it is possible to generate an immediate breakpoint on selected channels, whilst a state sequencer transition can be initiated by a match on other channels. If a debug session is ended by a trigger on a channel with BRK = 1, the state sequencer transitions through Final State for a clock cycle to state0. This is independent of tracing and breakpoint activity, thus with tracing and breakpoints disabled, the state sequencer enters state0 and the debug module is disarmed. An XGATE S/W breakpoint request, if enabled causes a transition to the State0 and generates a breakpoint request to the CPU12X immediately. 16.4.4.1 Final State On entering Final State a trigger may be issued to the trace buffer according to the trace position control as deﬁned by the TALIGN ﬁeld (see Section 16.3.2.3”). If TSOURCE in the trace control register DBGTCR are cleared then the trace buffer is disabled and the transition to Final State can only generate a breakpoint request. In this case or upon completion of a tracing session when tracing is enabled, the ARM MC9S12XF - Family Reference Manual, Rev.1.19 786 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module bit in the DBGC1 register is cleared, returning the module to the disarmed state0. If tracing is enabled a breakpoint request can occur at the end of the tracing session. If neither tracing nor breakpoints are enabled then when the ﬁnal state is reached it returns automatically to state0 and the debug module is disarmed. 16.4.5 Trace Buffer Operation The trace buffer is a 64 lines deep by 64-bits wide RAM array. The S12XDBG module stores trace information in the RAM array in a circular buffer format. The RAM array can be accessed through a register window (DBGTBH:DBGTBL) using 16-bit wide word accesses. After each complete 64-bit trace buffer line is read, an internal pointer into the RAM is incremented so that the next read will receive fresh information. Data is stored in the format shown in Table 16-42. After each store the counter register bits DBGCNT[6:0] are incremented. Tracing of CPU12X activity is disabled when the BDM is active but tracing of XGATE activity is still possible. Reading the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not incremented. 16.4.5.1 Trace Trigger Alignment Using the TALIGN bits (see Section 16.3.2.3”) it is possible to align the trigger with the end, the middle, or the beginning of a tracing session. If End or Mid tracing is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is entered. The transition to Final State if End is selected signals the end of the tracing session. The transition to Final State if Mid is selected signals that another 32 lines will be traced before ending the tracing session. Tracing with Begin-Trigger starts at the opcode of the trigger. 16.4.5.1.1 Storing with Begin-Trigger Storing with Begin-Trigger, data is not stored in the Trace Buffer until the Final State is entered. Once the trigger condition is met the S12XDBG module will remain armed until 64 lines are stored in the Trace Buffer. If the trigger is at the address of the change-of-ﬂow instruction the change of ﬂow associated with the trigger will be stored in the Trace Buffer. Using Begin-trigger together with tagging, if the tagged instruction is about to be executed then the trace is started. Upon completion of the tracing session the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 16.4.5.1.2 Storing with Mid-Trigger Storing with Mid-Trigger, data is stored in the Trace Buffer as soon as the S12XDBG module is armed. When the trigger condition is met, another 32 lines will be traced before ending the tracing session, irrespective of the number of lines stored before the trigger occurred, then the S12XDBG module is disarmed and no more data is stored. Using Mid-trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. Upon tracing completion the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 787 Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.5.1.3 Storing with End-Trigger Storing with End-Trigger, data is stored in the Trace Buffer until the Final State is entered, at which point the S12XDBG module will become disarmed and no more data will be stored. If the trigger is at the address of a change of ﬂow instruction the trigger event will not be stored in the Trace Buffer. 16.4.5.2 Trace Modes The S12XDBG module can operate in four trace modes. The mode is selected using the TRCMOD bits in the DBGTCR register. In each mode tracing of XGATE or CPU12X information is possible. The source for the trace is selected using the TSOURCE bits in the DBGTCR register. The modes are described in the following subsections. The trace buffer organization is shown in Table 16-42. 16.4.5.2.1 Normal Mode In Normal Mode, change of ﬂow (COF) program counter (PC) addresses will be stored. COF addresses are deﬁned as follows for the CPU12X: • Source address of taken conditional branches (long, short, bit-conditional, and loop primitives) • Destination address of indexed JMP, JSR, and CALL instruction. • Destination address of RTI, RTS, and RTC instructions • Vector address of interrupts, except for SWI and BDM vectors LBRA, BRA, BSR, BGND as well as non-indexed JMP, JSR, and CALL instructions are not classiﬁed as change of ﬂow and are not stored in the trace buffer. COF addresses are deﬁned as follows for the XGATE: • Source address of taken conditional branches • Destination address of indexed JAL instructions. • First XGATE code address in a thread Change-of-ﬂow addresses stored include the full 23-bit address bus of CPU12X, the 16-bit address bus for the XGATE module and an information byte, which contains a source/destination bit to indicate whether the stored address was a source address or destination address. NOTE When an CPU12X COF instruction with destination address is executed, the destination address is stored to the trace buffer on instruction completion, indicating the COF has taken place. If an interrupt occurs simultaneously then the next instruction carried out is actually from the interrupt service routine. The instruction at the destination address of the original program ﬂow gets exectuted after the interrupt service routine. MC9S12XF - Family Reference Manual, Rev.1.19 788 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module In the following example an IRQ interrupt occurs during execution of the indexed JMP at address MARK1. The BRN at the destination (SUB_1) is not executed until after the IRQ service routine but the destination address is entered into the trace buffer to indicate that the indexed JMP COF has taken place. MARK1 MARK2 SUB_1 LDX JMP NOP BRN NOP DBNE LDAB STAB RTI #SUB_1 0,X ; IRQ interrupt occurs during execution of this ; ; JMP Destination address TRACE BUFFER ENTRY 1 ; RTI Destination address TRACE BUFFER ENTRY 3 ; ; Source address TRACE BUFFER ENTRY 4 ; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2 ; * ADDR1 IRQ_ISR A,PART5 #$F0 VAR_C1 The execution ﬂow taking into account the IRQ is as follows MARK1 IRQ_ISR LDX JMP LDAB STAB RTI BRN NOP DBNE #SUB_1 0,X #$F0 VAR_C1 * A,PART5 ; ; ; ; ; SUB_1 ADDR1 16.4.5.2.2 Loop1 Mode Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it however allows the ﬁltering out of redundant information. The intent of Loop1 Mode is to prevent the Trace Buffer from being ﬁlled entirely with duplicate information from a looping construct such as delays using the DBNE instruction or polling loops using BRSET/BRCLR instructions. Immediately after address information is placed in the Trace Buffer, the S12XDBG module writes this value into a background register. This prevents consecutive duplicate address entries in the Trace Buffer resulting from repeated branches. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 789 Chapter 16 S12X Debug (S12XDBGV3) Module Loop1 Mode only inhibits consecutive duplicate source address entries that would typically be stored in most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector addresses, since repeated entries of these would most likely indicate a bug in the user’s code that the S12XDBG module is designed to help ﬁnd. NOTE In certain very tight loops, the source address will have already been fetched again before the background comparator is updated. This results in the source address being stored twice before further duplicate entries are suppressed. This condition occurs with branch-on-bit instructions when the branch is fetched by the ﬁrst P-cycle of the branch or with loop-construct instructions in which the branch is fetched with the ﬁrst or second P cycle. See examples below: LOOP INX BRCLR CMPTMP,#$0c, LOOP ; 1-byte instruction fetched by 1st P-cycle of BRCLR ; the BRCLR instruction also will be fetched by 1st ; P-cycle of BRCLR ; 2-byte instruction fetched by 1st P-cycle of DBNE ; 1-byte instruction fetched by 2nd P-cycle of DBNE ; this instruction also fetched by 2nd P-cycle of DBNE LOOP2 BRN NOP DBNE * A,LOOP2 16.4.5.2.3 Detail Mode In Detail Mode, address and data for all memory and register accesses is stored in the trace buffer. In the case of XGATE tracing this means that initialization of the R1 register during a vector fetch is not traced. This mode is intended to supply additional information on indexed, indirect addressing modes where storing only the destination address would not provide all information required for a user to determine where the code is in error. This mode also features information byte entries to the trace buffer, for each address byte entry. The information byte indicates the size of access (word or byte) and the type of access (read or write). When tracing CPU12X activity in Detail Mode, all cycles are traced except those when the CPU12X is either in a free or opcode fetch cycle. In this mode the XGATE program counter is also traced to provide a snapshot of the XGATE activity. CXINF information byte bits indicate the type of XGATE activity occurring at the time of the trace buffer entry. When tracing CPU12X activity alone in Detail Mode, the address range can be limited to a range speciﬁed by the TRANGE bits in DBGTCR. This function uses comparators C and D to deﬁne an address range inside which CPU12X activity should be traced (see Table 16-42). Thus the traced CPU12X activity can be restricted to particular register range accesses. When tracing XGATE activity in Detail Mode, all load and store cycles are traced. Additionally the CPU12X program counter is stored at the time of the XGATE trace buffer entry to provide a snapshot of CPU12X activity. 16.4.5.2.4 Pure PC Mode In Pure PC Mode, tracing from the CPU the PC addresses of all executed opcodes, including illegal opcodes, are stored. In Pure PC Mode, tracing from the XGATE the PC addresses of all executed opcodes are stored. MC9S12XF - Family Reference Manual, Rev.1.19 790 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.5.3 Trace Buffer Organization Referring to Table 16-42. An X preﬁx denotes information from the XGATE module, a C preﬁx denotes information from the CPU12X. ADRH, ADRM, ADRL denote address high, middle and low byte respectively. INF bytes contain control information (R/W, S/D etc.). The numerical sufﬁx indicates which tracing step. The information format for Loop1 Mode and PurePC Mode is the same as that of Normal Mode. Whilst tracing from XGATE or CPU12X only, in Normal or Loop1 modes each array line contains 2 data entries, thus in this case the DBGCNT[0] is incremented after each separate entry. In Detail mode DBGCNT[0] remains cleared whilst the other DBGCNT bits are incremented on each trace buffer entry. XGATE and CPU12X COFs occur independently of each other and the proﬁle of COFs for the two sources is totally different. When both sources are being traced in Normal or Loop1 mode, for each COF from one source, there may be many COFs from the other source, depending on user code. COF events could occur far from each other in the time domain, on consecutive cycles or simultaneously. When a COF occurs in either source (S12X or XGATE) a trace buffer entry is made and the corresponding CDV or XDV bit is set. The current PC of the other source is simultaneously stored to the trace buffer even if no COF has occurred, in which case CDV/XDV remains cleared indicating the address is not associated with a COF, but is simply a snapshot of the PC contents at the time of the COF from the other source. Single byte data accesses in Detail Mode are always stored to the low byte of the trace buffer (CDATAL or XDATAL) and the high byte is cleared. When tracing word accesses, the byte at the lower address is always stored to trace buffer byte3 and the byte at the higher address is stored to byte2 Table 16-42. Trace Buffer Organization Mode 8-Byte Wide Word Buffer 7 CXINF1 CXINF2 CXINF1 CXINF2 XINF0 XINF1 XINF1 XINF3 CINF1 CINF3 CPCH1 CPCH3 6 CADRH1 CADRH2 CADRH1 CADRH2 5 CADRM1 CADRM2 CADRM1 CADRM2 XPCM0 XPCM1 XPCM1 XPCM3 CPCM1 CPCM3 4 CADRL1 CADRL2 CADRL1 CADRL2 XPCL0 XPCL1 XPCL1 XPCL3 CPCL1 CPCL3 3 XDATAH1 XDATAH2 CDATAH1 CDATAH2 CINF0 CINF1 XINF0 XINF2 CINF0 CINF2 CPCH0 CPCH2 2 XDATAL1 XDATAL2 CDATAL1 CDATAL2 CPCH0 CPCH1 1 XADRM1 XADRM2 XADRM1 XADRM2 CPCM0 CPCM1 XPCM0 XPCM2 CPCM0 CPCM2 0 XADRL1 XADRL2 XADRL1 XADRL2 CPCL0 CPCL1 XPCL0 XPCL2 CPCL0 CPCL2 XGATE Detail CPU12X Detail Both Other Modes XGATE Other Modes CPU12X Other Modes MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 791 Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.5.3.1 Information Byte Organization The format of the control information byte is dependent upon the active trace mode as described below. In Normal, Loop1, or Pure PC modes tracing of XGATE activity, XINF is used to store control information. In Normal, Loop1, or Pure PC modes tracing of CPU12X activity, CINF is used to store control information. In Detail Mode, CXINF contains the control information XGATE Information Byte Bit 7 XSD Bit 6 XSOT Bit 5 XCOT Bit 4 XDV Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 16-23. XGATE Information Byte XINF Table 16-43. XINF Field Descriptions Field 7 XSD Description Source Destination Indicator — This bit indicates if the corresponding stored address is a source or destination address. This is only used in Normal and Loop1 mode tracing. 0 Source address 1 Destination address or Start of Thread or Continuation of Thread Source Of Thread Indicator — This bit indicates that the corresponding stored address is a start of thread address. This is only used in Normal and Loop1 mode tracing. NOTE. This bit only has effect on devices where the XGATE module supports multiple interrupt levels. 0 Stored address not from a start of thread 1 Stored address from a start of thread Continuation Of Thread Indicator — This bit indicates that the corresponding stored address is the ﬁrst address following a return from a higher priority thread. This is only used in Normal and Loop1 mode tracing. NOTE. This bit only has effect on devices where the XGATE module supports multiple interrupt levels. 0 Stored address not from a continuation of thread 1 Stored address from a continuation of thread Data Invalid Indicator — This bit indicates if the trace buffer entry is invalid. It is only used when tracing from both sources in Normal, Loop1 and Pure PC modes, to indicate that the XGATE trace buffer entry is valid. 0 Trace buffer entry is invalid 1 Trace buffer entry is valid 6 XSOT 5 XCOT 4 XDV XGATE info bit setting XGATE FLOW XSD XSOT XCOT SOT1 SOT2 JAL RTS COT1 RTS Figure 16-24. XGATE info bit setting Figure 16-24 indicates the XGATE information bit setting when switching between threads, the initial thread starting at SOT1 and continuing at COT1 after the higher priority thread2 has ended. MC9S12XF - Family Reference Manual, Rev.1.19 792 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module CPU12X Information Byte Bit 7 CSD Bit 6 CVA Bit 5 0 Bit 4 CDV Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 16-25. CPU12X Information Byte CINF Table 16-44. CINF Field Descriptions Field 7 CSD Description Source Destination Indicator — This bit indicates if the corresponding stored address is a source or destination address. This is only used in Normal and Loop1 mode tracing. 0 Source address 1 Destination address Vector Indicator — This bit indicates if the corresponding stored address is a vector address.. Vector addresses are destination addresses, thus if CVA is set, then the corresponding CSD is also set. This is only used in Normal and Loop1 mode tracing. This bit has no meaning in Pure PC mode. 0 Indexed jump destination address 1 Vector destination address Data Invalid Indicator — This bit indicates if the trace buffer entry is invalid. It is only used when tracing from both sources in Normal, Loop1 and Pure PC modes, to indicate that the CPU12X trace buffer entry is valid. 0 Trace buffer entry is invalid 1 Trace buffer entry is valid 6 CVA 4 CDV CXINF Information Byte Bit 7 CFREE Bit 6 CSZ Bit 5 CRW Bit 4 COCF Bit 3 XACK Bit 2 XSZ Bit 1 XRW Bit 0 XOCF Figure 16-26. Information Byte CXINF This describes the format of the information byte used only when tracing from CPU12X or XGATE in Detail Mode. When tracing from the CPU12X in Detail Mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. The XGATE entry stored on the same line is a snapshot of the XGATE program counter. In this case the CSZ and CRW bits indicate the type of access being made by the CPU12X, whilst the XACK and XOCF bits indicate if the simultaneous XGATE cycle is a free cycle (no bus acknowledge) or opcode fetch cycle. Similarly when tracing from the XGATE in Detail Mode, information is stored to the trace buffer on all cycles except opcode fetch and free cycles. The CPU12X entry stored on the same line is a snapshot of the CPU12X program counter. In this case the XSZ and XRW bits indicate the type of access being made by the XGATE, whilst the CFREE and COCF bits indicate if the simultaneous CPU12X cycle is a free cycle or opcode fetch cycle. Table 16-45. CXINF Field Descriptions Field 7 CFREE Description CPU12X Free Cycle Indicator — This bit indicates if the stored CPU12X address corresponds to a free cycle. This bit only contains valid information when tracing the XGATE accesses in Detail Mode. 0 Stored information corresponds to free cycle 1 Stored information does not correspond to free cycle MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 793 Chapter 16 S12X Debug (S12XDBGV3) Module Table 16-45. CXINF Field Descriptions (continued) Field 6 CSZ Description Access Type Indicator — This bit indicates if the access was a byte or word size access.This bit only contains valid information when tracing CPU12X activity in Detail Mode. 0 Word Access 1 Byte Access Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access. This bit only contains valid information when tracing CPU12X activity in Detail Mode. 0 Write Access 1 Read Access CPU12X Opcode Fetch Indicator — This bit indicates if the stored address corresponds to an opcode fetch cycle. This bit only contains valid information when tracing the XGATE accesses in Detail Mode. 0 Stored information does not correspond to opcode fetch cycle 1 Stored information corresponds to opcode fetch cycle XGATE Access Indicator — This bit indicates if the stored XGATE address corresponds to a free cycle. This bit only contains valid information when tracing the CPU12X accesses in Detail Mode. 0 Stored information corresponds to free cycle 1 Stored information does not correspond to free cycle Access Type Indicator — This bit indicates if the access was a byte or word size access. This bit only contains valid information when tracing XGATE activity in Detail Mode. 0 Word Access 1 Byte Access Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access. This bit only contains valid information when tracing XGATE activity in Detail Mode. 0 Write Access 1 Read Access XGATE Opcode Fetch Indicator — This bit indicates if the stored address corresponds to an opcode fetch cycle.This bit only contains valid information when tracing the CPU12X accesses in Detail Mode. 0 Stored information does not correspond to opcode fetch cycle 1 Stored information corresponds to opcode fetch cycle 5 CRW 4 COCF 3 XACK 2 XSZ 1 XRW 0 XOCF 16.4.5.4 Reading Data from Trace Buffer The data stored in the Trace Buffer can be read using either the background debug module (BDM) module, the XGATE or the CPU12X provided the S12XDBG module is not armed, is conﬁgured for tracing and the system not secured. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by an aligned word write to DBGTB when the module is disarmed. The Trace Buffer can only be read through the DBGTB register using aligned word reads, any byte or misaligned reads return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. The Trace Buffer data is read out ﬁrst-in ﬁrst-out. By reading CNT in DBGCNT the number of valid 64-bit lines can be determined. DBGCNT will not decrement as data is read. Whilst reading an internal pointer is used to determine the next line to be read. After a tracing session, the pointer points to the oldest data entry, thus if no overﬂow has occurred, the pointer points to line0, otherwise it points to the line with the oldest entry. The pointer is initialized by each aligned write to MC9S12XF - Family Reference Manual, Rev.1.19 794 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module DBGTBH to point to the oldest data again. This enables an interrupted trace buffer read sequence to be easily restarted from the oldest data entry. The least signiﬁcant word of each 64-bit wide array line is read out ﬁrst. This corresponds to the bytes 1 and 0 of Table 16-42. The bytes containing invalid information (shaded in Table 16-42) are also read out. Reading the Trace Buffer while the S12XDBG module is armed will return invalid data and no shifting of the RAM pointer will occur. 16.4.5.5 Trace Buffer Reset State The Trace Buffer contents are not initialized by a system reset. Thus should a system reset occur, the trace session information from immediately before the reset occurred can be read out. The DBGCNT bits are not cleared by a system reset. Thus should a reset occur, the number of valid lines in the trace buffer is indicated by DBGCNT. The internal pointer to the current trace buffer address is initialized by unlocking the trace buffer thus points to the oldest valid data even if a reset occurred during the tracing session. Generally debugging occurrences of system resets is best handled using mid or end trigger alignment since the reset may occur before the trace trigger, which in the begin trigger alignment case means no information would be stored in the trace buffer. 16.4.6 Tagging A tag follows program information as it advances through the instruction queue. When a tagged instruction reaches the head of the queue a tag hit occurs and triggers the state sequencer. Each comparator control register features a TAG bit, which controls whether the comparator match will cause a trigger immediately or tag the opcode at the matched address. If a comparator is enabled for tagged comparisons, the address stored in the comparator match address registers must be an opcode address for the trigger to occur. Both CPU12X and XGATE opcodes can be tagged with the comparator register TAG bits. Using Begin trigger together with tagging, if the tagged instruction is about to be executed then the transition to the next state sequencer state occurs. If the transition is to the Final State, tracing is started. Only upon completion of the tracing session can a breakpoint be generated. Similarly using Mid trigger with tagging, if the tagged instruction is about to be executed then the trace is continued for another 32 lines. Upon tracing completion the breakpoint is generated. Using End trigger, when the tagged instruction is about to be executed and the next transition is to Final State then a breakpoint is generated immediately, before the tagged instruction is carried out. R/W monitoring is not useful for tagged operations since the trigger occurs based on the tagged opcode reaching the execution stage of the instruction queue. Similarly access size (SZ) monitoring and data bus monitoring is not useful if tagged triggering is selected, since the tag is attached to the opcode at the matched address and is not dependent on the data bus nor on the size of access. Thus these bits are ignored if tagged triggering is selected. When conﬁgured for range comparisons and tagging, the ranges are accurate only to word boundaries. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 795 Chapter 16 S12X Debug (S12XDBGV3) Module S12X tagging is disabled when the BDM becomes active. XGATE tagging is possible when the BDM is active. 16.4.6.1 External Tagging using TAGHI and TAGLO External tagging using the external TAGHI and TAGLO pins can only be used to tag CPU12X opcodes; tagging of XGATE code using these pins is not possible. An external tag triggers the state sequencer into state0 when the tagged opcode reaches the execution stage of the instruction queue. The pins operate independently, thus the state of one pin does not affect the function of the other. External tagging is possible in emulation modes only. The presence of logic level 0 on either pin at the rising edge of the external clock (ECLK) performs the function indicated in the Table 16-46. It is possible to tag both bytes of an instruction word. If a taghit occurs, a breakpoint can be generated as deﬁned by the DBGBRK and BDM bits in DBGC1. Each time TAGHI or TAGLO are low on the rising edge of ECLK, the old tag is replaced by a new one. Table 16-46. Tag Pin Function TAGHI 1 1 0 0 TAGLO 1 0 1 0 Tag No tag Low byte High byte Both bytes 16.4.6.2 Unconditional Tagging Function In emulation modes a low assertion of PE5/TAGLO/MODA in the 7th or 8th bus cycle after reset enables the unconditional tagging function, allowing immediate tagging via TAGHI/TAGLO with breakpoint to BDM independent of the ARM, BDM and DBGBRK bits. Conversely these bits are not affected by unconditional tagging. The unconditional tagging function remains enabled until the next reset. This function allows an immediate entry to BDM in emulation modes before user code execution. The TAGLO assertion must be in the 7th or 8th bus cycle following the end of reset, whereby the prior RESET pin assertion lasts the full 192 bus cycles. 16.4.7 Breakpoints Breakpoints can be generated as follows. • Through XGATE software breakpoint requests. • From comparator channel triggers to ﬁnal state. • Using software to write to the TRIG bit in the DBGC1 register. • From taghits generated using the external TAGHI and TAGLO pins. Breakpoints generated by the XGATE module or via the BDM BACKGROUND command have no affect on the CPU12X in STOP or WAIT mode. MC9S12XF - Family Reference Manual, Rev.1.19 796 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.7.1 XGATE Software Breakpoints The XGATE software breakpoint instruction BRK can request an CPU12X breakpoint, via the S12XDBG module. In this case, if the XGSBPE bit is set, the S12XDBG module immediately generates a forced breakpoint request to the CPU12X, the state sequencer is returned to state0 and tracing, if active, is terminated. If conﬁgured for BEGIN trigger and tracing has not yet been triggered from another source, the trace buffer contains no information. Breakpoint requests from the XGATE module do not depend upon the state of the DBGBRK or ARM bits in DBGC1. They depend solely on the state of the XGSBPE and BDM bits. Thus it is not necessary to ARM the DBG module to use XGATE software breakpoints to generate breakpoints in the CPU12X program ﬂow, but it is necessary to set XGSBPE. Furthermore, if a breakpoint to BDM is required, the BDM bit must also be set. When the XGATE requests an CPU12X breakpoint, the XGATE program ﬂow stops by default, independent of the S12XDBG module. 16.4.7.2 Breakpoints From Internal Comparator Channel Final State Triggers Breakpoints can be generated when internal comparator channels trigger the state sequencer to the Final State. If conﬁgured for tagging, then the breakpoint is generated when the tagged opcode reaches the execution stage of the instruction queue. If a tracing session is selected by TSOURCE, breakpoints are requested when the tracing session has completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 16-47). If no tracing session is selected, breakpoints are requested immediately. If the BRK bit is set on the triggering channel, then the breakpoint is generated immediately independent of tracing trigger alignment. Table 16-47. Breakpoint Setup For Both XGATE and CPU12X Breakpoints BRK 0 0 0 0 0 0 1 1 x TALIGN 00 00 01 01 10 10 00,01,10 00,01,10 11 DBGBRK[n] 0 1 0 1 0 1 1 0 x Breakpoint Alignment Fill Trace Buffer until trigger (no breakpoints — keep running) Fill Trace Buffer until trigger, then breakpoint request occurs Start Trace Buffer at trigger (no breakpoints — keep running) Start Trace Buffer at trigger A breakpoint request occurs when Trace Buffer is full Store a further 32 Trace Buffer line entries after trigger (no breakpoints — keep running) Store a further 32 Trace Buffer line entries after trigger Request breakpoint after the 32 further Trace Buffer entries Terminate tracing and generate breakpoint immediately on trigger Terminate tracing immediately on trigger Reserved MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 797 Chapter 16 S12X Debug (S12XDBGV3) Module 16.4.7.3 Breakpoints Generated Via The TRIG Bit If a TRIG triggers occur, the Final State is entered. If a tracing session is selected by TSOURCE, breakpoints are requested when the tracing session has completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 16-47). If no tracing session is selected, breakpoints are requested immediately. TRIG breakpoints are possible even if the S12XDBG module is disarmed. 16.4.7.4 Breakpoints Via TAGHI Or TAGLO Pin Taghits Tagging using the external TAGHI/TAGLO pins always ends the session immediately at the tag hit. It is always end aligned, independent of internal channel trigger alignment conﬁguration. 16.4.7.5 S12XDBG Breakpoint Priorities XGATE software breakpoints have the highest priority. Active tracing sessions are terminated immediately. If a TRIG trigger occurs after Begin or Mid aligned tracing has already been triggered by a comparator instigated transition to Final State, then TRIG no longer has an effect. When the associated tracing session is complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent trigger from a comparator channel, it has no effect, since tracing has already started. If a comparator tag hit occurs simultaneously with an external TAGHI/TAGLO hit, the state sequencer enters state0. TAGHI/TAGLO triggers are always end aligned, to end tracing immediately, independent of the tracing trigger alignment bits TALIGN[1:0]. 16.4.7.5.1 S12XDBG Breakpoint Priorities And BDM Interfacing Breakpoint operation is dependent on the state of the S12XBDM module. If the S12XBDM module is active, the CPU12X is executing out of BDM ﬁrmware and S12X breakpoints are disabled. In addition, while executing a BDM TRACE command, tagging into BDM is disabled. If BDM is not active, the breakpoint will give priority to BDM requests over SWI requests if the breakpoint coincides with a SWI instruction in the user’s code. On returning from BDM, the SWI from user code gets executed. Table 16-48. Breakpoint Mapping Summary DBGBRK[1] (DBGC1[3]) 0 1 1 1 1 1 BDM Bit (DBGC1[4]) X 0 0 1 1 1 BDM Enabled X X X 0 1 1 BDM Active X 0 1 X 0 1 S12X Breakpoint Mapping No Breakpoint Breakpoint to SWI No Breakpoint Breakpoint to SWI Breakpoint to BDM No Breakpoint BDM cannot be entered from a breakpoint unless the ENABLE bit is set in the BDM. If entry to BDM via a BGND instruction is attempted and the ENABLE bit in the BDM is cleared, the CPU12X actually MC9S12XF - Family Reference Manual, Rev.1.19 798 Freescale Semiconductor Chapter 16 S12X Debug (S12XDBGV3) Module executes the BDM ﬁrmware code. It checks the ENABLE and returns if ENABLE is not set. If not serviced by the monitor then the breakpoint is re-asserted when the BDM returns to normal CPU12X ﬂow. If the comparator register contents coincide with the SWI/BDM vector address then an SWI in user code and DBG breakpoint could occur simultaneously. The CPU12X ensures that BDM requests have a higher priority than SWI requests. Returning from the BDM/SWI service routine care must be taken to avoid re triggering a breakpoint. NOTE When program control returns from a tagged breakpoint using an RTI or BDM GO command without program counter modiﬁcation it will return to the instruction whose tag generated the breakpoint. To avoid re triggering a breakpoint at the same location reconﬁgure the S12XDBG module in the SWI routine, if conﬁgured for an SWI breakpoint, or over the BDM interface by executing a TRACE command before the GO to increment the program ﬂow past the tagged instruction. An XGATE software breakpoint is forced immediately, the tracing session terminated and the XGATE module execution stops. The user can thus determine if an XGATE breakpoint has occurred by reading out the XGATE program counter over the BDM interface. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 799 Chapter 16 S12X Debug (S12XDBGV3) Module MC9S12XF - Family Reference Manual, Rev.1.19 800 Freescale Semiconductor Chapter 17 Memory Protection Unit (S12XMPUV2) Revision History Table 17-1. Revision History Version Revision Effective Number Date Date 01.04 14 Sep 2005 14 Mar 2005 03 Aug 2006 Author Description of Changes - added note to only use the CPU to clear the AE ﬂag. - added disclaimer to avoid changing descriptors while they are in use because of other bus-masters doing accesses - clariﬁed that interrupt generation is independent of AEF bit state - corrected preliminary statement about execution of violating accesses - new spec version: MPU can now be conﬁgured for descriptor granularity and for which address range to cover 01.05 02.00 17.1 Introduction The MPU module provides basic functionality required to protect memory mapped resources from undesired accesses. Multiple address range comparators compare memory accesses against eight memory protection descriptors located in the MPU module to determine if each access is valid or not. The comparison is sensitive to which bus master generates the access and the type of the access. The MPU module can be used to isolate memory ranges accessible by different bus masters. It can be also be used by an operating system or software kernel to isolate the regions of memory “legally” available to speciﬁc software tasks, with the kernel re-conﬁguring the task speciﬁc memory protection descriptors in supervisor state during task-switching. 17.1.1 Preface Table 17-2. Terminology Term MCU MPU CPU XGATE Meaning Micro-Controller Unit Memory Protection Unit S12X Central Processing Unit (see S12XCPU Reference Manual) XGATE Co-processor (see XGATE chapter) The following terms and abbreviations are used in the document. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 801 Chapter 17 Memory Protection Unit (S12XMPUV2) Term supervisor state user state Meaning refers to the supervisor state of the S12XCPU (see S12XCPU Reference Manual) refers to the user state of the S12XCPU (see S12XCPU Reference Manual) 17.1.2 Overview The MPU module monitors the bus activity of each bus master. The data describing each access is fed into multiple address range comparators. The output of the comparators is used to determine if a particular access is allowed or represents an access violation. If an access violation caused by the S12X CPU is detected, the MPU module raises an access violation interrupt. If the MPU detects an access violation caused by a bus master other than the S12X CPU, it ﬂags an access error condition to the respective master. In addition to the restrictions deﬁned for memory ranges in the MPU descriptors, accesses to memory inside the MPU address range which are not covered by any MPU descriptor (even read accesses!) are considered access violations. Figure 17-1 shows a block diagram of the MPU module. MPU Bus Interface Bus Interface Access Validation Comparators Data Access MPU Monitoring CPU Bus Interface Bus Interface Access Validation Op-code Fetch Comparators Data Access MPU Monitoring XGATE MPU Monitoring Bus Interface Bus Interface Data Access Access Validation Comparators Status Registers “Master3” MMC Access Violation Interrupt Figure 17-1. Block Diagram MC9S12XF - Family Reference Manual, Rev.1.19 802 Freescale Semiconductor Protection Descriptors Protection Descriptors Op-code Fetch Chapter 17 Memory Protection Unit (S12XMPUV2) 17.1.3 • • Features • • Protects memory from undesired accesses coming from up to 3 bus masters1 Four memory protection descriptors — each descriptor can cover the full MPU address range2 in the global memory map (up to 8 MBytes) — the minimum granularity for each descriptor is 8 Bytes3 Each descriptor can be conﬁgured to allow one of four types of access privilege for the deﬁned memory region — Bus master has full access (read, write and execute enabled) — Bus master can read and execute (write illegal) — Bus master can read and write (execution illegal) — Bus master can only read (write and execution illegal) Accesses to memory in the MPU address range2 which are not covered by any protection descriptor will cause an access violation 17.1.4 Modes of Operation The MPU module can be used in all MCU modes. 17.2 External Signal Description The MPU module has no external signals. 17.3 Memory Map and Register Deﬁnition This section provides a detailed description of address space and registers used by the MPU module. 1. Master 3 can be implemented or left out depending the chip conﬁguration. Please refer to the SoC guide for information about the availability and function of Master 3. 2. The MPU address range is a conﬁguration option deﬁned at SoC level. Please refer to the MCU top-level chapter for details. 3. The MPU descriptor granularity is a conﬁguration option deﬁned at SoC level. Please refer to the MCU top-level chapter for details. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 803 Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1 Register Descriptions This section describes in address order all the MPU registers and their individual bits. Register Name 0x0000 MPUFLG 0x0001 MPUASTAT0 0x0002 MPUASTAT1 0x0003 MPUASTAT2 0x0004 Reserved 0x0005 MPUSEL 0x0006 MPUDESC0(1) 0x0007 MPUDESC11 0x0008 MPUDESC21 0x0009 MPUDESC31 0x000A MPUDESC41 0x000B MPUDESC51 R W R W R W R W R W R W R W R W R W R W R W R W WP NEX 0 SVSEN 0 0 0 0 SEL[2:0] 0 0 0 0 0 0 0 0 ADDR[7:0] ADDR[15:8] Bit 7 AEF 0 6 WPF 5 NEXF 4 0 3 0 2 0 1 0 Bit 0 SVSF ADDR[22:16] MSTR0 MSTR1 MSTR2 MSTR3 LOW_ADDR[22:19] LOW_ADDR[18:11] LOW_ADDR[10:3] 0 HIGH_ADDR[22:19] HIGH_ADDR[18:11] HIGH_ADDR[10:3] = Unimplemented or Reserved 1. The module addresses 0x0006−0x000B represent a window in the register map through which different descriptor registers are visible. Figure 17-2. MPU Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 804 Freescale Semiconductor Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.1 MPU Flag Register (MPUFLG) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0000 R W Reset WPF 0 NEXF 0 0 0 0 0 0 0 0 0 SVSF 0 AEF 0 Figure 17-3. MPU Flag Register (MPUFLG) Read: Anytime Write: Write of 1 clears ﬂag, write of 0 ignored Table 17-3. MPUFLG Field Descriptions Field 7 AEF Description Access Error Flag — This bit is the CPU access error interrupt ﬂag. It is set if a CPU access violation has occurred. At the same time this bit is set, all the other status ﬂags in this register and the access violation address bits in the MPUASTATn registers are captured. Clear this ﬂag by writing a one. Note: If a CPU access error is ﬂagged and both the WPF bit and the NEXF bit are zero, the access violation was caused by an access to memory in the MPU address range which is not covered by the MPU descriptors. Note: While this bit is set, the CPU in supervisor state (“Master 0”) can read from and write to the peripheral register space even if there is no memory protection descriptor explicitly allowing this. This is to prevent the case that the CPU cannot clear the AEF bit if the registers are write protected for the CPU in supervisor state. Note: This bit should only be cleared by an access from the S12X CPU. Otherwise, when using one of the other masters (such as the XGATE) to clear this bit, the status ﬂags and the address status registers may not get updated correctly if a CPU access causes a violation in the same bus cycle. Write-Protect Violation Flag — This ﬂag is set if the current CPU access violation has occurred because of an attempt to write to memory conﬁgured as read-only. The WPF bit is read-only; it will be automatically updated when the next access violation is ﬂagged with the AEF bit. No-Execute Violation Flag — This bit is set if the current CPU access violation has occurred because of an attempt to fetch code from memory conﬁgured as No-Execute. The NEXF bit is read-only; it will be automatically updated when the next access violation is ﬂagged with the AEF bit. Supervisor State Flag — This bit is set if the current CPU access violation occurred while the CPU was in supervisor state. This bit is cleared if the current CPU access violation occurred while the CPU was in user state. The supervisor state ﬂag is read-only; it will be automatically updated when the next CPU access violation is ﬂagged with the AEF bit. 6 WPF 5 NEXF 0 SVSF If the AEF bit is set further violations are not captured into the MPU status registers. The status of the AEF bit has no effect on the access restrictions, i.e. access restrictions for all masters are still enforced if the AEF bit is set. Also, the non-maskable hardware interrupt for violating accesses coming from the S12X CPU is generated regardless of the state of the AEF bit. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 805 Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.2 MPU Address Status Register 0 (MPUASTAT0) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0001 R W Reset 0 0 0 0 0 0 0 0 0 ADDR[22:16] Figure 17-4. MPU Address Status Register 0 (MPUASTAT0) Read: Anytime Write: Never Table 17-4. MPUASTAT0 Field Descriptions Field Description 6–0 Access violation address bits — The ADDR[22:16] bits contain bits [22:16] of the global address which ADDR[22:16] caused the current access violation interrupt. These bits are undeﬁned if the access error ﬂag bit (AEF) in the MPUFLG register is not set. 17.3.1.3 MPU Address Status Register 1 (MPUASTAT1) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0002 R W Reset 0 0 0 0 0 0 0 0 ADDR[15:8] Figure 17-5. MPU Address Status Register 1 (MPUASTAT1) Read: Anytime Write: Never Table 17-5. MPUASTAT1 Field Descriptions Field 7–0 ADDR[15:8] Description Access violation address bits — The ADDR[15:8] bits contain bits [15:8] of the global address which caused the current access violation interrupt. These bits are undeﬁned if the access error ﬂag bit (AEF) in the MPUFLG register is not set. MC9S12XF - Family Reference Manual, Rev.1.19 806 Freescale Semiconductor Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.4 MPU Address Status Register 2 (MPUASTAT2) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0003 R W Reset 0 0 0 0 0 0 0 0 ADDR[7:0] Figure 17-6. MPU Address Status Register (MPUASTAT2) Read: Anytime Write: Never Table 17-6. MPUASTAT2 Field Descriptions Field 7–0 ADDR[7:0] Description Access violation address bits — The ADDR[7:0] bits contain bits [7:0] of the global address which caused the current access violation interrupt. These bits are undeﬁned if the access error ﬂag bit (AEF) in the MPUFLG register is not set. 17.3.1.5 MPU Descriptor Select Register (MPUSEL) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0005 R W Reset 0 0 0 0 0 0 0 0 SVSEN 0 SEL[3:0] 0 0 Figure 17-7. MPU Descriptor Select Register (MPUSEL) Read: Anytime Write: Anytime Table 17-7. MPUSEL Field Descriptions Field 7 SVSEN Description MPU supervisor state enable bit — This bit enables the memory protection for the CPU in supervisor state. If this bit is cleared, the MPU does not affect any accesses coming from the CPU in supervisor state. This is to prevent the CPU from locking out itself while conﬁguring the protection descriptors (during initialization after a system reset and during the update of the protection descriptors for a task switch). The memory protection functionality for the other bus-masters is unaffected by this bit. 0 MPU is disabled for the CPU in supervisor state 1 MPU is enabled for the CPU in supervisor state Descriptor select bits — The SEL[3:0] bits select which descriptor is visible in the MPU Descriptor Register window (MPUDESC0—MPUDESC5). How many of the SEL[3:0] bits are writeable depends on the number of implemented descriptors. The number of implemented descriptors is a conﬁguration option deﬁned at SoC level. Please refer to the MCU toplevel chapter for details. 3–0 SEL[3:0] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 807 Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.6 MPU Descriptor Register 0 (MPUDESC0) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0006 R W MSTR0 MSTR1 MSTR2 MSTR3 LOW_ADDR[22:19] 0(3) Reset 1(1) 03 03 03 1 1 1(2) 1. initialized as set for descriptor 0 only, cleared for all others 2. initialized as set for descriptor 0 only, if respective master is implemented on the device 3. These bits are intialized to the lower boundary of the MPU address range by a system reset. Depending on deﬁned descriptor granularity and MPU address range some of these bits may not be writeable. Figure 17-8. MPU Descriptor Register 0 (MPUDESC0) Read: Anytime Write: Anytime Table 17-8. MPUDESC0 Field Descriptions Field 7 MSTR0 6 MSTR1 5 MSTR2 4 MSTR3 Description Master 0 select bit — If this bit is set the descriptor is valid for bus master 0 (CPU in supervisor state). Master 1 select bit — If this bit is set the descriptor is valid for bus master 1 (CPU in user state). This bit can only be set if the CPU supports user state. Master 2 select bit — If this bit is set the descriptor is valid for bus master 2 (XGATE). This bit can only be set if there is an XGATE implemented on the SoC. Master 3 select bit — If this bit is set the descriptor is valid for bus master 3 (FlexRay).(1) 3–0 Memory range lower boundary address bits — The LOW_ADDR[22:19] bits represent bits [22:19] of the LOW_ADDR global memory address that is used as the lower boundary for the described memory range. These bits are [22:19] intialized to the lower boundary of the MPU address range by a system reset. 1. Please refer Refernce Guide for information about the availability and function of Master 3 (see 1.9 MPU Conﬁguration). A descriptor can be conﬁgured as valid for more than one bus-master at the same time by setting multiple Master select bits to one. Setting all Master select bits of a descriptor to zero disables the descriptor. Bits for non-implemented masters cannot be written to and always read zero. MC9S12XF - Family Reference Manual, Rev.1.19 808 Freescale Semiconductor Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.7 MPU Descriptor Register 1 (MPUDESC1) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0007 R W LOW_ADDR[18:11] Reset 0(1) 01 01 01 01 01 01 01 1. These bits are intialized to the lower boundary of the MPU address range by a system reset. Depending on deﬁned descriptor granularity and MPU address range some of these bits may not be writeable. Figure 17-9. MPU Descriptor Register 1 (MPUDESC1) Read: Anytime Write: Anytime Table 17-9. MPUDESC1 Field Descriptions Field Description 7–0 Memory range lower boundary address bits — The LOW_ADDR[18:11] bits represent bits [18:11] of the LOW_ADDR[ global memory address that is used as the lower boundary for the described memory range.hese bits are 18:11] intialized to the lower boundary of the MPU address range by a system reset. 17.3.1.8 MPU Descriptor Register 2 (MPUDESC2) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0008 R W LOW_ADDR[10:3] 01 01 01 01 01 01 01 Reset 0(1) 1. These bits are intialized to the lower boundary of the MPU address range by a system reset. Depending on deﬁned descriptor granularity and MPU address range some of these bits may not be writeable. Figure 17-10. MPU Descriptor Register 2 (MPUDESC2) Read: Anytime Write: Anytime Table 17-10. MPUDESC2 Field Descriptions Field Description 7–0 Memory range lower boundary address bits — The LOW_ADDR[10:3] bits represent bits [10:3] of the global LOW_ADDR[ memory address that is used as the lower boundary for the described memory range. These bits are intialized 10:3] to the lower boundary of the MPU address range by a system reset. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 809 Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.9 MPU Descriptor Register 3 (MPUDESC3) 7 6 5 4 3 2 1 0 Address: Module Base + 0x0009 R W 0 0 WP NEX HIGH_ADDR[22:19] Reset 0 0 0 0 1(1) 11 11 11 1. These bits are intialized to the upper boundary of the MPU address range by a system reset. Depending on deﬁned descriptor granularity and MPU address range some of these bits may not be writeable. Figure 17-11. MPU Descriptor Register 3 (MPUDESC3) Read: Anytime Write: Anytime Table 17-11. MPUDESC3 Field Descriptions Field 7 WP 6 NEX Description Write-Protect bit — The WP bit causes the described memory range to be treated as write-protected. If this bit is set every attempt to write in the described memory range causes an access violation. No-Execute bit — The NEX bit prevents the described memory range from being used as code memory. If this bit is set every Op-code fetch in this memory range causes an access violation. 3–0 Memory range upper boundary address bits — The HIGH_ADDR[22:19] bits represent bits [22:19] of the HIGH_ADDR[ global memory address that is used as the upper boundary for the described memory range.These bits are 22:19] intialized to the upper boundary of the MPU address range by a system reset. 17.3.1.10 MPU Descriptor Register 4 (MPUDESC4) Address: Module Base + 0x000A 7 6 5 4 3 2 1 0 R W HIGH_ADDR[18:11] 11 11 11 11 11 11 11 Reset 1(1) 1. These bits are intialized to the upper boundary of the MPU address range by a system reset. Depending on deﬁned descriptor granularity and MPU address range some of these bits may not be writeable. Figure 17-12. MPU Descriptor Register 4 (MPUDESC4) Read: Anytime Write: Anytime Table 17-12. MPUDESC4 Field Descriptions Field Description 7–0 Memory range upper boundary address bits — The HIGH_ADDR[18:11] bits represent bits [18:11] of the HIGH_ADDR[ global memory address that is used as the upper boundary for the described memory range. These bits are 18:11] intialized to the upper boundary of the MPU address range by a system reset. MC9S12XF - Family Reference Manual, Rev.1.19 810 Freescale Semiconductor Chapter 17 Memory Protection Unit (S12XMPUV2) 17.3.1.11 MPU Descriptor Register 5 (MPUDESC5) Address: Module Base + 0x000B 7 6 5 4 3 2 1 0 R W HIGH_ADDR[10:3] Reset 1(1) 11 11 11 11 11 11 11 1. These bits are intialized to the upper boundary of the MPU address range by a system reset. Depending on deﬁned descriptor granularity and MPU address range some of these bits may not be writeable. Figure 17-13. MPU Descriptor Register 5 (MPUDESC5) Read: Anytime Write: Anytime Table 17-13. MPUDESC5 Field Descriptions Field Description 7–0 Memory range upper boundary address bits — The HIGH_ADDR[10:3] bits represent bits [10:3] of the HIGH_ADDR[ global memory address that is used as the upper boundary for the described memory range. These bits are 10:3] intialized to the upper boundary of the MPU address range by a system reset. 17.4 Functional Description The MPU module provides memory protection for accesses coming from multiple masters in the system. This is done by monitoring bus trafﬁc of each master and compare this with the conﬁguration information from a set of N1 programmable descriptors located in the MPU module. If the MPU detects an access violation caused by the S12X CPU, it will assert the CPU access violation interrupt signal. If the MPU detects an access violation caused by a bus master other than the S12X CPU, it raises an access error signal. Please refer to the documentation chapter of the individual master modules (i.e. XGATE, etc.) for more information about the access error condition. Violating accesses are not executed. The return value of a violating read access is undeﬁned for both 8 bit and 16 bit accesses. NOTE Accesses from BDM are not restricted. BDM hardware accesses always bypass the MPU. During execution of BDM ﬁrmware code S12X CPU accesses are masked from the MPU as well. 17.4.1 Protection Descriptors Each of the N protection descriptors can be used to restrict the allowed types of memory accesses for a given memory range. Each of these memory ranges can cover up the entire deﬁned MPU address range. This can be the full 23 bits global memory range (8 MBytes) of the SoC. 1. The number of implemented descriptors is a conﬁguration option deﬁned at SoC level. Please refer to the MCU toplevel chapter for details. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 811 Chapter 17 Memory Protection Unit (S12XMPUV2) The descriptors are banked in the MPU register map. Each descriptor can be selected for modifying using the SEL bits in the MPU Descriptor Select (MPUSEL) register. Table 17-14 gives an overview of the types of accesses that can be conﬁgured using the protection descriptors. Table 17-14. Access Types WP 0 0 1 1 NEX 0 1 0 1 Meaning read, write and execute read, write read and execute read only The minimum granularity of each descriptor is 8 bytes. This means the protection comparators in the MPU module cover only address bits [22:3] of each access. The lower address bits (default [2:0], depending on descriptor granularity) are ignored. NOTE A mis-aligned word access to the upper boundary address of a descriptor is always ﬂagged as an access violation. NOTE Conﬁguring the lower boundary address of a descriptor to be higher than the upper boundary address of a descriptor causes this descriptor to be ignored by the comparator block. This effectively disables the descriptor. NOTE Avoid changing descriptors while they are in active use to validate accesses from bus-masters. This can be done by temporarily disabling the affected master during the update (XGATE, Master 3, switch S12X CPU states). Otherwise accesses from bus-masters affected by a descriptor which is updated concurrently could yield undeﬁned results. 17.4.1.1 Overlapping Descriptors If the memory ranges of two protection descriptors deﬁned for the same bus-master overlap, the access restrictions for the overlapped memory range are accumulated. For example: • a memory protection descriptor deﬁnes memory range 0x40_0000−0x41_FFFF as WP=1, NEX=0 (read and execute) • another descriptor deﬁnes memory range 0x41_0000−0x43_FFFF as WP=0, NEX=1 (read and write) • the resulting access rights for the overlapping range 0x41_0000−0x41_FFFF are WP=1, NEX=1 (read only) MC9S12XF - Family Reference Manual, Rev.1.19 812 Freescale Semiconductor Chapter 17 Memory Protection Unit (S12XMPUV2) 17.4.1.2 Implicitly deﬁned memory descriptors As mentioned in the bit description of the Access Error Flag (AEF) in the MPUFLG register (Table 17-3), there is an additional memory range implicitly deﬁned only while the AEF bit is set: The CPU in supervisor state can read from and write to the peripheral register space even if there is no memory protection descriptor explicitly allowing this. This is to prevent the case that the CPU cannot clear the AEF bit if the registers are write protected for the CPU in supervisor state. The register address space containing the PAGE registers (EPAGE, RPAGE, GPAGE, PPAGE) at 0x0010− 0x0017 gets special treatment. It is deﬁned like this: • The S12X CPU can always read and write these registers, regardless of the conﬁguration in the descriptors. • XGATE or Master3 (if available) are never allowed to read or write these registers, even if the descriptor conﬁguration allows accesses for other masters than the S12X CPU. 17.4.1.3 Op-code pre-fetch cycles and the NEX bit Some bus-masters (CPU, XGATE) do a pre-fetch of program-code past the current instruction. The S12XCPU pre-fetches two words past the current instruction, the XGATE pre-fetches one word, even if the pre-fetched code is not executed. The MPU module has no way of knowing this at the time when the pre-fetch cycles occur. Therefore this will result in an access violation if the op-code pre-fetch accesses a memory range marked as “No-Execute” (NEX=1). This must be taken into account when deﬁning memory ranges with the NEX bit set adjacent to memory used for program code. The best way to do this would be to leave some ﬁll-bytes between the memory ranges in this case, i.e. do not set the upper memory boundary to the address of the last op-code but to a following address which is at least two words (four bytes) away. 17.4.2 Interrupts This section describes all interrupts originated by the MPU. 17.4.2.1 Description of Interrupt Operation The MPU generates one interrupt request. It cannot be masked locally in the MPU and is meant to be used as the source of a non-maskable hardware interrupt request for the S12X CPU. Table 17-15. Interrupt vectors Interrupt Source S12X CPU access error interrupt (AEF) CCR Mask Local Enable − − 17.4.2.2 CPU Access Error Interrupt An S12X CPU access error interrupt request is generated if the MPU has detected an illegal memory access originating from the S12X CPU. This is a non-maskable hardware interrupt. Due to the non-maskable nature of this interrupt, the de-assertion of this interrupt request is coupled to the S12X CPU interrupt vector fetch instead of the local access error ﬂag (AEF). This means leaving the access error ﬂag (AEF) in MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 813 Chapter 17 Memory Protection Unit (S12XMPUV2) the MPUFLG register set will not cause the same interrupt to be serviced again after leaving the interrupt service routine with “RTI”. Instead, the interrupt request will be asserted again only when the next illegal S12X CPU access is detected. 17.5 17.5.1 Initialization/Application Information Initialization After reset the MPU module is in an unconﬁgured state, with all N protection descriptors covering the whole memory map. The master bits are all set for descriptor “0” and cleared for all other descriptors. The S12XCPU in supervisor state can access everything because the SVSEN bit in the MPUSEL register is cleared by a system reset. After system reset every master has full access to the memory map because of descriptor “0”. In order to use the MPU to protect memory ranges from undesired accesses, software needs to: • • • • • Initialize the protection descriptors. Make sure there are meaningful interrupt service routines deﬁned for the Access Violation interrupts because these are usually non-maskable (See XINT chapter for details). Initialize peripherals and other masters for use (i.e. set-up XGATE, Master3 if applicable). Enable the MPU protection for the S12X CPU in supervisor state, if desired. Switch the S12X CPU to user state, if desired. MC9S12XF - Family Reference Manual, Rev.1.19 814 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) Revision History Rev. No. Date (Item No.) (Submitted By) V04.01 V04.02 V04.03 12-Sep-05 23-May-06 24-Jul-06 Sections Affected Substantial Change(s) - Added CSx stretch description. - Internal updates - Removed term IVIS 18.1 Introduction This document describes the functionality of the XEBI block controlling the external bus interface. The XEBI controls the functionality of a non-multiplexed external bus (a.k.a. ‘expansion bus’) in relationship with the chip operation modes. Dependent on the mode, the external bus can be used for data exchange with external memory, peripherals or PRU, and provide visibility to the internal bus externally in combination with an emulator. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 815 Chapter 18 External Bus Interface (S12XEBIV4) 18.1.1 Glossary or Terms bus clock expanded modes System Clock. Refer to CRG Block Guide. Normal Expanded Mode Emulation Single-Chip Mode Emulation Expanded Mode Special Test Mode Normal Single-Chip Mode Special Single-Chip Mode Emulation Single-Chip Mode Emulation Expanded Mode Normal Single-Chip Mode Normal Expanded Mode Special Single-Chip Mode Special Test Mode Normal Single-Chip Mode Special Single-Chip Mode Normal Expanded Mode Emulation Single-Chip Mode Emulation Expanded Mode Special Test Mode Addresses outside MCU Port Replacement Registers Port Replacement Unit External emulation memory CPU or BDM or XGATE single-chip modes emulation modes normal modes special modes NS SS NX ES EX ST external resource PRR PRU EMULMEM access source 18.1.2 Features The XEBI includes the following features: • Output of up to 23-bit address bus and control signals to be used with a non-muxed external bus • Bidirectional 16-bit external data bus with option to disable upper half • Visibility of internal bus activity 18.1.3 • • Modes of Operation • Single-chip modes The external bus interface is not available in these modes. Expanded modes Address, data, and control signals are activated on the external bus in normal expanded mode and special test mode. Emulation modes The external bus is activated to interface to an external tool for emulation of normal expanded mode or normal single-chip mode applications. MC9S12XF - Family Reference Manual, Rev.1.19 816 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) Refer to the S12X_MMC section for a detailed description of the MCU operating modes. 18.1.4 Block Diagram Figure 18-1 is a block diagram of the XEBI with all related I/O signals. ADDR[22:0] DATA[15:0] IVD[15:0] LSTRB RW EWAIT XEBI UDS LDS RE WE ACC[2:0] IQSTAT[3:0] CS[3:0] Figure 18-1. XEBI Block Diagram 18.2 External Signal Description NOTE The following external bus related signals are described in other sections: ECLK, ECLKX2 (free-running clocks) — PIM section TAGHI, TAGLO (tag inputs) — PIM section, S12X_DBG section The user is advised to refer to the SoC section for port configuration and location of external bus signals. Table 18-1 outlines the pin names and gives a brief description of their function. Refer to the SoC section and PIM section for reset states of these pins and associated pull-ups or pull-downs. Table 18-1. External System Signals Associated with XEBI (Sheet 1 of 2) EBI Signal Multiplex (T)ime(2) (F)unction(3) — T — — — T — — Available in Modes Description NS Read Enable, indicates external read access External address Access source External address Instruction Queue Status No No No No No SS No No No No No NX Yes Yes No Yes No ES No Yes Yes Yes Yes EX No Yes Yes Yes Yes ST No Yes Yes Yes Yes Signal I(1)/O RE ADDR[22:20] ACC[2:0] ADDR[19:16] IQSTAT[3:0] O O O O O MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 817 Chapter 18 External Bus Interface (S12XEBIV4) Table 18-1. External System Signals Associated with XEBI (Sheet 2 of 2) EBI Signal Multiplex (T)ime(2) (F)unction(3) T — — T F External address Internal visibility read data External address Internal visibility read data — — — — — — — — — — — — — F F Upper Data Select, indicates external access to the high byte DATA[15:8] Low Strobe, indicates valid data on DATA[7:0] Lower Data Select, indicates external access to the low byte DATA[7:0] Read/Write, indicates the direction of internal data transfers Write Enable, indicates external write access Chip select Bidirectional data (even address) Bidirectional data (odd address) Available in Modes Description NS No No No No No No No No No No No No SS No No No No No No No No No No No No NX Yes No No No Yes No Yes No Yes Yes Yes Yes ES Yes Yes Yes Yes No Yes No Yes No No Yes Yes EX Yes Yes Yes Yes No Yes No Yes No Yes Yes Yes ST Yes Yes Yes Yes No Yes No Yes No No Yes Yes Signal I(1)/O ADDR[15:1] IVD[15:1] ADDR0 IVD0 UDS LSTRB LDS RW WE CS[3:0] DATA[15:8] DATA[7:0] EWAIT O O O O O O O O O O I/O I/O I External control for external bus access No No Yes No Yes No stretches (adding wait states) 1. All inputs are capable of reducing input threshold level 2. Time-multiplex means that the respective signals share the same pin on chip level and are active alternating in a dedicated time slot (in modes where applicable). 3. Function-multiplex means that one of the respective signals sharing the same pin on chip level continuously uses the pin depending on conﬁguration and reset state. 18.3 Memory Map and Register Deﬁnition This section provides a detailed description of all registers accessible in the XEBI. 18.3.1 Module Memory Map The registers associated with the XEBI block are shown in Figure 18-2. Register Name 0x0E EBICTL0 0x0F EBICTL1 R W R W Bit 7 ITHRS 0 6 0 5 HDBE 4 ASIZ4 3 ASIZ3 0 2 ASIZ2 1 ASIZ1 Bit 0 ASIZ0 EXSTR12 EXSTR11 EXSTR10 EXSTR02 EXSTR01 EXSTR00 Figure 18-2. XEBI Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 818 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) = Unimplemented or Reserved Figure 18-2. XEBI Register Summary 18.3.2 Register Descriptions The following sub-sections provide a detailed description of each register and the individual register bits. All control bits can be written anytime, but this may have no effect on the related function in certain operating modes. This allows specific configurations to be set up before changing into the target operating mode. NOTE Depending on the operating mode an available function may be enabled, disabled or depend on the control register bit. Reading the register bits will reﬂect the status of related function only if the current operating mode allows user control. Please refer the individual bit descriptions. 18.3.2.1 External Bus Interface Control Register 0 (EBICTL0) Module Base +0x000E (PRR) 7 6 5 4 3 2 1 0 R W Reset ITHRS 0 0 0 HDBE 1 ASIZ4 1 ASIZ3 1 ASIZ2 1 ASIZ1 1 ASIZ0 1 = Unimplemented or Reserved Figure 18-3. External Bus Interface Control Register 0 (EBICTL0) Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes, the data is read from this register. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. This register controls input pin threshold level and determines the external address and data bus sizes in normal expanded mode. If not in use with the external bus interface, the related pins can be used for alternative functions. External bus is available as programmed in normal expanded mode and always full-sized in emulation modes and special test mode; function not available in single-chip modes. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 819 Chapter 18 External Bus Interface (S12XEBIV4) Table 18-2. EBICTL0 Field Descriptions Field 7 ITHRS Description Reduced Input Threshold — This bit selects reduced input threshold on external data bus pins and speciﬁc control input signals which are in use with the external bus interface in order to adapt to external devices with a 3.3 V, 5 V tolerant I/O. The reduced input threshold level takes effect depending on ITHRS, the operating mode and the related enable signals of the EBI pin function as summarized in Table 18-3. 0 Input threshold is at standard level on all pins 1 Reduced input threshold level enabled on pins in use with the external bus interface High Data Byte Enable — This bit enables the higher half of the 16-bit data bus. If disabled, only the lower 8bit data bus can be used with the external bus interface. In this case the unused data pins and the data select signals (UDS and LDS) are free to be used for alternative functions. 0 DATA[15:8], UDS, and LDS disabled 1 DATA[15:8], UDS, and LDS enabled External Address Bus Size — These bits allow scalability of the external address bus. The programmed value corresponds to the number of available low-aligned address lines (refer to Table 18-4). All address lines ADDR[22:0] start up as outputs after reset in expanded modes. This needs to be taken into consideration when using alternative functions on relevant pins in applications which utilize a reduced external address bus. 5 HDBE 4–0 ASIZ[4:0] Table 18-3. Input Threshold Levels on External Signals ITHRS External Signal DATA[15:8] TAGHI, TAGLO 0 DATA[7:0] EWAIT DATA[15:8] TAGHI, TAGLO 1 DATA[7:0] EWAIT Standard Standard Reduced if HDBE = 1 Reduced Standard Standard Standard NS SS NX ES Reduced Standard Reduced EX Reduced Standard Reduced Reduced ST Standard Reduced Reduced if EWAIT if EWAIT Standard Standard enabled1 enabled(1) 1. EWAIT function is enabled if at least one CSx line is conﬁgured respectively in MMCCTL0. Refer to S12X_MMC section and Table 18-5. Table 18-4. External Address Bus Size ASIZ[4:0] 00000 00001 00010 00011 : 10110 Available External Address Lines None UDS ADDR1, UDS ADDR[2:1], UDS : ADDR[21:1], UDS MC9S12XF - Family Reference Manual, Rev.1.19 820 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) Table 18-4. External Address Bus Size ASIZ[4:0] 10111 : 11111 Available External Address Lines ADDR[22:1], UDS 18.3.2.2 External Bus Interface Control Register 1 (EBICTL1) Module Base +0x000F (PRR) 7 6 5 4 3 2 1 0 R W Reset 0 0 EXSTR12 1 EXSTR11 1 EXSTR10 1 0 0 EXSTR02 1 EXSTR01 1 EXSTR00 1 = Unimplemented or Reserved Figure 18-4. External Bus Interface Control Register 1 (EBICTL1) Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data is read from this register. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. This register allows programming of two independent values determining the amount of additional stretch cycles for external accesses (wait states). With two bits in S12X_MMC register MMCCTL0 for every individual CSx line one of the two counter options or the EWAIT input is selected as stretch source. The chip select outputs can also be disabled to free up the pins for alternative functions (Table 18-5). Refer also to S12X_MMC section for register bit descriptions. Table 18-5. Chip select function CSxE1 0 0 1 1 CSxE0 0 1 0 1 CSx disabled CSx stretched with EXSTR0 CSx stretched with EXSTR1 CSx stretched with EWAIT Function If EWAIT input usage is selected in MMCCTL0 the minimum number of stretch cycles is 2 for accesses to the related address range. If conﬁgured respectively, stretch cycles are added as programmed or dependent on EWAIT in normal expanded mode and emulation expanded mode; function not available in all other operating modes. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 821 Chapter 18 External Bus Interface (S12XEBIV4) Table 18-6. EBICTL1 Field Descriptions Field Description 6–4 External Access Stretch Option 1 Bits 2, 1, 0 — This three bit ﬁeld determines the amount of additional clock EXSTR1[2:0] stretch cycles on every access to the external address space as shown in Table 18-7. 2–0 External Access Stretch Option 0 Bits 2, 1, 0 — This three bit ﬁeld determines the amount of additional clock EXSTR0[2:0] stretch cycles on every access to the external address space as shown in Table 18-7. Table 18-7. External Access Stretch Bit Deﬁnition EXSTRx[2:0] 000 001 010 011 100 101 110 111 Number of Stretch Cycles 1 2 3 4 5 6 7 8 18.4 Functional Description This section describes the functions of the external bus interface. The availability of external signals and functions in relation to the operating mode is initially summarized and described in more detail in separate sub-sections. 18.4.1 Operating Modes and External Bus Properties Table 18-8. Summary of Functions Single-Chip Modes Expanded Modes Normal Expanded Emulation Single-Chip Emulation Expanded Special Test A summary of the external bus interface functions for each operating mode is shown in Table 18-8. Properties (if Enabled) Normal Single-Chip Special Single-Chip Timing Properties PRR access(1) 2 cycles read internal write internal — — 2 cycles read internal write internal — — 2 cycles read internal write internal — Max. of 2 to 9 programmed cycles or n cycles of ext. wait(3) 2 cycles read external write int & ext 1 cycle 1 cycle 2 cycles read external write int & ext 1 cycle Max. of 2 to 9 programmed cycles or n cycles of ext. wait3 2 cycles read internal write internal 1 cycle 1 cycle Internal access visible externally External address access and unimplemented area access(2) MC9S12XF - Family Reference Manual, Rev.1.19 822 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) Table 18-8. Summary of Functions Single-Chip Modes Properties (if Enabled) Flash area address access(4) Normal Single-Chip — Special Single-Chip — Normal Expanded — Signal Properties Bus signals — — ADDR[22:1] DATA[15:0] ADDR[22:20]/ ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] ADDR[15:0]/ IVD[15:0] DATA[15:0] ADDR0 LSTRB RW ADDR[22:20]/ ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] ADDR[15:0]/ IVD[15:0] DATA[15:0] ADDR0 LSTRB RW CS0 CS1 CS2 CS3 EWAIT ADDR[22:0] DATA[15:0] Expanded Modes Emulation Single-Chip 1 cycle Emulation Expanded 1 cycle Special Test 1 cycle Data select signals (if 16-bit data bus) Data direction signals — — — — UDS LDS RE WE CS0 CS1 CS2 CS3 EWAIT ADDR0 LSTRB RW Chip Selects — — — — External wait feature — — — — Reduced input — — Refer to DATA[15:0] DATA[15:0] Refer to threshold enabled on Table 18-3 EWAIT EWAIT Table 18-3 1. Incl. S12X_EBI registers 2. Refer to S12X_MMC section. 3. If EWAIT enabled for at least one CSx line (refer to S12X_MMC section), the minimum number of external bus cycles is 3. 4. Available only if conﬁgured appropriately by ROMON and EROMON (refer to S12X_MMC section). 18.4.2 Internal Visibility Internal visibility allows the observation of the internal CPU address and data bus as well as the determination of the access source and the CPU pipe (queue) status through the external bus interface. Internal visibility is always enabled in emulation single chip mode and emulation expanded mode. Internal CPU accesses are made visible on the external bus interface except CPU execution of BDM firmware instructions. Internal reads are made visible on ADDRx/IVDx (address and read data multiplexed, see Table 18-11 to Table 18-13), internal writes on ADDRx and DATAx (see Table 18-14 to Table 18-16). RW and LSTRB show the type of access. External read data are also visible on IVDx. During ‘no access’ cycles RW is held in read position while LSTRB is undetermined. All accesses which make use of the external bus interface are considered external accesses. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 823 Chapter 18 External Bus Interface (S12XEBIV4) 18.4.2.1 Access Source Signals (ACC) The access source can be determined from the external bus control signals ACC[2:0] as shown in Table 18-9. Table 18-9. Determining Access Source from Control Signals ACC[2:0] 000 001 010 011 100 101 Access Description Repetition of previous access cycle CPU access BDM external access XGATE PRR access No access(1) CPU access error 110, 111 Reserved 1. Denotes also CPU accesses to BDM ﬁrmware and BDM registers (IQSTATx are ‘XXXX’ and RW = 1 in these cases) 18.4.2.2 Instruction Queue Status Signals (IQSTAT) The CPU instruction queue status (execution-start and data-movement information) is brought out as IQSTAT[3:0] signals. For decoding of the IQSTAT values, refer to the S12X_CPU section. 18.4.2.3 Internal Visibility Data (IVD) Depending on the access size and alignment, either a word of read data is made visible on the address lines or only the related data byte will be presented in the ECLK low phase. For details refer to Table 18-10. Invalid IVD are brought out in case of non-CPU read accesses. Table 18-10. IVD Read Data Output Access Word read of data at an even and even+1 address Word read of data at an odd and odd+1 internal RAM address (misaligned) Byte read of data at an even address Byte read of data at an odd address IVD[15:8] ivd(even) ivd(odd+1) ivd(even) addr[15:8] (rep.) IVD[7:0] ivd(even+1) ivd(odd) addr[7:0] (rep.) ivd(odd) 18.4.2.4 Emulation Modes Timing A bus access lasts 1 ECLK cycle. In case of a stretched external access (emulation expanded mode), up to an infinite amount of ECLK cycles may be added. ADDRx values will only be shown in ECLK high phases, while ACCx, IQSTATx, and IVDx values will only be presented in ECLK low phases. Based on this multiplex timing, ACCx are only shown in the current (first) access cycle. IQSTATx and (for read accesses) IVDx follow in the next cycle. If the access takes more than one bus cycle, ACCx display NULL (0x000) in the second and all following cycles of the access. IQSTATx display NULL (0x0000) from the third until one cycle after the access to indicate continuation. MC9S12XF - Family Reference Manual, Rev.1.19 824 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) The resulting timing pattern of the external bus signals is outlined in the following tables for read, write and interleaved read/write accesses. Three examples represent different access lengths of 1, 2, and n–1 bus cycles. Non-shaded bold entries denote all values related to Access #0. The following terminology is used: ‘addr’ — value(ADDRx); small letters denote the logic values at the respective pins ‘x’ — Undeﬁned output pin values ‘z’ — Tristate pins ‘?’ — Dependent on previous access (read or write); IVDx: ‘ivd’ or ‘x’; DATAx: ‘data’ or ‘z’ 18.4.2.4.1 Read Access Timing Table 18-11. Read Access (1 Cycle) Access #0 Bus cycle -> ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (internal read) DATA[15:0] (external read) RW ... ... ... addr 0 ? ? 1 ... ... ... ... high Access #1 2 3 low acc 1 iqstat 0 ivd 0 z z 1 high addr 2 z data 1 1 low acc 2 iqstat 1 ivd 1 z z 1 ... ... ... ... ... ... ... ... 1 low acc 0 iqstat -1 ? z z 1 z data 0 1 addr 1 high ADDR[19:16] / IQSTAT[3:0] ... Table 18-12. Read Access (2 Cycles) Access #0 Bus cycle -> ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (internal read) DATA[15:0] (external read) RW ... ... ... addr 0 ? ? 1 ... ... ... ... high Access #1 2 3 low 000 iqstat 0 x z z 1 high addr 1 z data 0 1 low acc 1 0000 ivd 0 z z 1 ... ... ... ... ... ... ... ... 1 low acc 0 iqstat-1 ? z z 1 z z 1 addr 0 high ADDR[19:16] / IQSTAT[3:0] ... Table 18-13. Read Access (n–1 Cycles) Access #0 Bus cycle -> ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (internal read) ... ... ... addr 0 ? ... ... high Access #1 3 ... low 000 addr 0 z 0000 x z ... ... ... ... ... z addr 1 high 1 low acc 0 iqstat-1 ? z z addr 0 high 2 low 000 iqstat 0 x z high n low acc 1 0000 ivd 0 z ... ... ... ... ... ... ADDR[19:16] / IQSTAT[3:0] ... MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 825 Chapter 18 External Bus Interface (S12XEBIV4) Table 18-13. Read Access (n–1 Cycles) DATA[15:0] (external read) RW ... ... ? 1 z 1 z 1 z 1 z 1 z 1 ... ... data 0 1 z 1 ... ... 18.4.2.4.2 Write Access Timing Table 18-14. Write Access (1 Cycle) Access #0 Bus cycle -> ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (write) RW ... ... ... addr 0 ? 0 0 ... ... ... high Access #1 2 high addr 1 low acc 1 iqstat 0 x data 0 1 1 data 1 Access #2 3 high addr 2 low acc 2 iqstat 1 x data 2 1 1 ... ... ... ... ... ... ... 1 low acc 0 iqstat -1 ? ADDR[19:16] / IQSTAT[3:0] ... Table 18-15. Write Access (2 Cycles) Access #0 Bus cycle -> ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (write) RW ... ... ... addr 0 ? 0 0 0 ... ... ... high Access #1 2 3 low 000 iqstat 0 x data 0 0 1 high addr 1 low acc 1 0000 x x 1 ... ... ... ... ... ... ... 1 low acc 0 iqstat-1 ? addr 0 high ADDR[19:16] / IQSTAT[3:0] ... Table 18-16. Write Access (n–1 Cycles) Access #0 Bus cycle -> ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (write) RW ... ... ... addr 0 ? 0 0 0 0 ... ... ... high Access #1 3 ... low 000 addr 0 0000 x data 0 0 0 ... 1 ... ... ... ... addr 1 high 1 low acc 0 iqstat-1 ? addr 0 high 2 low 000 iqstat 0 x high n low acc 1 0000 x x 1 ... ... ... ... ... ... ... ADDR[19:16] / IQSTAT[3:0] ... 18.4.2.4.3 Read-Write-Read Access Timing Table 18-17. Interleaved Read-Write-Read Accesses (1 Cycle) Access #0 Access #1 2 Access #2 3 ... Bus cycle -> ... 1 MC9S12XF - Family Reference Manual, Rev.1.19 826 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) Table 18-17. Interleaved Read-Write-Read Accesses (1 Cycle) ECLK phase ADDR[22:20] / ACC[2:0] ADDR[15:0] / IVD[15:0] DATA[15:0] (internal read) DATA[15:0] (external read) RW ... ... addr 0 ? ? 1 ... ... ... ... high low acc 0 iqstat -1 ? z z 1 z data 0 0 addr 1 high low acc 1 iqstat 0 ivd 0 (write) data 1 (write) data 1 0 1 addr 2 high low acc 2 iqstat 1 x z z 1 ... ... ... ... ... ... ... ADDR[19:16] / IQSTAT[3:0] ... 18.4.3 Accesses to Port Replacement Registers All read and write accesses to PRR addresses take two bus clock cycles independent of the operating mode. If writing to these addresses in emulation modes, the access is directed to both, the internal register and the external resource while reads will be treated external. The XEBI control registers also belong to this category. 18.4.4 Stretched External Bus Accesses In order to allow fast internal bus cycles to coexist in a system with slower external resources, the XEBI supports stretched external bus accesses (wait states) for each external address range related to one of the 4 chip select lines individually. This feature is available in normal expanded mode and emulation expanded mode for accesses to all external addresses except emulation memory and PRR. In these cases the fixed access times are 1 or 2 cycles, respectively. Stretched accesses are controlled by: 1. EXSTR1[2:0] and EXSTR0[2:0] bits in the EBICTL1 register conﬁguring a ﬁxed amount of stretch cycles individually for each CSx line in MMCCTL0 2. Activation of the external wait feature for each CSx line MMCCTL0 register 3. Assertion of the external EWAIT signal when at least one CSx line is conﬁgured for EWAIT The EXSTRx[2:0] control bits can be programmed for generation of a fixed number of 1 to 8 stretch cycles. If the external wait feature is enabled, the minimum number of additional stretch cycles is 2. An arbitrary amount of stretch cycles can be added using the EWAIT input. EWAIT needs to be asserted at least for a minimal specified time window within an external access cycle for the internal logic to detect it and add a cycle (refer to electrical characteristics). Holding it for additional cycles will cause the external bus access to be stretched accordingly. Write accesses are stretched by holding the initiator in its current state for additional cycles as programmed and controlled by external wait after the data have been driven out on the external bus. This results in an extension of time the bus signals and the related control signals are valid externally. Read data are not captured by the system in normal expanded mode until the specified setup time before the RE rising edge. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 827 Chapter 18 External Bus Interface (S12XEBIV4) Read data are not captured in emulation expanded mode until the specified setup time before the falling edge of ECLK. In emulation expanded mode, accesses to the internal flash or the emulation memory (determined by EROMON and ROMON bits; see S12X_MMC section for details) always take 1 cycle and stretching is not supported. In case the internal flash is taken out of the map in user applications, accesses are stretched as programmed and controlled by external wait. 18.4.5 Data Select and Data Direction Signals The S12X_EBI supports byte and word accesses at any valid external address. The big endian system of the MCU is extended to the external bus; however, word accesses are restricted to even aligned addresses. The only exception is the visibility of misaligned word accesses to addresses in the internal RAM as this module exclusively supports these kind of accesses in a single cycle. With the above restriction, a fixed relationship is implied between the address parity and the dedicated bus halves where the data are accessed: DATA[15:8] is related to even addresses and DATA[7:0] is related to odd addresses. In expanded modes the data access type is externally determined by a set of control signals, i.e., data select and data direction signals, as described below. The data select signals are not available if using the external bus interface with an 8-bit data bus. 18.4.5.1 Normal Expanded Mode In normal expanded mode, the external signals RE, WE, UDS, LDS indicate the access type (read/write), data size and alignment of an external bus access (Table 18-18). Table 18-18. Access in Normal Expanded Mode DATA[15:8] Access Word write of data on DATA[15:0] at an even and even+1 address Byte write of data on DATA[7:0] at an odd address Byte write of data on DATA[15:8] at an even address Word read of data on DATA[15:0] at an even and even+1 address Byte read of data on DATA[7:0] at an odd address Byte read of data on DATA[15:8] at an even address Indicates No Access Unimplemented RE WE UDS LDS I/O data(addr) I/O data(addr) 1 1 1 0 0 0 1 1 1 0 0 0 1 1 1 1 1 1 0 1 0 0 1 0 1 1 0 0 0 1 0 0 1 1 0 1 Out data(even) Out In In In In In In In x data(even) x data(even) x x x Out In In In In In In In Out data(even) data(odd) data(odd) x data(odd) data(odd) x x x x DATA[7:0] 18.4.5.2 Emulation Modes and Special Test Mode In emulation modes and special test mode, the external signals LSTRB, RW, and ADDR0 indicate the access type (read/write), data size and alignment of an external bus access. Misaligned accesses to the MC9S12XF - Family Reference Manual, Rev.1.19 828 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) internal RAM and misaligned XGATE PRR accesses in emulation modes are the only type of access that are able to produce LSTRB = ADDR0 = 1. This is summarized in Table 18-19. Table 18-19. Access in Emulation Modes and Special Test Mode DATA[15:8] Access Word write of data on DATA[15:0] at an even and even+1 address Byte write of data on DATA[7:0] at an odd address Byte write of data on DATA[15:8] at an even address Word write at an odd and odd+1 internal RAM address (misaligned — only in emulation modes) Word read of data on DATA[15:0] at an even and even+1 address Byte read of data on DATA[7:0] at an odd address Byte read of data on DATA[15:8] at an even address Word read at an odd and odd+1 internal RAM address (misaligned - only in emulation modes) RW LSTRB ADDR0 I/O 0 0 0 0 1 1 1 1 0 0 1 1 0 0 1 1 0 1 0 1 0 1 0 1 Out In Out data(addr) data(even) x data(odd) I/O Out Out In data(addr) data(odd) data(odd) x data(odd) data(even+1) data(odd) x data(odd) DATA[7:0] Out data(odd+1) Out In In In In data(even) x data(even) data(odd+1) In In In In 18.4.6 Low-Power Options The XEBI does not support any user-controlled options for reducing power consumption. 18.4.6.1 Run Mode The XEBI does not support any options for reducing power in run mode. Power consumption is reduced in single-chip modes due to the absence of the external bus interface. Operation in expanded modes results in a higher power consumption, however any unnecessary toggling of external bus signals is reduced to the lowest indispensable activity by holding the previous states between external accesses. 18.4.6.2 Wait Mode The XEBI does not support any options for reducing power in wait mode. 18.4.6.3 Stop Mode The XEBI will cease to function in stop mode. 18.5 Initialization/Application Information This section describes the external bus interface usage and timing. Typical customer operating modes are normal expanded mode and emulation modes, specifically to be used in emulator applications. Taking the availability of the external wait feature into account the use cases are divided into four scenarios: • Normal expanded mode MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 829 Chapter 18 External Bus Interface (S12XEBIV4) • — External wait feature disabled – External wait feature enabled Emulation modes – Emulation single-chip mode (without wait states) – Emulation expanded mode (with optional access stretching) Normal single-chip mode and special single-chip mode do not have an external bus. Special test mode is used for factory test only. Therefore, these modes are omitted here. All timing diagrams referred to throughout this section are available in the Electrical Characteristics appendix of the SoC section. 18.5.1 Normal Expanded Mode This mode allows interfacing to external memories or peripherals which are available in the commercial market. In these applications the normal bus operation requires a minimum of 1 cycle stretch for each external access. 18.5.1.1 Example 1a: External Wait Feature Disabled The first example of bus timing of an external read and write access with the external wait feature disabled is shown in • Figure ‘Example 1a: Normal Expanded Mode — Read Followed by Write’ The associated supply voltage dependent timing are numbers given in • Table ‘Example 1a: Normal Expanded Mode Timing VDD5 = 5.0 V (EWAIT disabled)’ • Table ‘Example 1a: Normal Expanded Mode Timing VDD5 = 3.0 V (EWAIT disabled)’ Systems designed this way rely on the internal programmable access stretching. These systems have predictable external memory access times. The additional stretch time can be programmed up to 8 cycles to provide longer access times. 18.5.1.2 Example 1b: External Wait Feature Enabled The external wait operation is shown in this example. It can be used to exceed the amount of stretch cycles over the programmed number in EXSTR[2:0]. The feature must be enabled by configuring at least one CSx line for EWAIT. If the EWAIT signal is not asserted, the number of stretch cycles is forced to a minimum of 2 cycles. If EWAIT is asserted within the predefined time window during the access it will be strobed active and another stretch cycle is added. If strobed inactive, the next cycle will be the last cycle before the access is finished. EWAIT can be held asserted as long as desired to stretch the access. An access with 1 cycle stretch by EWAIT assertion is shown in • Figure ‘Example 1b: Normal Expanded Mode — Stretched Read Access’ • Figure ‘Example 1b: Normal Expanded Mode — Stretched Write Access’ MC9S12XF - Family Reference Manual, Rev.1.19 830 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) The associated timing numbers for both operations are given in • Table ‘Example 1b: Normal Expanded Mode Timing VDD5 = 5.0 V (EWAIT enabled)’ • Table ‘Example 1b: Normal Expanded Mode Timing VDD5 = 3.0 V (EWAIT enabled)’ It is recommended to use the free-running clock (ECLK) at the fastest rate (bus clock rate) to synchronize the EWAIT input signal. 18.5.2 Emulation Modes In emulation mode applications, the development systems use a custom PRU device to rebuild the singlechip or expanded bus functions which are lost due to the use of the external bus with an emulator. Accesses to a set of registers controlling the related ports in normal modes (refer to SoC section) are directed to the external bus in emulation modes which are substituted by PRR as part of the PRU. Accesses to these registers take a constant time of 2 cycles. Depending on the setting of ROMON and EROMON (refer to S12X_MMC section), the program code can be executed from internal memory or an optional external emulation memory (EMULMEM). No wait state operation (stretching) of the external bus access is done in emulation modes when accessing internal memory or emulation memory addresses. In both modes observation of the internal operation is supported through the external bus (internal visibility). 18.5.2.1 Example 2a: Emulation Single-Chip Mode This mode is used for emulation systems in which the target application is operating in normal single-chip mode. Figure 18-5 shows the PRU connection with the available external bus signals in an emulator application. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 831 Chapter 18 External Bus Interface (S12XEBIV4) S12X_EBI ADDR[22:0]/IVD[15:0] DATA[15:0] Emulator EMULMEM PRU PRR Ports LSTRB RW ADDR[22:20]/ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] ECLK ECLKX2 Figure 18-5. Application in Emulation Single-Chip Mode The timing diagram for this operation is shown in: • Figure ‘Example 2a: Emulation Single-Chip Mode — Read Followed by Write’ The associated timing numbers are given in: • Table ‘Example 2a: Emulation Single-Chip Mode Timing (EWAIT disabled)’ Timing considerations: • Signals muxed with address lines ADDRx, i.e., IVDx, IQSTATx and ACCx, have the same timing. • LSTRB has the same timing as RW. • ECLKX2 rising edges have the same timing as ECLK edges. • The timing for accesses to PRU registers, which take 2 cycles to complete, is the same as the timing for an external non-PRR access with 1 cycle of stretch as shown in example 2b. 18.5.2.2 Example 2b: Emulation Expanded Mode This mode is used for emulation systems in which the target application is operating in normal expanded mode. If the external bus is used with a PRU, the external device rebuilds the data select and data direction signals UDS, LDS, RE, and WE from the ADDR0, LSTRB, and RW signals. Figure 18-6 shows the PRU connection with the available external bus signals in an emulator application. MC9S12XF - Family Reference Manual, Rev.1.19 832 Freescale Semiconductor Chapter 18 External Bus Interface (S12XEBIV4) S12X_EBI ADDR[22:0]/IVD[15:0] DATA[15:0] Emulator EMULMEM PRU PRR Ports LSTRB RW UDS LDS RE WE ADDR[22:20]/ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] CS[3:0] EWAIT ECLK ECLKX2 Figure 18-6. Application in Emulation Expanded Mode The timings of accesses with 1 stretch cycle are shown in • Figure ‘Example 2b: Emulation Expanded Mode — Read with 1 Stretch Cycle’ • Figure ‘Example 2b: Emulation Expanded Mode — Write with 1 Stretch Cycle’ The associated timing numbers are given in • Table ‘Example 2b: Emulation Expanded Mode Timing VDD5 = 5.0 V (EWAIT disabled)’ (this also includes examples for alternative settings of 2 and 3 additional stretch cycles) Timing considerations: • If no stretch cycle is added, the timing is the same as in Emulation Single-Chip Mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 833 Chapter 18 External Bus Interface (S12XEBIV4) MC9S12XF - Family Reference Manual, Rev.1.19 834 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Revision History Table 19-1. Revision History Table Rev. No. Date (Item No.) (Submitted By) V02.01 V02.02 Rev 00.05 09 Oct 2006 09 Nov 2006 18-May-2010 Sections Affected 19.2/19-836 19.1.1/19-835 19.2/19-836 Substantial Change(s) Removed name KWP7 from pin map Corrected typo Removed interrupt function from PJ description 19.1 19.1.1 Introduction Overview The S12XF-family Port Integration Module establishes the interface between the peripheral modules including the non-multiplexed External Bus Interface module (S12X_EBI) and the I/O pins for all ports. It controls the electrical pin properties as well as the signal prioritization and multiplexing on shared pins. This document covers: • Port A and B used as address output of the S12X_EBI • Port C and D used as data I/O of the S12X_EBI • Port E associated with the S12X_EBI control signals and the IRQ, XIRQ interrupt inputs • Port K associated with address output and control signals of the S12X_EBI • Port T connected to the Enhanced Capture Timer (ECT) module • Port S associated with 2 SCI and 1 SPI modules • Port M associated with 1 SPI, 1 MSCAN, 4 chip select lines and parts of the Pulse Width Modulator with Fault Protection (PMF) module • Port P connected to parts of the Pulse Width Modulator with Fault Protection (PMF) module • Port H associated with parts of the FlexRay module • Port J associated with parts of the FlexRay module and parts of the Pulse Width Modulator with Fault Protection (PMF) module • Port AD associated with the 16-channel ATD module MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 835 Chapter 19 Port Integration Module (S12XFPIMV2) Most I/O pins can be conﬁgured by register bits to select data direction and drive strength, to enable and select pull-up or pull-down devices. NOTE The implementation of the S12XF-family Port Integration Module is device dependent. Therefore some functions are not available on certain derivatives or 112-pin and 80-pin package options. 19.1.2 Features A full-featured S12XF-family Port Integration Module includes these distinctive registers: • Data and data direction registers for Ports A, B, C, D, E, K, T, S, M, P, H, J, and AD when used as general-purpose I/O • Control registers to enable/disable pull-device and select pull-ups/pull-downs on Ports T, S, M, P, H, and J on per-pin basis • Control registers to enable/disable pull-up devices on Port AD on per-pin basis • Single control register to enable/disable pull-ups on Ports A, B, C, D, E, and K on per-port basis and on BKGD pin • Control registers to enable/disable reduced output drive on Ports T, S, M, P, H, J, and AD on perpin basis • Single control register to enable/disable reduced output drive on Ports A, B, C, D, E, and K on perport basis • Control registers to enable/disable open-drain (wired-or) mode on Ports S and M • Control register to conﬁgure IRQ pin operation • Free-running clock outputs A standard port pin has the following minimum features: • Input/output selection • 5V output drive with two selectable drive strengths • 5V digital and analog input • Input with selectable pull-up or pull-down device Optional features supported on dedicated pins: • • Open drain for wired-or connections Reduced input threshold to support low voltage applications 19.2 External Signal Description This section lists and describes the signals that do connect off-chip. Table 19-2 shows all the pins and their functions that are controlled by the S12XFPIMV2. Refer to the SoC Guide for the availability of the individual pins in the different package options. MC9S12XF - Family Reference Manual, Rev.1.19 836 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) NOTE If there is more than one function associated with a pin, the priority is indicated by the position in the table from top (highest priority) to bottom (lowest priority). Table 19-2. Pin Functions and Priorities Port A Pin Name BKGD PA[7:0] Pin Function & Priority(1) MODC (2) BKGD ADDR[15:8] mux IVD[15:8] (3) GPIO B PB[7:1] ADDR[7:1] mux IVD[7:1] 3 GPIO PB[0] ADDR[0] mux IVD0 3 UDS GPIO C PC[7:0] DATA[15:8] GPIO D PD[7:0] DATA[7:0] GPIO I/O I O Description MODC input during RESET High-order external bus address output (multiplexed with IVIS data) Pin Function after Reset BKGD Mode dependent (4) I/O S12X_BDM communication pin I/O General-purpose I/O O Low-order external bus address output (multiplexed with IVIS data) Mode dependent 4 I/O General-purpose I/O O Low-order external bus address output (multiplexed with IVIS data) Upper data strobe Mode dependent 4 Mode dependent 4 O I/O General-purpose I/O I/O High-order bidirectional data input/output Conﬁgurable for reduced input threshold I/O General-purpose I/O I/O Low-order bidirectional data input/output Conﬁgurable for reduced input threshold I/O General-purpose I/O MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 837 Chapter 19 Port Integration Module (S12XFPIMV2) Port E Pin Name PE[7] Pin Function & Priority(1) XCLKS 2 ECLKX2 GPIO I/O I I I I Description External clock selection input during RESET Free-running clock output at Core Clock rate (ECLK x 2) MODB input during RESET Instruction tagging low pin Conﬁgurable for reduced input threshold MODA input during RESET Read enable signal Instruction tagging low pin Conﬁgurable for reduced input threshold Free-running clock output at the Bus Clock rate or programmable divided in normal modes EROMON bit control input during RESET Low strobe bar output Lower data strobe Read/write output for external bus Write enable signal Maskable level- or falling edge-sensitive interrupt input General-purpose input Non-maskable level-sensitive interrupt input General-purpose input ROMON bit control input during RESET External Wait signal Conﬁgurable for reduced input threshold Extended external bus address output (multiplexed with access master output) Pin Function after Reset Mode dependent 4 I/O General-purpose I/O PE[6] MODB 2 TAGHI GPIO I/O General-purpose I/O I O I PE[5] MODA 2 RE TAGLO GPIO I/O General-purpose I/O O PE[4] ECLK GPIO I/O General-purpose I/O I O O O O I I I I 2 PE[3] EROMCTL 2 LSTRB LDS GPIO I/O General-purpose I/O PE[2] RW WE GPIO I/O General-purpose I/O PE[1] PE[0] K PK[7] IRQ GPI XIRQ GPI ROMCTL EWAIT GPIO I I Mode dependent 4 I/O General-purpose I/O O PK[6:4] ADDR[22:20] mux ACC[2:0] 3 GPIO ADDR[19:16] mux IQSTAT[3:0] 3 GPIO I/O General-purpose I/O O Extended external bus address output (multiplexed with instruction pipe status bits) PK[3:0] I/O General-purpose I/O MC9S12XF - Family Reference Manual, Rev.1.19 838 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Port T Pin Name PT[7:6] Pin Function & Priority(1) IOC[7:6] GPIO IOC[5] I/O Description Pin Function after Reset GPIO I/O Enhanced Capture Timer Channels 7 - 6 input/output I/O General-purpose I/O I/O Enhanced Capture Timer Channels 5 input/output O VREG RC clock test output I/O General-purpose I/O I/O Enhanced Capture Timer Channels 4 - 0 input/output I/O General-purpose I/O I/O Serial Peripheral Interface 0 slave select output in master mode, input in slave mode or master mode. I/O General-purpose I/O I/O Serial Peripheral Interface 0 serial clock pin I/O General-purpose I/O I/O Serial Peripheral Interface 0 master out/slave in pin I/O General-purpose I/O I/O Serial Peripheral Interface 0 master in/slave out pin I/O General-purpose I/O O I O I Serial Communication Interface 1 transmit pin Serial Communication Interface 1 receive pin Serial Communication Interface 0 transmit pin Serial Communication Interface 0 receive pin I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O PT[5] PT[4:0] S PS7 VREG_API GPIO IOC[4:0] GPIO SS0 GPIO GPIO PS6 PS5 PS4 PS3 PS2 PS1 PS0 SCK0 GPIO MOSI0 GPIO MISO0 GPIO TXD1 GPIO RXD1 GPIO TXD0 GPIO RXD0 GPIO MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 839 Chapter 19 Port Integration Module (S12XFPIMV2) Port M Pin Name PM7 Pin Function & Priority(1) SS1 CS3 GPIO I/O Description Pin Function after Reset GPIO I/O Serial Peripheral Interface 1 slave select output in master mode, input in slave mode or master mode. O Chip select 3 I/O General-purpose I/O I/O Serial Peripheral Interface 1 serial clock pin I/O General-purpose I/O I/O Serial Peripheral Interface 1 master out/slave in pin I/O General-purpose I/O I/O Serial Peripheral Interface 1 master in/slave out pin O I O I O O I I I O Chip select 2 FAULT3 input to PMF Chip select 1 FAULT2 input to PMF Chip select 0 MSCAN transmit pin MSCAN receive pin FAULT1 input to PMF FAULT0 input to PMF Pulse Width Modulator output channels 5 to 0 I/O General-purpose I/O PM6 PM5 PM4 SCK1 GPIO MOSI1 GPIO MISO1 CS2 GPIO PM3 FAULT3 CS1 GPIO I/O General-purpose I/O PM2 FAULT2 CS0 GPIO I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O GPIO I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O PM1 PM0 P PP7 PP6 PP[5:0] TXCAN GPIO RXCAN GPIO FAULT1 GPIO FAULT0 GPIO PW0[5:0] GPIO MC9S12XF - Family Reference Manual, Rev.1.19 840 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Port H Pin Name PH7 PH6 PH5 PH4 PH3 PH2 PH1 PH0 PJ7 PJ6 PJ5 Pin Function & Priority(1) GPIO TXE_B GPIO TXD_B GPIO RXD_B GPIO GPIO TXE_A GPIO TXD_A GPIO RXD_A GPIO GPIO STB3 GPIO STB2 GPIO STB1 GPIO STB0 GPIO IS[2:0] GPIO GPIO I/O I/O General-purpose I/O O O I Description Pin Function after Reset GPIO FlexRay channel B Tx enable, active low FlexRay channel B Tx data FlexRay channel B Rx data I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O O O I FlexRay channel A Tx enable, active low FlexRay channel A Tx data FlexRay channel A Rx data I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O O O O O O FlexRay debug strobe signal 3 FlexRay debug strobe signal 2 FlexRay debug strobe signal 1 FlexRay debug strobe signal 0 PMF current status outputs 2 to 0 GPIO GPIO I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O I/O General-purpose I/O J PJ4 PJ3 PJ[2:0] AD PAD[15:00] AN[15:0] I ATD analog inputs 1. Signals in brackets denote alternative module routing pins. 2. Function active when RESET asserted. 3. Only available in emulation modes or in Special Test Mode with IVIS on. 4. Refer to S12X_EBI Block Guide. 19.3 Memory Map and Register Deﬁnition This section provides a detailed description of all S12XFPIMV2 registers. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 841 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.1 Register Name 0x0000 PORTA 0x0001 PORTB 0x0002 DDRA 0x0003 DDRB 0x0004 PORTC 0x0005 PORTD 0x0006 DDRC 0x0007 DDRD 0x0008 PORTE 0x0009 DDRE Memory Map Bit 7 R W R W R W R W R W R W R W R W R W R W PA7 6 PA6 5 PA5 4 PA4 3 PA3 2 PA2 1 PA1 Bit 0 PA0 PB7 PB6 PB5 PB4 PB3 PB2 PB1 PB0 DDRA7 DDRA6 DDRA5 DDRA4 DDRA3 DDRA2 DDRA1 DDRA0 DDRB7 DDRB6 DDRB5 DDRB4 DDRB3 DDRB2 DDRB1 DDRB0 PC7 PC6 PC5 PC4 PC3 PC2 PC1 PC0 PD7 PD6 PD5 PD4 PD3 PD2 PD1 PD0 DDRC7 DDRC6 DDRC5 DDRC4 DDRC3 DDRC2 DDRC1 DDRC0 DDRD7 DDRD6 DDRD5 DDRD4 DDRD3 DDRD2 DDRD1 PE1 DDRD0 PE0 PE7 PE6 PE5 PE4 PE3 PE2 DDRE7 DDRE6 DDRE5 DDRE4 DDRE3 DDRE2 0 0 0x000A R 0x000B W Non-PIM Address Range 0x000C PUCR 0x000D RDRIV R W R W PUPKE BKPUE 0 0 Non-PIM Address Range PUPEE PUPDE PUPCE PUPBE PUPAE RDPK 0 RDPE RDPD RDPC RDPB RDPA = Unimplemented or Reserved MC9S12XF - Family Reference Manual, Rev.1.19 842 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Register Name 0x000E– R 0x001B W Non-PIM Address Range 0x001C R ECLKCTL W 0x001D R Reserved W 0x001E IRQCR R W Bit 7 6 5 4 3 2 1 Bit 0 Non-PIM Address Range NECLK 0 NCLKX2 0 DIV16 0 EDIV4 0 EDIV3 0 EDIV2 0 EDIV1 0 EDIV0 0 IRQE 0 IRQEN 0 0 0 0 0 0 0 0x001F R Reserved W 0x0020– R 0x0031 W Non-PIM Address Range 0x0032 PORTK 0x0033 DDRK R W R W 0 0 0 0 0 0 Non-PIM Address Range PK7 PK6 PK5 PK4 PK3 PK2 PK1 PK0 DDRK7 DDRK6 DDRK5 DDRK4 DDRK3 DDRK2 DDRK1 DDRK0 0x0034– R 0x023F W Non-PIM Address Range 0x0240 PTT 0x0241 PTIT 0x0242 DDRT 0x0243 RDRT R W R W R W R W DDRT7 DDRT6 DDRT5 PTT7 PTIT7 PTT6 PTIT6 PTT5 PTIT5 Non-PIM Address Range PTT4 PTIT4 PTT3 PTIT3 PTT2 PTIT2 PTT1 PTIT1 PTT0 PTIT0 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 RDRT7 RDRT6 RDRT5 RDRT4 RDRT3 RDRT2 RDRT1 RDRT0 = Unimplemented or Reserved MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 843 Chapter 19 Port Integration Module (S12XFPIMV2) Register Name 0x0244 PERT 0x0245 PPST R W R W Bit 7 PERT7 6 PERT6 5 PERT5 4 PERT4 3 PERT3 2 PERT2 1 PERT1 Bit 0 PERT0 PPST7 0 PPST6 0 PPST5 0 PPST4 0 PPST3 0 PPST2 0 PPST1 0 PPST0 0 0x0246 R Reserved W 0x0247 R Reserved W 0x0248 PTS 0x0249 PTIS 0x024A DDRS 0x024B RDRS 0x024C PERS 0x024D PPSS 0x024E WOMS R W R W R W R W R W R W R W 0 0 0 0 0 0 0 0 PTS7 PTIS7 PTS6 PTIS6 PTS5 PTIS5 PTS4 PTIS4 PTS3 PTIS3 PTS2 PTIS2 PTS1 PTIS1 PTS0 PTIS0 DDRS7 DDRS6 DDRS5 DDRS4 DDRS3 DDRS2 DDRS1 DDRS0 RDRS7 RDRS6 RDRS5 RDRS4 RDRS3 RDRS2 RDRS1 RDRS0 PERS7 PERS6 PERS5 PERS4 PERS3 PERS2 PERS1 PERS0 PPSS7 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 WOMS7 0 WOMS6 0 WOMS5 0 WOMS4 0 WOMS3 0 WOMS2 0 WOMS1 0 WOMS0 0 0x024F R Reserved W 0x0250 PTM 0x0251 PTIM 0x0252 DDRM R W R W R W PTM7 PTIM7 PTM6 PTIM6 PTM5 PTIM5 PTM4 PTIM4 PTM3 PTIM3 PTM2 PTIM2 PTM1 PTIM1 PTM0 PTIM0 DDRM7 DDRM6 DDRM5 DDRM4 DDRM3 DDRM2 DDRM1 DDRM0 = Unimplemented or Reserved MC9S12XF - Family Reference Manual, Rev.1.19 844 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Register Name 0x0253 RDRM 0x0254 PERM 0x0255 PPSM 0x0256 WOMM R W R W R W R W Bit 7 RDRM7 6 RDRM6 5 RDRM5 4 RDRM4 3 RDRM3 2 RDRM2 1 RDRM1 Bit 0 RDRM0 PERM7 PERM6 PERM5 PERM4 PERM3 PERM2 PERM1 PERM0 PPSM7 PPSM6 PPSM5 PPSM4 PPSM3 PPSM2 PPSM1 PPSM0 WOMM7 0 WOMM6 0 WOMM5 0 WOMM4 0 WOMM3 0 WOMM2 0 WOMM1 0 WOMM0 0 0x0257 R Reserved W 0x0258 PTP 0x0259 PTIP 0x025A DDRP 0x025B RDRP 0x025C PERP 0x025D PPSP R W R W R W R W R W R W PTP7 PTIP7 PTP6 PTIP6 PTP5 PTIP5 PTP4 PTIP4 PTP3 PTIP3 PTP2 PTIP2 PTP1 PTIP1 PTP0 PTIP0 DDRP7 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 RDRP7 RDRP6 RDRP5 RDRP4 RDRP3 RDRP2 RDRP1 RDRP0 PERP7 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 PPSP7 0 PPSP6 0 PPSP5 0 PPSP4 0 PPSP3 0 PPSP2 0 PPSP1 0 PPSP0 0 0x025E R Reserved W 0x025F R Reserved W 0x0260 PTH 0x0261 PTIH R W R W 0 0 0 0 0 0 0 0 PTH7 PTIH7 PTH6 PTIH6 PTH5 PTIH5 PTH4 PTIH4 PTH3 PTIH3 PTH2 PTIH2 PTH1 PTIH1 PTH0 PTIH0 = Unimplemented or Reserved MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 845 Chapter 19 Port Integration Module (S12XFPIMV2) Register Name 0x0262 DDRH 0x0263 RDRH 0x0264 PERH 0x0265 PPSH R W R W R W R W Bit 7 DDRH7 6 DDRH6 5 DDRH5 4 DDRH4 3 DDRH3 2 DDRH2 1 DDRH1 Bit 0 DDRH0 RDRH7 RDRH6 RDRH5 RDRH4 RDRH3 RDRH2 RDRH1 RDRH0 PERH7 PERH6 PERH5 PERH4 PERH3 PERH2 PERH1 PERH0 PPSH7 0 PPSH6 0 PPSH5 0 PPSH4 0 PPSH3 0 PPSH2 0 PPSH1 0 PPSH0 0 0x0266 R Reserved W 0x0267 R Reserved W 0x0268 PTJ 0x0269 PTIJ 0x026A DDRJ 0x026B RDRJ 0x026C PERJ 0x026D PPSJ R W R W R W R W R W R W 0 0 0 0 0 0 0 0 PTJ7 PTIJ7 PTJ6 PTIJ6 PTJ5 PTIJ5 PTJ4 PTIJ4 PTJ3 PTIJ3 PTJ2 PTIJ2 PTJ1 PTIJ1 PTJ0 PTIJ0 DDRJ7 DDRJ6 DDRJ5 DDRJ4 DDRJ3 DDRJ2 DDRJ1 DDRJ0 RDRJ7 RDRJ6 RDRJ5 RDRJ4 RDRJ3 RDRJ2 RDRJ1 RDRJ0 PERJ7 PERJ6 PERJ5 PERJ4 PERJ3 PERJ2 PERJ1 PERJ0 PPSJ7 0 PPSJ6 0 PPSJ5 0 PPSJ4 0 PPSJ3 0 PPSJ2 0 PPSJ1 0 PPSJ0 0 0x026E R Reserved W 0x026F R Reserved W 0x0270 PT0AD R W 0 0 0 0 0 0 0 0 PT0AD15 PT0AD14 PT0AD13 PT0AD12 PT0AD11 PT0AD10 PT0AD9 PT0AD8 = Unimplemented or Reserved MC9S12XF - Family Reference Manual, Rev.1.19 846 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Register Name 0x0271 PT1AD R W Bit 7 PT1AD7 6 PT1AD6 5 PT1AD5 4 PT1AD4 3 PT1AD3 2 PT1AD2 1 PT1AD1 Bit 0 PT1AD0 0x0272 R DDR0AD W DDR0AD15 DDR0AD14 DDR0AD13 DDR0AD12 DDR0AD11 DDR0AD10 0x0273 R DDR1AD W DDR1AD7 DDR1AD6 DDR1AD5 DDR1AD4 DDR1AD3 DDR1AD2 DDR0AD9 DDR0AD8 DDR1AD1 DDR1AD0 0x0274 R RDR0AD W RDR0AD15 RDR0AD14 RDR0AD13 RDR0AD12 RDR0AD11 RDR0AD10 0x0275 R RDR1AD W RDR1AD7 0x0276 R PER0AD W PER0AD15 0x0277 R PER1AD W PER1AD7 RDR1AD6 RDR1AD5 RDR1AD4 RDR1AD3 RDR1AD2 RDR0AD9 RDR0AD8 RDR1AD1 RDR1AD0 PER0AD14 PER0AD13 PER0AD12 PER0AD11 PER0AD10 PER0AD9 PER0AD8 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 = Unimplemented or Reserved 19.3.2 Register Descriptions The following table summarizes the effect of the various conﬁguration bits, i.e. data direction (DDR), output level (IO), reduced drive (RDR), pull enable (PE), pull select (PS) on the pin function and pull device activity. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 847 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-3. Pin Conﬁguration Summary DDR 0 0 0 0 0 0 0 1 1 1 1 1 1 1 IO X X X X X X X 0 1 0 1 0 1 0 RDR X X X X X X X 0 0 1 1 0 0 1 PE 0 1 1 0 0 1 1 X X X X X X X PS (1) X 0 1 0 1 0 1 X X X X 0 1 0 Function Input Input Input Input Input Input Input Output, full drive to 0 Output, full drive to 1 Output, reduced drive to 0 Output, reduced drive to 1 Output, full drive to 0 Output, full drive to 1 Output, reduced drive to 0 Output, reduced drive to 1 Pull Device Disabled Pull Up Pull Down Disabled Disabled Pull Up Pull Down Disabled Disabled Disabled Disabled Disabled Disabled Disabled Disabled 1 1 1 X 1 1. Always “0” on Port A, B, C, D, E, K, and AD. NOTE All register bits in this module are completely synchronous to internal clocks during a register read. 19.3.3 Port A Data Register (PORTA) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0000 (PRR) 7 R PA7 W Altern. Function ADDR15 mux IVD15 0 ADDR14 mux IVD14 0 ADDR13 mux IVD13 0 ADDR12 mux IVD12 0 ADDR11 mux IVD11 0 ADDR10 mux IVD10 0 ADDR9 mux IVD9 0 ADDR8 mux IVD8 0 PA6 PA5 PA4 PA3 PA2 PA1 PA0 Reset Figure 19-1. Port A Data Register (PORTA) MC9S12XF - Family Reference Manual, Rev.1.19 848 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-4. PORTA Register Field Descriptions Field 7-0 PA Description Port A general purpose input/output data—Data Register Port A pins 7 through 0 are associated with address outputs ADDR[15:8] respectively in expanded modes. In emulation modes the address is multiplexed with IVD[15:8]. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 19.3.4 Port B Data Register (PORTB) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0001 (PRR) 7 R PB7 W Altern. Function ADDR7 mux IVD7 0 ADDR6 mux IVD6 0 ADDR5 mux IVD5 0 ADDR4 mux IVD4 0 ADDR3 mux IVD3 0 ADDR2 mux IVD2 0 ADDR1 mux IVD1 0 ADDR0 mux IVD0 or UDS 0 PB6 PB5 PB4 PB3 PB2 PB1 PB0 Reset Figure 19-2. Port B Data Register (PORTB) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-5. PORTB Register Field Descriptions Field 7-0 PB Description Port B general purpose input/output data—Data Register Port B pins 7 through 0 are associated with address outputs ADDR[7:0] respectively in expanded modes. In emulation modes the address is multiplexed with IVD[7:0]. In normal expanded mode pin 0 is related to the UDS input. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 849 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.5 Port A Data Direction Register (DDRA) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0002 (PRR) 7 R DDRA7 W Reset 0 0 0 0 0 0 0 0 DDRA6 DDRA5 DDRA4 DDRA3 DDRA2 DDRA1 DDRA0 Figure 19-3. Port A Data Direction Register (DDRA) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-6. DDRA Register Field Descriptions Field 7-0 DDRA Description Port A Data Direction— This register controls the data direction of pins 7 through 0. The external bus function forces the I/O state to be outputs for all associated pins. In this case the data direction bits will not change. When operating a pin as a general purpose I/O, the associated data direction bit determines whether it is an input or output. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. 19.3.6 Port B Data Direction Register (DDRB) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0003 (PRR) 7 R DDRB7 W Reset 0 0 0 0 0 0 0 0 DDRB6 DDRB5 DDRB4 DDRB3 DDRB2 DDRB1 DDRB0 Figure 19-4. Port B Data Direction Register (DDRB) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. MC9S12XF - Family Reference Manual, Rev.1.19 850 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-7. DDRB Register Field Descriptions Field 7-0 DDRB Description Port B Data Direction— This register controls the data direction of pins 7 through 0. The external bus function forces the I/O state to be outputs for all associated pins. In this case the data direction bits will not change. When operating a pin as a general purpose I/O, the associated data direction bit determines whether it is an input or output. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. 19.3.7 Port C Data Register (PORTC) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0004 (PRR) 7 R PC7 W Altern. Function Reset DATA15 0 DATA14 0 DATA13 0 DATA12 0 DATA11 0 DATA10 0 DATA9 0 DATA8 0 PC6 PC5 PC4 PC3 PC2 PC1 PC0 Figure 19-5. Port C Data Register (PORTC) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-8. PORTC Register Field Descriptions Field 7-0 PC Description Port C general purpose input/output data—Data Register Port C pins 7 through 0 are associated with data I/O lines DATA[15:8] respectively in expanded modes. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 851 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.8 Port D Data Register (PORTD) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0005 (PRR) 7 R PD7 W Altern. Function Reset DATA7 0 DATA6 0 DATA5 0 DATA4 0 DATA3 0 DATA2 0 DATA1 0 DATA0 0 PD6 PD5 PD4 PD3 PD2 PD1 PD0 Figure 19-6. Port D Data Register (PORTD) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-9. PORTD Register Field Descriptions Field 7-0 PD Description Port D general purpose input/output data—Data Register Port D pins 7 through 0 are associated with data I/O lines DATA[7:0] respectively in expanded modes. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 19.3.9 Port C Data Direction Register (DDRC) Access: User read/write(1) 6 5 4 3 2 1 0 Address 0x0006 (PRR) 7 R DDRC7 W Reset 0 0 0 0 0 0 0 0 DDRC6 DDRC5 DDRC4 DDRC3 DDRC2 DDRC1 DDRC0 Figure 19-7. Port C Data Direction Register (DDRC) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. MC9S12XF - Family Reference Manual, Rev.1.19 852 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-10. DDRC Register Field Descriptions Field 7-0 DDRC Description Port C Data Direction— This register controls the data direction of pins 7 through 0. The external bus function controls the data direction for the associated pins. In this case the data direction bits will not change. When operating a pin as a general purpose I/O, the associated data direction bit determines whether it is an input or output. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. 19.3.10 Port D Data Direction Register (DDRD) Address 0x0007 (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRD7 W Reset 0 0 0 0 0 0 0 0 DDRD6 DDRD5 DDRD4 DDRD3 DDRD2 DDRD1 DDRD0 Figure 19-8. Port D Data Direction Register (DDRD) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-11. DDRD Register Field Descriptions Field 7-0 DDRD Description Port D Data Direction— This register controls the data direction of pins 7 through 0. When used with the external bus this function controls the data direction for the associated pins. In this case the data direction bits will not change. When operating a pin as a general purpose I/O, the associated data direction bit determines whether it is an input or output. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 853 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.11 Port E Data Register (PORTE) Address 0x0008 (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PE7 W Altern. Function XCLKS or ECLKX2 0 MODB or TAGHI 0 MODA or RE or TAGLO 0 EROMCTL or LSTRB or LDS 0 RW or WE 0 PE6 PE5 PE4 PE3 PE2 PE1 PE0 ECLK IRQ XIRQ Reset 0 0 0 = Unimplemented or Reserved Figure 19-9. Port E Data Register (PORTE) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-12. PORTE Register Field Descriptions Field 7-0 PE Description Port E general purpose input/output data—Data Register Port E bits 7 through 0 are associated with external bus control signals and interrupt inputs. These include mode select (MODB, MODA), E clock, double frequency E clock, Instruction Tagging High and Low (TAGHI, TAGLO), Read/Write (RW), Read Enable and Write Enable (RE, WE), Lower Data Select (LDS), IRQ, and XIRQ. When not used with the alternative functions, Port E pins 7-2 can be used as general purpose I/O and pins 1-0 can be used as general purpose inputs. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Pins 6 and 5 are inputs with enabled pull-down devices while RESET pin is low. Pins 7 and 3 are inputs with enabled pull-up devices while RESET pin is low. 19.3.12 Port E Data Direction Register (DDRE) Address 0x0009 (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRE7 W Reset 0 0 0 0 0 0 DDRE6 DDRE5 DDRE4 DDRE3 DDRE2 0 0 0 0 = Unimplemented or Reserved Figure 19-10. Port E Data Direction Register (DDRE) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. MC9S12XF - Family Reference Manual, Rev.1.19 854 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-13. DDRE Register Field Descriptions Field 7-2 DDRE Description Port E Data Direction— This register controls the data direction of pins 7 through 2. The external bus function controls the data direction for the associated pins. In this case the data direction bits will not change. When operating a pin as a general purpose I/O, the associated data direction bit determines whether it is an input or output. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. Reserved— Port E bit 1 (associated with IRQ) and bit 0 (associated with XIRQ) cannot be conﬁgured as outputs. Port E, bits 1 and 0, can be read regardless of whether the alternate interrupt function is enabled. 1-0 19.3.13 S12X_EBI ports, BKGD pin Pull-up Control Register (PUCR) Address 0x000C (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PUPKE W Reset 1 1 BKPUE 0 PUPEE 0 1 PUPDE 0 PUPCE 0 PUPBE 0 PUPAE 0 = Unimplemented or Reserved Figure 19-11. S12X_EBI ports, BKGD pin Pull-up Control Register (PUCR) 1. Read:Anytime in single-chip modes. Write:Anytime, except BKPUE which is writable in Special Test Mode only. Table 19-14. PUCR Register Field Descriptions Field 7 PUPKE Description Pull-up Port K Enable—Enable pull-up devices on all Port K input pins This bit conﬁgures whether pull-up devices are activated, if the pins are used as inputs. This bit has no effect if the pins are used as outputs. Out of reset the pull-up devices are enabled. 1 Pull-up devices enabled. 0 Pull-up devices disabled. BKGD pin pull-up Enable—Enable pull-up devices on BKGD pin This bit conﬁgures whether a pull-up device is activated, if the pin is used as input. This bit has no effect if the pin is used as outputs. Out of reset the pull-up device is enabled. 1 Pull-up device enabled. 0 Pull-up device disabled. Reserved— Pull-up Port E Enable—Enable pull-up devices on all Port E input pins except on pins 5 and 6 which have pull-down devices only enabled during reset. This bit has no effect on these pins. This bit conﬁgures whether pull-up devices are activated, if the pins are used as inputs. This bit has no effect if the pins are used as outputs. Out of reset the pull-up devices are enabled. 1 Pull-up devices enabled. 0 Pull-up devices disabled. 6 BKPUE 5 4 PUPEE MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 855 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-14. PUCR Register Field Descriptions (continued) Field 3 PUPDE Description Pull-up Port D Enable—Enable pull-up devices on all Port D input pins This bit conﬁgures whether pull-up devices are activated, if the pins are used as inputs. This bit has no effect if the pins are used as outputs. Out of reset the pull-up devices are disabled. 1 Pull-up devices enabled. 0 Pull-up devices disabled. Pull-up Port C Enable—Enable pull-up devices on all Port C input pins This bit conﬁgures whether pull-up devices are activated, if the pins are used as inputs. This bit has no effect if the pins are used as outputs. Out of reset the pull-up devices are disabled. 1 Pull-up devices enabled. 0 Pull-up devices disabled. Pull-up Port B Enable—Enable pull-up devices on all Port B input pins This bit conﬁgures whether pull-up devices are activated, if the pins are used as inputs. This bit has no effect if the pins are used as outputs. Out of reset the pull-up devices are disabled. 1 Pull-up devices enabled. 0 Pull-up devices disabled. Pull-up Port A Enable—Enable pull-up devices on all Port A input pins This bit conﬁgures whether pull-up devices are activated, if the pins are used as inputs. This bit has no effect if the pins are used as outputs. Out of reset the pull-up devices are disabled. 1 Pull-up devices enabled. 0 Pull-up devices disabled. 2 PUPCE 1 PUPBE 0 PUPAE 19.3.14 S12X_EBI ports Reduced Drive Register (RDRIV) Address 0x000D (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDPK W Reset 0 0 0 RDPE RDPD 0 RDPC 0 RDPB 0 RDPA 0 0 0 0 = Unimplemented or Reserved u = Unaffected by reset Figure 19-12. S12X_EBI ports Reduced Drive Register (RDRIV) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. This register is used to select reduced drive for the pins associated with the S12X_EBI ports A, B, C, D, E, and K. If enabled, the pins drive at about 1/6 of the full drive strength. The reduced drive function is independent of which function is being used on a particular pin. The reduced drive functionality does not take effect on the pins in emulation modes. MC9S12XF - Family Reference Manual, Rev.1.19 856 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-15. RDRIV Register Field Descriptions Field 7 RDPK Description Port K reduced drive—Select reduced drive for outputs This bit conﬁgures the drive strength of all Port K output pins as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. Reserved— Port E reduced drive—Select reduced drive for outputs This bit conﬁgures the drive strength of all Port E output pins as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. Port D reduced drive—Select reduced drive for outputs This bit conﬁgures the drive strength of all output pins as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. Port C reduced drive—Select reduced drive for outputs This bit conﬁgures the drive strength of all output pins as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. Port B reduced drive—Select reduced drive for outputs This bit conﬁgures the drive strength of all output pins as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. Port A reduced drive—Select reduced drive for outputs This bit conﬁgures the drive strength of all output pins as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 6-5 4 RDPE 3 RDPD 2 RDPC 1 RDPB 0 RDPA MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 857 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.15 ECLK Control Register (ECLKCTL) Address 0x001C (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R NECLK W Reset(2): Mode Dependent 0 1 0 0 1 0 NCLKX2 DIV16 EDIV4 EDIV3 EDIV2 EDIV1 EDIV0 1 0 0 0 0 0 0 SS ES ST EX NS NX 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-13. ECLK Control Register (ECLKCTL) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. 2. Reset values in emulation modes are identical to those of the target mode. The ECLKCTL register is used to control the availability of the free-running clocks and the free-running clock divider. Table 19-16. ECLKCTL Register Field Descriptions Field 7 NECLK Description No ECLK—Disable ECLK output This bit controls the availability of a free-running clock on the ECLK pin. Clock output is always active in emulation modes and if enabled in all other operating modes. 1 ECLK disabled 0 ECLK enabled No ECLKX2—Disable ECLKX2 output This bit controls the availability of a free-running clock on the ECLKX2 pin. This clock has a ﬁxed rate of twice the internal Bus Clock. Clock output is always active in emulation modes and if enabled in all other operating modes. 1 ECLKX2 disabled 0 ECLKX2 enabled 6 NCLKX2 MC9S12XF - Family Reference Manual, Rev.1.19 858 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-16. ECLKCTL Register Field Descriptions (continued) Field 5 DIV16 Description Free-running ECLK predivider—Divide by 16 This bit enables a divide-by-16 stage on the selected EDIV rate. 1 Divider enabled: ECLK rate = EDIV rate divided by 16 0 Divider disabled: ECLK rate = EDIV rate Free-running ECLK Divider—Conﬁgure ECLK rate These bits determine the rate of the free-running clock on the ECLK pin. Divider is always disabled in emulation modes and active as programmed in all other operating modes. 00000 ECLK rate = Bus Clock rate 00001 ECLK rate = Bus Clock rate divided by 2 00010 ECLK rate = Bus Clock rate divided by 3, ... 11111 ECLK rate = Bus Clock rate divided by 32 4-0 EDIV 19.3.16 PIM Reserved Register Address 0x001D (PRR) 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-14. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.3.17 IRQ Control Register (IRQCR) Address 0x001E 7 6 5 4 3 2 Access: User read/write(1) 1 0 R IRQE W Reset 0 1 IRQEN 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-15. IRQ Control Register (IRQCR) 1. Read: See individual bit descriptions below. Write: See individual bit descriptions below. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 859 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-17. IRQCR Register Field Descriptions Field 7 IRQE Description IRQ select edge sensitive only— Special modes: Read or write anytime. Normal & emulation modes: Read anytime, write once. 1 IRQ conﬁgured to respond only to falling edges. Falling edges on the IRQ pin will be detected anytime IRQE = 1 and will be cleared only upon a reset or the servicing of the IRQ interrupt. 0 IRQ conﬁgured for low level recognition. External IRQ enable— Read or write anytime. 1 External IRQ pin is connected to interrupt logic. 0 External IRQ pin is disconnected from interrupt logic. Reserved— 6 IRQEN 5-0 19.3.18 PIM Reserved Register Address 0x001F 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-16. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.3.19 Port K Data Register (PORTK) Address 0x0032 (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PK7 W Altern. Function Reset ROMCTL or EWAIT 0 ADDR22 mux NOACC 0 ADDR21 0 ADDR20 0 ADDR19 mux IQSTAT3 0 ADDR18 mux IQSTAT2 0 ADDR17 mux IQSTAT1 0 ADDR16 mux IQSTAT0 0 PK6 PK5 PK4 PK3 PK2 PK1 PK0 Figure 19-17. Port K Data Register (PORTK) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. MC9S12XF - Family Reference Manual, Rev.1.19 860 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-18. PORTK Register Field Descriptions Field 7-0 PK Description Port K general purpose input/output data—Data Register Port K pins 7 through 0 are associated with external bus control signals and internal memory expansion emulation pins. These include ADDR[22:16], No-Access (NOACC), External Wait (EWAIT) and instruction pipe signals IQSTAT[3:0]. Bits 6-0 carry the external addresses in all expanded modes. In emulation modes the address is multiplexed with the alternate functions NOACC and IQSTAT on the respective pins. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 19.3.20 Port K Data Direction Register (DDRK) Address 0x0033 (PRR) 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRK7 W Reset 0 0 0 0 0 0 0 0 DDRK6 DDRK5 DDRK4 DDRK3 DDRK2 DDRK1 DDRK0 Figure 19-18. Port K Data Direction Register (DDRK) 1. Read: Anytime. In emulation modes, read operations will return the data from the external bus, in all other modes the data source is depending on the data direction value. Write: Anytime. In emulation modes, write operations will also be directed to the external bus. Table 19-19. DDRK Register Field Descriptions Field 7-0 DDRK Description Port K Data Direction— This register controls the data direction of pins 7 through 0. The external bus function controls the data direction for the associated pins. In this case the data direction bits will not change. When operating a pin as a general purpose I/O, the associated data direction bit determines whether it is an input or output. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 861 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.21 Port T Data Register (PTT) Address 0x0240 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PTT7 W Altern. Function IOC7 — Reset 0 IOC6 — 0 IOC5 VREG_API 0 IOC4 — 0 IOC3 — 0 IOC2 — 0 IOC1 — 0 IOC0 — 0 PTT6 PTT5 PTT4 PTT3 PTT2 PTT1 PTT0 Figure 19-19. Port T Data Register (PTT) 1. Read: Anytime. Write: Anytime. Table 19-20. PTT Register Field Descriptions Field 7-6 PTT Description Port T general purpose input/output data—Data Register Port T pins 7 through 0 are associated with ECT channels IOC7 and IOC6. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port T general purpose input/output data—Data Register Port T pins 5 is associated with ECT channel IOC5 and the VREG_API output. The ECT function takes precedence over the VREG_API and the general purpose I/O function if the related channel is enabled. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port T general purpose input/output data—Data Register Port T pins 4 through 0 are associated with ECT channels IOC4 through IOC0. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5 PTT 4-0 PTT 19.3.22 Port T Input Register (PTIT) Address 0x0241 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset PTIT7 PTIT6 PTIT5 PTIT4 PTIT3 PTIT2 PTIT1 PTIT0 u u u u u u u u = Unimplemented or Reserved u = Unaffected by reset Figure 19-20. Port T Input Register (PTIT) MC9S12XF - Family Reference Manual, Rev.1.19 862 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 1. Read: Anytime. Write:Never, writes to this register have no effect. Table 19-21. PTIT Register Field Descriptions Field 7-0 PTIT Description Port T input data— This register always reads back the buffered state of the associated pins. This can also be used to detect overload or short circuit conditions on output pins. 19.3.23 Port T Data Direction Register (DDRT) Address 0x0242 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRT7 W Reset 0 0 0 0 0 0 0 0 DDRT6 DDRT5 DDRT4 DDRT3 DDRT2 DDRT1 DDRT0 Figure 19-21. Port T Data Direction Register (DDRT) 1. Read: Anytime. Write: Anytime. Table 19-22. DDRT Register Field Descriptions Field 7-0 DDRT Description Port T data direction— This register controls the data direction of pins 7 through 0. The ECT forces the I/O state to be an output for each timer port associated with an enabled output compare. In this case the data direction bits will not change. The data direction bits revert to controlling the I/O direction of a pin when the associated timer output compare is disabled. The timer Input Capture always monitors the state of the pin. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as high-impedance input. NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PTT or PTIT registers, when changing the DDRT register. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 863 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.24 Port T Reduced Drive Register (RDRT) Address 0x0243 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDRT7 W Reset 0 0 0 0 0 0 0 0 RDRT6 RDRT5 RDRT4 RDRT3 RDRT2 RDRT1 RDRT0 Figure 19-22. Port T Reduced Drive Register (RDRT) 1. Read: Anytime. Write: Anytime. Table 19-23. RDRT Register Field Descriptions Field 7-0 RDRT Description Port T reduced drive—Select reduced drive for outputs This register conﬁgures the drive strength of output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 19.3.25 Port T Pull Device Enable Register (PERT) Address 0x0244 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PERT7 W Reset 0 0 0 0 0 0 0 0 PERT6 PERT5 PERT4 PERT3 PERT2 PERT1 PERT0 Figure 19-23. Port T Pull Device Enable Register (PERT) 1. Read: Anytime. Write: Anytime. Table 19-24. PERT Register Field Descriptions Field 7-0 PERT Description Port T pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset no pull device is enabled. 1 Pull device enabled. 0 Pull device disabled. MC9S12XF - Family Reference Manual, Rev.1.19 864 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.26 Port T Polarity Select Register (PPST) Address 0x0245 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PPST7 W Reset 0 0 0 0 0 0 0 0 PPST6 PPST5 PPST4 PPST3 PPST2 PPST1 PPST0 Figure 19-24. Port T Polarity Select Register (PPST) 1. Read: Anytime. Write: Anytime. Table 19-25. PPST Register Field Descriptions Field 7-0 PPST Description Port T pull device select—Determine pull device polarity on input pins This register selects whether a pull-down or a pull-up device is connected to the pin. 1 A pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 A pull-up device is connected to the associated pin, if enabled and if the pin is used as input. 19.3.27 PIM Reserved Register Address 0x0246 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-25. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.3.28 PIM Reserved Register Address 0x0247 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-26. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 865 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.29 Port S Data Register (PTS) Address 0x0248 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PTS7 W Altern. Function Reset SS0 0 SCK0 0 MOSI0 0 MISO0 0 TXD1 0 RXD1 0 TXD0 0 RXD0 0 PTST6 PTS5 PTS4 PTS3 PTS2 PTS1 PTS0 Figure 19-27. Port S Data Register (PTS) 1. Read: Anytime. Write: Anytime. Table 19-26. PTS Register Field Descriptions Field 7 PTS Description Port S general purpose input/output data—Data Register Port S pin 7 is associated with the SS signal of the SPI0 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port S general purpose input/output data—Data Register Port S pin 6 is associated with the SCK signal of the SPI0 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port S general purpose input/output data—Data Register Port S pin 5 is associated with the MOSI signal of the SPI0 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port S general purpose input/output data—Data Register Port S pin 4 is associated with the MISO signal of the SPI0 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port S general purpose input/output data—Data Register Port S pin 3 is associated with the TXD signal of the SCI1 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port S general purpose input/output data—Data Register Port S bits 2 is associated with the RXD signal of the SCI1 module . When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 PTS 5 PTS 4 PTS 3 PTS 2 PTS MC9S12XF - Family Reference Manual, Rev.1.19 866 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-26. PTS Register Field Descriptions (continued) Field 1 PTS Description Port S general purpose input/output data—Data Register Port S pin 3 is associated with the TXD signal of the SCI0 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port S general purpose input/output data—Data Register Port S bits 2 is associated with the RXD signal of the SCI0 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 PTS 19.3.30 Port S Input Register (PTIS) Address 0x0249 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset PTIS7 PTIS6 PTIS5 PTIS4 PTIS3 PTIS2 PTIS1 PTIS0 u u u u u u u u = Unimplemented or Reserved 1. Read: Anytime. Write:Never, writes to this register have no effect. u = Unaffected by reset Figure 19-28. Port S Input Register (PTIS) Table 19-27. PTIS Register Field Descriptions Field 7-0 PTIS Description Port S input data— This register always reads back the buffered state of the associated pins. This can also be used to detect overload or short circuit conditions on output pins. 19.3.31 Port S Data Direction Register (DDRS) Address 0x024A 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRS7 W Reset 0 0 0 0 0 0 0 0 DDRS6 DDRS5 DDRS4 DDRS3 DDRS2 DDRS1 DDRS0 Figure 19-29. Port S Data Direction Register (DDRS) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 867 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-28. DDRS Register Field Descriptions Field 7-0 DDRS Description Port S data direction— This register controls the data direction of pins 7 through 0.This register conﬁgures each Port S pin as either input or output. If SPI0 is enabled, the SPI0 determines the pin direction. Refer to SPI Block Guide for details. If the associated SCI transmit or receive channel is enabled this register has no effect on the pins. The pin is forced to be an output if a SCI transmit channel is enabled, it is forced to be an input if the SCI receive channel is enabled. The data direction bits revert to controlling the I/O direction of a pin when the associated channel is disabled. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PTS or PTIS registers, when changing the DDRS register. 19.3.32 Port S Reduced Drive Register (RDRS) Address 0x024B 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDRS7 W Reset 0 0 0 0 0 0 0 0 RDRS6 RDRS5 RDRS4 RDRS3 RDRS2 RDRS1 RDRS0 Figure 19-30. Port S Reduced Drive Register (RDRS) 1. Read: Anytime. Write: Anytime. Table 19-29. RDRS Register Field Descriptions Field 7-0 RDRS Description Port S reduced drive—Select reduced drive for outputs This register conﬁgures the drive strength of output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. MC9S12XF - Family Reference Manual, Rev.1.19 868 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.33 Port S Pull Device Enable Register (PERS) Address 0x024C 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PERS7 W Reset 1 1 1 1 1 1 1 1 PERS6 PERS5 PERS4 PERS3 PERS2 PERS1 PERS0 Figure 19-31. Port S Pull Device Enable Register (PERS) 1. Read: Anytime. Write: Anytime. Read: Anytime. Write: Anytime. Table 19-30. PERS Register Field Descriptions Field 7-0 PERS Description Port S pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset all pull devices are enabled. 1 Pull device enabled. 0 Pull device disabled. 19.3.34 Port S Polarity Select Register (PPSS) Address 0x024D 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PPSS7 W Reset 0 0 0 0 0 0 0 0 PPSS6 PPSS5 PPSS4 PPSS3 PPSS2 PPSS1 PPSS0 Figure 19-32. Port S Polarity Select Register (PPSS) 1. Read: Anytime. Write: Anytime. Table 19-31. PPSS Register Field Descriptions Field 7-0 PPSS Description Port S pull device select—Determine pull device polarity on input pins This register selects whether a pull-down or a pull-up device is connected to the pin. 1 A pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 A pull-up device is connected to the associated pin, if enabled and if the pin is used as input. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 869 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.35 Port S Wired-Or Mode Register (WOMS) Address 0x024E 7 6 5 4 3 2 Access: User read/write(1) 1 0 R WOMS7 W Reset 0 0 0 0 0 0 0 0 WOMS6 WOMS5 WOMS4 WOMS3 WOMS2 WOMS1 WOMS0 Figure 19-33. Port S Wired-Or Mode Register (WOMS) 1. Read: Anytime. Write: Anytime. Table 19-32. WOMS Register Field Descriptions Field 7-0 WOMS Description Port S wired-or mode—Enable wired-or functionality This register conﬁgures the output pins as wired-or. If enabled the output is driven active low only (open-drain). A logic level of “1” is not driven.This allows a multipoint connection of several serial modules. These bits have no inﬂuence on pins used as inputs. 1 Output buffers operate as open-drain outputs. 0 Output buffers operate as push-pull outputs. 19.3.36 PIM Reserved Register Address 0x024F 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved 1. Read: Always reads 0x00 Write: Unimplemented u = Unaffected by reset Figure 19-34. PIM Reserved Register MC9S12XF - Family Reference Manual, Rev.1.19 870 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.37 Port M Data Register (PTM) Address 0x0250 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PTM7 W Altern. Function Reset SS1 SCK1 CS3 0 0 0 MOSI1 CS2 0 CS1 0 CS0 0 0 0 MISO1 FAULT3 FAULT2 TXCAN RXCAN PTM6 PTM5 PTM4 PTM3 PTM2 PTM1 PTM0 Figure 19-35. Port M Data Register (PTM) 1. Read: Anytime. Write: Anytime. Table 19-33. PTM Register Field Descriptions Field 7 PTM Description Port M general purpose input/output data—Data Register Port M pin 7 is associated with the SS signal of the SPI1 module and the chip select output CS3. The SPI function takes precedence over the chip select. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port M general purpose input/output data—Data Register Port M pin 6 is associated with the SCK signal of the SPI1 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port M general purpose input/output data—Data Register Port M pin 5 is associated with the MOSI signal of the SPI1 module. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port M general purpose input/output data—Data Register Port M pin 4 is associated with the MISO signal of the SPI1 module and the chip select output CS2. The SPI function takes precedence over the chip select. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port M general purpose input/output data—Data Register Port M pins 3 and 2 are associated with the PMF fault inputs FAULT[3:2] and chip select outputs CS[1:0]. The PMF function takes precedence over the chip selects. When not used with the alternative functions, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 PTM 5 PTM 4 PTM 3-2 PTM MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 871 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-33. PTM Register Field Descriptions (continued) Field 1 PTM Description Port M general purpose input/output data—Data Register Port M pin 1 is associated with the TXCAN signal of the CAN module. When not used with the alternative functions, these pins can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port M general purpose input/output data—Data Register Port M pin 0 is associated with the RXCAN signal of the CAN module. When not used with the alternative functions, these pins can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 PTM 19.3.38 Port M Input Register (PTIM) Address 0x0251 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset PTIM7 PTIM6 PTIM5 PTIM4 PTIM3 PTIM2 PTIM1 PTIM0 u u u u u u u u = Unimplemented or Reserved 1. Read: Anytime. Write:Never, writes to this register have no effect. u = Unaffected by reset Figure 19-36. Port M Input Register (PTIM) Table 19-34. PTIM Register Field Descriptions Field 7-0 PTIM Description Port M input data— This register always reads back the buffered state of the associated pins. This can also be used to detect overload or short circuit conditions on output pins. 19.3.39 Port M Data Direction Register (DDRM) Address 0x0252 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRM7 W Reset 0 0 0 0 0 0 0 0 DDRM6 DDRM5 DDRM4 DDRM3 DDRM2 DDRM1 DDRM0 Figure 19-37. Port M Data Direction Register (DDRM) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 872 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-35. DDRM Register Field Descriptions Field 7-6 DDRM Description Port M data direction— This register controls the data direction of pins 7 through 6. The PMF forces the I/O state to be an to be an input on the associated FAULT[3:2] pins if fault protection functions are enabled. Refer to PMF Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port M data direction— This register controls the data direction of pins 5 through 2. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port M data direction— This register controls the data direction of pin 1. The CAN forces the I/O state to be an output (TXCAN) if enabled . In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port M data direction— This register controls the data direction of pin 0. The CAN forces the I/O state to be an input (RXCAN) if enabled . In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. 5-2 DDRM 1 DDRM 0 DDRM NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PTM or PTIM registers, when changing the DDRM register. 19.3.40 Port M Reduced Drive Register (RDRM) Address 0x0253 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDRM7 W Reset 0 0 0 0 0 0 0 0 RDRM6 RDRM5 RDRM4 RDRM3 RDRM2 RDRM1 RDRM0 Figure 19-38. Port M Reduced Drive Register (RDRM) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 873 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-36. RDRM Register Field Descriptions Field 7-0 RDRM Description Port M reduced drive—Select reduced drive for outputs This register conﬁgures the drive strength of Port M output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 19.3.41 Port M Pull Device Enable Register (PERM) Address 0x0254 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PERM7 W Reset 0 0 0 0 0 0 0 0 PERM6 PERM5 PERM4 PERM3 PERM2 PERM1 PERM0 Figure 19-39. Port M Pull Device Enable Register (PERM) 1. Read: Anytime. Write: Anytime. Table 19-37. PERM Register Field Descriptions Field 7-0 PERM Description Port M pull device enable—Enable pull-up devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset no pull device is enabled. 1 Pull device enabled. 0 Pull device disabled. 19.3.42 Port M Polarity Select Register (PPSM) Address 0x0255 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PPSM7 W Reset 0 0 0 0 0 0 0 0 PPSM6 PPSM5 PPSM4 PPSM3 PPSM2 PPSM1 PPSM0 Figure 19-40. Port M Polarity Select Register (PPSM) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 874 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-38. PPSM Register Field Descriptions Field 7-0 PPSM Description Port M pull device select—Determine pull device polarity on input pins This register selects whether a pull-down or a pull-up device is connected to the pin. 1 A pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 A pull-up device is connected to the associated pin, if enabled and if the pin is used as input. 19.3.43 Port M Wired-Or Mode Register (WOMM) Address 0x0256 7 6 5 4 3 2 Access: User read/write(1) 1 0 R WOMM7 W Reset 0 0 0 0 0 0 0 0 WOMM6 WOMM5 WOMM4 WOMM3 WOMM2 WOMM1 WOMM0 Figure 19-41. Port M Wired-Or Mode Register (WOMM) 1. Read: Anytime. Write: Anytime. Table 19-39. WOMM Register Field Descriptions Field 7-0 WOMM Description Port M wired-or mode—Enable wired-or functionality This register conﬁgures the output pins as wired-or. If enabled the output is driven active low only (open-drain). A logic level of “1” is not driven.This allows a multipoint connection of several serial modules. These bits have no inﬂuence on pins used as inputs. 1 Output buffers operate as open-drain outputs. 0 Output buffers operate as push-pull outputs. 19.3.44 PIM Reserved Register Address 0x0257 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-42. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 875 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.45 Port P Data Register (PTP) Address 0x0258 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PTP7 W Altern. Function Reset FAULT1 0 FAULT0 0 PW05 0 PW04 0 PW03 0 PW02 0 PW01 0 PW00 0 PTP6 PTP5 PTP4 PTP3 PTP2 PTP1 PTP0 Figure 19-43. Port P Data Register (PTP) 1. Read: Anytime. Write: Anytime. Table 19-40. PTP Register Field Descriptions Field 7-6 PTP Description Port P general purpose input/output data—Data Register Port P pins 7 and 6 are associated with the PMF fault inputs FAULT[1:0]. When not used with the alternative functions, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port P general purpose input/output data—Data Register Port P pins 5 through 0 are associated with the PMF output channels PW0[5:0]. When not used with the alternative functions, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 5-0 PTP 19.3.46 Port P Input Register (PTIP) Address 0x0259 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset PTIP7 PTIP6 PTIP5 PTIP4 PTIP3 PTIP2 PTIP1 PTIP0 u u u u u u u u = Unimplemented or Reserved 1. Read: Anytime. Write:Never, writes to this register have no effect. u = Unaffected by reset Figure 19-44. Port P Input Register (PTIP) Table 19-41. PTIP Register Field Descriptions Field 7-0 PTIP Description Port P input data—This register always reads back the buffered state of the associated pins. This can also be used to detect overload or short circuit conditions on output pins. MC9S12XF - Family Reference Manual, Rev.1.19 876 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.47 Port P Data Direction Register (DDRP) Address 0x025A 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRP7 W Reset 0 0 0 0 0 0 0 0 DDRP6 DDRP5 DDRP4 DDRP3 DDRP2 DDRP1 DDRP0 Figure 19-45. Port P Data Direction Register (DDRP) 1. Read: Anytime. Write: Anytime. Table 19-42. DDRP Register Field Descriptions Field 7-6 DDRP Description Port P data direction— This register controls the data direction of pins 7 through 6. The PMF forces the I/O state to be an to be an input on the associated FAULT[1:0] pins if fault protection functions are enabled. Refer to PMF Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port P data direction— This register controls the data direction of pins 5 through 0. The PMF forces the I/O state to be an output for each pin associated with an enabled PW[05:00] channel. In this case the data direction bit will not change. Refer to PMF Block Guide for details. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. 5-0 DDRP NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PTP or PTIP registers, when changing the DDRP register. 19.3.48 Port P Reduced Drive Register (RDRP) Address 0x025B 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDRP7 W Reset 0 0 0 0 0 0 0 0 RDRP6 RDRP5 RDRP4 RDRP3 RDRP2 RDRP1 RDRP0 Figure 19-46. Port P Reduced Drive Register (RDRP) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 877 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-43. RDRP Register Field Descriptions Field 7-0 RDRP Description Port P reduced drive—Select reduced drive for outputs This register conﬁgures the drive strength of output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 19.3.49 Port P Pull Device Enable Register (PERP) Address 0x025C 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PERP7 W Reset 0 0 0 0 0 0 0 0 PERP6 PERP5 PERP4 PERP3 PERP2 PERP1 PERP0 Figure 19-47. Port P Pull Device Enable Register (PERP) 1. Read: Anytime. Write: Anytime. Table 19-44. PERP Register Field Descriptions Field 7-0 PERP Description Port P pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset no pull device is enabled. 1 Pull device enabled. 0 Pull device disabled. 19.3.50 Port P Polarity Select Register (PPSP) Address 0x025D 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PPSP7 W Reset 0 0 0 0 0 0 0 0 PPSP6 PPSP5 PPSP4 PPSP3 PPSP2 PPSP1 PPSP0 Figure 19-48. Port P Polarity Select Register (PPSP) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 878 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-45. PPSP Register Field Descriptions Field 7-0 PPSP Description Port P pull device select—Determine pull device polarity on input pins This register selects whether a pull-down or a pull-up device is connected to the pin. 1 A pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 A pull-up device is connected to the associated pin, if enabled and if the pin is used as input. 19.3.51 PIM Reserved Register Address 0x025E 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-49. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.3.52 PIM Reserved Register Address 0x025F 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-50. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 879 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.53 Port H Data Register (PTH) Address 0x0260 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PTH7 W Altern. Function Reset — 0 TXE_B 0 TXD_B 0 RXD_B 0 — 0 TXE_A 0 TXD_A 0 RXD_A 0 PTH6 PTH5 PTH4 PTH3 PTH2 PTH1 PTH0 Figure 19-51. Port H Data Register (PTH) 1. Read: Anytime. Write: Anytime. Table 19-46. PTH Register Field Descriptions Field 7 PTH Description Port H general purpose input/output data—Data Register This pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port H general purpose input/output data—Data Register This pin is associated with the FlexRay channel B transmitter enable signal (TXE_B). When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port H general purpose input/output data—Data Register This pin is associated with the FlexRay channel B transmit pin (TXD_B). When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port H general purpose input/output data—Data Register This pin is associated with the FlexRay channel B receive pin (RXD_B). When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port H general purpose input/output data—Data Register This pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port H general purpose input/output data—Data Register This pin is associated with the FlexRay channel A transmitter enable signal (TXE_A). When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 PTH 5 PTH 4 PTH 3 PTH 2 PTH MC9S12XF - Family Reference Manual, Rev.1.19 880 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-46. PTH Register Field Descriptions (continued) Field 1 PTH Description Port H general purpose input/output data—Data Register This pin is associated with the FlexRay channel A transmit pin (TXD_A). When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port H general purpose input/output data—Data Register This pin is associated with the FlexRay channel A receive pin (RXD_A). When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 PTH 19.3.54 Port H Input Register (PTIH) Address 0x0261 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset PTIH7 PTIH6 PTIH5 PTIH4 PTIH3 PTIH2 PTIH1 PTIH0 u u u u u u u u = Unimplemented or Reserved 1. Read: Anytime. Write:Never, writes to this register have no effect. u = Unaffected by reset Figure 19-52. Port H Input Register (PTIH) Table 19-47. PTIH Register Field Descriptions Field 7-0 PTIH Description Port H input data— This register always reads back the buffered state of the associated pins. This can also be used to detect overload or short circuit conditions on output pins. 19.3.55 Port H Data Direction Register (DDRH) Address 0x0262 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRH7 W Reset 0 0 0 0 0 0 0 0 DDRH6 DDRH5 DDRH4 DDRH3 DDRH2 DDRH1 DDRH0 Figure 19-53. Port H Data Direction Register (DDRH) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 881 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-48. DDRH Register Field Descriptions Field 7 DDRH Port H data direction— This register controls the data direction of pin 7. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pin 6. The FlexRay forces the I/O state to be an output (TXE_B) if channel B is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pin 5. The FlexRay forces the I/O state to be an output (TXD_B) if channel B is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pin 4. The FlexRay forces the I/O state to be an input (RXD_B) if channel B is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pins 3 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pin 2. The FlexRay forces the I/O state to be an output (TXE_A) if channel A is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pin 1. The FlexRay forces the I/O state to be an output (TXD_A) if channel A is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Port H data direction— This register controls the data direction of pin 0. The FlexRay forces the I/O state to be an input (RXD_A) if channel A is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Pin is conﬁgured as output. 0 Pin is conﬁgured as input. Description 6 DDRH 5 DDRH 4 DDRH 3 DDRH 2 DDRH 1 DDRH 0 DDRH MC9S12XF - Family Reference Manual, Rev.1.19 882 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PTH or PTIH registers, when changing the DDRH register. 19.3.56 Port H Reduced Drive Register (RDRH) Address 0x0263 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDRH7 W Reset 0 0 0 0 0 0 0 0 RDRH6 RDRH5 RDRH4 RDRH3 RDRH2 RDRH1 RDRH0 Figure 19-54. Port H Reduced Drive Register (RDRH) 1. Read: Anytime. Write: Anytime. Table 19-49. RDRH Register Field Descriptions Field 7-0 RDRH Description Port H reduced drive—Select reduced drive for outputs This register conﬁgures the drive strength of output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 19.3.57 Port H Pull Device Enable Register (PERH) Address 0x0264 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PERH7 W Reset 0 0 0 0 0 0 0 0 PERH6 PERH5 PERH4 PERH3 PERH2 PERH1 PERH0 Figure 19-55. Port H Pull Device Enable Register (PERH) 1. Read: Anytime. Write: Anytime. Table 19-50. PERH Register Field Descriptions Field 7-0 PERH Description Port H pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset no pull device is enabled. 1 Pull device enabled. 0 Pull device disabled. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 883 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.58 Port H Polarity Select Register (PPSH) Address 0x0265 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PPSH7 W Reset 0 0 0 0 0 0 0 0 PPSH6 PPSH5 PPSH4 PPSH3 PPSH2 PPSH1 PPSH0 Figure 19-56. Port H Polarity Select Register (PPSH) 1. Read: Anytime. Write: Anytime. Table 19-51. PPSH Register Field Descriptions Field 7-0 PPSH Description Port H pull device select—Determine pull device polarity on input pins This register selects whether a pull-down or a pull-up device is connected to the pin. 1 A pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 A pull-up device is connected to the associated pin, if enabled and if the pin is used as input. 19.3.59 PIM Reserved Register Address 0x0266 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-57. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.3.60 PIM Reserved Register Address 0x0267 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-58. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 884 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.61 Port J Data Register (PTJ) Address 0x0268 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PTJ7 W Altern. Function Reset — 0 STB3 0 STB2 0 STB1 0 STB0 0 IS2 0 IS1 0 IS0 0 PTJ6 PTJ5 PTJ4 PTJ3 PTJ2 PTJ1 PTJ0 Figure 19-59. Port J Data Register (PTJ) 1. Read: Anytime. Write: Anytime. Table 19-52. PTJ Register Field Descriptions Field 7 PTJ Description Port J general purpose input/output data—Data Register This pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port J general purpose input/output data—Data Register This pin is associated with the FlexRay debug strobe signal 3. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port J general purpose input/output data—Data Register This pin is associated with the FlexRay debug strobe signal 2. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port J general purpose input/output data—Data Register This pin is associated with the FlexRay debug strobe signal 1. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port J general purpose input/output data—Data Register This pin is associated with the FlexRay debug strobe signal 0. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port J general purpose input/output data—Data Register This pin is associated with the PMF current status signal IS2. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 6 PTJ 5 PTJ 4 PTJ 3 PTJ 2 PTJ MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 885 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-52. PTJ Register Field Descriptions (continued) Field 1 PTJ Description Port J general purpose input/output data—Data Register This pin is associated with the PMF current status signal IS1. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. Port J general purpose input/output data—Data Register This pin is associated with the PMF current status signal IS0. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bit of this pin is set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 0 PTJ 19.3.62 Port J Input Register (PTIJ) Address 0x0269 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset PTIJ7 PTIJ6 PTIJ5 PTIJ4 PTIJ3 PTIJ2 PTIJ1 PTIJ0 u u u u u u u u = Unimplemented or Reserved 1. Read: Anytime. Write:Never, writes to this register have no effect. u = Unaffected by reset Figure 19-60. Port J Input Register (PTIJ) Table 19-53. PTIJ Register Field Descriptions Field 7-0 PTIJ Description Port J input data— This register always reads back the buffered state of the associated pins. This can also be used to detect overload or short circuit conditions on output pins. 19.3.63 Port J Data Direction Register (DDRJ) Address 0x026A 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDRJ7 W Reset 0 0 0 0 0 0 0 0 DDRJ6 DDRJ5 DDRJ4 DDRJ3 DDRJ2 DDRJ1 DDRJ0 Figure 19-61. Port J Data Direction Register (DDRJ) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 886 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-54. DDRJ Register Field Descriptions Field 7 DDRJ Port J data direction— This register controls the data direction of pin 7. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port J data direction— This register controls the data direction of pin 6. The FlexRay forces the I/O state to be an output (STB3) if the strobe signal is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port J data direction— This register controls the data direction of pin 5. The FlexRay forces the I/O state to be an output (STB2) if the strobe signal is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port J data direction— This register controls the data direction of pin 4. The FlexRay forces the I/O state to be an output (STB1) if the strobe signal is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port J data direction— This register controls the data direction of pin 3. The FlexRay forces the I/O state to be an output (STB0) if the strobe signal is enabled. Refer to FlexRay Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Port J data direction— This register controls the data direction of pins 2 through 0. The PMF forces the I/O state to be an input on the associated IS[2:0] pins if current sense functions are enabled. Refer to PMF Block Guide. In this case the data direction bit will not change. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. Description 6 DDRJ 5 DDRJ 4 DDRJ 3 DDRJ 2-0 DDRJ NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PTH or PTIH registers, when changing the DDRH register. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 887 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.64 Port J Reduced Drive Register (RDRJ) Address 0x026B 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDRJ7 W Reset 0 0 0 0 0 0 0 0 RDRJ6 RDRJ5 RDRJ4 RDRJ3 RDRJ2 RDRJ1 RDRJ0 Figure 19-62. Port J Reduced Drive Register (RDRJ) 1. Read: Anytime. Write: Anytime. Table 19-55. RDRJ Register Field Descriptions Field 7-0 RDRJ Description Port J reduced drive—Select reduced drive for outputs This register conﬁgures the drive strength of output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 19.3.65 Port J Pull Device Enable Register (PERJ) Address 0x026C 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PERJ7 W Reset 1 1 1 1 1 1 1 1 PERJ6 PERJ5 PERJ4 PERJ3 PERJ2 PERJ1 PERJ0 Figure 19-63. Port J Pull Device Enable Register (PERJ) 1. Read: Anytime. Write: Anytime. Table 19-56. PERJ Register Field Descriptions Field 7-0 PERJ Description Port J pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset all pull device are enabled. 1 Pull device enabled. 0 Pull device disabled. MC9S12XF - Family Reference Manual, Rev.1.19 888 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.66 Port J Polarity Select Register (PPSJ) Address 0x026D 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PPSJ7 W Reset 0 0 0 0 0 0 0 0 PPSJ6 PPSJ5 PPSJ4 PPSJ3 PPSJ2 PPSJ1 PPSJ0 Figure 19-64. Port J Polarity Select Register (PPSJ) 1. Read: Anytime. Write: Anytime. Table 19-57. PPSJ Register Field Descriptions Field 7-0 PPSJ Description Port J pull device select—Determine pull device polarity on input pins This register selects whether a pull-down or a pull-up device is connected to the pin. 1 A pull-down device is connected to the associated pin, if enabled and if the pin is used as input. 0 A pull-up device is connected to the associated pin, if enabled and if the pin is used as input. 19.3.67 PIM Reserved Register Address 0x026E 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-65. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.3.68 PIM Reserved Register Address 0x026F 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-66. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 889 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.69 Port AD Data Register 0 (PT0AD) Address 0x0270 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PT0AD15 W Altern. Function Reset AN15 0 AN14 0 AN13 0 AN12 0 AN11 0 AN10 0 AN9 0 AN8 0 PT0AD14 PT0AD13 PT0AD12 PT0AD11 PT0AD10 PT0AD9 PT0AD8 Figure 19-67. Port AD Data Register 0 (PT0AD) 1. Read: Anytime. Write: Anytime. Table 19-58. PT0AD Register Field Descriptions Field 7-0 PT0AD Description Port AD general purpose input/output data—Data Register This register is associated with ATD analog inputs PAD[15:08]. When not used with the alternative function, this pin can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. 19.3.70 Port AD Data Register 1 (PT1AD) Address 0x0271 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PT1AD7 W Altern. Function Reset AN7 0 AN6 0 AN5 0 AN4 0 AN3 0 AN2 0 AN1 0 AN0 0 PT1AD6 PT1AD5 PT1AD4 PT1AD3 PT1AD2 PT1AD1 PT1AD0 Figure 19-68. Port AD Data Register 1 (PT1AD) 1. Read: Anytime. Write: Anytime. Table 19-59. PT1AD Register Field Descriptions Field 7-0 PT1AD Description Port AD general purpose input/output data—Data Register This register is associated with ATD analog inputs PAD[07:00]. When not used with the alternative function, these pins can be used as general purpose I/O. If the associated data direction bits of these pins are set to 1, a read returns the value of the port register, otherwise the buffered pin input state is read. MC9S12XF - Family Reference Manual, Rev.1.19 890 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.71 Port AD Data Direction Register 0 (DDR0AD) Address 0x0272 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDR0AD15 W Reset 0 0 0 0 0 0 0 0 DDR0AD14 DDR0AD13 DDR0AD12 DDR0AD11 DDR0AD10 DDR0AD9 DDR0AD8 Figure 19-69. Port AD Data Direction Register 0 (DDR0AD) 1. Read: Anytime. Write: Anytime. Table 19-60. DDR0AD Register Field Descriptions Field 7-0 DDR0AD Description Port AD data direction— This register controls the data direction of pins 15 through 8. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PT0AD registers, when changing the DDR0AD register. NOTE To use the digital input function on Port AD the ATD Digital Input Enable Register (ATDDIEN1) has to be set to logic level “1”. 19.3.72 Port AD Data Direction Register 1 (DDR1AD) Address 0x0273 7 6 5 4 3 2 Access: User read/write(1) 1 0 R DDR1AD7 W Reset 0 0 0 0 0 0 0 0 DDR1AD6 DDR1AD5 DDR1AD4 DDR1AD3 DDR1AD2 DDR1AD1 DDR1AD0 Figure 19-70. Port AD Data Direction Register 1 (DDR1AD) 1. Read: Anytime. Write: Anytime. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 891 Chapter 19 Port Integration Module (S12XFPIMV2) Table 19-61. DDR1AD Register Field Descriptions Field 7-0 DDR1AD Description Port AD data direction— This register controls the data direction of pins 7 through 0. 1 Associated pin is conﬁgured as output. 0 Associated pin is conﬁgured as input. NOTE Due to internal synchronization circuits, it can take up to 2 bus clock cycles until the correct value is read on PT0AD registers, when changing the DDR1AD register. NOTE To use the digital input function on Port AD the ATD Digital Input Enable Register (ATDDIEN1) has to be set to logic level “1”. 19.3.73 Port AD Reduced Drive Register 0 (RDR0AD) Address 0x0274 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDR0AD15 W Reset 0 0 0 0 0 0 0 0 RDR0AD14 RDR0AD13 RDR0AD12 RDR0AD11 RDR0AD10 RDR0AD9 RDR0AD8 Figure 19-71. Port AD Reduced Drive Register 0 (RDR0AD) 1. Read: Anytime. Write: Anytime. Table 19-62. RDR0AD Register Field Descriptions Field 7-0 RDR0AD Description Port AD reduced drive—Select reduced drive for Port AD outputs This register conﬁgures the drive strength of Port AD output pins 15 through 8 as either full or reduce. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. MC9S12XF - Family Reference Manual, Rev.1.19 892 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.74 Port AD Reduced Drive Register 1 (RDR1AD) Address 0x0275 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RDR1AD15 W Reset 0 0 0 0 0 0 0 0 RDR1AD14 RDR1AD13 RDR1AD12 RDR1AD11 RDR1AD10 RDR1AD9 RDR1AD8 Figure 19-72. Port AD Reduced Drive Register 1 (RDR1AD) 1. Read: Anytime. Write: Anytime. Table 19-63. RDR1AD Register Field Descriptions Field 7-0 RDR1AD Description Port AD reduced drive—Select reduced drive for Port AD outputs This register conﬁgures the drive strength of Port AD output pins 7 through 0 as either full or reduced. If a pin is used as input this bit has no effect. 1 Reduced drive selected (1/6 of the full drive strength). 0 Full drive strength enabled. 19.3.75 Port AD Pull Up Enable Register 0 (PER0AD) Address 0x0276 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PER0AD15 W Reset 0 0 0 0 0 0 0 0 PER0AD14 PER0AD13 PER0AD12 PER0AD11 PER0AD10 PER0AD9 PER0AD8 Figure 19-73. Port AD Pull Device Up Register 0 (PER0AD) 1. Read: Anytime. Write: Anytime. Table 19-64. PER0AD Register Field Descriptions Field 7-0 PER0AD Description Port AD pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset no pull device is enabled. 1 Pull device enabled. 0 Pull device disabled. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 893 Chapter 19 Port Integration Module (S12XFPIMV2) 19.3.76 Port AD Pull Up Enable Register 1 (PER1AD) Address 0x0277 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PER1AD7 W Reset 0 0 0 0 0 0 0 0 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 Figure 19-74. Port AD Pull Up Enable Register 1 (PER1AD) 1. Read: Anytime. Write: Anytime. Table 19-65. PER1AD Register Field Descriptions Field 7-0 PER1AD Description Port AD pull device enable—Enable pull devices on input pins These bits conﬁgure whether a pull device is activated, if the associated pin is used as an input. This bit has no effect if the pin is used as an output. Out of reset no pull device is enabled. 1 Pull device enabled. 0 Pull device disabled. 19.3.77 PIM Reserved Register Address 0x0278 - 0x027F 7 6 5 4 3 2 1 Access: User read(1) 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 19-75. PIM Reserved Register 1. Read: Always reads 0x00 Write: Unimplemented 19.4 19.4.1 Functional Description General Each pin except PE0, PE1, and BKGD can act as general purpose I/O. In addition each pin can act as an output from the external bus interface module or a peripheral module or an input to the external bus interface module or a peripheral module. MC9S12XF - Family Reference Manual, Rev.1.19 894 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.4.2 Registers A set of conﬁguration registers is common to all ports with exceptions in the expanded bus interface and ATD ports (Table 19-66). All registers can be written at any time, however a speciﬁc conﬁguration might not become active. Example 19-1. Selecting a pull-up device This device does not become active while the port is used as a push-pull output. Table 19-66. Register availability per port(1) Port A B C D E K T S M P H J Data ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ Input - ✔ ✔ ✔ ✔ ✔ ✔ AD 1. Each cell represents one register with individual conﬁguration bits Data Reduced Direction Drive ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ Pull Enable Polarity Select - Wired-Or Mode - ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ - ✔ ✔ - 19.4.2.1 Data register (PORTx, PTx) This register holds the value driven out to the pin if the pin is used as a general purpose I/O. Writing to this register has only an effect on the pin if the pin is used as general purpose output. When reading this address, the buffered state of the pin is returned if the associated data direction register bit is set to “0”. If the data direction register bits are set to logic level “1”, the contents of the data register is returned. This is independent of any other conﬁguration (Figure 19-76). 19.4.2.2 Input register (PTIx) This is a read-only register and always returns the buffered state of the pin (Figure 19-76). 19.4.2.3 Data direction register (DDRx) This register deﬁnes whether the pin is used as an input or an output. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 895 Chapter 19 Port Integration Module (S12XFPIMV2) If a peripheral module controls the pin the contents of the data direction register is ignored (Figure 19-76). PTI 0 1 PT 0 1 PIN DDR data out 0 1 Module output enable module enable Figure 19-76. Illustration of I/O pin functionality 19.4.2.4 Reduced drive register (RDRx) If the pin is used as an output this register allows the conﬁguration of the drive strength. 19.4.2.5 Pull device enable register (PERx) This register turns on a pull-up or pull-down device. It becomes active only if the pin is used as an input or as a wired-or output. 19.4.2.6 Polarity select register (PPSx) This register selects either a pull-up or pull-down device if enabled. It becomes only active if the pin is used as an input. A pull-up device can be activated if the pin is used as a wired-or output. 19.4.2.7 Wired-or mode register (WOMx) If the pin is used as an output this register turns off the active high drive. This allows wired-or type connections of outputs. 19.4.3 Pins and Ports NOTE Please refer to the SoC Guide to determine the pin availability in the different package options. MC9S12XF - Family Reference Manual, Rev.1.19 896 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) 19.4.3.1 BKGD pin The BKGD pin is associated with the S12X_BDM and S12X_EBI modules. During reset, the BKGD pin is used as MODC input. 19.4.3.2 Port A, B Port A pins PA[7:0] and Port B pins PB[7:0] can be used for either general-purpose I/O with the external bus interface. In this case Port A and Port B are associated with the external address bus outputs ADDR15ADDR8 and ADDR7-ADDR0, respectively. PB0 is the ADDR0 or UDS output. 19.4.3.3 Port C, D Port C pins PC[7:0] and Port D pins PD[7:0] can be used for either general-purpose I/O with the external bus interface. In this case Port C and Port D are associated with the external data bus inputs/outputs DATA15-DATA8 and DATA7-DATA0, respectively. These pins are configured for reduced input threshold in certain operating modes (refer to S12X_EBI Block Guide). 19.4.3.4 Port E Port E is associated with the external bus control outputs RW, LSTRB, LDS and RE, the free-running clock outputs ECLK and ECLK2X, as well as with the TAGHI, TAGLO, MODA and MODB and interrupt inputs IRQ and XIRQ. Port E pins PE[7:2] can be used for either general-purpose I/O or with the alternative functions. Port E pin PE[7] an be used for either general-purpose I/O or as the free-running clock ECLKX2 output running at the Core Clock rate. The clock output is always enabled in emulation modes. Port E pin PE[6] an be used for either general-purpose I/O, as TAGHI input or as MODB input during reset. Port E pin PE[5] an be used for either general-purpose I/O, as TAGLO input, RE output or as MODB input during reset. Port E pin PE[4] an be used for either general-purpose I/O or as the free-running clock ECLK output running at the Bus Clock rate or at the programmed divided clock rate. The clock output is always enabled in emulation modes. Port E pin PE[3] an be used for either general-purpose I/O, as LSTRB or LDS output, or as EROMCTL input during reset. Port E pin PE[2] an be used for either general-purpose I/O, or as RW or RE output. Port E pin PE[1] can be used for either general-purpose input or as the level- or falling edge-sensitive IRQ interrupt input. IRQ will be enabled by setting the IRQEN conﬁguration bit (19.3.17/19-859) and clearing MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 897 Chapter 19 Port Integration Module (S12XFPIMV2) the I-bit in the CPU condition code register. It is inhibited at reset so this pin is initially conﬁgured as a simple input with a pull-up. Port E pin PE[0] can be used for either general-purpose input or as the level-sensitive XIRQ interrupt input. XIRQ can be enabled by clearing the X-bit in the CUP’s condition code register. It is inhibited at reset so this pin is initially conﬁgured as a high-impedance input with a pull-up. Port E pins PE[5] and PE[6] are conﬁgured for reduced input threshold in certain modes (refer to S12X_EBI Block Guide). 19.4.3.5 Port K Port K pins PK[7:0] can be used for either general-purpose I/O, or with the external bus interface. In this case Port K pins PK[6:0] are associated with the external address bus outputs ADDR22-ADDR16 and PK7 is associated to the EWAIT input. Port K pin PE[7] is conﬁgured for reduced input threshold in certain modes (refer to S12X_EBI Block Guide). 19.4.3.6 Port T This port is associated with the ECT module, or with the FlexRay subsystem. Port T pins PT[7:0] can be used for either general-purpose I/O, or with the channels of the Enhanced Capture Timer. 19.4.3.7 Port S This port is associated with SCI0, SCI1 and SPI0. Port S pins PS[7:4] can be used either for general-purpose I/O, or with the SPI0 subsystem. Port S pins PS[3:2] can be used either for general-purpose I/O, or with the SCI1 subsystem. Port S pins PS[1:0] can be used either for general-purpose I/O, or with the SCI0 subsystem. 19.4.3.8 Port M This port is associated with the CAN0, SPI1, PMF and chip selects CS0, CS1, CS2 and CS3. Port M pins PM[7:4] can be used for either general purpose I/O, or with the SPI1 subsystem. Port M pins PM[3:2] can be used for either general purpose I/O, or as fault inputs of the PMF subsystem. Port M pins PM[1:0] can be used for either general purpose I/O, or with CAN0 subsystem. Port M pins PM[7] and PM[4:2] can also be used as chip select outputs. 19.4.3.9 Port P This port is associated with the PMF. MC9S12XF - Family Reference Manual, Rev.1.19 898 Freescale Semiconductor Chapter 19 Port Integration Module (S12XFPIMV2) Port P pins PP[7:0] can be used for either general purpose I/O, or with the PMF subsystem. 19.4.3.10 Port H This port is associated with the FlexRay. Port H pins PH[6:4] and PH[2:0] can be used for either general purpose I/O, or with FlexRay subsystem. Port H pins PH[7] and PH[3] can be used as general purpose I/O. 19.4.3.11 Port J This port is associated with the FlexRay and PMF. Port J pins PJ[7:4] can be used for either general purpose I/O, or with the FlexRay subsystem. Port J pins PJ[2:0] can be used for either general purpose I/O, or with the PMF subsystem. 19.4.3.12 Port AD This port is associated with the ATD. Port AD pins PAD[15:00] can be used for either general purpose I/O, or with the ATD subsystem. 19.5 19.5.1 Initialization Information Port Data and Data Direction Register writes It is not recommended to write PORTx/PTx and DDRx in a word access. When changing the register pins from inputs to outputs, the data may have extra transitions during the write access. Initialize the port data register before enabling the outputs. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 899 Chapter 19 Port Integration Module (S12XFPIMV2) MC9S12XF - Family Reference Manual, Rev.1.19 900 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Revision History Version Number V01.04 V01.05 V02.05 Revision Date 23 MAY 2002 19 AUG 2002 15 MAY 2003 Effective Date 23 MAY 2002 19 AUG 2002 15 MAY 2003 Author Description of Changes Updates after MPW, and added control logic to incorporate general purpose I/O functionality when no correction control method is selected. Updates after review with veriﬁcation team. Updated version number to match clearcase label 20.1 Introduction The Pulse width Modulator with Fault protection (PMF) module can be conﬁgured for one, two, or three complementary pairs. For example: • One complementary pair and four independent PWM outputs • Two complementary pair and two independent PWM outputs • Three complementary pair and zero independent PWM outputs • Zero complementary pair and six independent PWM outputs All PWM outputs can be generated from the same counter, or each pair can have its own counter for three independent PWM frequencies. Complementary operation permits programmable dead-time insertion, distortion correction through current sensing by software, and separate top and bottom output polarity control. Each counter value is programmable to support a continuously variable PWM frequency. Both edge- and center-aligned synchronous pulse width-control and full range modulation from 0 percent to 100 percent, are supported. The PMF is capable of controlling most motor types: AC induction motors (ACIM), both brushless (BLDC) and brush DC motors (BDC), switched (SRM) and variable reluctance motors (VRM), and stepper motors. 20.1.1 • • Features Three complementary PWM signal pairs, or six independent PWM signals Three 15-bit counters MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 901 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module • • • • • • • • • • Features of complementary channel operation Deadtime insertion Separate top and bottom pulse width correction via current status inputs or software Separate top and bottom polarity control Edge-aligned or center-aligned PWM signals Half-cycle reload capability Integral reload rates from 1 to 16 Individual software-controlled PWM output Programmable fault protection Polarity control 20.1.2 Modes of Operation Care must be exercised when using this module in the modes listed in Table 20-1. PWM outputs are placed in their inactive states in STOP mode, and optionally under WAIT and FREEZE modes. PWM outputs will be reactivated (assuming they were active to begin with) when these modes are exited . Table 20-1. Modes When PWM Operation is Restricted Mode STOP WAIT FREEZE PWM outputs are disabled PWM outputs are disabled as a function of the PMFWAI bit. PWM outputs are disabled as a function of the PMFFRZ bit. Description 20.1.3 Block Diagrams Figure 20-1 provides an overview of the PMF module. The Mux/Swap/Current Sense block is tightly integrated with the dead time insertion block. This detail is shown in Figure 20-2. NOTE It is possible to have both channels of a complementary pair to be high. For example, if the TOPNEGA (negative polarity for PWM0), BOTNEGA (negative polarity for PWM1), MASK0 and MASK1 bits are set, both the PWM complementary outputs of generator A will be high. See Section 20.3.2.2, “PMF Conﬁgure 1 Register (PMFCFG1)” for the description of TOPNEG and BOTNEG bits, and Section 20.3.2.3, “PMF Conﬁgure 2 Register (PMFCFG2)” for the description of the MSK0 and MSK1 bits. MC9S12XF - Family Reference Manual, Rev.1.19 902 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module PRSC1 PRSC0 BUS CLOCK LDFQ0 LDFQ1 MTG MULTIPLE REGISTERS OR BITS FOR TIMEBASE A, B, OR C PRESCALER LDFQ2 LDFQ3 PMFMOD REGISTERS PMFVAL0-5 REGISTERS PMFCNT REGISTERS PWM GENERATORS A,B,C PWMRF EDGE HALF LDOK PWMEN IPOL INDEP OUT0 OUT2 OUT4 OUTCTL0 OUTCTL2 OUTCTL4 DT 0—5 OUT1 OUT3 OUT5 OUTCTL1 OUTCTL3 OUTCTL5 MUX, SWAP & CURRENT SENSE DEADTIME INSERTION TOP/BOTTOM GENERATION 6 PMFDTM REGISTER TOPNEG BOTNEG ISENS0 ISENS1 RELOAD A INTERRUPT REQUEST IS0 IS1 IS2 PIN PIN PIN PMDISMAP REGISTERS PMFFPIN REGISTER FAULT PROTECTION POLARITY CONTROL PWM0 PIN PWM1 PIN PWM2 PIN PWM3 PIN PWM4 PIN PWM5 PIN PWMRF PWMRIE FFLAG0 FINT0 FFLAG1 FINT1 FFLAG2 FINT2 FAULT2 INTERRUPT REQUEST FFLAG3 FAULT3 INTERRUPT REQUEST FINT3 FFLAG3 FFLAG2 INTERRUPT CONTROL FAULT0 INTERRUPT REQUEST FAULT1 INTERRUPT REQUEST FFLAG1 RELOAD A INTERRUPT REQUEST RELOAD B INTERRUPT REQUEST RELOAD C INTERRUPT REQUEST FMODE0 FMODE1 FMODE2 FMODE3 FFLAG0 FAULT PIN FILTERS FAULT0 PIN FAULT1 PIN FAULT2 PIN FAULT3 PIN QSMP0 QSMP1 QSMP2 QSMP3 Figure 20-1. PMF Block Diagram MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 903 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module PWM source selection is based on a number of factors: • State of current sense pins • IPOL bit • OUTCTL bit • Center versus edge aligned SWAPA GENERATE COMPLEMENT AND INSERT DEADTIME IPOLA or ISENS0 or OUTCTL0 OUT0 PWM GENERATOR 0 OUTCTL0 1 PAD0 MSK0 1 INDEPA FAULT AND POLARITY CONTROL PAD1 PWM GENERATOR 1 OUT1 1 OUTCTL1 1 MSK1 Figure 20-2. Detail of Mux, Swap, and Deadtime Functions 20.2 Signal Descriptions The pulse width modulator has external pins named PWM0–5, FAULT0–3, and IS0–IS2. 20.2.1 PWM0–PWM5 Pins PWM0–PWM5 are the output pins of the six PWM channels. 20.2.2 FAULT0–FAULT3 Pins FAULT0–FAULT3 are input pins for disabling selected PWM outputs. 20.2.3 IS0–IS2 Pins IS0–IS2 are current status pins for top/bottom pulse width correction in complementary channel operation while deadtime is asserted. MC9S12XF - Family Reference Manual, Rev.1.19 904 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3 20.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the PMF module is shown in Figure 20-3. Detailed descriptions of the registers and bits are given in the subsections that follow. Address $0000 Name PMFCFG0 R W R W R W R W R W R W R W R W R W R W R W R W R W R W 0 0 0 0 OUTCTL5 OUTCTL4 OUTCTL3 OUTCTL2 OUTCTL1 OUTCTL0 0 PMFWAI PMFFRZ Bit 7 WP 6 MTG 0 5 EDGEC 4 EDGEB 3 EDGEA 2 INDEPC 1 INDEPB Bit 0 INDEPA $0001 PMFCFG1 ENHA 0 BOTNEGC TOPNEGC BOTNEGB TOPNEGB BOTNEGA TOPNEGA $0002 PMFCFG2 0 MSK5 0 MSK4 MSK3 MSK2 MSK1 MSK0 $0003 PMFCFG3 VLMODE SWAPC SWAPB SWAPA $0004 PMFFCTL FMODE3 0 FIE3 FMODE2 0 FIE2 FMODE1 0 FIE1 FMODE0 0 FIE0 $0005 PMFFPIN FPINE3 FPINE2 FPINE1 FPINE0 $0006 PMFFSTA FFLAG3 0 FFLAG2 0 FFLAG1 0 FFLAG0 $0007 PMFQSMP QSMP3 QSMP2 QSMP1 QSMP0 $0008 PMFDMPA DMP13 DMP12 DMP11 DMP10 DMP03 DMP02 DMP01 DMP00 $0009 PMFDMPB DMP33 DMP32 DMP31 DMP30 DMP23 DMP22 DMP21 DMP20 $000A PMFDMPC DMP53 DMP52 DMP51 DMP50 DMP43 DMP42 DMP41 DMP53 $000B Reserved $000C PMFOUTC $000D PMFOUTB OUT5 OUT4 OUT3 OUT2 OUT1 OUT0 = Unimplemented or Reserved Figure 20-3. Quick Reference to PMF Registers (Sheet 1 of 4) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 905 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Address $000E Name PMFDTMS R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 0 6 0 5 DT5 4 DT4 3 DT3 2 DT2 1 DT1 Bit 0 DT0 $000F PMFCCTL 0 0 ISENS 0 IPOLC IPOLB IPOLA $0010 PMFVAL0 PMFVAL0 $0011 PMFVAL0 PMFVAL0 $0012 PMFVAL1 PMFVAL1 $0013 PMFVAL1 PMFVAL1 $0014 PMFVAL2 PMFVAL2 $0015 PMFVAL2 PMFVAL2 $0016 PMFVAL3 PMFVAL3 $0017 PMFVAL3 PMFVAL3 $0018 PMFVAL4 PMFVAL4 $0019 PMFVAL4 PMFVAL4 $001A PMFVAL5 PMFVAL5 $001B $001C– $001F $0020 PMFVAL5 PMFVAL5 Reserved PMFENCA PWMENA 0 0 0 0 0 LDOKA PWMRIEA $0021 PMFFQCA LDFQA = Unimplemented or Reserved HALFA PRSCA PWMRFA Figure 20-3. Quick Reference to PMF Registers (Sheet 2 of 4) MC9S12XF - Family Reference Manual, Rev.1.19 906 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Address $0022 Name PMFCNTA R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 0 6 5 4 3 PMFCNTA 2 1 Bit 0 $0023 PMFCNTA PMFCNTA $0024 PMFMODA 0 PMFMODA $0025 PMFMODA PMFMODA 0 0 0 0 $0026 PMFDTMA PMFDTMA $0027 PMFDTMA PMFDTMA 0 0 0 0 0 $0028 PMFENCB PWMENB LDOKB PWMRIEB $0029 PMFFQCB LDFQB 0 HALFB PMFCNTB PRSCB PWMRFB $002A PMFCNTB $002B PMFCNTB PMFCNTB $002C PMFMODB 0 PMFMODB $002D PMFMODB PMFMODB 0 0 0 0 $002E PMFDTMB PMFDTMB $002F PMFDTMB PMFDTMB 0 0 0 0 0 $0030 PMFENCC PWMENC LDOKC PWMRIEC $0031 PMFFQCC LDFQC = Unimplemented or Reserved HALFC PRSCC PWMRFC Figure 20-3. Quick Reference to PMF Registers (Sheet 3 of 4) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 907 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Address $0032 Name PMFCNTC R W R W R W R W R W R W R W Bit 7 0 6 5 4 3 PMFCNTC 2 1 Bit 0 $0033 PMFCNTC PMFCNTC $0034 PMFMODC 0 PMFMODC $0035 PMFMODC PMFMODC 0 0 0 0 $0036 PMFDTMC PMFDTMC $0037 $0038– $003F PMFDTMC PMFDTMC Reserved = Unimplemented or Reserved Figure 20-3. Quick Reference to PMF Registers (Sheet 4 of 4) 20.3.2 Register Descriptions The address of a register is the sum of a base address and an address offset. The base address is deﬁned at the chip level and the address offset is deﬁned at the module level. 20.3.2.1 PMF Conﬁgure 0 Register (PMFCFG0) Address: $0000 7 6 5 4 3 2 1 0 R W Reset WP 0 MTG 0 EDGEC 0 EDGEB 0 EDGEA 0 INDEPC 0 INDEPB 0 INDEPA 0 Figure 20-4. PMF Conﬁgure 0 Register (PMFCFG0) Read anytime. See bit description for write conditions. Table 20-2. PMFCFG0 Field Descriptions Field 7 WP Description Write Protect — This bit enables write protection to be used for all write-protectable registers. While clear, WP allows write-protected registers to be written. When set, WP prevents any further writes to write-protected registers. Once set, WP can be cleared only by reset. 0 Write-protectable registers may be written. 1 Write-protectable registers are write-protected. MC9S12XF - Family Reference Manual, Rev.1.19 908 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-2. PMFCFG0 Field Descriptions (continued) Field 6 MTG Description Multiple Timebase Generators — This bit determines the number of timebase counters used. Once set, MTG can be cleared only by reset. If MTG is set, PWM generators B and C and registers $0028 – $0037 are available. The three generators have their own variable frequencies and are not synchronized. If MTG is cleared, PMF registers from $0028 – $0037 can not be written and read zeroes, and bits EDGEC and EDGEB are ignored. Pair A, Pair B and Pair C PWMs are synchronized to PWM generator A and use registers from $0020 – $0027. 0 Single timebase generator. 1 Multiple timebase generators. Edge-Aligned or Center-Aligned PWM for Pair C — This bit determines whether PWM4 and PWM5 channels will use edge-aligned or center-aligned waveforms. This bit has no effect if MTG bit is cleared. This bit cannot be modiﬁed after the WP bit is set. 0 PWM4 and PWM5 are center-aligned PWMs 1 PWM4 and PWM5 are edge-aligned PWMs Edge-Aligned or Center-Aligned PWM for Pair B — This bit determines whether PWM2 and PWM3 channels will use edge-aligned or center-aligned waveforms. This bit has no effect if MTG bit is cleared. This bit cannot be modiﬁed after the WP bit is set. 0 PWM2 and PWM3 are center-aligned PWMs 1 PWM2 and PWM3 are edge-aligned PWMs Edge-Aligned or Center-Aligned PWM for Pair A— This bit determines whether PWM0 and PWM1 channels will use edge-aligned or center-aligned waveforms. It determines waveforms for Pair B and Pair C if the MTG bit is cleared. This bit cannot be modiﬁed after the WP bit is set. 0 PWM0 and PWM1 are center-aligned PWMs 1 PWM0 and PWM1 are edge-aligned PWMs Independent or Complimentary Operation for Pair C— This bit determines if the PWM channels 4 and 5 will be independent PWMs or complementary PWMs. This bit cannot be modiﬁed after the WP bit is set. 0 PWM4 and PWM5 are complementary PWM pair 1 PWM4 and PWM5 are independent PWMs Independent or Complimentary Operation for Pair B— This bit determines if the PWM channels 2 and 3 will be independent PWMs or complementary PWMs. This bit cannot be modiﬁed after the WP bit is set. 0 PWM2 and PWM3 are complementary PWM pair 1 PWM2 and PWM3 are independent PWMs Independent or Complimentary Operation for Pair A— This bit determines if the PWM channels 0 and 1 will be independent PWMs or complementary PWMs. This bit cannot be modiﬁed after the WP bit is set. 0 PWM0 and PWM1 are complementary PWM pair 1 PWM0 and PWM1 are independent PWMs 5 EDGEC 4 EDGEB 3 EDGEA 2 INDEPC 1 INDEPB 0 INDEPA 20.3.2.2 PMF Conﬁgure 1 Register (PMFCFG1) Address: $0001 7 6 5 4 3 2 1 0 R W Reset ENHA 0 0 0 BOTNEGC 0 TOPNEGC 0 BOTNEGB 0 TOPNEGB 0 BOTNEGA 0 TOPNEGA 0 = Unimplemented or Reserved Figure 20-5. PMF Conﬁgure 1 Register (PMFCFG1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 909 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Read anytime. This register cannot be modiﬁed after the WP bit is set. A normal PWM output or positive polarity means that the PWM channel outputs high when the counter value is smaller than or equal to the pulse width value and outputs low otherwise. An inverted output or negative polarity means that the PWM channel outputs low when the counter value is smaller than or equal to the pulse width value and outputs high otherwise. Table 20-3. PMFCFG1 Field Descriptions Field 7 ENHA Description Enable Hardware Acceleration — This bit enables writing to the VLMODE[1:0], SWAPC, SWAPB, and SWAPA bits in the PMFCFG3 register. This bit cannot be modiﬁed after the WP bit is set. 0 Disable writing to VLMODE[1:0], SWAPC, SWAPB, and SWAPA bits 1 Enable writing to VLMODE[1:0], SWAPC, SWAPB, and SWAPA bits Pair C Bottom-Side PWM Polarity — This bit determines the polarity for Pair C bottom-side PWM (PWM5). This bit cannot be modiﬁed after the WP bit is set. 0 Positive PWM5 polarity 1 Negative PWM5 polarity Pair C Top-Side PWM Polarity — This bit determines the polarity for Pair C top-side PWM (PWM4). This bit cannot be modiﬁed after the WP bit is set. 0 Positive PWM4 polarity 1 Negative PWM4 polarity Pair B Bottom-Side PWM Polarity — This bit determines the polarity for Pair B bottom-side PWM (PWM3). This bit cannot be modiﬁed after the WP bit is set. 0 Positive PWM3 polarity 1 Negative PWM3 polarity Pair B Top-Side PWM Polarity — This bit determines the polarity for Pair B top-side PWM (PWM2). This bit cannot be modiﬁed after the WP bit is set. 0 Positive PWM2 polarity 1 Negative PWM2 polarity Pair A Bottom-Side PWM Polarity — This bit determines the polarity for Pair A bottom-side PWM (PWM1). This bit cannot be modiﬁed after the WP bit is set. 0 Positive PWM1 polarity 1 Negative PWM1 polarity Pair A Top-Side PWM Polarity — This bit determines the polarity for Pair A top-side PWM (PWM0). This bit cannot be modiﬁed after the WP bit is set. 0 Positive PWM0 polarity 1 Negative PWM0 polarity 5 BOTNEGC 4 TOPNEGC 3 BOTNEGB 2 TOPNEGB 1 BOTNEGA 0 TOPNEGA 20.3.2.3 PMF Conﬁgure 2 Register (PMFCFG2) Address: $0002 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 MSK5 0 MSK4 0 MSK3 0 MSK2 0 MSK1 0 MSK0 0 = Unimplemented or Reserved Figure 20-6. PMF Conﬁgure 2 Register (PMFCFG2) MC9S12XF - Family Reference Manual, Rev.1.19 910 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Read and write anytime. Table 20-4. PMFCFG2 Field Descriptions Field 5–0 MSK[5:0] Description Mask PWMx 0 PWMx is unmasked. 1 PWMx is masked and the channel is set to a value of 0 percent duty cycle. where x is 0, 1, 2, 3, 4, and 5 CAUTION When using the TOPNEG/BOTNEG bits and the MSKx bits at the same time, when in complementary mode, it is possible to have both PMF channel outputs of a channel pair set to one. 20.3.2.4 PMF Conﬁgure 3 Register (PMFCFG3) Address: $0003 7 6 5 4 3 2 1 0 R W Reset PMFWAI 0 PMFFRZ 0 0 0 0 VLMODE 0 SWAPC 0 SWAPB 0 SWAPA 0 = Unimplemented or Reserved Figure 20-7. PMF Conﬁgure 3 Register (PMFCFG3) Read and write anytime. Table 20-5. PMFCFG3 Field Descriptions Field 7 PMFWAI Description PMF Stops While in WAIT Mode — When set to zero, the PWM generators will continue to run while the chip is in WAIT mode. In this mode, the peripheral clock continues to run but the CPU clock does not. If the device enters WAIT mode and this bit is one, then the PWM outputs will be switched to their inactive state until WAIT mode is exited. At that point the PWM pins will resume operation as programmed in the PWM registers. 0 PMF continues to run in WAIT mode. 1 PMF is disabled in WAIT mode. PMF Stops While in FREEZE Mode — When set to zero, the PWM generators will continue to run while the chip is in FREEZE mode. If the device enters FREEZE mode and this bit is one, then the PWM outputs will be switched to their inactive state until FREEZE mode is exited. At that point the PWM pins will resume operation as programmed in the PWM registers. 0 PMF continues to run in FREEZE mode. 1 PMF is disabled in FREEZE mode. Value Register Load Mode — This ﬁeld determines the way the value registers are being loaded. This ﬁeld can only be written if ENHA is set. 00 Each value register is accessed independently 01 Writing to value register zero also writes to value registers one to ﬁve 10 Writing to value register zero also writes to value registers one to three 11 Reserved (defaults to independent access) 6 PMFFRZ 4–3 VLMODE MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 911 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-5. PMFCFG3 Field Descriptions (continued) Field 2 SWAPC 1 SWAPB 0 SWAPA Description Swap Pair C — This bit can only be written if ENHA is set. 0 No swap. 1 PWM4 and PWM5 are swapped only in complementary mode. Swap Pair B — This bit can only be written if ENHA is set. 0 No swap. 1 PWM2 and PWM3 are swapped only in complementary mode. Swap Pair A — This bit can only be written if ENHA is set. 0 No swap. 1 PWM0 and PWM1 are swapped only in complementary mode. 20.3.2.5 PMF Fault Control Register (PMFFCTL) Address: $0004 7 6 5 4 3 2 1 0 R W Reset FMODE3 0 FIE3 0 FMODE2 0 FIE2 0 FMODE1 0 FIE1 0 FMODE0 0 FIE0 0 Figure 20-8. PMF Fault Control Register (PMFFCTL) Read and write anytime. Table 20-6. PMFFCTL Field Descriptions Field Description 7, 5, 3, 1 Fault x Pin Clearing Mode — This bit selects automatic or manual clearing of FAULTx pin faults. See FMODE[3:0] Section 20.4.8.2, “Automatic Fault Clearing” and Section 20.4.8.3, “Manual Fault Clearing” for more details. 0 Manual fault clearing of FAULTx pin faults. 1 Automatic fault clearing of FAULTx pin faults. where x is 0, 1, 2 and 3. 6, 4, 2, 0 FIE]3:0] Fault x Pin Interrupt Enable — This bit enables CPU interrupt requests to be generated by the FAULTx pin. The fault protection circuit is independent of the FIEx bit and is active when FPINEx is set. If a fault is detected, the PWM pins are disabled according to the PMF Disable Mapping registers. 0 Fault x CPU interrupt requests disabled. 1 Fault x CPU interrupt requests enabled. where x is 0, 1, 2 and 3. 20.3.2.6 PMF Fault Pin Enable Register (PMFFPIN) Address: $0005 7 6 5 4 3 2 1 0 R W Reset 0 0 FPINE3 0 0 0 FPINE2 0 0 0 FPINE1 0 0 0 FPINE0 0 = Unimplemented or Reserved Figure 20-9. PMF Fault Pin Enable Register (PMFFPIN) MC9S12XF - Family Reference Manual, Rev.1.19 912 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Read anytime. This register cannot be modiﬁed after the WP bit is set. Table 20-7. PMFFPIN Field Descriptions Field 6, 4, 2, 0 FPINE[3:0] Fault x Pin Enable 0 FAULTx pin is disabled for fault protection. 1 FAULTx pin is enabled for fault protection. where x is 0, 1, 2 and 3 Description 20.3.2.7 PMF Fault Status Register (PMFFSTA) Address: $0006 7 6 5 4 3 2 1 0 R W Reset 0 0 FFLAG3 0 0 0 FFLAG2 0 0 0 FFLAG1 0 0 0 FFLAG0 0 = Unimplemented or Reserved Figure 20-10. PMF Fault Flag Register (PMFFSTA) Read and write anytime. Table 20-8. PMFFSTA Field Descriptions Field Description 6, 4, 2, 0 Fault x pin Flag — This ﬂag is set after the required number of samples have been detected after a rising edge FFLAG[3:0] on the FAULTx pin. Writing a logic one to FFLAGx clears it. Writing a logic zero has no effect. The fault protection is enabled when FPINEx is set even when the PWMs are not enabled; therefore, a fault will be latched in, requiring to be cleared in order to prevent an interrupt. 0 No fault on the FAULTx pin. 1 Fault on the FAULTx pin. Note: Clearing FFLAGx satisﬁes pending FFLAGx CPU interrupt requests. where x is 0, 1, 2 and 3 20.3.2.8 PMF Fault Qualifying Samples Register (PMFQSMP) Address: $0007 7 6 5 4 3 2 1 0 R W Reset 0 QSMP3 0 0 QSMP2 0 0 QSMP1 0 0 QSMP0 0 Figure 20-11. PMF Fault Qualifying Samples Register (PMFQSMP) Read anytime. This register cannot be modiﬁed after the WP bit is set. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 913 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-9. PMFQSMP Field Descriptions Field 7–0 QSMP[3:0] Description Fault x Qualifying Samples — This ﬁeld indicates the number of consecutive samples taken at the FAULTx pin to determine if a fault is detected. The ﬁrst sample is qualiﬁed after two bus cycles from the time the fault is present and each sample after that is taken every four bus cycles. See Table 20-10. where x is 0, 1, 2 and 3 Table 20-10. Qualifying Samples QSMPx 00 01 10 Number of Samples 1 sample(1) 5 samples 10 samples 11 15 samples 1. There is an asynchronous path from fault pin to disable PWMs immediately but the fault is qualiﬁed in two bus cycles. 20.3.2.9 PMF Disable Mapping Registers Address: $0008 7 6 5 4 3 2 1 0 R W Reset DMP13 0 DMP12 0 DMP11 0 DMP10 0 DMP03 0 DMP02 0 DMP01 0 DMP00 0 Figure 20-12. PMF Disable Mapping A Register (PMFDMPA) Address: $0009 7 6 5 4 3 2 1 0 R W Reset DMP33 0 DMP32 0 DMP31 0 DMP30 0 DMP23 0 DMP22 0 DMP21 0 DMP20 0 Figure 20-13. PMF Disable Mapping B Register (PMFDMPB) Address: $000A 7 6 5 4 3 2 1 0 R W Reset DMP53 0 DMP52 0 DMP51 0 DMP50 0 DMP43 0 DMP42 0 DMP41 0 DMP53 0 Figure 20-14. PMF Disable Mapping C Register (PMFDMPC) Read anytime. These registers cannot be modiﬁed after the WP bit is set. The fault decoder disables PWM pins selected by the fault logic and the disable mapping registers. See Figure 20-15. Each bank of four bits in the disable mapping registers control the mapping of a single PWM pin. Refer to Table 20-11. MC9S12XF - Family Reference Manual, Rev.1.19 914 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module DMPx3 DMPx2 DMPx1 DMPx0 FAULT0 FAULT1 FAULT2 FAULT3 WHERE x is 0, 1, 2, 3, 4, 5 DISABLE PWM PIN x Figure 20-15. Fault Decoder Table 20-11. Fault Mapping PWM Pin PWM0 PWM1 PWM2 PWM3 PWM4 PWM5 Controlling Register Bits DMP03 – DMP00 DMP13 – DMP10 DMP23 – DMP20 DMP33 – DMP30 DMP43 – DMP40 DMP53 – DMP50 20.3.2.10 PMF Output Control Register (PMFOUTC) Address: $000C 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 OUTCTL5 0 OUTCTL4 0 OUTCTL3 0 OUTCTL2 0 OUTCTL1 0 OUTCTL0 0 = Unimplemented or Reserved Figure 20-16. PMF Output Control Register (PMFOUTC) Read and write anytime. Table 20-12. PMFOUTC Field Descriptions Field Description 5–0 OUTCTLx Bits — These bits enable software control of their corresponding PWM pin. When OUTCTLx is set, OUTCTL[5:0] the OUTx bit activates and deactivates the PWMx output. When operating the PWM in complementary mode, these bits must be switched in pairs for proper operation. That is OUTCTL0 and OUTCTL1 must have the same value; OUTCTL2 and OUTCTL3 must have the same value; and OUTCTL4 and OUTCTL5 must have the same value. 0 Software control disabled 1 Software control enabled where X is 0, 1, 2, 3, 4 and 5 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 915 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3.2.11 PMF Output Control Bit Register (PMFOUTB) Address: $000D 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 OUT5 0 OUT4 0 OUT3 0 OUT2 0 OUT1 0 OUT0 0 = Unimplemented or Reserved Figure 20-17. PMF Output Control Bit Register (PMFOUTB) Read and write anytime. Table 20-13. PMFOUTB Field Descriptions Field 5–0 OUT[5:0] Description OUT Bits — When the corresponding OUTCTL bit is set, these bits control the PWM pins, illustrated in Table 2014. . Table 20-14. Software Output Control OUTx Bit OUT0 OUT1 OUT2 OUT3 OUT4 OUT5 Complementary Channel Operation 1 — PWM0 is active 0 — PWM0 is inactive 1 — PWM1 is complement of PWM0 0 — PWM1 is inactive 1 — PWM2 is active 0 — PWM2 is inactive 1 — PWM3 is complement of PWM2 0 — PWM3 is inactive 1 — PWM4 is active 0 — PWM4 is inactive 1 — PWM5 is complement of PWM4 0 — PWM5 is inactive Independent Channel Operation 1 — PWM0 is active 0 — PWM0 is inactive 1 — PWM1 is active 0 — PWM1 is inactive 1 — PWM2 is active 0 — PWM2 is inactive 1 — PWM3 is active 0 — PWM3 is inactive 1 — PWM4 is active 0 — PWM4 is inactive 1 — PWM5 is active 0 — PWM5 is inactive 20.3.2.12 PMF Deadtime Sample Register (PMFDTMS) Address: $000E 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 DT5 0 DT4 0 DT3 0 DT2 0 DT1 0 DT0 0 = Unimplemented or Reserved Figure 20-18. PMF Deadtime Sample Register (PMFDTMS) Read anytime and writes have no effect. MC9S12XF - Family Reference Manual, Rev.1.19 916 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-15. PMFDTMS Field Descriptions Field 5–0 DT[5:0} Description DTx Bits — The DTx bits are grouped in pairs, DT0 and DT1, DT2 and DT3, DT4 and DT5. Each pair reﬂects the corresponding ISx pin value as sampled at the end of deadtime. 20.3.2.13 PMF Correction Control Register (PMFCCTL) Address: $000F 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 ISENS 0 0 0 IPOLC 0 IPOLB 0 IPOLA 0 = Unimplemented or Reserved Figure 20-19. PMF Correction Control Register (PMFCCTL) Read and write anytime. Table 20-16. PMFCCTL Field Descriptions Field 5–4 ISENS Description Current Status Sensing Method — This ﬁeld selects the top/bottom correction scheme, illustrated in Table 2017. Note: Assume the user will provide current sensing circuitry causing the voltage at the corresponding input pin to be low for positive current and high for negative current. In addition, it assumes the top PWMs are PWM 0, 2, and 4 while the bottom PWMs are PWM 1, 3, and 5. Note: The ISENS bits are not buffered. Changing the current status sensing method can affect the present PWM cycle. Current Polarity — This buffered bit selects the PMF Value register for the PWM4 and PWM5 pins in top/bottom software correction in complementary mode. 0 PMF Value 4 register in next PWM cycle. 1 PMF Value 5 register in next PWM cycle. Current Polarity — This buffered bit selects the PMF Value register for the PWM2 and PWM3 pins in top/bottom software correction in complementary mode. 0 PMF Value 2 register in next PWM cycle. 1 PMF Value 3 register in next PWM cycle. Current Polarity — This buffered bit selects the PMF Value register for the PWM0 and PWM1 pins in top/bottom software correction in complementary mode. 0 PMF Value 0 register in next PWM cycle. 1 PMF Value 1 register in next PWM cycle. 2 IPOLC 1 IPOLB 0 IPOLA Table 20-17. Correction Method Selection ISENS 00 01 10 No correction(1) Manual correction Current status sample correction on pins IS0, IS1, and IS2 during deadtime(2) Correction Method MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 917 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-17. Correction Method Selection ISENS 11 Correction Method Current status sample on pins IS0, IS1, and IS2(3) At the half cycle in center-aligned operation At the end of the cycle in edge-aligned operation 1. The current status pins can be used as general purpose input/output ports. 2. The polarity of the ISx pin is latched when both the top and bottom PWMs are off. At the 0% and 100% duty cycle boundaries, there is no deadtime, so no new current value is sensed. 3. Current is sensed even with 0% or 100% duty cycle. NOTE The IPOLx bits take effect at the beginning of the next load cycle, regardless of the state of the load okay bit, LDOK. Select top/bottom software correction by writing 01 to the current select bits, ISENS[1:0], in the PWM control register. Reading the IPOLx bits read the buffered value and not necessarily the value currently in effect. 20.3.2.14 PMF Value 0 Register (PMFVAL0) Address: $0010 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 PMFVAL0 0 0 0 0 0 0 0 0 0 Figure 20-20. PMF Value 0 Register (PMFVAL0) Read and write anytime. Table 20-18. PMFVAL0 Field Descriptions Field 15–0 PMFVAL0 Description PMF Value 0 Bits — The 16-bit signed value in this buffered register is the pulse width in PWM0 clock period. A value less than or equal to zero deactivates the PWM output for the entire PWM period. A value greater than, or equal to the modulus, activates the PWM output for the entire PWM period. See Table 20-36. The terms activate and deactivate refer to the high and low logic states of the PWM output. Note: PMFVAL0 is buffered. The value written does not take effect until the LDOK bit is set and the next PWM load cycle begins Reading PMFVAL0 reads the value in the buffer and not necessarily the value the PWM generator is currently using. 20.3.2.15 PMF Value 1 Register (PMFVAL1) Address: $0012 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 PMFVAL1 0 0 0 0 0 0 0 0 0 Figure 20-21. PMF Value 1 Register (PMFVAL1) MC9S12XF - Family Reference Manual, Rev.1.19 918 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Read and write anytime. Table 20-19. PMFVAL1 Field Descriptions Field 15–0 PMFVAL1 Description PMF Value 1 Bits — The 16-bit signed value in this buffered register is the pulse width in PWM1 clock period. A value less than or equal to zero deactivates the PWM output for the entire PWM period. A value greater than, or equal to the modulus, activates the PWM output for the entire PWM period. SeeTable 20-36. The terms activate and deactivate refer to the high and low logic states of the PWM output. Note: PMFVAL1 is buffered. The value written does not take effect until the LDOK bit is set and the next PWM load cycle begins. Reading PMFVAL1 reads the value in the buffer and not necessarily the value the PWM generator is currently using. 20.3.2.16 PMF Value 2 Register (PMFVAL2) Address: $0014 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 PMFVAL2 0 0 0 0 0 0 0 0 0 Figure 20-22. PMF Value 2 Register (PMFVAL2) Read and write anytime. Table 20-20. PMFVAL2 Field Descriptions Field 15–0 PMFVAL2 Description PMF Value 2 Bits — The 16-bit signed value in this buffered register is the pulse width in PWM2 clock period. A value less than or equal to zero deactivates the PWM output for the entire PWM period. A value greater than, or equal to the modulus, activates the PWM output for the entire PWM period. See Table 20-36. The terms activate and deactivate refer to the high and low logic states of the PWM output. Note: PMFVAL2 is buffered. The value written does not take effect until the LDOK bit is set and the next PWM load cycle begins. Reading PMFVAL2 reads the value in the buffer and not necessarily the value the PWM generator is currently using. 20.3.2.17 PMF Value 3 Register (PMFVAL3) Address: $0016 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 PMFVAL3 0 0 0 0 0 0 0 0 0 Figure 20-23. PMF Value 3 Register (PMFVAL3) Read and write anytime. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 919 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-21. PMFVAL3 Field Descriptions Field 15–0 PMFVAL3 Description PMF Value 3 Bits — The 16-bit signed value in this buffered register is the pulse width in PWM3 clock period. A value less than or equal to zero deactivates the PWM output for the entire PWM period. A value greater than, or equal to the modulus, activates the PWM output for the entire PWM period. See Table 20-36. The terms activate and deactivate refer to the high and low logic states of the PWM output. Note: PMFVAL3 is buffered. The value written does not take effect until the LDOK bit is set and the next PWM load cycle begins. Reading PMFVAL3 reads the value in the buffer and not necessarily the value the PWM generator is currently using. 20.3.2.18 PMF Value 4 Register (PMFVAL4) Address: $0018 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 PMFVAL4 0 0 0 0 0 0 0 0 0 Figure 20-24. PMF Value 4 Register (PMFVAL4) Read and write anytime. Table 20-22. PMFVAL4 Field Descriptions Field 15–0 PMFVAL4 Description PMF Value 4 Bits — The 16-bit signed value in this buffered register is the pulse width in PWM4 clock period. A value less than or equal to zero deactivates the PWM output for the entire PWM period. A value greater than, or equal to the modulus, activates the PWM output for the entire PWM period. See Table 20-36. The terms activate and deactivate refer to the high and low logic states of the PWM output. Note: PMFVAL4 is buffered. The value written does not take effect until the LDOK bit is set and the next PWM load cycle begins. Reading PMFVAL4 reads the value in the buffer and not necessarily the value the PWM generator is currently using. 20.3.2.19 PMF Value 5 Register (PMFVAL5) Address: $001A 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 PMFVAL5 0 0 0 0 0 0 0 0 0 Figure 20-25. PMF Value 5 Register (PMFVAL5) Read and write anytime. MC9S12XF - Family Reference Manual, Rev.1.19 920 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-23. PMFVAL5 Field Descriptions Field 15–0 PMFVAL5 Description PMF Value 5 Bits — The 16-bit signed value in this buffered register is the pulse width in PWM5 clock period. A value less than or equal to zero deactivates the PWM output for the entire PWM period. A value greater than, or equal to the modulus, activates the PWM output for the entire PWM period. See Table 20-36. The terms activate and deactivate refer to the high and low logic states of the PWM output. Note: PMFVAL5 is buffered. The value written does not take effect until the LDOK bit is set and the next PWM load cycle begins. Reading PMFVAL5 reads the value in the buffer and not necessarily the value the PWM generator is currently using. 20.3.2.20 PMF Enable Control A Register (PMFENCA) Address: $0020 7 6 5 4 3 2 1 0 R W Reset PWMENA 0 0 0 0 0 0 0 0 0 0 0 LDOKA 0 PWMRIEA 0 = Unimplemented or Reserved Figure 20-26. PMF Enable Control A Register (PMFENCA) Read and write anytime. Table 20-24. PMFENCA Field Descriptions Field 7 PWMENA Description PWM Generator A Enable — When MTG is clear, this bit when set enables the PWM generators A, B and C and the PWM0–5 pins. When PWMENA is clear, PWM generators A, B and C are disabled, and the PWM0–5 pins are in their inactive states unless the corresponding OUTCTLx bits are set. When MTG is set, this bit when set enables the PWM generator A and the PWM0 and PWM1 pins. When PWMENA is clear, the PWM generator A is disabled and PWM0 and PWM1 pins are in their inactive states unless the OUTCTL0 and OUTCTL1 bits are set. 0 PWM generator A and PWM0-1 (2–5 if MTG = 0) pins disabled unless the respective OUTCTL bit is set. 1 PWM generator A and PWM0-1 (2–5 if MTG = 0) pins enabled. Load Okay A — When MTG is clear, this bit allows loads of the PRSCA bits, the PMFMODA register and the PWMVAL0-5 registers into a set of buffers. The buffered prescaler A divisor, PWM counter modulus A value, and all PWM pulse widths take effect at the next PWM reload. When MTG is set, this bit allows loads of the PRSCA bits, the PMFMODA register and the PWMVAL0–1 registers into a set of buffers. The buffered prescaler divisor A, PWM counter modulus A value, PWM0–1 pulse widths take effect at the next PWM reload. Set LDOKA by reading it when it is logic zero and then writing a logic one to it. LDOKA is automatically cleared after the new values are loaded, or can be manually cleared before a reload by writing a logic zero to it. Reset clears LDOKA. 0 Do not load new modulus A, prescaler A, and PWM0–1 (2–5 if MTG = 0) values 1 Load prescaler A, modulus A, and PWM0–1 (2–5 if MTG = 0) values Note: Do not set PWMENA bit before setting the LDOKA bit and do not clear the LDOKA bit at the same time as setting the PWMENA bit. PWM Reload Interrupt Enable A — This bit enables the PWMRFA ﬂag to generate CPU interrupt requests. 0 PWMRFA CPU interrupt requests disabled 1 PWMRFA CPU interrupt requests enabled 1 LDOKA 0 PWMRIEA MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 921 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3.2.21 PMF Frequency Control A Register (PMFFQCA) Address: $0021 7 6 5 4 3 2 1 0 R W Reset 0 0 LDFQA 0 0 HALFA 0 0 PRSCA 0 PWMRFA 0 Figure 20-27. PMF Frequency Control A Register (PMFFQCA) Read and write anytime. Table 20-25. PMFFQCA Field Descriptions Field 7–4 LDFQA Description Load Frequency A — This ﬁeld selects the PWM load frequency according to Table 20-26. See Section 20.4.7.2, “Load Frequency” for more details. Note: The LDFQA ﬁeld takes effect when the current load cycle is complete, regardless of the state of the load okay bit, LDOKA. Reading the LDFQA ﬁeld reads the buffered value and not necessarily the value currently in effect. Half Cycle Reload A — This bit enables half-cycle reloads in center-aligned PWM mode. This bit has no effect on edge-aligned PWMs. 0 Half-cycle reloads disabled 1 Half-cycle reloads enabled Prescaler A — This buffered ﬁeld selects the PWM clock frequency illustrated in Table 20-27. Note: Reading the PRSCA ﬁeld reads the buffered value and not necessarily the value currently in effect. The PRSCA ﬁeld takes effect at the beginning of the next PWM cycle and only when the load okay bit, LDOKA, is set. PWM Reload Flag A — This ﬂag is set at the beginning of every reload cycle regardless of the state of the LDOKA bit. Clear PWMRFA by reading PMFFQCA with PWMRFA set and then writing a logic one to the PWMRFA bit. If another reload occurs before the clearing sequence is complete, writing logic one to PWMRFA has no effect. 0 No new reload cycle since last PWMRFA clearing 1 New reload cycle since last PWMRFA clearing Note: Clearing PWMRFA satisﬁes pending PWMRFA CPU interrupt requests. 3 HALFA 2–1 PRSCA 0 PWMRFA Table 20-26. PWM Reload Frequency A LDFQA 0000 0001 0010 0011 0100 0101 0110 0111 PWM Reload Frequency Every PWM opportunity Every 2 PWM opportunities Every 3 PWM opportunities Every 4 PWM opportunities Every 5 PWM opportunities Every 6 PWM opportunities Every 7 PWM opportunities Every 8 PWM opportunities LDFQ[3:0] 1000 1001 1010 1011 1100 1101 1110 1111 PWM Reload Frequency Every 9 PWM opportunities Every 10 PWM opportunities Every 11 PWM opportunities Every 12 PWM opportunities Every 13 PWM opportunities Every 14 PWM opportunities Every 15 PWM opportunities Every 16 PWM opportunities MC9S12XF - Family Reference Manual, Rev.1.19 922 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-27. PWM Prescaler A PRSCA 00 01 10 11 PWM Clock Frequency fbus fbus/2 fbus/4 fbus/8 20.3.2.22 PMF Counter A Register (PMFCNTA) Address: $0022 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 PMFCNTA 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-28. PMF Counter A Register (PMFCNTA) Read anytime and writes have no effect. This register displays the state of the 15-bit PWM A counter. 20.3.2.23 PMF Counter Modulo A Register (PMFMODA) Address: $0024 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 PMFMODA 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-29. PMF Counter Modulo A Register (PMFMODA) Read and write anytime. The 15-bit unsigned value written to this register is the PWM period in PWM clock periods. Do not write a modulus value of zero. NOTE The PWM counter modulo register is buffered. The value written does not take effect until the LDOKA bit is set and the next PWM load cycle begins. Reading PMFMODA reads the value in the buffer. It is not necessarily the value the PWM generator A is currently using. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 923 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3.2.24 PMF Deadtime A Register (PMFDTMA) Address: $0026 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 1 1 1 1 1 PMFDTMA 1 1 1 1 1 1 1 = Unimplemented or Reserved Figure 20-30. PMF Deadtime A Register (PMFDTMA) Read anytime. This register cannot be modiﬁed after the WP bit is set. The 12-bit value written to this register is the number of PWM clock cycles in complementary channel operation. A reset sets the PWM deadtime register to a default value of 0x0FFF, selecting a deadtime of 256-PWM clock cycles minus one bus clock cycle. NOTE Deadtime is affected by changes to the prescaler value. The deadtime duration is determined as follows: DT = P × PMFDTMA – 1, where DT is deadtime, P is the prescaler value, PMFDTMA is the programmed value of dead time. For example: if the prescaler is programmed for a divide-by-two and the PMFDTMA is set to ﬁve, then P = 2 and the deadtime value is equal to DT = 2 × 5 – 1 = 9 IPbus clock cycles. A special case exists when the P = 1, then DT = PMFDTMA. 20.3.2.25 PMF Enable Control B Register (PMFENCB) Address: $0028 7 6 5 4 3 2 1 0 R W Reset PWMENB 0 0 0 0 0 0 0 0 0 0 0 LDOKB 0 PWMRIEB 0 = Unimplemented or Reserved Figure 20-31. PMF Enable Control B Register (PMFENCB) Read anytime and write only if MTG is set. Table 20-28. PMFENCB Field Descriptions Field 7 PWMENB Description PWM Generator B Enable — If MTG is clear, this bit reads zero and cannot be written. If MTG is set, this bit when set enables the PWM generator B and the PWM2 and PWM3 pins. When PWMENB is clear, PWM generator B is disabled, and the PWM2 and PWM3 pins are in their inactive states unless the OUTCTL2 and OUTCTL3 bits are set. 0 PWM generator B and PWM2–3 pins disabled unless the respective OUTCTL bit is set. 1 PWM generator B and PWM2–3 pins enabled. MC9S12XF - Family Reference Manual, Rev.1.19 924 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-28. PMFENCB Field Descriptions (continued) Field 1 LDOKB Description Load Okay B — If MTG is clear, this bit reads zero and cannot be written. If MTG is set, this bit loads the PRSCB bits, the PMFMODB register and the PWMVAL2-3 registers into a set of buffers. The buffered prescaler divisor B, PWM counter modulus B value, PWM2–3 pulse widths take effect at the next PWM reload. Set LDOKB by reading it when it is logic zero and then writing a logic one to it. LDOKB is automatically cleared after the new values are loaded, or can be manually cleared before a reload by writing a logic zero to it. Reset clears LDOKB. 0 Do not load new modulus B, prescaler B, and PWM2–3 values. 1 Load prescaler B, modulus B, and PWM2–3 values. Note: Do not set PWMENB bit before setting the LDOKB bit and do not clear the LDOKB bit at the same time as setting the PWMENB bit. PWM Reload Interrupt Enable B — If MTG is clear, this bit reads zero and cannot be written. If MTG is set, this bit enables the PWMRFB ﬂag to generate CPU interrupt requests. 0 PWMRFB CPU interrupt requests disabled 1 PWMRFB CPU interrupt requests enabled 0 PWMRIEB 20.3.2.26 PMF Frequency Control B Register (PMFFQCB) Address: $0029 7 6 5 4 3 2 1 0 R W Reset 0 0 LDFQB 0 0 HALFB 0 0 PRSCB 0 PWMRFB 0 Figure 20-32. PMF Frequency Control B Register (PMFFQCB) Read anytime and write only if MTG is set. Table 20-29. PMFFQCB Field Descriptions Field 7–4 LDFQB Description Load Frequency B — This ﬁeld selects the PWM load frequency according to Table 20-30. See Section 20.4.7.2, “Load Frequency” for more details. Note: The LDFQB ﬁeld takes effect when the current load cycle is complete, regardless of the state of the load okay bit, LDOKB. Reading the LDFQB ﬁeld reads the buffered value and not necessarily the value currently in effect. Half Cycle Reload B — This bit enables half-cycle reloads in center-aligned PWM mode. This bit has no effect on edge-aligned PWMs. 0 Half-cycle reloads disabled 1 Half-cycle reloads enabled Prescaler B — This buffered ﬁeld selects the PWM clock frequency illustrated in Table 20-31. Note: Reading the PRSCB ﬁeld reads the buffered value and not necessarily the value currently in effect. The PRSCB ﬁeld takes effect at the beginning of the next PWM cycle and only when the load okay bit, LDOKB, is set. 3 HALFB 2–1 PRSCB MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 925 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-29. PMFFQCB Field Descriptions (continued) Field 0 PWMRFB Description PWM Reload Flag B — This ﬂag is set at the beginning of every reload cycle regardless of the state of the LDOKB bit. Clear PWMRFB by reading PMFFQCB with PWMRFB set and then writing a logic one to the PWMRFB bit. If another reload occurs before the clearing sequence is complete, writing logic one to PWMRFB has no effect. 0 No new reload cycle since last PWMRFB clearing 1 New reload cycle since last PWMRFB clearing Note: Clearing PWMRFB satisﬁes pending PWMRFB CPU interrupt requests. Table 20-30. PWM Reload Frequency B LDFQB 0000 0001 0010 0011 0100 0101 0110 0111 PWM Reload Frequency Every PWM opportunity Every 2 PWM opportunities Every 3 PWM opportunities Every 4 PWM opportunities Every 5 PWM opportunities Every 6 PWM opportunities Every 7 PWM opportunities Every 8 PWM opportunities LDFQ[3:0] 1000 1001 1010 1011 1100 1101 1110 1111 PWM Reload Frequency Every 9 PWM opportunities Every 10 PWM opportunities Every 11 PWM opportunities Every 12 PWM opportunities Every 13 PWM opportunities Every 14 PWM opportunities Every 15 PWM opportunities Every 16 PWM opportunities Table 20-31. PWM Prescaler B PRSCB 00 01 10 11 PWM Clock Frequency fbus fbus/2 fbus/4 fbus/8 20.3.2.27 PMF Counter B Register (PMFCNTB) Address: $002A 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 PMFCNTB 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-33. PMF Counter B Register (PMFCNTB) Read anytime and writes have no effect. This register displays the state of the 15-bit PWM B counter. MC9S12XF - Family Reference Manual, Rev.1.19 926 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3.2.28 PMF Counter Modulo B Register (PMFMODB) Address: $002C 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 PMFMODB 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-34. PMF Counter Modulo B Register (PMFMODB) Read anytime and write only if MTG is set. The 15-bit unsigned value written to this register is the PWM period in PWM clock periods. Do not write a modulus value of zero. NOTE The PWM counter modulo register is buffered. The value written does not take effect until the LDOKB bit is set and the next PWM load cycle begins. Reading PMFMODB reads the value in the buffer. It is not necessarily the value the PWM generator B is currently using. 20.3.2.29 PMF Deadtime B Register (PMFDTMB) Address: $002E 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 1 1 1 1 1 PMFDTMB 1 1 1 1 1 1 1 = Unimplemented or Reserved Figure 20-35. PMF Deadtime B Register (PMFDTMB) Read anytime and write only if MTG is set. This register cannot be modiﬁed after the WP bit is set. The 12-bit value written to this register is the number of PWM clock cycles in complementary channel operation. A reset sets the PWM deadtime register to a default value of 0x0FFF, selecting a deadtime of 256-PWM clock cycles minus one bus clock cycle. NOTE Deadtime is affected by changes to the prescaler value. The deadtime duration is determined as follows: DT = P × PMFDTMB – 1, where DT is deadtime, P is the prescaler value, PMFDTMB is the programmed value of dead time. For example: if the prescaler is programmed for a divide-by-two and the PMFDTMB is set to ﬁve, then P = 2 and the deadtime value is equal to DT = 2 × 5 – 1 = 9 IPbus clock cycles. A special case exists when the P = 1, then DT = PMFDTMB. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 927 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3.2.30 PMF Enable Control C Register (PMFENCC) Address: $0030 7 6 5 4 3 2 1 0 R W Reset PWMENC 0 0 0 0 0 0 0 0 0 0 0 LDOKC 0 PWMRIEC 0 = Unimplemented or Reserved Figure 20-36. PMF Enable Control C Register (PMFENCC) Read anytime and write only if MTG is set. Table 20-32. PMFENCC Field Descriptions Field 7 PWMENC Description PWM Generator C Enable — If MTG is clear, this bit reads zero and cannot be written. If MTG is set, this bit when set enables the PWM generator C and the PWM4 and PWM5 pins. When PWMENC is clear, PWM generator C is disabled, and the PWM4 and PWM5 pins are in their inactive states unless the OUTCTL4 and OUTCTL5 bits are set. 0 PWM generator C and PWM4–5 pins disabled unless the respective OUTCTL bit is set. 1 PWM generator C and PWM4–5 pins enabled. Load Okay C — If MTG is clear, this bit reads zero and can not be written. If MTG is set, this bit loads the PRSCC bits, the PMFMODC register and the PWMVAL4–5 registers into a set of buffers. The buffered prescaler divisor C, PWM counter modulus C value, PWM4–5 pulse widths take effect at the next PWM reload. Set LDOKC by reading it when it is logic zero and then writing a logic one to it. LDOKC is automatically cleared after the new values are loaded, or can be manually cleared before a reload by writing a logic zero to it. Reset clears LDOKC. 0 Do not load new modulus C, prescaler C, and PWM4–5 values. 1 Load prescaler C, modulus C, and PWM4–5 values. Note: Do not set PWMENC bit before setting the LDOKC bit and do not clear the LDOKC bit at the same time as setting the PWMENC bit. PWM Reload Interrupt Enable C — If MTG is clear, this bit reads zero and cannot be written. If MTG is set, this bit enables the PWMRFC ﬂag to generate CPU interrupt requests. 0 PWMRFC CPU interrupt requests disabled 1 PWMRFC CPU interrupt requests enabled 1 LDOCKC 0 PWMRIEC 20.3.2.31 PMF Frequency Control C Register (PMFFQCC) Address: $0031 7 6 5 4 3 2 1 0 R W Reset 0 0 LDFQC 0 0 HALFC 0 0 PRSCC 0 PWMRFC 0 Figure 20-37. PMF Frequency Control C Register (PMFFQCC) Read anytime and write only if MTG is set. MC9S12XF - Family Reference Manual, Rev.1.19 928 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-33. PMFFQCC Field Descriptions Field 7–4 LDFQC Description Load Frequency C — This ﬁeld selects the PWM load frequency according to Table 20-34. See Section 20.4.7.2, “Load Frequency” for more details. Note: The LDFQC ﬁeld takes effect when the current load cycle is complete, regardless of the state of the load okay bit, LDOKC. Reading the LDFQC ﬁeld reads the buffered value and not necessarily the value currently in effect. Half Cycle Reload C — This bit enables half-cycle reloads in center-aligned PWM mode. This bit has no effect on edge-aligned PWMs. 0 Half-cycle reloads disabled 1 Half-cycle reloads enabled Prescaler C — This buffered ﬁeld selects the PWM clock frequency illustrated in Table 20-35. Note: Reading the PRSCC ﬁeld reads the buffered value and not necessarily the value currently in effect. The PRSCC ﬁeld takes effect at the beginning of the next PWM cycle and only when the load okay bit, LDOKC, is set. PWM Reload Flag C — This ﬂag is set at the beginning of every reload cycle regardless of the state of the LDOKC bit. Clear PWMRFC by reading PMFFQCC with PWMRFC set and then writing a logic one to the PWMRFC bit. If another reload occurs before the clearing sequence is complete, writing logic one to PWMRFC has no effect. 0 No new reload cycle since last PWMRFC clearing 1 New reload cycle since last PWMRFC clearing Note: Clearing PWMRFC satisﬁes pending PWMRFC CPU interrupt requests. 3 HALFC 2–1 PRSCC 0 PWMRFC Table 20-34. PWM Reload Frequency C LDFQC 0000 0001 0010 0011 0100 0101 0110 0111 PWM Reload Frequency Every PWM opportunity Every 2 PWM opportunities Every 3 PWM opportunities Every 4 PWM opportunities Every 5 PWM opportunities Every 6 PWM opportunities Every 7 PWM opportunities Every 8 PWM opportunities LDFQ[3:0] 1000 1001 1010 1011 1100 1101 1110 1111 PWM Reload Frequency Every 9 PWM opportunities Every 10 PWM opportunities Every 11 PWM opportunities Every 12 PWM opportunities Every 13 PWM opportunities Every 14 PWM opportunities Every 15 PWM opportunities Every 16 PWM opportunities Table 20-35. PWM Prescaler C PRSCC 00 01 10 11 PWM Clock Frequency fbus fbus/2 fbus/4 fbus/8 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 929 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.3.2.32 PMF Counter C Register (PMFCNTC) Address: $0032 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 PMFCNTC 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-38. PMF Counter C Register (PMFCNTC) Read anytime and writes have no effect. This register displays the state of the 15-bit PWM C counter. 20.3.2.33 PMF Counter Modulo C Register (PMFMODC) Address: $0034 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 PMFMODC 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 20-39. PMF Counter Modulo C Register (PMFMODC) Read anytime and write only if MTG is set. The 15-bit unsigned value written to this register is the PWM period in PWM clock periods. Do not write a modulus value of zero. NOTE The PWM counter modulo register is buffered. The value written does not take effect until the LDOKC bit is set and the next PWM load cycle begins. Reading PMFMODC reads the value in the buffer. It is not necessarily the value the PWM generator A is currently using. 20.3.2.34 PMF Deadtime C Register (PMFDTMC) Address: $0036 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 1 1 1 1 1 PMFDTMC 1 1 1 1 1 1 1 = Unimplemented or Reserved Figure 20-40. PMF Deadtime C Register (PMFDTMC) Read anytime and write only if MTG is set. This register cannot be modiﬁed after the WP bit is set. MC9S12XF - Family Reference Manual, Rev.1.19 930 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module The 12-bit value written to this register is the number of PWM clock cycles in complementary channel operation. A reset sets the PWM deadtime register to a default value of 0x0FFF, selecting a deadtime of 4096-PWM clock cycles minus one bus clock cycle. NOTE Deadtime is affected by changes to the prescaler value. The deadtime duration is determined as follows: DT = P × PMFDTMC – 1, where DT is deadtime, P is the prescaler value, PMFDTMC is the programmed value of dead time. For example: if the prescaler is programmed for a divide-by-two and the PMFDTMC is set to ﬁve, then P = 2 and the deadtime value is equal to DT = 2 × 5 – 1 = 9 IPbus clock cycles. A special case exists when the P = 1, then DT = PMFDTMC. 20.4 20.4.1 Functional Description Block Diagram A block diagram of the PMF is shown in Figure 20-1. The MTG bit allows the use of multiple PWM generators (A, B, and C) or just a single generator (A). PWM0 and PWM1 constitute Pair A, PWM2 and PWM3 constitute Pair B, and PWM4 and PWM5 constitute Pair C. 20.4.2 Prescaler To permit lower PWM frequencies, the prescaler produces the PWM clock frequency by dividing the bus clock frequency by one, two, four, and eight. Each PWM generator has its own prescaler divisor. Each prescaler is buffered and will not be used by its PWM generator until the corresponding Load OK bit is set and a new PWM reload cycle begins. 20.4.3 PWM Generator Each PWM generator contains a 15-bit up/down PWM counter producing output signals with softwareselectables: • Alignment — The logic state of each pair EDGE bit determines whether the PWM pair outputs are edge-aligned or center-aligned • Period — The value written to each pair PWM counter modulo register is used to determine the PWM pair period. The period can also be varied by using the prescaler • With edge-aligned output, the modulus is the period of the PWM output in clock cycles • With center-aligned output, the modulus is one-half of the PWM output period in clock cycles • Pulse width — The number written to the PWM value register determines the pulse width duty cycle of the PWM output in clock cycles — With center-aligned output, the pulse width is twice the value written to the PWM value register — With edge-aligned output, the pulse width is the value written to the PWM value register MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 931 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module 20.4.3.1 Alignment Each edge-align bit, EDGEx, selects either center-aligned or edge-aligned PWM generator outputs. ALIGNMENT REFERENCE UP/DOWN COUNTER MODULUS = 4 PWM OUTPUT DUTY CYCLE = 50% Figure 20-41. Center-Aligned PWM Output ALIGNMENT REFERENCE UP COUNTER MODULUS = 4 PWM OUTPUT DUTY CYCLE = 50% Figure 20-42. Edge-Aligned PWM Output NOTE Because of the equals-comparator architecture of this PMF, the modulus equals zero case is considered illegal. Therefore, the modulus register does not return to zero, and a modulus value of zero will result in waveforms inconsistent with the other modulus waveforms. If a modulus of zero is loaded, the counter will continually count down from $7FFF. This operation will not be tested or guaranteed. Consider it illegal. However, the dead-time constraints and fault conditions will still be guaranteed. 20.4.3.2 Period A PWM period is determined by the value written to the PWM counter modulo register. The PWM counter is an up/down counter in a center-aligned operation. In this mode the PWM highest output resolution is two bus clock cycles. PWM period = (PWM modulus) × (PWM clock period) × 2 MC9S12XF - Family Reference Manual, Rev.1.19 932 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module COUNT 1 2 3 4 3 2 1 0 UP/DOWN COUNTER MODULUS = 4 PWM CLOCK PERIOD PWM PERIOD = 8 x PWM CLOCK PERIOD Figure 20-43. Center-Aligned PWM Period In an edge-aligned operation, the PWM counter is an up counter. The PWM output resolution is one bus clock cycle. PWM period = PWM modulus × PWM clock period COUNT 1 2 3 4 UP COUNTER MODULUS = 4 PWM CLOCK PERIOD PWM PERIOD = 4 x PWM CLOCK PERIOD Figure 20-44. Edge-Aligned PWM Period 20.4.3.3 Duty Cycle The signed 16-bit number written to the PMF value registers is the pulse width in PWM clock periods of the PWM generator output. PMFVAL Duty cycle = ------------------------------- × 100 MODULUS NOTE A PWM value less than or equal to zero deactivates the PWM output for the entire PWM period. A PWM value greater than or equal to the modulus activates the PWM output for the entire PWM period. Table 20-36. PWM Value and Underﬂow Conditions PMFVALx $0000–$7FFF $8000–$FFFF Condition Normal Underﬂow PWM Value Used Value in registers $0000 Center-aligned operation is illustrated in Figure 20-45. PWM pulse width = (PWM value) × (PWM clock period) × 2 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 933 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module COUNT 0 1 2 3 4 3 2 1 0 1 2 3 4 3 2 1 UP/DOWN COUNTER MODULUS = 4 PWM VALUE = 0 0/4 = 0% PWM VALUE = 1 1/4 = 25% PWM VALUE = 2 2/4 = 50% PWM VALUE = 3 3/4 = 75% PWM VALUE = 4 4/4 = 100% Figure 20-45. Center-Aligned PWM Pulse Width Edge-aligned operation is illustrated in Figure 20-46. PWM pulse width = (PWM value) × (PWM clock period) COUNT 1 2 30 UP COUNTER MODULUS = 4 PWM VALUE = 0 0/4 = 0% PWM VALUE = 1 1/4 = 25% PWM VALUE = 2 2/4 = 50% PWM VALUE = 3 3/4 = 75% PWM VALUE = 4 4/4 = 100% Figure 20-46. Edge-Aligned PWM Pulse Width 20.4.4 Independent or Complementary Channel Operation Writing a logic one to a INDEPx bit conﬁgures a pair of the PWM outputs as two independent PWM channels. Each PWM output has its own PWM value register operating independently of the other channels in independent channel operation. MC9S12XF - Family Reference Manual, Rev.1.19 934 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Writing a logic zero to a INDEPx bit conﬁgures the PWM output as a pair of complementary channels. The PWM pins are paired as shown in Figure 20-47 in complementary channel operation. PMFVAL0 REGISTER PAIR A PWM CHANNELS 0 AND 1 TOP BOTTOM PMFVAL2 REGISTER PAIR B PWM CHANNELS 2 AND 3 TOP BOTTOM PMFVAL4 REGISTER PAIR C PWM CHANNELS 4 AND 5 TOP BOTTOM PMFVAL5 REGISTER PMFVAL3 REGISTER PMFVAL1 REGISTER Figure 20-47. Complementary Channel Pairs The complementary channel operation is for driving top and bottom transistors in a motor drive circuit, such as the one in Figure 20-48. PWM 0 PWM 2 PWM 4 AC INPUTS TO MOTOR PWM 1 PWM 3 PWM 5 Figure 20-48. Typical 3 Phase AC Motor Drive In complementary channel operation, there are three additional features: • Deadtime insertion • Separate top and bottom pulse width correction for distortions are caused by deadtime inserted and the motor drive characteristics • Separate top and bottom output polarity control MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 935 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module • Swap functionality 20.4.5 Deadtime Generators While in the complementary mode, each PWM pair can be used to drive top/bottom transistors, as shown in Figure 20-49. Ideally, the PWM pairs are an inversion of each other. When the top PWM channel is active, the bottom PWM channel is inactive, and vice versa. NOTE To avoid a short-circuit on the DC bus and endangering the transistor, there must be no overlap of conducting intervals between top and bottom transistor. But the transistor’s characteristics make its switching-off time longer than switching-on time. To avoid the conducting overlap of top and bottom transistors, deadtime needs to be inserted in the switching period. Deadtime generators automatically insert software-selectable activation delays into each pair of PWM outputs. The deadtime register (PMFDTMx) speciﬁes the number of PWM clock cycles to use for deadtime delay. Every time the deadtime generator inputs changes state, deadtime is inserted. Deadtime forces both PWM outputs in the pair to the inactive state. A method of correcting this, adding to or subtracting from the PWM value used, is discussed next. OUT1 OUT0 MUX PWM0 & PWM1 DEADTIME GENERATOR TOP (PWM0) TO FAULT TOP/BOTTOM GENERATOR BOTTOM (PWM1) PROTECTION OUTCTL0 OUT3 TOP (PWM2) TO FAULT TOP/BOTTOM GENERATOR BOTTOM (PWM3) PROTECTION OUT2 PWM GENERATOR CURRENT STATUS MUX PWM2 & PWM3 DEADTIME GENERATOR OUTCTL2 OUT5 TOP (PWM4) TO FAULT TOP/BOTTOM GENERATOR BOTTOM (PWM5) PROTECTION OUT4 MUX PWM4 & PWM5 DEADTIME GENERATOR OUTCTL4 Figure 20-49. Deadtime Generators MC9S12XF - Family Reference Manual, Rev.1.19 936 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module MODULUS = 4 PWM VALUE = 2 PWM0, NO DEADTIME PWM1, NO DEADTIME PWM0, DEADTIME = 1 PWM1, DEADTIME = 1 Figure 20-50. Deadtime Insertion, Center Alignment MODULUS = 3 PWM VALUE = 1 PWM VALUE = 3 PWM0, NO DEADTIME PWM VALUE = 3 PWM VALUE = 3 PWM1, NO DEADTIME PWM0, DEADTIME = 2 PWM1, DEADTIME = 2 Figure 20-51. Deadtime at Duty Cycle Boundaries MODULUS = 3 PWM VALUE PWM0, NO DEADTIME 2 PWM Value = 3 PWM Value = 2 PWM Value = 1 PWM1, NO DEADTIME PWM0, DEADTIME = 3 PWM1, DEADTIME = 3 Figure 20-52. Deadtime and Small Pulse Widths MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 937 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module NOTE The waveform at the pad is delayed by two bus clock cycles for deadtime insertion. 20.4.5.1 Top/Bottom Correction In complementary mode, either the top or the bottom transistor controls the output voltage. However, deadtime has to be inserted to avoid overlap of conducting interval between the top and bottom transistor. Both transistors in complementary mode are off during deadtime, allowing the output voltage to be determined by the current status of load and introduce distortion in the output voltage. See Figure 20-53. On AC induction motors running open-loop, the distortion typically manifests itself as poor low-speed performance, such as torque ripple and rough operation. DESIRED LOAD VOLTAGE DEADTIME PWM TO TOP TRANSISTOR POSITIVE CURRENT V+ NEGATIVE CURRENT PWM TO BOTTOM TRANSISTOR POSITIVE CURRENT LOAD VOLTAGE NEGATIVE CURRENT LOAD VOLTAGE Figure 20-53. Deadtime Distortion During deadtime, load inductance distorts output voltage by keeping current ﬂowing through the diodes. This deadtime current ﬂow creates a load voltage that varies with current direction. With a positive current ﬂow, the load voltage during deadtime is equal to the bottom supply, putting the top transistor in control. With a negative current ﬂow, the load voltage during deadtime is equal to the top supply putting the bottom transistor in control. Remembering that the original PWM pulse widths were shortened by deadtime insertion, the averaged sinusoidal output will be less than desired value. However, when deadtime is inserted, it creates a distortion in motor current waveform. This distortion is aggravated by dissimilar turn-on and turn-off delays of each of the transistors. By giving the PWM module information on which transistor is controlling at a given time this distortion can be corrected. For a typical circuit in complementary channel operation, only one of the transistors will be effective in controlling the output voltage at any given time. This depends on the direction of the motor current for that pair. See Figure 20-53. To correct distortion one of two different factors must be added to the desired PWM value, depending on whether the top or bottom transistor is controlling the output voltage. Therefore, the MC9S12XF - Family Reference Manual, Rev.1.19 938 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module software is responsible for calculating both compensated PWM values prior to placing them in an oddnumbered/even numbered PWM register pair. Either the odd or the even PMFVAL register controls the pulse width at any given time. For a given PWM pair, whether the odd or even PMFVAL register is active depends on either: • The state of the current status pin, ISx, for that driver • The state of the odd/even correction bit, IPOLx, for that driver • To correct deadtime distortion, software can decrease or increase the value in the appropriate PMFVAL register. • In edge-aligned operation, decreasing or increasing the PWM value by a correction value equal to the deadtime typically compensates for deadtime distortion. • In center-aligned operation, decreasing or increasing the PWM value by a correction value equal to one-half the deadtime typically compensates for deadtime distortion. • In the complementary channel operation, ISENS selects one of three correction methods: • Manual correction • Automatic current status correction during deadtime • Automatic current status correction when the PWM counter value equals the value in the PWM counter modulus registers Table 20-37. Correction Method Selection ISENS 00 01 10 11 No correction(1) Manual correction Current status sample correction on pins IS0, IS1, and IS2 during deadtime(2) Correction Method Current status sample on pins IS0, IS1, and IS2(3) At the half cycle in center-aligned operation At the end of the cycle in edge-aligned operation 1. The current status pins can be used as general purpose input/output ports. 2. The polarity of the ISx pin is latched when both the top and bottom PWMs are off. At the 0% and 100% duty cycle boundaries, there is no deadtime, so no new current value is sensed. 3. Current is sensed even with 0% or 100% duty cycle. NOTE Assume the user will provide current status sensing circuitry causing the voltage at the corresponding input pin to be low for positive current and high for negative current. In addition, it assumes the top PWMs are PWM 0, 2, and 4 while the bottom PWMS are PWM 1, 3, and 5. 20.4.5.2 Manual Correction The IPOLx bits select either the odd or the even PWM value registers to use in the next PWM cycle. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 939 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-38. Top/Bottom Manual Correction Bit IPOLA IPOLB IPOLC Logic state 0 1 0 1 0 1 Output Control PMFVAL0 controls PWM0/PWM1 pair PMFVAL1 controls PWM0/PWM1 pair PMFVAL2 controls PWM2/PWM3 pair PMFVAL3 controls PWM2/PWM3 pair PMFVAL4 controls PWM4/PWM5 pair PMFVAL5 controls PWM4/PWM5 pair NOTE IPOLx bits are buffered so only one PWM register is used per PWM cycle. If an IPOLx bit changes during a PWM period, the new value does not take effect until the next PWM period. IPOLx bits take effect at the end of each PWM cycle regardless of the state of the load okay bit, LDOK. PWM CONTROLLED BY ODD PWMVAL REGISTER PWM CONTROLLED BY EVEN PWMVAL REGISTER A DEADTIME GENERATOR B A/B IPOLx BIT PWM CYCLE START D CLK Q BOTTOM PWM TOP PWM Figure 20-54. Internal Correction Logic when ISENS = 01 To detect the current status, the voltage on each ISx pin is sampled twice in a PWM period, at the end of each deadtime. The value is stored in the DTx bits in the PMF Deadtime Sample register (PMFDTMS). The DTx bits are a timing marker especially indicating when to toggle between PWM value registers. Software can then set the IPOLx bit to toggle PMFVAL registers according to DTx values. MC9S12XF - Family Reference Manual, Rev.1.19 940 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module PWM0 POSITIVE CURRENT NEGATIVE CURRENT PWM1 D PWM0 CLK Q DT0 IS0 PIN D PWM1 CLK Q DT1 VOLTAGE SENSOR Figure 20-55. Current Status Sense Scheme for Deadtime Correction If both D ﬂip-ﬂops latch low, DT0 = 0, DT1 = 0, during deadtime periods if current is large and ﬂowing out of the complementary circuit. See Figure 20-55. If both D ﬂip-ﬂops latch the high, DT0 = 1, DT1 = 1, during deadtime periods if current is also large and ﬂowing into the complementary circuit. However, under low-current, the output voltage of the complementary circuit during deadtime is somewhere between the high and low levels. The current cannot free-wheel throughout the opposition anti-body diode, regardless of polarity, giving additional distortion when the current crosses zero. Sampled results will be DT0 = 0 and DT1 = 1. Thus, the best time to change one PWM value register to another is just before the current zero crossing. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 941 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module V+ T DEADTIME PWM TO TOP TRANSISTOR B T B POSITIVE CURRENT NEGATIVE CURRENT PWM TO BOTTOM TRANSISTOR LOAD VOLTAGE WITH HIGH POSITIVE CURRENT LOAD VOLTAGE WITH LOW POSITIVE CURRENT LOAD VOLTAGE WITH HIGH NEGATIVE CURRENT LOAD VOLTAGE WITH NEGATIVE CURRENT T = DEADTIME INTERVAL BEFORE ASSERTION OF TOP PWM B = DEADTIME INTERVAL BEFORE ASSERTION OF BOTTOM PWM Figure 20-56. Output Voltage Waveforms 20.4.5.3 Current-Sensing Correction A current sense pin, ISx, for a PWM pair selects either the odd or the even PWM value registers to use in the next PWM cycle. The selection is based on user-provided current sense circuitry driving the ISx pin high for negative current and low for positive current. Table 20-39. Top/Bottom Current Sense Correction Pin IS0 IS1 IS2 Logic State 0 1 0 1 0 1 Output Control PMFVAL0 controls PWM0/PWM1 pair PMFVAL1 controls PWM0/PWM1 pair PMFVAL2 controls PWM2/PWM3 pair PMFVAL3 controls PWM2/PWM3 pair PMFVAL4 controls PWM4/PWM5 pair PMFVAL5 controls PWM4/PWM5 pair Previously shown, the current direction can be determined by the output voltage during deadtime. Thus, a simple external voltage sensor can be used when current status is completed during deadtime, ISENS = 10. Deadtime does not exists at the 100 percent and zero percent duty cycle boundaries. Therefore, the second automatic mode must be used for correction, ISENS = 11, where current status is sampled at the half cycle in center-aligned operation and at the end of cycle in edge-aligned operation. Using this mode requires external circuitry. It actually senses current direction. MC9S12XF - Family Reference Manual, Rev.1.19 942 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module PWM CONTROLLED BY ODD PWMVAL REGISTER PWM CONTROLLED BY EVEN PWMVAL REGISTER INITIAL VALUE = 0 ISx PIN IN DEADTIME D CLK Q D CLK Q A DEADTIME GENERATOR B A/B TOP PWM BOTTOM PWM PWM CYCLE START Figure 20-57. Internal Correction Logic when ISENS = 10 PWM CONTROLLED BY ODD PWMVAL REGISTER PWM CONTROLLED BY EVEN PWMVAL REGISTER INITIAL VALUE = 0 ISx PIN PMFCNT = PMFMOD D CLK Q D CLK Q A DEADTIME GENERATOR B A/B TOP PWM BOTTOM PWM PWM CYCLE START Figure 20-58. Internal Correction Logic when ISENS = 11 NOTE Values latched on the ISx pins are buffered so only one PWM register is used per PWM cycle. If a current status changes during a PWM period, the new value does not take effect until the next PWM period. When initially enabled by setting the PWMEN bit, no current status has previously been sampled. PWM value registers one, three, and ﬁve initially control the three PWM pairs when conﬁgured for current status correction. DESIRED LOAD VOLTAGE TOP PWM BOTTOM PWM LOAD VOLTAGE Figure 20-59. Correction with Positive Current MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 943 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module DESIRED LOAD VOLTAGE TOP PWM BOTTOM PWM LOAD VOLTAGE Figure 20-60. Correction with Negative Current 20.4.5.4 Output Polarity Output polarity of the PWMs is determined by two options: TOPNEG and BOTNEG. The top polarity option, TOPNEG, controls the polarity of PWM0, PWM2 and PWM4. The bottom polarity option, BOTNEG, controls the polarity of PWM1, PWM3 and PWM5. Positive polarity means when the PWM is active its output is high. Conversely, negative polarity means when the PWM is active its output is low. The TOPNEG and BOTNEG are in the conﬁgure register. TOPNEG is the output of PWM0, PWM2 and PWM4. They are active low. If TOPNEG is set, PWM0, PWM2, and PWM4 outputs become active-low. When BOTNEG is set, PWM1, PWM3, and PWM5 outputs are active-low. When these bits are clear, their respective PWM pins are active-high. See Figure 20-59 and Figure 20-60. UP/DOWN COUNTER MODULUS = 4 UP COUNTER MODULUS = 4 PWM = 0 PWM = 0 CENTER-ALIGNED PWM = 1 POSITIVE POLARITY PWM = 2 PWM = 3 PWM = 4 UP/DOWN COUNTER MODULUS = 4 UP COUNTER MODULUS = 4 PWM = 0 PWM = 0 PWM = 1 CENTER-ALIGNED PWM = 2 NEGATIVE POLARITY PWM = 3 PWM = 4 PWM = 1 EDGE-ALIGNED PWM = 2 NEGATIVE POLARITY PWM = 3 PWM = 4 PWM = 1 EDGE-ALIGNED PWM = 2 POSITIVE POLARITY PWM = 3 PWM = 4 Figure 20-61. PWM Polarity 20.4.6 Software Output Control Setting output control enable bit, OUTCTLx, enables software to drive the PWM outputs rather than the PWM generator. In an independent mode, with OUTCTLx = 1, the output bit OUTx, controls the PWMx MC9S12XF - Family Reference Manual, Rev.1.19 944 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module channel. In a complementary channel operation the even OUTCTL bit is used to enable software output control for the pair. But the OUTCTL bits must be switched in pairs for proper operation. The OUTCTLx and OUTx bits are in the PWM output control register. NOTE During software output control, TOPNEG and BOTNEG still control output polarity. It will take up to 3 clock cycles to see the effect of output control on the PWM output pins. In independent PWM operation, setting or clearing the OUTx bit activates or deactivates the PWMx output. In complementary channel operation, the even-numbered OUTx bits replace the PWM generator outputs as inputs to the deadtime generators. Complementary channel pairs still cannot be active simultaneously, and the deadtime generators continue to insert deadtime in both channels of that pair, whenever an even OUTx bit toggles. Even OUTx bits control the top PWM signals while the odd OUTx bits control the bottom PWM signals with respect to the even OUTx bits. Setting the odd OUTx bit makes its corresponding PWMx the complement of its even pair, while clearing the odd OUTx bit deactivates the odd PWMx. Setting the OUTCTLx bits do not disable the PWM generators and current status sensing circuitry. They continue to run, but no longer control the output pins. When the OUTCTLx bits are cleared, the outputs of the PWM generator become the inputs to the deadtime generators at the beginning of the next PWM cycle. Software can drive the PWM outputs even when PWM enable bit (PWMEN) is set to zero. NOTE Avoid an unexpected deadtime insertion by clearing the OUTx bits before setting and after clearing the OUTCTLx bits. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 945 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module MODULUS = 4 PWM VALUE = 2 DEADTIME = 2 PWM0 PWM1 PWM0 WITH DEADTIME PWM1 WITH DEADTIME OUTCTL0 OUT0 OUT1 PWM0 PWM1 Figure 20-62. Setting OUT0 with OUTCTL Set in Complementary Mode MODULUS = 4 PWM VALUE = 2 DEADTIME = 2 PWM0 PWM1 PWM0 WITH DEADTIME PWM1 WITH DEADTIME OUTCTL0 OUT0 OUT1 PWM0 PWM1 Figure 20-63. Clearing OUT0 with OUTCTL Set In Complementary Mode MC9S12XF - Family Reference Manual, Rev.1.19 946 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module MODULUS = 4 PWM VALUE = 2 DEADTIME = 2 PWM0 PWM1 PWM0 WITH DEADTIME PWM1 WITH DEADTIME OUTCTL0 OUT0 OUT1 PWM0 PWM1 Figure 20-64. Setting OUTCTL with OUT0 Set in Complementary Mode 20.4.7 20.4.7.1 PWM Generator Loading Load Enable The load okay bit, LDOK, enables loading the PWM generator with: • A prescaler divisor—from the PRSC1 and PRSC0 bits in PWM control register • A PWM period—from the PWM counter modulus registers • A PWM pulse width—from the PWM value registers LDOK prevents reloading of these PWM parameters before software is ﬁnished calculating them Setting LDOK allows the prescaler bits, PMFMOD and PMFVALx registers to be loaded into a set of buffers. The loaded buffers use the PWM generator at the beginning of the next PWM reload cycle. Set LDOK by reading it when it is a logic zero and then writing a logic one to it. After loading, LDOK is automatically cleared. 20.4.7.2 Load Frequency The LDFQ3, LDFQ2, LDFQ1, and LDFQ0 bits in the PWM control register (PWMCTL) select an integral loading frequency of one to 16-PWM reload opportunities. The LDFQ bits take effect at every PWM reload opportunity, regardless the state of the load okay bit, LDOK. The half bit in the PWMCTL register controls half-cycle reloads for center-aligned PWMs. If the half bit is set, a reload opportunity occurs at the beginning of every PWM cycle and half cycle when the count equals the modulus. If the half bit is not set, a reload opportunity occurs only at the beginning of every cycle. Reload opportunities can only occur at the beginning of a PWM cycle in edge-aligned mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 947 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module NOTE Loading a new modulus on a half cycle will force the count to the new modulus value minus one on the next clock cycle. Half cycle reloads are possible only in center-aligned mode. Enabling or disabling half-cycle reloads in edge-aligned mode will have no effect on the reload rate. UP/DOWN COUNTER RELOAD CHANGE RELOAD FREQUENCY TO EVERY TWO OPPORTUNITIES TO EVERY FOUR OPPORTUNITIES TO EVERY OPPORTUNITY Figure 20-65. Full Cycle Reload Frequency Change UP/DOWN COUNTER RELOAD CHANGE RELOAD FREQUENCY TO EVERY TWO OPPORTUNITIES TO EVERY TO EVERY TO EVERY FOUR OPPORTUNITIES OPPORTUNITY TWO OPPORTUNITIES Figure 20-66. Half Cycle Reload Frequency Change 20.4.7.3 Reload Flag With a reload opportunity, regardless an actual reload occurs as determined by LDOK bit, the PWMF reload flag is set. If the PWM reload interrupt enable bit, PWMRIE is set, the PWMF flag generates CPU interrupt requests allowing software to calculate new PWM parameters in real time. When PWMRIE is not set, reloads still occur at the selected reload rate without generating CPU interrupt requests. READ PWMRF AS 1 THEN WRITE 0 TO PWMF RESET VDD D PWM RELOAD CLR Q PWMRIE PWMRF CPU INTERRUPT REQUEST CLK Figure 20-67. PWMRF Reload Interrupt Request MC9S12XF - Family Reference Manual, Rev.1.19 948 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module HALF = 0, LDFQ[3:0] = 00 = RELOAD EVERY CYCLE UP/DOWN COUNTER LDOK = 1 MODULUS = 3 PWM VALUE = 1 PWMRF = 1 PWM 0 3 2 1 1 3 2 1 0 3 1 1 Figure 20-68. Full-Cycle Center-Aligned PWM Value Loading HALF = 0, LDFQ[3:0] = 00 = RELOAD EVERY CYCLE UP/DOWN COUNTER LDOK = 1 MODULUS = 2 PWM VALUE = 1 PWMRF = 1 PWM 1 3 1 1 1 2 1 1 1 1 1 1 0 2 1 1 Figure 20-69. Full-Cycle Center-Aligned Modulus Loading HALF = 1, LDFQ[3:0] = 00 = RELOAD EVERY HALF-CYCLE UP/DOWN COUNTER 1 3 1 1 LDOK = 1 MODULUS = 3 PWM VALUE = 1 PWMRF = 1 PWM 1 3 2 1 0 3 2 1 0 3 2 1 1 3 1 1 1 3 3 1 0 3 3 1 Figure 20-70. Half-Cycle Center-Aligned PWM Value Loading MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 949 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module HALF = 1, LDFQ[3:0] = 00 = RELOAD EVERY HALF-CYCLE UP/DOWN COUNTER 1 1 1 1 1 4 1 1 LDOK = 1 MODULUS = 2 PWM VALUE = 1 PWMRF = 1 0 2 1 1 0 3 1 1 1 4 1 1 0 4 1 1 0 2 1 1 PWM Figure 20-71. Half-Cycle Center-Aligned Modulus Loading LDFQ[3:0] = 00 = RELOAD EVERY CYCLE UP ONLY COUNTER LDOK = 1 MODULUS = 3 PWM VALUE = 1 PWMRF = 1 0 3 2 1 1 3 2 1 0 3 1 1 0 3 1 1 PWM Figure 20-72. Edge-Aligned PWM Value Loading LDFQ[3:0] = 00 = RELOAD EVERY CYCLE UP ONLY COUNTER LDOK = 1 MODULUS = 3 PWM VALUE = 2 PWMRF = 1 PWM 1 4 2 1 1 2 2 1 0 1 2 1 Figure 20-73. Untitled Figure 20.4.7.4 Initialization Initialize all registers and set the LDOK bit before setting the PWMEN bit. With LDOK set, setting PWMEN for the ﬁrst time after reset, immediately loads the PWM generator thereby setting the PWMRF ﬂag. PWMRF generates a CPU interrupt request if the PWMRIE bit is set. In complementary channel MC9S12XF - Family Reference Manual, Rev.1.19 950 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module operation with current-status correction selected, PWM value registers one, three, and ﬁve control the outputs for the ﬁrst PWM cycle. NOTE Even if LDOK is not set, setting PWMEN also sets the PWMRF ﬂag. To prevent a CPU interrupt request, clear the PWMRIE bit before setting PWMEN. Setting PWMEN for the ﬁrst time after reset without ﬁrst setting LDOK loads a prescaler divisor of one, a PWM value of $0000, and an unknown modulus. The PWM generator uses the last values loaded if PWMEN is cleared and then set while LDOK equals zero. Initializing the deadtime register, after setting PWMEN or OUTCTLx, can cause an improper deadtime insertion. However, the deadtime can never be shorter than the speciﬁed value. IPBus CLOCK PWMEN BIT PWM PINS HI-Z ACTIVE HI-Z Figure 20-74. PWMEN and PWM Pins in Independent Operation IPBus CLOCK PWMEN BIT PWM PINS HI-Z ACTIVE HI-Z Figure 20-75. PWMEN and PWM Pins in Complementary Operation When the PWMEN bit is cleared: • The PWMx outputs will be tri-stated unless OUTCTLx = 1 • The PWM counter is cleared and does not count • The PWM generator forces its outputs to zero • The PWMRF ﬂag and pending CPU interrupt requests are not cleared • All fault circuitry remains active unless FPINEx = 0 • Software output control remains active • Deadtime insertion continues during software output control 20.4.8 Fault Protection Fault protection can disable any combination of PWM pins. Faults are generated by a logic one on any of the FAULT pins. Each FAULT pin can be mapped arbitrarily to any of the PWM pins. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 951 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module When fault protection hardware disables PWM pins, the PWM generator continues to run, only the output pins are deactivated. The fault decoder disables PWM pins selected by the fault logic and the disable mapping register. See Figure 20-15. Each bank of four bits in the disable mapping register control the mapping for a single PWM pin. Refer to Table 20-11. The fault protection is enabled even when the PWM is not enabled; therefore, a fault will be latched in and will be cleared in order to prevent an interrupt when the PWM is enabled. 20.4.8.1 Fault Pin Sample Filter Each fault pin has a sample ﬁlter to test for fault conditions. After every bus cycle setting the FAULTx pin at logic zero, the ﬁlter synchronously samples the pin once every four bus cycles. QSMP determines the number of consecutive samples that must be logic one for a fault to be detected. When a fault is detected, the corresponding FAULTx pin ﬂag, FFLAGx, is set. Clear FFLAGx by writing a logic one to it. If the FIEx, FAULTx pin interrupt enable bit is set, the FFLAGx ﬂag generates a CPU interrupt request. The interrupt request latch remains set until: • Software clears the FFLAGx ﬂag by writing a logic one to it • Software clears the FIEx bit by writing a logic zero to it • A reset occurs 20.4.8.2 Automatic Fault Clearing Setting a fault mode bit, FMODEx, conﬁgures faults from the FAULTx pin for automatic clearing. When FMODEx is set, disabled PWM pins are enabled when the FAULTx pin returns to logic zero and a new PWM half cycle begins. See Figure 20-76. Clearing the FFLAGx ﬂag does not affect disabled PWM pins when FMODEx is set. FAULT PIN PWMS ENABLED PWMS DISABLED ENABLED DISABLED PWMS ENABLED Figure 20-76. Automatic Fault Clearing 20.4.8.3 Manual Fault Clearing Clearing a fault mode bit, FMODEx, conﬁgures faults from the FAULTx pin for manual clearing: • PWM pins disabled by the FAULT0 pin or the FAULT2 pin are enabled by clearing the corresponding FFLAGx ﬂag. The time at which the PWM pins are enabled depends on the corresponding QSMPx bit setting. If QSMPx = 00, the PWM pins are enabled on the next IP bus cycle when the logic level detected by the ﬁlter at the fault pin is logic zero. If QSMPx = 01,10 or MC9S12XF - Family Reference Manual, Rev.1.19 952 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module • 11, the PWMs are enabled when the next PWM half cycle begins regardless of the state of the logic level detected by the ﬁlter at the fault. See Figure 20-77 and Figure 20-78. PWM pins disabled by the FAULT1 pin or the FAULT3 pin are enabled when — Software clears the corresponding FFLAGx ﬂag — The ﬁlter detects a logic zero on the fault pin at the start of the next PWM half cycle boundary. See Figure 20-79. FAULT0 OR FAULT2 PWMS ENABLED PWMS DISABLED PWMS ENABLED FFLAGx CLEARED Figure 20-77. Manual Fault Clearing (Faults 0 and 2) — QSMP = 00 FAULT0 OR FAULT2 PWMS ENABLED PWMS DISABLED PWMS ENABLED FFLAGx CLEARED Figure 20-78. Manual Fault Clearing (Faults 0 and 2) — QSMP = 01, 10, or 11 FAULT1 OR FAULT3 PWMS ENABLED PWMS DISABLED PWMS ENABLED FFLAGx CLEARED Figure 20-79. Manual Fault Clearing (Faults 1 and 3) NOTE PWM half-cycle boundaries occur at both the PWM cycle start and when the counter equals the modulus, so in edge-aligned operation full-cycles and half-cycles are equal. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 953 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module NOTE Fault protection also applies during software output control when the OUTCTLx bits are set. Fault clearing still occurs at half PWM cycle boundaries while the PWM generator is engaged, PWMEN equals one. But the OUTx bits can control the PWM pins while the PWM generator is off, PWMEN equals zero. Thus, fault clearing occurs at IPbus cycles while the PWM generator is off and at the start of PWM cycles when the generator is engaged. 20.5 Resets All PWM registers are reset to their default values upon any system reset. 20.6 Clocks The system bus clock is the only clock required by this module. 20.7 Interrupts Seven PWM sources can generate CPU interrupt requests: • Reload ﬂag x (PWMRFx)—PWMRFx is set at the beginning of every PWM Generator x reload cycle. The reload interrupt enable bit, PWMRIEx, enables PWMRFx to generate CPU interrupt requests. where x is A, B and C. • Fault ﬂag x (FFLAGx)—The FFLAGx bit is set when a logic one occurs on the FAULTx pin. The fault pin interrupt enable x bit, FIEx, enables the FFLAGx ﬂag to generate CPU interrupt requests. where x is 0, 1, 2 and 3. 20.8 Electrical Speciﬁcations In general, electrical speciﬁcations may vary a bit from chip to chip. This section illustrates typical parameters. Refer to the chip speciﬁcation electrical and timing speciﬁcations for details of a speciﬁc implementation. Table 20-40. DC Electrical Characteristics Characteristic Input high voltage Input low voltage Input hysteresis on Schmitt trigger inputs (Fault pins) Input pullup current Input current low (pullups disabled) Input current high (pullups disabled) Output tri-state current low Symbol VIH VIL VHYS IPU IIL IIH IOZL Min 2.0 –0.3 — –50 –10 –10 –10 Typ — — 0.3 –100 — — — Max 5.5 0.8 — –170 10 10 10 Unit V V V µA µA µA µA MC9S12XF - Family Reference Manual, Rev.1.19 954 Freescale Semiconductor Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module Table 20-40. DC Electrical Characteristics (continued) Characteristic Output tri-state current high Output voltage high (at IOHP) Output voltage low (at IOLP) Input capacitance Output capacitance PWM pin output high Current(1) (at VOH-min) Symbol IOZH VOH VOL CIN COUT IOHP Min –10 VDD – 0.7 — — — –10 16 Typ — — — 8 12 — — Max 10 — 0.4 — — — — Unit µA V V pF pF mA mA IOLP PWM pin output low current(2) (at VOL-min) 1. PWM pin output high current measured with 50% duty cycle. 2. PWM pin output low current measured with 50% duty cycle. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 955 Chapter 20 Pulse Width Modulator with Fault Protection (PMF15B6C) Module MC9S12XF - Family Reference Manual, Rev.1.19 956 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-1. Revision History Revision Number V02.14 V02.15 V02.16 Revision Date Sections Affected Description of Changes Added Initialization/Application information; replaced ’MCU’ with ’CPU’ in several places; cleaned up Mode descriptions; general cleanup. Corrected buffer read/write access deﬁnitions; corrected bit time equation. Convert to SRSLite3.2 with single-source document for V02 and V03 (controlled by conditonal text) 18 Sep 2002 15 Jul 2004 3 Jan 2005 21.1 Introduction Freescale’s scalable controller area network (S12MSCANV2) deﬁnition is based on the MSCAN12 deﬁnition, which is the speciﬁc implementation of the MSCAN concept targeted for the M68HC12 microcontroller family. The module is a communication controller implementing the CAN 2.0A/B protocol as deﬁned in the Bosch speciﬁcation dated September 1991. For users to fully understand the MSCAN speciﬁcation, it is recommended that the Bosch speciﬁcation be read ﬁrst to familiarize the reader with the terms and concepts contained within this document. Though not exclusively intended for automotive applications, CAN protocol is designed to meet the speciﬁc requirements of a vehicle serial data bus: real-time processing, reliable operation in the EMI environment of a vehicle, cost-effectiveness, and required bandwidth. MSCAN uses an advanced buffer arrangement resulting in predictable real-time behavior and simpliﬁed application software. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 957 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.1.1 Glossary Table 21-2. Terminology ACK CAN CRC EOF FIFO IFS SOF CPU bus CAN bus oscillator clock bus clock CAN clock Acknowledge of CAN message Controller Area Network Cyclic Redundancy Code End of Frame First-In-First-Out Memory Inter-Frame Sequence Start of Frame CPU related read/write data bus CAN protocol related serial bus Direct clock from external oscillator CPU bus related clock CAN protocol related clock 21.1.2 Block Diagram MSCAN Oscillator Clock Bus Clock CANCLK MUX Presc. Tq Clk Receive/ Transmit Engine RXCAN TXCAN Transmit Interrupt Req. Receive Interrupt Req. Errors Interrupt Req. Wake-Up Interrupt Req. Control and Status Message Filtering and Buffering Conﬁguration Registers Wake-Up Low Pass Filter Figure 21-1. MSCAN Block Diagram MC9S12XF - Family Reference Manual, Rev.1.19 958 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.1.3 Features The basic features of the MSCAN are as follows: • Implementation of the CAN protocol — Version 2.0A/B — Standard and extended data frames — Zero to eight bytes data length — Programmable bit rate up to 1 Mbps1 — Support for remote frames • Five receive buffers with FIFO storage scheme • Three transmit buffers with internal prioritization using a “local priority” concept • Flexible maskable identiﬁer ﬁlter supports two full-size (32-bit) extended identiﬁer ﬁlters, or four 16-bit ﬁlters, or eight 8-bit ﬁlters • Programmable wake-up functionality with integrated low-pass ﬁlter • Programmable loopback mode supports self-test operation • Programmable listen-only mode for monitoring of CAN bus • Separate signalling and interrupt capabilities for all CAN receiver and transmitter error states (warning, error passive, bus-off) • Programmable MSCAN clock source either bus clock or oscillator clock • Internal timer for time-stamping of received and transmitted messages • Three low-power modes: sleep, power down, and MSCAN enable • Global initialization of conﬁguration registers 21.1.4 Modes of Operation For a description of the speciﬁc MSCAN modes and the module operation related to the system operating modes refer to Section 21.4.4, “Modes of Operation”. 1. Depending on the actual bit timing and the clock jitter of the PLL. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 959 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.2 External Signal Description NOTE On MCUs with an integrated CAN physical interface (transceiver) the MSCAN interface is connected internally to the transceiver interface. In these cases the external availability of signals TXCAN and RXCAN is optional. The MSCAN uses two external pins. 21.2.1 RXCAN — CAN Receiver Input Pin RXCAN is the MSCAN receiver input pin. 21.2.2 TXCAN — CAN Transmitter Output Pin TXCAN is the MSCAN transmitter output pin. The TXCAN output pin represents the logic level on the CAN bus: 0 = Dominant state 1 = Recessive state 21.2.3 CAN System A typical CAN system with MSCAN is shown in Figure 21-2. Each CAN station is connected physically to the CAN bus lines through a transceiver device. The transceiver is capable of driving the large current needed for the CAN bus and has current protection against defective CAN or defective stations. CAN node 1 MCU CAN Controller (MSCAN) CAN node 2 CAN node n TXCAN Transceiver RXCAN CANH CANL CAN Bus Figure 21-2. CAN System MC9S12XF - Family Reference Manual, Rev.1.19 960 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.3 Memory Map and Register Deﬁnition This section provides a detailed description of all registers accessible in the MSCAN. 21.3.1 Module Memory Map Figure 21-3 gives an overview on all registers and their individual bits in the MSCAN memory map. The register address results from the addition of base address and address offset. The base address is determined at the MCU level and can be found in the MCU memory map description. The address offset is deﬁned at the module level. The MSCAN occupies 64 bytes in the memory space. The base address of the MSCAN module is determined at the MCU level when the MCU is deﬁned. The register decode map is ﬁxed and begins at the ﬁrst address of the module address offset. The detailed register descriptions follow in the order they appear in the register map. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 961 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Register Name 0x0000 CANCTL0 0x0001 CANCTL1 0x0002 CANBTR0 0x0003 CANBTR1 0x0004 CANRFLG 0x0005 CANRIER 0x0006 CANTFLG 0x0007 CANTIER 0x0008 CANTARQ 0x0009 CANTAAK 0x000A CANTBSEL 0x000B CANIDAC 0x000C–0x000D Reserved 0x000E CANRXERR 0x000F CANTXERR R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 6 RXACT 5 4 SYNCH 3 2 1 Bit 0 RXFRM CSWAI TIME WUPE SLPRQ SLPAK INITRQ INITAK CANE CLKSRC LOOPB LISTEN WUPM SJW1 SJW0 BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 SAMP TSEG22 TSEG21 RSTAT1 TSEG20 RSTAT0 TSEG13 TSTAT1 TSEG12 TSTAT0 TSEG11 TSEG10 WUPIF CSCIF OVRIF RXF WUPIE 0 CSCIE 0 RSTATE1 0 RSTATE0 0 TSTATE1 0 TSTATE0 OVRIE RXFIE TXE2 TXE1 TXE0 0 0 0 0 0 TXEIE2 TXEIE1 TXEIE0 0 0 0 0 0 ABTRQ2 ABTAK2 ABTRQ1 ABTAK1 ABTRQ0 ABTAK0 0 0 0 0 0 0 0 0 0 0 TX2 IDHIT2 TX1 IDHIT1 TX0 IDHIT0 0 0 IDAM1 0 IDAM0 0 0 0 0 0 0 0 0 RXERR7 RXERR6 RXERR5 RXERR4 RXERR3 RXERR2 RXERR1 RXERR0 TXERR7 TXERR6 TXERR5 TXERR4 TXERR3 TXERR2 TXERR1 TXERR0 = Unimplemented or Reserved Figure 21-3. MSCAN Register Summary MC9S12XF - Family Reference Manual, Rev.1.19 962 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Register Name 0x0010–0x0013 CANIDAR0–3 0x0014–0x0017 CANIDMRx 0x0018–0x001B CANIDAR4–7 0x001C–0x001F CANIDMR4–7 0x0020–0x002F CANRXFG 0x0030–0x003F CANTXFG R W R W R W R W R W R W Bit 7 AC7 6 AC6 5 AC5 4 AC4 3 AC3 2 AC2 1 AC1 Bit 0 AC0 AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 AC7 AC6 AC5 AC4 AC3 AC2 AC1 AC0 AM7 AM6 AM5 AM4 AM3 AM2 AM1 AM0 See Section 21.3.3, “Programmer’s Model of Message Storage” See Section 21.3.3, “Programmer’s Model of Message Storage” = Unimplemented or Reserved Figure 21-3. MSCAN Register Summary (continued) 21.3.2 Register Descriptions This section describes in detail all the registers and register bits in the MSCAN module. Each description includes a standard register diagram with an associated ﬁgure number. Details of register bit and ﬁeld function follow the register diagrams, in bit order. All bits of all registers in this module are completely synchronous to internal clocks during a register read. 21.3.2.1 MSCAN Control Register 0 (CANCTL0) The CANCTL0 register provides various control bits of the MSCAN module as described below. Module Base + 0x0000 7 6 5 4 3 2 Access: User read/write(1) 1 0 R RXFRM W Reset: 0 RXACT CSWAI 0 = Unimplemented 0 SYNCH TIME 0 0 WUPE 0 SLPRQ 0 INITRQ 1 Figure 21-4. MSCAN Control Register 0 (CANCTL0) 1. Read: Anytime Write: Anytime when out of initialization mode; exceptions are read-only RXACT and SYNCH, RXFRM (which is set by the module only), and INITRQ (which is also writable in initialization mode) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 963 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) NOTE The CANCTL0 register, except WUPE, INITRQ, and SLPRQ, is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). This register is writable again as soon as the initialization mode is exited (INITRQ = 0 and INITAK = 0). Table 21-3. CANCTL0 Register Field Descriptions Field 7 RXFRM(1) Description Received Frame Flag — This bit is read and clear only. It is set when a receiver has received a valid message correctly, independently of the ﬁlter conﬁguration. After it is set, it remains set until cleared by software or reset. Clearing is done by writing a 1. Writing a 0 is ignored. This bit is not valid in loopback mode. 0 No valid message was received since last clearing this ﬂag 1 A valid message was received since last clearing of this ﬂag Receiver Active Status — This read-only ﬂag indicates the MSCAN is receiving a message. The ﬂag is controlled by the receiver front end. This bit is not valid in loopback mode. 0 MSCAN is transmitting or idle2 1 MSCAN is receiving a message (including when arbitration is lost)(2) CAN Stops in Wait Mode — Enabling this bit allows for lower power consumption in wait mode by disabling all the clocks at the CPU bus interface to the MSCAN module. 0 The module is not affected during wait mode 1 The module ceases to be clocked during wait mode Synchronized Status — This read-only ﬂag indicates whether the MSCAN is synchronized to the CAN bus and able to participate in the communication process. It is set and cleared by the MSCAN. 0 MSCAN is not synchronized to the CAN bus 1 MSCAN is synchronized to the CAN bus Timer Enable — This bit activates an internal 16-bit wide free running timer which is clocked by the bit clock rate. If the timer is enabled, a 16-bit time stamp will be assigned to each transmitted/received message within the active TX/RX buffer. Right after the EOF of a valid message on the CAN bus, the time stamp is written to the highest bytes (0x000E, 0x000F) in the appropriate buffer (see Section 21.3.3, “Programmer’s Model of Message Storage”). The internal timer is reset (all bits set to 0) when disabled. This bit is held low in initialization mode. 0 Disable internal MSCAN timer 1 Enable internal MSCAN timer Wake-Up Enable — This conﬁguration bit allows the MSCAN to restart from sleep mode or from power down mode (entered from sleep) when trafﬁc on CAN is detected (see Section 21.4.5.5, “MSCAN Sleep Mode”). This bit must be conﬁgured before sleep mode entry for the selected function to take effect. 0 Wake-up disabled — The MSCAN ignores trafﬁc on CAN 1 Wake-up enabled — The MSCAN is able to restart 6 RXACT 5 CSWAI(3) 4 SYNCH 3 TIME 2 WUPE(4) MC9S12XF - Family Reference Manual, Rev.1.19 964 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-3. CANCTL0 Register Field Descriptions (continued) Field 1 SLPRQ(5) Description Sleep Mode Request — This bit requests the MSCAN to enter sleep mode, which is an internal power saving mode (see Section 21.4.5.5, “MSCAN Sleep Mode”). The sleep mode request is serviced when the CAN bus is idle, i.e., the module is not receiving a message and all transmit buffers are empty. The module indicates entry to sleep mode by setting SLPAK = 1 (see Section 21.3.2.2, “MSCAN Control Register 1 (CANCTL1)”). SLPRQ cannot be set while the WUPIF ﬂag is set (see Section 21.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)”). Sleep mode will be active until SLPRQ is cleared by the CPU or, depending on the setting of WUPE, the MSCAN detects activity on the CAN bus and clears SLPRQ itself. 0 Running — The MSCAN functions normally 1 Sleep mode request — The MSCAN enters sleep mode when CAN bus idle 0 Initialization Mode Request — When this bit is set by the CPU, the MSCAN skips to initialization mode (see INITRQ(6),(7) Section 21.4.4.5, “MSCAN Initialization Mode”). Any ongoing transmission or reception is aborted and synchronization to the CAN bus is lost. The module indicates entry to initialization mode by setting INITAK = 1 (Section 21.3.2.2, “MSCAN Control Register 1 (CANCTL1)”). The following registers enter their hard reset state and restore their default values: CANCTL0(8), CANRFLG(9), CANRIER(10), CANTFLG, CANTIER, CANTARQ, CANTAAK, and CANTBSEL. The registers CANCTL1, CANBTR0, CANBTR1, CANIDAC, CANIDAR0-7, and CANIDMR0-7 can only be written by the CPU when the MSCAN is in initialization mode (INITRQ = 1 and INITAK = 1). The values of the error counters are not affected by initialization mode. When this bit is cleared by the CPU, the MSCAN restarts and then tries to synchronize to the CAN bus. If the MSCAN is not in bus-off state, it synchronizes after 11 consecutive recessive bits on the CAN bus; if the MSCAN is in bus-off state, it continues to wait for 128 occurrences of 11 consecutive recessive bits. Writing to other bits in CANCTL0, CANRFLG, CANRIER, CANTFLG, or CANTIER must be done only after initialization mode is exited, which is INITRQ = 0 and INITAK = 0. 0 Normal operation 1 MSCAN in initialization mode 1. The MSCAN must be in normal mode for this bit to become set. 2. See the Bosch CAN 2.0A/B speciﬁcation for a detailed deﬁnition of transmitter and receiver states. 3. In order to protect from accidentally violating the CAN protocol, TXCAN is immediately forced to a recessive state when the CPU enters wait (CSWAI = 1) or stop mode (see Section 21.4.5.2, “Operation in Wait Mode” and Section 21.4.5.3, “Operation in Stop Mode”). 4. The CPU has to make sure that the WUPE register and the WUPIE wake-up interrupt enable register (see Section 21.3.2.6, “MSCAN Receiver Interrupt Enable Register (CANRIER)) is enabled, if the recovery mechanism from stop or wait is required. 5. The CPU cannot clear SLPRQ before the MSCAN has entered sleep mode (SLPRQ = 1 and SLPAK = 1). 6. The CPU cannot clear INITRQ before the MSCAN has entered initialization mode (INITRQ = 1 and INITAK = 1). 7. In order to protect from accidentally violating the CAN protocol, TXCAN is immediately forced to a recessive state when the initialization mode is requested by the CPU. Thus, the recommended procedure is to bring the MSCAN into sleep mode (SLPRQ = 1 and SLPAK = 1) before requesting initialization mode. 8. Not including WUPE, INITRQ, and SLPRQ. 9. TSTAT1 and TSTAT0 are not affected by initialization mode. 10. RSTAT1 and RSTAT0 are not affected by initialization mode. 21.3.2.2 MSCAN Control Register 1 (CANCTL1) The CANCTL1 register provides various control bits and handshake status information of the MSCAN module as described below. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 965 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x0001 7 6 5 4 3 2 Access: User read/write(1) 1 0 R CANE W Reset: 0 0 0 1 0 0 CLKSRC LOOPB LISTEN WUPM SLPAK INITAK 0 1 = Unimplemented Figure 21-5. MSCAN Control Register 1 (CANCTL1) 1. Read: AnytimeWrite: Anytime when INITRQ = 1 and INITAK = 1, except CANE which is write once in normal and anytime in special system operation modes when the MSCAN is in initialization mode (INITRQ = 1 and INITAK = 1) Table 21-4. CANCTL1 Register Field Descriptions Field 7 CANE 6 CLKSRC MSCAN Enable 0 MSCAN module is disabled 1 MSCAN module is enabled MSCAN Clock Source — This bit deﬁnes the clock source for the MSCAN module (only for systems with a clock generation module; Section 21.4.3.2, “Clock System,” and Section Figure 21-42., “MSCAN Clocking Scheme,”). 0 MSCAN clock source is the oscillator clock 1 MSCAN clock source is the bus clock Loopback Self Test Mode — When this bit is set, the MSCAN performs an internal loopback which can be used for self test operation. The bit stream output of the transmitter is fed back to the receiver internally. The RXCAN input is ignored and the TXCAN output goes to the recessive state (logic 1). The MSCAN behaves as it does normally when transmitting and treats its own transmitted message as a message received from a remote node. In this state, the MSCAN ignores the bit sent during the ACK slot in the CAN frame acknowledge ﬁeld to ensure proper reception of its own message. Both transmit and receive interrupts are generated. 0 Loopback self test disabled 1 Loopback self test enabled Listen Only Mode — This bit conﬁgures the MSCAN as a CAN bus monitor. When LISTEN is set, all valid CAN messages with matching ID are received, but no acknowledgement or error frames are sent out (see Section 21.4.4.4, “Listen-Only Mode”). In addition, the error counters are frozen. Listen only mode supports applications which require “hot plugging” or throughput analysis. The MSCAN is unable to transmit any messages when listen only mode is active. 0 Normal operation 1 Listen only mode activated Wake-Up Mode — If WUPE in CANCTL0 is enabled, this bit deﬁnes whether the integrated low-pass ﬁlter is applied to protect the MSCAN from spurious wake-up (see Section 21.4.5.5, “MSCAN Sleep Mode”). 0 MSCAN wakes up on any dominant level on the CAN bus 1 MSCAN wakes up only in case of a dominant pulse on the CAN bus that has a length of Twup Description 5 LOOPB 4 LISTEN 2 WUPM MC9S12XF - Family Reference Manual, Rev.1.19 966 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-4. CANCTL1 Register Field Descriptions (continued) Field 1 SLPAK Description Sleep Mode Acknowledge — This ﬂag indicates whether the MSCAN module has entered sleep mode (see Section 21.4.5.5, “MSCAN Sleep Mode”). It is used as a handshake ﬂag for the SLPRQ sleep mode request. Sleep mode is active when SLPRQ = 1 and SLPAK = 1. Depending on the setting of WUPE, the MSCAN will clear the ﬂag if it detects activity on the CAN bus while in sleep mode. 0 Running — The MSCAN operates normally 1 Sleep mode active — The MSCAN has entered sleep mode Initialization Mode Acknowledge — This ﬂag indicates whether the MSCAN module is in initialization mode (see Section 21.4.4.5, “MSCAN Initialization Mode”). It is used as a handshake ﬂag for the INITRQ initialization mode request. Initialization mode is active when INITRQ = 1 and INITAK = 1. The registers CANCTL1, CANBTR0, CANBTR1, CANIDAC, CANIDAR0–CANIDAR7, and CANIDMR0–CANIDMR7 can be written only by the CPU when the MSCAN is in initialization mode. 0 Running — The MSCAN operates normally 1 Initialization mode active — The MSCAN has entered initialization mode 0 INITAK 21.3.2.3 MSCAN Bus Timing Register 0 (CANBTR0) The CANBTR0 register conﬁgures various CAN bus timing parameters of the MSCAN module. Module Base + 0x0002 7 6 5 4 3 2 Access: User read/write(1) 1 0 R SJW1 W Reset: 0 0 0 0 0 0 0 0 SJW0 BRP5 BRP4 BRP3 BRP2 BRP1 BRP0 Figure 21-6. MSCAN Bus Timing Register 0 (CANBTR0) 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table 21-5. CANBTR0 Register Field Descriptions Field 7-6 SJW[1:0] 5-0 BRP[5:0] Description Synchronization Jump Width — The synchronization jump width deﬁnes the maximum number of time quanta (Tq) clock cycles a bit can be shortened or lengthened to achieve resynchronization to data transitions on the CAN bus (see Table 21-6). Baud Rate Prescaler — These bits determine the time quanta (Tq) clock which is used to build up the bit timing (see Table 21-7). Table 21-6. Synchronization Jump Width SJW1 0 0 1 1 SJW0 0 1 0 1 Synchronization Jump Width 1 Tq clock cycle 2 Tq clock cycles 3 Tq clock cycles 4 Tq clock cycles MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 967 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-7. Baud Rate Prescaler BRP5 0 0 0 0 : 1 BRP4 0 0 0 0 : 1 BRP3 0 0 0 0 : 1 BRP2 0 0 0 0 : 1 BRP1 0 0 1 1 : 1 BRP0 0 1 0 1 : 1 Prescaler value (P) 1 2 3 4 : 64 21.3.2.4 MSCAN Bus Timing Register 1 (CANBTR1) The CANBTR1 register conﬁgures various CAN bus timing parameters of the MSCAN module. Module Base + 0x0003 7 6 5 4 3 2 Access: User read/write(1) 1 0 R SAMP W Reset: 0 0 0 0 0 0 0 0 TSEG22 TSEG21 TSEG20 TSEG13 TSEG12 TSEG11 TSEG10 Figure 21-7. MSCAN Bus Timing Register 1 (CANBTR1) 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table 21-8. CANBTR1 Register Field Descriptions Field 7 SAMP Description Sampling — This bit determines the number of CAN bus samples taken per bit time. 0 One sample per bit. 1 Three samples per bit(1). If SAMP = 0, the resulting bit value is equal to the value of the single bit positioned at the sample point. If SAMP = 1, the resulting bit value is determined by using majority rule on the three total samples. For higher bit rates, it is recommended that only one sample is taken per bit time (SAMP = 0). 6-4 Time Segment 2 — Time segments within the bit time ﬁx the number of clock cycles per bit time and the location TSEG2[2:0] of the sample point (see Figure 21-43). Time segment 2 (TSEG2) values are programmable as shown in Table 21-9. 3-0 Time Segment 1 — Time segments within the bit time ﬁx the number of clock cycles per bit time and the location TSEG1[3:0] of the sample point (see Figure 21-43). Time segment 1 (TSEG1) values are programmable as shown in Table 21-10. 1. In this case, PHASE_SEG1 must be at least 2 time quanta (Tq). MC9S12XF - Family Reference Manual, Rev.1.19 968 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-9. Time Segment 2 Values TSEG22 0 0 : 1 TSEG21 0 0 : 1 TSEG20 0 1 : 0 Time Segment 2 1 Tq clock cycle(1) 2 Tq clock cycles : 7 Tq clock cycles 1 1 1 8 Tq clock cycles 1. This setting is not valid. Please refer to Table 21-36 for valid settings. Table 21-10. Time Segment 1 Values TSEG13 0 0 0 0 : 1 TSEG12 0 0 0 0 : 1 TSEG11 0 0 1 1 : 1 TSEG10 0 1 0 1 : 0 Time segment 1 1 Tq clock cycle(1) 2 Tq clock cycles1 3 Tq clock cycles1 4 Tq clock cycles : 15 Tq clock cycles 1 1 1 1 16 Tq clock cycles 1. This setting is not valid. Please refer to Table 21-36 for valid settings. The bit time is determined by the oscillator frequency, the baud rate prescaler, and the number of time quanta (Tq) clock cycles per bit (as shown in Table 21-9 and Table 21-10). Eqn. 21-1 ( Prescaler value ) Bit Time = ----------------------------------------------------- • ( 1 + TimeSegment1 + TimeSegment2 ) f CANCLK 21.3.2.5 MSCAN Receiver Flag Register (CANRFLG) A ﬂag can be cleared only by software (writing a 1 to the corresponding bit position) when the condition which caused the setting is no longer valid. Every ﬂag has an associated interrupt enable bit in the CANRIER register. Module Base + 0x0004 7 6 5 4 3 2 Access: User read/write(1) 1 0 R WUPIF W Reset: 0 0 CSCIF RSTAT1 RSTAT0 TSTAT1 TSTAT0 OVRIF RXF 0 0 0 0 0 0 = Unimplemented Figure 21-8. MSCAN Receiver Flag Register (CANRFLG) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 969 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 1. Read: Anytime Write: Anytime when not in initialization mode, except RSTAT[1:0] and TSTAT[1:0] ﬂags which are read-only; write of 1 clears ﬂag; write of 0 is ignored NOTE The CANRFLG register is held in the reset state1 when the initialization mode is active (INITRQ = 1 and INITAK = 1). This register is writable again as soon as the initialization mode is exited (INITRQ = 0 and INITAK = 0). Table 21-11. CANRFLG Register Field Descriptions Field 7 WUPIF Description Wake-Up Interrupt Flag — If the MSCAN detects CAN bus activity while in sleep mode (see Section 21.4.5.5, “MSCAN Sleep Mode,”) and WUPE = 1 in CANTCTL0 (see Section 21.3.2.1, “MSCAN Control Register 0 (CANCTL0)”), the module will set WUPIF. If not masked, a wake-up interrupt is pending while this ﬂag is set. 0 No wake-up activity observed while in sleep mode 1 MSCAN detected activity on the CAN bus and requested wake-up CAN Status Change Interrupt Flag — This ﬂag is set when the MSCAN changes its current CAN bus status due to the actual value of the transmit error counter (TEC) and the receive error counter (REC). An additional 4bit (RSTAT[1:0], TSTAT[1:0]) status register, which is split into separate sections for TEC/REC, informs the system on the actual CAN bus status (see Section 21.3.2.6, “MSCAN Receiver Interrupt Enable Register (CANRIER)”). If not masked, an error interrupt is pending while this ﬂag is set. CSCIF provides a blocking interrupt. That guarantees that the receiver/transmitter status bits (RSTAT/TSTAT) are only updated when no CAN status change interrupt is pending. If the TECs/RECs change their current value after the CSCIF is asserted, which would cause an additional state change in the RSTAT/TSTAT bits, these bits keep their status until the current CSCIF interrupt is cleared again. 0 No change in CAN bus status occurred since last interrupt 1 MSCAN changed current CAN bus status Receiver Status Bits — The values of the error counters control the actual CAN bus status of the MSCAN. As soon as the status change interrupt ﬂag (CSCIF) is set, these bits indicate the appropriate receiver related CAN bus status of the MSCAN. The coding for the bits RSTAT1, RSTAT0 is: 00 RxOK: 0 ≤ receive error counter ≤ 96 01 RxWRN: 96 < receive error counter ≤ 127 10 RxERR: 127 < receive error counter 11 Bus-off(1): transmit error counter > 255 Transmitter Status Bits — The values of the error counters control the actual CAN bus status of the MSCAN. As soon as the status change interrupt ﬂag (CSCIF) is set, these bits indicate the appropriate transmitter related CAN bus status of the MSCAN. The coding for the bits TSTAT1, TSTAT0 is: 00 TxOK: 0 ≤ transmit error counter ≤ 96 01 TxWRN: 96 < transmit error counter ≤ 127 10 TxERR: 127 < transmit error counter ≤ 255 11 Bus-Off: transmit error counter > 255 6 CSCIF 5-4 RSTAT[1:0] 3-2 TSTAT[1:0] 1. The RSTAT[1:0], TSTAT[1:0] bits are not affected by initialization mode. MC9S12XF - Family Reference Manual, Rev.1.19 970 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-11. CANRFLG Register Field Descriptions (continued) Field 1 OVRIF Description Overrun Interrupt Flag — This ﬂag is set when a data overrun condition occurs. If not masked, an error interrupt is pending while this ﬂag is set. 0 No data overrun condition 1 A data overrun detected Receive Buffer Full Flag — RXF is set by the MSCAN when a new message is shifted in the receiver FIFO. This ﬂag indicates whether the shifted buffer is loaded with a correctly received message (matching identiﬁer, matching cyclic redundancy code (CRC) and no other errors detected). After the CPU has read that message from the RxFG buffer in the receiver FIFO, the RXF ﬂag must be cleared to release the buffer. A set RXF ﬂag prohibits the shifting of the next FIFO entry into the foreground buffer (RxFG). If not masked, a receive interrupt is pending while this ﬂag is set. 0 No new message available within the RxFG 1 The receiver FIFO is not empty. A new message is available in the RxFG 1. Redundant Information for the most critical CAN bus status which is “bus-off”. This only occurs if the Tx error counter exceeds a number of 255 errors. Bus-off affects the receiver state. As soon as the transmitter leaves its bus-off state the receiver state skips to RxOK too. Refer also to TSTAT[1:0] coding in this register. 2. To ensure data integrity, do not read the receive buffer registers while the RXF ﬂag is cleared. For MCUs with dual CPUs, reading the receive buffer registers while the RXF ﬂag is cleared may result in a CPU fault condition. 0 RXF(2) 21.3.2.6 MSCAN Receiver Interrupt Enable Register (CANRIER) Access: User read/write(1) 6 5 4 3 2 1 0 This register contains the interrupt enable bits for the interrupt ﬂags described in the CANRFLG register. Module Base + 0x0005 7 R WUPIE W Reset: 0 0 0 0 0 0 0 0 CSCIE RSTATE1 RSTATE0 TSTATE1 TSTATE0 OVRIE RXFIE Figure 21-9. MSCAN Receiver Interrupt Enable Register (CANRIER) 1. Read: Anytime Write: Anytime when not in initialization mode NOTE The CANRIER register is held in the reset state when the initialization mode is active (INITRQ=1 and INITAK=1). This register is writable when not in initialization mode (INITRQ=0 and INITAK=0). The RSTATE[1:0], TSTATE[1:0] bits are not affected by initialization mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 971 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-12. CANRIER Register Field Descriptions Field 7 WUPIE(1) 6 CSCIE Description Wake-Up Interrupt Enable 0 No interrupt request is generated from this event. 1 A wake-up event causes a Wake-Up interrupt request. CAN Status Change Interrupt Enable 0 No interrupt request is generated from this event. 1 A CAN Status Change event causes an error interrupt request. 5-4 Receiver Status Change Enable — These RSTAT enable bits control the sensitivity level in which receiver state RSTATE[1:0] changes are causing CSCIF interrupts. Independent of the chosen sensitivity level the RSTAT ﬂags continue to indicate the actual receiver state and are only updated if no CSCIF interrupt is pending. 00 Do not generate any CSCIF interrupt caused by receiver state changes. 01 Generate CSCIF interrupt only if the receiver enters or leaves “bus-off” state. Discard other receiver state changes for generating CSCIF interrupt. 10 Generate CSCIF interrupt only if the receiver enters or leaves “RxErr” or “bus-off”(2) state. Discard other receiver state changes for generating CSCIF interrupt. 11 Generate CSCIF interrupt on all state changes. 3-2 Transmitter Status Change Enable — These TSTAT enable bits control the sensitivity level in which transmitter TSTATE[1:0] state changes are causing CSCIF interrupts. Independent of the chosen sensitivity level, the TSTAT ﬂags continue to indicate the actual transmitter state and are only updated if no CSCIF interrupt is pending. 00 Do not generate any CSCIF interrupt caused by transmitter state changes. 01 Generate CSCIF interrupt only if the transmitter enters or leaves “bus-off” state. Discard other transmitter state changes for generating CSCIF interrupt. 10 Generate CSCIF interrupt only if the transmitter enters or leaves “TxErr” or “bus-off” state. Discard other transmitter state changes for generating CSCIF interrupt. 11 Generate CSCIF interrupt on all state changes. 1 OVRIE 0 RXFIE Overrun Interrupt Enable 0 No interrupt request is generated from this event. 1 An overrun event causes an error interrupt request. Receiver Full Interrupt Enable 0 No interrupt request is generated from this event. 1 A receive buffer full (successful message reception) event causes a receiver interrupt request. 1. WUPIE and WUPE (see Section 21.3.2.1, “MSCAN Control Register 0 (CANCTL0)”) must both be enabled if the recovery mechanism from stop or wait is required. 2. Bus-off state is only deﬁned for transmitters by the CAN standard (see Bosch CAN 2.0A/B protocol speciﬁcation). Because the only possible state change for the transmitter from bus-off to TxOK also forces the receiver to skip its current state to RxOK, the coding of the RXSTAT[1:0] ﬂags deﬁne an additional bus-off state for the receiver (see Section 21.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)”). 21.3.2.7 MSCAN Transmitter Flag Register (CANTFLG) The transmit buffer empty ﬂags each have an associated interrupt enable bit in the CANTIER register. MC9S12XF - Family Reference Manual, Rev.1.19 972 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x0006 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 0 0 0 TXE2 TXE1 1 TXE0 1 0 0 0 0 0 1 = Unimplemented Figure 21-10. MSCAN Transmitter Flag Register (CANTFLG) 1. Read: Anytime Write: Anytime when not in initialization mode; write of 1 clears ﬂag, write of 0 is ignored NOTE The CANTFLG register is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). This register is writable when not in initialization mode (INITRQ = 0 and INITAK = 0). Table 21-13. CANTFLG Register Field Descriptions Field 2-0 TXE[2:0] Description Transmitter Buffer Empty — This ﬂag indicates that the associated transmit message buffer is empty, and thus not scheduled for transmission. The CPU must clear the ﬂag after a message is set up in the transmit buffer and is due for transmission. The MSCAN sets the ﬂag after the message is sent successfully. The ﬂag is also set by the MSCAN when the transmission request is successfully aborted due to a pending abort request (see Section 21.3.2.9, “MSCAN Transmitter Message Abort Request Register (CANTARQ)”). If not masked, a transmit interrupt is pending while this ﬂag is set. Clearing a TXEx ﬂag also clears the corresponding ABTAKx (see Section 21.3.2.10, “MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK)”). When a TXEx ﬂag is set, the corresponding ABTRQx bit is cleared (see Section 21.3.2.9, “MSCAN Transmitter Message Abort Request Register (CANTARQ)”). When listen-mode is active (see Section 21.3.2.2, “MSCAN Control Register 1 (CANCTL1)”) the TXEx ﬂags cannot be cleared and no transmission is started. Read and write accesses to the transmit buffer will be blocked, if the corresponding TXEx bit is cleared (TXEx = 0) and the buffer is scheduled for transmission. 0 The associated message buffer is full (loaded with a message due for transmission) 1 The associated message buffer is empty (not scheduled) 21.3.2.8 MSCAN Transmitter Interrupt Enable Register (CANTIER) This register contains the interrupt enable bits for the transmit buffer empty interrupt ﬂags. Module Base + 0x0007 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 0 0 0 TXEIE2 TXEIE1 0 TXEIE0 0 0 0 0 0 0 0 = Unimplemented Figure 21-11. MSCAN Transmitter Interrupt Enable Register (CANTIER) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 973 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 1. Read: Anytime Write: Anytime when not in initialization mode NOTE The CANTIER register is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). This register is writable when not in initialization mode (INITRQ = 0 and INITAK = 0). Table 21-14. CANTIER Register Field Descriptions Field 2-0 TXEIE[2:0] Description Transmitter Empty Interrupt Enable 0 No interrupt request is generated from this event. 1 A transmitter empty (transmit buffer available for transmission) event causes a transmitter empty interrupt request. 21.3.2.9 MSCAN Transmitter Message Abort Request Register (CANTARQ) The CANTARQ register allows abort request of queued messages as described below. Module Base + 0x0008 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 0 0 0 ABTRQ2 ABTRQ1 0 ABTRQ0 0 0 0 0 0 0 0 = Unimplemented Figure 21-12. MSCAN Transmitter Message Abort Request Register (CANTARQ) 1. Read: Anytime Write: Anytime when not in initialization mode NOTE The CANTARQ register is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). This register is writable when not in initialization mode (INITRQ = 0 and INITAK = 0). Table 21-15. CANTARQ Register Field Descriptions Field Description 2-0 Abort Request — The CPU sets the ABTRQx bit to request that a scheduled message buffer (TXEx = 0) be ABTRQ[2:0] aborted. The MSCAN grants the request if the message has not already started transmission, or if the transmission is not successful (lost arbitration or error). When a message is aborted, the associated TXE (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and abort acknowledge ﬂags (ABTAK, see Section 21.3.2.10, “MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK)”) are set and a transmit interrupt occurs if enabled. The CPU cannot reset ABTRQx. ABTRQx is reset whenever the associated TXE ﬂag is set. 0 No abort request 1 Abort request pending MC9S12XF - Family Reference Manual, Rev.1.19 974 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.3.2.10 MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK) The CANTAAK register indicates the successful abort of a queued message, if requested by the appropriate bits in the CANTARQ register. Module Base + 0x0009 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 0 0 0 ABTAK2 ABTAK1 ABTAK0 0 0 0 0 0 0 0 0 = Unimplemented Figure 21-13. MSCAN Transmitter Message Abort Acknowledge Register (CANTAAK) 1. Read: Anytime Write: Unimplemented NOTE The CANTAAK register is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK = 1). Table 21-16. CANTAAK Register Field Descriptions Field Description 2-0 Abort Acknowledge — This ﬂag acknowledges that a message was aborted due to a pending abort request ABTAK[2:0] from the CPU. After a particular message buffer is ﬂagged empty, this ﬂag can be used by the application software to identify whether the message was aborted successfully or was sent anyway. The ABTAKx ﬂag is cleared whenever the corresponding TXE ﬂag is cleared. 0 The message was not aborted. 1 The message was aborted. 21.3.2.11 MSCAN Transmit Buffer Selection Register (CANTBSEL) The CANTBSEL register allows the selection of the actual transmit message buffer, which then will be accessible in the CANTXFG register space. Module Base + 0x000A 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 0 0 0 TX2 TX1 0 TX0 0 0 0 0 0 0 0 = Unimplemented Figure 21-14. MSCAN Transmit Buffer Selection Register (CANTBSEL) 1. Read: Find the lowest ordered bit set to 1, all other bits will be read as 0 Write: Anytime when not in initialization mode MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 975 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) NOTE The CANTBSEL register is held in the reset state when the initialization mode is active (INITRQ = 1 and INITAK=1). This register is writable when not in initialization mode (INITRQ = 0 and INITAK = 0). Table 21-17. CANTBSEL Register Field Descriptions Field 2-0 TX[2:0] Description Transmit Buffer Select — The lowest numbered bit places the respective transmit buffer in the CANTXFG register space (e.g., TX1 = 1 and TX0 = 1 selects transmit buffer TX0; TX1 = 1 and TX0 = 0 selects transmit buffer TX1). Read and write accesses to the selected transmit buffer will be blocked, if the corresponding TXEx bit is cleared and the buffer is scheduled for transmission (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”). 0 The associated message buffer is deselected 1 The associated message buffer is selected, if lowest numbered bit The following gives a short programming example of the usage of the CANTBSEL register: To get the next available transmit buffer, application software must read the CANTFLG register and write this value back into the CANTBSEL register. In this example Tx buffers TX1 and TX2 are available. The value read from CANTFLG is therefore 0b0000_0110. When writing this value back to CANTBSEL, the Tx buffer TX1 is selected in the CANTXFG because the lowest numbered bit set to 1 is at bit position 1. Reading back this value out of CANTBSEL results in 0b0000_0010, because only the lowest numbered bit position set to 1 is presented. This mechanism eases the application software’s selection of the next available Tx buffer. • LDAA CANTFLG; value read is 0b0000_0110 • STAA CANTBSEL; value written is 0b0000_0110 • LDAA CANTBSEL; value read is 0b0000_0010 If all transmit message buffers are deselected, no accesses are allowed to the CANTXFG registers. 21.3.2.12 MSCAN Identiﬁer Acceptance Control Register (CANIDAC) The CANIDAC register is used for identiﬁer acceptance control as described below. Module Base + 0x000B 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 IDAM1 IDAM0 0 0 IDHIT2 IDHIT1 IDHIT0 0 0 0 0 0 0 0 = Unimplemented Figure 21-15. MSCAN Identiﬁer Acceptance Control Register (CANIDAC) 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1), except bits IDHITx, which are read-only MC9S12XF - Family Reference Manual, Rev.1.19 976 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-18. CANIDAC Register Field Descriptions Field 5-4 IDAM[1:0] 2-0 IDHIT[2:0] Description Identiﬁer Acceptance Mode — The CPU sets these ﬂags to deﬁne the identiﬁer acceptance ﬁlter organization (see Section 21.4.3, “Identiﬁer Acceptance Filter”). Table 21-19 summarizes the different settings. In ﬁlter closed mode, no message is accepted such that the foreground buffer is never reloaded. Identiﬁer Acceptance Hit Indicator — The MSCAN sets these ﬂags to indicate an identiﬁer acceptance hit (see Section 21.4.3, “Identiﬁer Acceptance Filter”). Table 21-20 summarizes the different settings. Table 21-19. Identiﬁer Acceptance Mode Settings IDAM1 0 0 1 1 IDAM0 0 1 0 1 Identiﬁer Acceptance Mode Two 32-bit acceptance ﬁlters Four 16-bit acceptance ﬁlters Eight 8-bit acceptance ﬁlters Filter closed Table 21-20. Identiﬁer Acceptance Hit Indication IDHIT2 0 0 0 0 1 1 1 1 IDHIT1 0 0 1 1 0 0 1 1 IDHIT0 0 1 0 1 0 1 0 1 Identiﬁer Acceptance Hit Filter 0 hit Filter 1 hit Filter 2 hit Filter 3 hit Filter 4 hit Filter 5 hit Filter 6 hit Filter 7 hit The IDHITx indicators are always related to the message in the foreground buffer (RxFG). When a message gets shifted into the foreground buffer of the receiver FIFO the indicators are updated as well. 21.3.2.13 MSCAN Reserved Registers These registers are reserved for factory testing of the MSCAN module and is not available in normal system operating modes. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 977 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x000C to Module Base + 0x000D 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented Figure 21-16. MSCAN Reserved Registers 1. Read: Always reads zero in normal system operation modes Write: Unimplemented in normal system operation modes NOTE Writing to this register when in special system operating modes can alter the MSCAN functionality. 21.3.2.14 MSCAN Receive Error Counter (CANRXERR) This register reﬂects the status of the MSCAN receive error counter. Module Base + 0x000E 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: RXERR7 RXERR6 RXERR5 RXERR4 RXERR3 RXERR2 RXERR1 RXERR0 0 0 0 0 0 0 0 0 = Unimplemented Figure 21-17. MSCAN Receive Error Counter (CANRXERR) 1. Read: Only when in sleep mode (SLPRQ = 1 and SLPAK = 1) or initialization mode (INITRQ = 1 and INITAK = 1) Write: Unimplemented NOTE Reading this register when in any other mode other than sleep or initialization mode may return an incorrect value. For MCUs with dual CPUs, this may result in a CPU fault condition. Writing to this register when in special modes can alter the MSCAN functionality. MC9S12XF - Family Reference Manual, Rev.1.19 978 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.3.2.15 MSCAN Transmit Error Counter (CANTXERR) This register reﬂects the status of the MSCAN transmit error counter. Module Base + 0x000F 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: TXERR7 TXERR6 TXERR5 TXERR4 TXERR3 TXERR2 TXERR1 TXERR0 0 0 0 0 0 0 0 0 = Unimplemented Figure 21-18. MSCAN Transmit Error Counter (CANTXERR) 1. Read: Only when in sleep mode (SLPRQ = 1 and SLPAK = 1) or initialization mode (INITRQ = 1 and INITAK = 1) Write: Unimplemented NOTE Reading this register when in any other mode other than sleep or initialization mode, may return an incorrect value. For MCUs with dual CPUs, this may result in a CPU fault condition. Writing to this register when in special modes can alter the MSCAN functionality. 21.3.2.16 MSCAN Identiﬁer Acceptance Registers (CANIDAR0-7) On reception, each message is written into the background receive buffer. The CPU is only signalled to read the message if it passes the criteria in the identiﬁer acceptance and identiﬁer mask registers (accepted); otherwise, the message is overwritten by the next message (dropped). The acceptance registers of the MSCAN are applied on the IDR0–IDR3 registers (see Section 21.3.3.1, “Identiﬁer Registers (IDR0–IDR3)”) of incoming messages in a bit by bit manner (see Section 21.4.3, “Identiﬁer Acceptance Filter”). For extended identiﬁers, all four acceptance and mask registers are applied. For standard identiﬁers, only the ﬁrst two (CANIDAR0/1, CANIDMR0/1) are applied. Module Base + 0x0010 to Module Base + 0x0013 7 6 5 4 3 2 Access: User read/write(1) 1 0 R AC7 W Reset 0 0 0 0 0 0 0 0 AC6 AC5 AC4 AC3 AC2 AC1 AC0 Figure 21-19. MSCAN Identiﬁer Acceptance Registers (First Bank) — CANIDAR0–CANIDAR3 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 979 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-21. CANIDAR0–CANIDAR3 Register Field Descriptions Field 7-0 AC[7:0] Description Acceptance Code Bits — AC[7:0] comprise a user-deﬁned sequence of bits with which the corresponding bits of the related identiﬁer register (IDRn) of the receive message buffer are compared. The result of this comparison is then masked with the corresponding identiﬁer mask register. Module Base + 0x0018 to Module Base + 0x001B 7 6 5 4 3 2 Access: User read/write(1) 1 0 R AC7 W Reset 0 0 0 0 0 0 0 0 AC6 AC5 AC4 AC3 AC2 AC1 AC0 Figure 21-20. MSCAN Identiﬁer Acceptance Registers (Second Bank) — CANIDAR4–CANIDAR7 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table 21-22. CANIDAR4–CANIDAR7 Register Field Descriptions Field 7-0 AC[7:0] Description Acceptance Code Bits — AC[7:0] comprise a user-deﬁned sequence of bits with which the corresponding bits of the related identiﬁer register (IDRn) of the receive message buffer are compared. The result of this comparison is then masked with the corresponding identiﬁer mask register. 21.3.2.17 MSCAN Identiﬁer Mask Registers (CANIDMR0–CANIDMR7) The identiﬁer mask register speciﬁes which of the corresponding bits in the identiﬁer acceptance register are relevant for acceptance ﬁltering. To receive standard identiﬁers in 32 bit ﬁlter mode, it is required to program the last three bits (AM[2:0]) in the mask registers CANIDMR1 and CANIDMR5 to “don’t care.” To receive standard identiﬁers in 16 bit ﬁlter mode, it is required to program the last three bits (AM[2:0]) in the mask registers CANIDMR1, CANIDMR3, CANIDMR5, and CANIDMR7 to “don’t care.” Module Base + 0x0014 to Module Base + 0x0017 7 6 5 4 3 2 Access: User read/write(1) 1 0 R AM7 W Reset 0 0 0 0 0 0 0 0 AM6 AM5 AM4 AM3 AM2 AM1 AM0 Figure 21-21. MSCAN Identiﬁer Mask Registers (First Bank) — CANIDMR0–CANIDMR3 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) MC9S12XF - Family Reference Manual, Rev.1.19 980 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-23. CANIDMR0–CANIDMR3 Register Field Descriptions Field 7-0 AM[7:0] Description Acceptance Mask Bits — If a particular bit in this register is cleared, this indicates that the corresponding bit in the identiﬁer acceptance register must be the same as its identiﬁer bit before a match is detected. The message is accepted if all such bits match. If a bit is set, it indicates that the state of the corresponding bit in the identiﬁer acceptance register does not affect whether or not the message is accepted. 0 Match corresponding acceptance code register and identiﬁer bits 1 Ignore corresponding acceptance code register bit Module Base + 0x001C to Module Base + 0x001F 7 6 5 4 3 2 Access: User read/write(1) 1 0 R AM7 W Reset 0 0 0 0 0 0 0 0 AM6 AM5 AM4 AM3 AM2 AM1 AM0 Figure 21-22. MSCAN Identiﬁer Mask Registers (Second Bank) — CANIDMR4–CANIDMR7 1. Read: Anytime Write: Anytime in initialization mode (INITRQ = 1 and INITAK = 1) Table 21-24. CANIDMR4–CANIDMR7 Register Field Descriptions Field 7-0 AM[7:0] Description Acceptance Mask Bits — If a particular bit in this register is cleared, this indicates that the corresponding bit in the identiﬁer acceptance register must be the same as its identiﬁer bit before a match is detected. The message is accepted if all such bits match. If a bit is set, it indicates that the state of the corresponding bit in the identiﬁer acceptance register does not affect whether or not the message is accepted. 0 Match corresponding acceptance code register and identiﬁer bits 1 Ignore corresponding acceptance code register bit 21.3.3 Programmer’s Model of Message Storage The following section details the organization of the receive and transmit message buffers and the associated control registers. To simplify the programmer interface, the receive and transmit message buffers have the same outline. Each message buffer allocates 16 bytes in the memory map containing a 13 byte data structure. An additional transmit buffer priority register (TBPR) is deﬁned for the transmit buffers. Within the last two bytes of this memory map, the MSCAN stores a special 16-bit time stamp, which is sampled from an internal timer after successful transmission or reception of a message. This feature is only available for transmit and receiver buffers, if the TIME bit is set (see Section 21.3.2.1, “MSCAN Control Register 0 (CANCTL0)”). The time stamp register is written by the MSCAN. The CPU can only read these registers. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 981 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-25. Message Buffer Organization Offset Address 0x00X0 0x00X1 0x00X2 0x00X3 0x00X4 0x00X5 0x00X6 0x00X7 0x00X8 0x00X9 0x00XA 0x00XB 0x00XC 0x00XD 0x00XE Identiﬁer Register 0 Identiﬁer Register 1 Identiﬁer Register 2 Identiﬁer Register 3 Data Segment Register 0 Data Segment Register 1 Data Segment Register 2 Data Segment Register 3 Data Segment Register 4 Data Segment Register 5 Data Segment Register 6 Data Segment Register 7 Data Length Register Transmit Buffer Priority Register (1) Register Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R R Time Stamp Register (High Byte) 0x00XF Time Stamp Register (Low Byte) 1. Not applicable for receive buffers Figure 21-23 shows the common 13-byte data structure of receive and transmit buffers for extended identiﬁers. The mapping of standard identiﬁers into the IDR registers is shown in Figure 21-24. All bits of the receive and transmit buffers are ‘x’ out of reset because of RAM-based implementation1. All reserved or unused bits of the receive and transmit buffers always read ‘x’. 1. Exception: The transmit buffer priority registers are 0 out of reset. MC9S12XF - Family Reference Manual, Rev.1.19 982 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Figure 21-23. Receive/Transmit Message Buffer — Extended Identiﬁer Mapping Register Name 0x00X0 IDR0 R ID28 W R ID20 W R ID14 W R ID6 W R DB7 W R DB7 W R DB7 W R DB7 W R DB7 W R DB7 W R DB7 W R DB7 W R DLC3 W DLC2 DLC1 DLC0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DB6 DB5 DB4 DB3 DB2 DB1 DB0 ID5 ID4 ID3 ID2 ID1 ID0 RTR ID13 ID12 ID11 ID10 ID9 ID8 ID7 ID19 ID18 SRR (=1) IDE (=1) ID17 ID16 ID15 ID27 ID26 ID25 ID24 ID23 ID22 ID21 Bit 7 6 5 4 3 2 1 Bit0 0x00X1 IDR1 0x00X2 IDR2 0x00X3 IDR3 0x00X4 DSR0 0x00X5 DSR1 0x00X6 DSR2 0x00X7 DSR3 0x00X8 DSR4 0x00X9 DSR5 0x00XA DSR6 0x00XB DSR7 0x00XC DLR MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 983 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Figure 21-23. Receive/Transmit Message Buffer — Extended Identiﬁer Mapping (continued) Register Name Bit 7 6 5 4 3 2 1 Bit0 = Unused, always read ‘x’ Read: • For transmit buffers, anytime when TXEx ﬂag is set (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). • For receive buffers, only when RXF ﬂag is set (see Section 21.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)”). Write: • For transmit buffers, anytime when TXEx ﬂag is set (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). Unimplemented for receive buffers. • Reset: Undeﬁned because of RAM-based implementation Figure 21-24. Receive/Transmit Message Buffer — Standard Identiﬁer Mapping Register Name IDR0 0x00X0 R ID10 W R ID2 W R W R W ID1 ID0 RTR IDE (=0) ID9 ID8 ID7 ID6 ID5 ID4 ID3 Bit 7 6 5 4 3 2 1 Bit 0 IDR1 0x00X1 IDR2 0x00X2 IDR3 0x00X3 = Unused, always read ‘x’ 21.3.3.1 Identiﬁer Registers (IDR0–IDR3) The identiﬁer registers for an extended format identiﬁer consist of a total of 32 bits: ID[28:0], SRR, IDE, and RTR. The identiﬁer registers for a standard format identiﬁer consist of a total of 13 bits: ID[10:0], RTR, and IDE. MC9S12XF - Family Reference Manual, Rev.1.19 984 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.3.3.1.1 IDR0–IDR3 for Extended Identiﬁer Mapping Module Base + 0x00X0 7 6 5 4 3 2 1 0 R ID28 W Reset: x x x x x x x x ID27 ID26 ID25 ID24 ID23 ID22 ID21 Figure 21-25. Identiﬁer Register 0 (IDR0) — Extended Identiﬁer Mapping Table 21-26. IDR0 Register Field Descriptions — Extended Field 7-0 ID[28:21] Description Extended Format Identiﬁer — The identiﬁers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. Module Base + 0x00X1 7 6 5 4 3 2 1 0 R ID20 W Reset: x x x x x x x x ID19 ID18 SRR (=1) IDE (=1) ID17 ID16 ID15 Figure 21-26. Identiﬁer Register 1 (IDR1) — Extended Identiﬁer Mapping Table 21-27. IDR1 Register Field Descriptions — Extended Field 7-5 ID[20:18] 4 SRR 3 IDE Description Extended Format Identiﬁer — The identiﬁers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. Substitute Remote Request — This ﬁxed recessive bit is used only in extended format. It must be set to 1 by the user for transmission buffers and is stored as received on the CAN bus for receive buffers. ID Extended — This ﬂag indicates whether the extended or standard identiﬁer format is applied in this buffer. In the case of a receive buffer, the ﬂag is set as received and indicates to the CPU how to process the buffer identiﬁer registers. In the case of a transmit buffer, the ﬂag indicates to the MSCAN what type of identiﬁer to send. 0 Standard format (11 bit) 1 Extended format (29 bit) Extended Format Identiﬁer — The identiﬁers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. 2-0 ID[17:15] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 985 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00X2 7 6 5 4 3 2 1 0 R ID14 W Reset: x x x x x x x x ID13 ID12 ID11 ID10 ID9 ID8 ID7 Figure 21-27. Identiﬁer Register 2 (IDR2) — Extended Identiﬁer Mapping Table 21-28. IDR2 Register Field Descriptions — Extended Field 7-0 ID[14:7] Description Extended Format Identiﬁer — The identiﬁers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. Module Base + 0x00X3 7 6 5 4 3 2 1 0 R ID6 W Reset: x x x x x x x x ID5 ID4 ID3 ID2 ID1 ID0 RTR Figure 21-28. Identiﬁer Register 3 (IDR3) — Extended Identiﬁer Mapping Table 21-29. IDR3 Register Field Descriptions — Extended Field 7-1 ID[6:0] 0 RTR Description Extended Format Identiﬁer — The identiﬁers consist of 29 bits (ID[28:0]) for the extended format. ID28 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. Remote Transmission Request — This ﬂag reﬂects the status of the remote transmission request bit in the CAN frame. In the case of a receive buffer, it indicates the status of the received frame and supports the transmission of an answering frame in software. In the case of a transmit buffer, this ﬂag deﬁnes the setting of the RTR bit to be sent. 0 Data frame 1 Remote frame MC9S12XF - Family Reference Manual, Rev.1.19 986 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.3.3.1.2 IDR0–IDR3 for Standard Identiﬁer Mapping Module Base + 0x00X0 7 6 5 4 3 2 1 0 R ID10 W Reset: x x x x x x x x ID9 ID8 ID7 ID6 ID5 ID4 ID3 Figure 21-29. Identiﬁer Register 0 — Standard Mapping Table 21-30. IDR0 Register Field Descriptions — Standard Field 7-0 ID[10:3] Description Standard Format Identiﬁer — The identiﬁers consist of 11 bits (ID[10:0]) for the standard format. ID10 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. See also ID bits in Table 21-31. Module Base + 0x00X1 7 6 5 4 3 2 1 0 R ID2 W Reset: x x x x x x x x ID1 ID0 RTR IDE (=0) = Unused; always read ‘x’ Figure 21-30. Identiﬁer Register 1 — Standard Mapping Table 21-31. IDR1 Register Field Descriptions Field 7-5 ID[2:0] 4 RTR Description Standard Format Identiﬁer — The identiﬁers consist of 11 bits (ID[10:0]) for the standard format. ID10 is the most signiﬁcant bit and is transmitted ﬁrst on the CAN bus during the arbitration procedure. The priority of an identiﬁer is deﬁned to be highest for the smallest binary number. See also ID bits in Table 21-30. Remote Transmission Request — This ﬂag reﬂects the status of the Remote Transmission Request bit in the CAN frame. In the case of a receive buffer, it indicates the status of the received frame and supports the transmission of an answering frame in software. In the case of a transmit buffer, this ﬂag deﬁnes the setting of the RTR bit to be sent. 0 Data frame 1 Remote frame ID Extended — This ﬂag indicates whether the extended or standard identiﬁer format is applied in this buffer. In the case of a receive buffer, the ﬂag is set as received and indicates to the CPU how to process the buffer identiﬁer registers. In the case of a transmit buffer, the ﬂag indicates to the MSCAN what type of identiﬁer to send. 0 Standard format (11 bit) 1 Extended format (29 bit) 3 IDE MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 987 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00X2 7 6 5 4 3 2 1 0 R W Reset: x x x x x x x x = Unused; always read ‘x’ Figure 21-31. Identiﬁer Register 2 — Standard Mapping Module Base + 0x00X3 7 6 5 4 3 2 1 0 R W Reset: x x x x x x x x = Unused; always read ‘x’ Figure 21-32. Identiﬁer Register 3 — Standard Mapping 21.3.3.2 Data Segment Registers (DSR0-7) The eight data segment registers, each with bits DB[7:0], contain the data to be transmitted or received. The number of bytes to be transmitted or received is determined by the data length code in the corresponding DLR register. Module Base + 0x00X4 to Module Base + 0x00XB 7 6 5 4 3 2 1 0 R DB7 W Reset: x x x x x x x x DB6 DB5 DB4 DB3 DB2 DB1 DB0 Figure 21-33. Data Segment Registers (DSR0–DSR7) — Extended Identiﬁer Mapping Table 21-32. DSR0–DSR7 Register Field Descriptions Field 7-0 DB[7:0] Data bits 7-0 Description MC9S12XF - Family Reference Manual, Rev.1.19 988 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.3.3.3 Data Length Register (DLR) This register keeps the data length ﬁeld of the CAN frame. Module Base + 0x00XC 7 6 5 4 3 2 1 0 R DLC3 W Reset: x x x x x x x x DLC2 DLC1 DLC0 = Unused; always read “x” Figure 21-34. Data Length Register (DLR) — Extended Identiﬁer Mapping Table 21-33. DLR Register Field Descriptions Field 3-0 DLC[3:0] Description Data Length Code Bits — The data length code contains the number of bytes (data byte count) of the respective message. During the transmission of a remote frame, the data length code is transmitted as programmed while the number of transmitted data bytes is always 0. The data byte count ranges from 0 to 8 for a data frame. Table 21-34 shows the effect of setting the DLC bits. Table 21-34. Data Length Codes Data Length Code DLC3 0 0 0 0 0 0 0 0 1 DLC2 0 0 0 0 1 1 1 1 0 DLC1 0 0 1 1 0 0 1 1 0 DLC0 0 1 0 1 0 1 0 1 0 Data Byte Count 0 1 2 3 4 5 6 7 8 21.3.3.4 Transmit Buffer Priority Register (TBPR) This register deﬁnes the local priority of the associated message buffer. The local priority is used for the internal prioritization process of the MSCAN and is deﬁned to be highest for the smallest binary number. The MSCAN implements the following internal prioritization mechanisms: • All transmission buffers with a cleared TXEx ﬂag participate in the prioritization immediately before the SOF (start of frame) is sent. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 989 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) • The transmission buffer with the lowest local priority ﬁeld wins the prioritization. In cases of more than one buffer having the same lowest priority, the message buffer with the lower index number wins. Module Base + 0x00XD 7 6 5 4 3 2 Access: User read/write(1) 1 0 R PRIO7 W Reset: 0 0 0 0 0 0 0 0 PRIO6 PRIO5 PRIO4 PRIO3 PRIO2 PRIO1 PRIO0 Figure 21-35. Transmit Buffer Priority Register (TBPR) 1. Read: Anytime when TXEx ﬂag is set (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”) Write: Anytime when TXEx ﬂag is set (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”) 21.3.3.5 Time Stamp Register (TSRH–TSRL) If the TIME bit is enabled, the MSCAN will write a time stamp to the respective registers in the active transmit or receive buffer right after the EOF of a valid message on the CAN bus (see Section 21.3.2.1, “MSCAN Control Register 0 (CANCTL0)”). In case of a transmission, the CPU can only read the time stamp after the respective transmit buffer has been ﬂagged empty. The timer value, which is used for stamping, is taken from a free running internal CAN bit clock. A timer overrun is not indicated by the MSCAN. The timer is reset (all bits set to 0) during initialization mode. The CPU can only read the time stamp registers. Module Base + 0x00XE 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: TSR15 TSR14 TSR13 TSR12 TSR11 TSR10 TSR9 TSR8 x x x x x x x x Figure 21-36. Time Stamp Register — High Byte (TSRH) 1. Read: Anytime when TXEx ﬂag is set (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”) Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 990 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Module Base + 0x00XF 7 6 5 4 3 2 Access: User read/write(1) 1 0 R W Reset: TSR7 TSR6 TSR5 TSR4 TSR3 TSR2 TSR1 TSR0 x x x x x x x x Figure 21-37. Time Stamp Register — Low Byte (TSRL) 1. Read: Anytime when TXEx ﬂag is set (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”) and the corresponding transmit buffer is selected in CANTBSEL (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”) Write: Unimplemented MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 991 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.4 21.4.1 Functional Description General This section provides a complete functional description of the MSCAN. 21.4.2 Message Storage CAN Receive / Transmit Engine Memory Mapped I/O Rx0 Rx1 Rx2 Rx3 Rx4 RXF RxBG MSCAN Receiver Tx0 RxFG CPU bus TXE0 TxBG Tx1 PRIO TXE1 TxFG MSCAN CPU bus PRIO Tx2 TXE2 Transmitter TxBG PRIO Figure 21-38. User Model for Message Buffer Organization MC9S12XF - Family Reference Manual, Rev.1.19 992 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) The MSCAN facilitates a sophisticated message storage system which addresses the requirements of a broad range of network applications. 21.4.2.1 Message Transmit Background Modern application layer software is built upon two fundamental assumptions: • Any CAN node is able to send out a stream of scheduled messages without releasing the CAN bus between the two messages. Such nodes arbitrate for the CAN bus immediately after sending the previous message and only release the CAN bus in case of lost arbitration. • The internal message queue within any CAN node is organized such that the highest priority message is sent out ﬁrst, if more than one message is ready to be sent. The behavior described in the bullets above cannot be achieved with a single transmit buffer. That buffer must be reloaded immediately after the previous message is sent. This loading process lasts a ﬁnite amount of time and must be completed within the inter-frame sequence (IFS) to be able to send an uninterrupted stream of messages. Even if this is feasible for limited CAN bus speeds, it requires that the CPU reacts with short latencies to the transmit interrupt. A double buffer scheme de-couples the reloading of the transmit buffer from the actual message sending and, therefore, reduces the reactiveness requirements of the CPU. Problems can arise if the sending of a message is ﬁnished while the CPU re-loads the second buffer. No buffer would then be ready for transmission, and the CAN bus would be released. At least three transmit buffers are required to meet the ﬁrst of the above requirements under all circumstances. The MSCAN has three transmit buffers. The second requirement calls for some sort of internal prioritization which the MSCAN implements with the “local priority” concept described in Section 21.4.2.2, “Transmit Structures.” 21.4.2.2 Transmit Structures The MSCAN triple transmit buffer scheme optimizes real-time performance by allowing multiple messages to be set up in advance. The three buffers are arranged as shown in Figure 21-38. All three buffers have a 13-byte data structure similar to the outline of the receive buffers (see Section 21.3.3, “Programmer’s Model of Message Storage”). An additional Transmit Buffer Priority Register (TBPR) contains an 8-bit local priority ﬁeld (PRIO) (see Section 21.3.3.4, “Transmit Buffer Priority Register (TBPR)”). The remaining two bytes are used for time stamping of a message, if required (see Section 21.3.3.5, “Time Stamp Register (TSRH–TSRL)”). To transmit a message, the CPU must identify an available transmit buffer, which is indicated by a set transmitter buffer empty (TXEx) ﬂag (see Section 21.3.2.7, “MSCAN Transmitter Flag Register (CANTFLG)”). If a transmit buffer is available, the CPU must set a pointer to this buffer by writing to the CANTBSEL register (see Section 21.3.2.11, “MSCAN Transmit Buffer Selection Register (CANTBSEL)”). This makes the respective buffer accessible within the CANTXFG address space (see Section 21.3.3, “Programmer’s Model of Message Storage”). The algorithmic feature associated with the CANTBSEL register simpliﬁes the transmit buffer selection. In addition, this scheme makes the handler MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 993 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) software simpler because only one address area is applicable for the transmit process, and the required address space is minimized. The CPU then stores the identiﬁer, the control bits, and the data content into one of the transmit buffers. Finally, the buffer is ﬂagged as ready for transmission by clearing the associated TXE ﬂag. The MSCAN then schedules the message for transmission and signals the successful transmission of the buffer by setting the associated TXE ﬂag. A transmit interrupt (see Section 21.4.7.2, “Transmit Interrupt”) is generated1 when TXEx is set and can be used to drive the application software to re-load the buffer. If more than one buffer is scheduled for transmission when the CAN bus becomes available for arbitration, the MSCAN uses the local priority setting of the three buffers to determine the prioritization. For this purpose, every transmit buffer has an 8-bit local priority ﬁeld (PRIO). The application software programs this ﬁeld when the message is set up. The local priority reﬂects the priority of this particular message relative to the set of messages being transmitted from this node. The lowest binary value of the PRIO ﬁeld is deﬁned to be the highest priority. The internal scheduling process takes place whenever the MSCAN arbitrates for the CAN bus. This is also the case after the occurrence of a transmission error. When a high priority message is scheduled by the application software, it may become necessary to abort a lower priority message in one of the three transmit buffers. Because messages that are already in transmission cannot be aborted, the user must request the abort by setting the corresponding abort request bit (ABTRQ) (see Section 21.3.2.9, “MSCAN Transmitter Message Abort Request Register (CANTARQ)”.) The MSCAN then grants the request, if possible, by: 1. Setting the corresponding abort acknowledge ﬂag (ABTAK) in the CANTAAK register. 2. Setting the associated TXE ﬂag to release the buffer. 3. Generating a transmit interrupt. The transmit interrupt handler software can determine from the setting of the ABTAK ﬂag whether the message was aborted (ABTAK = 1) or sent (ABTAK = 0). 21.4.2.3 Receive Structures The received messages are stored in a ﬁve stage input FIFO. The ﬁve message buffers are alternately mapped into a single memory area (see Figure 21-38). The background receive buffer (RxBG) is exclusively associated with the MSCAN, but the foreground receive buffer (RxFG) is addressable by the CPU (see Figure 21-38). This scheme simpliﬁes the handler software because only one address area is applicable for the receive process. All receive buffers have a size of 15 bytes to store the CAN control bits, the identiﬁer (standard or extended), the data contents, and a time stamp, if enabled (see Section 21.3.3, “Programmer’s Model of Message Storage”). The receiver full ﬂag (RXF) (see Section 21.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)”) signals the status of the foreground receive buffer. When the buffer contains a correctly received message with a matching identiﬁer, this ﬂag is set. On reception, each message is checked to see whether it passes the ﬁlter (see Section 21.4.3, “Identiﬁer Acceptance Filter”) and simultaneously is written into the active RxBG. After successful reception of a valid message, the MSCAN shifts the content of RxBG into the receiver FIFO, sets the RXF ﬂag, and 1. The transmit interrupt occurs only if not masked. A polling scheme can be applied on TXEx also. MC9S12XF - Family Reference Manual, Rev.1.19 994 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) generates a receive interrupt1 (see Section 21.4.7.3, “Receive Interrupt”) to the CPU. The user’s receive handler must read the received message from the RxFG and then reset the RXF ﬂag to acknowledge the interrupt and to release the foreground buffer. A new message, which can follow immediately after the IFS ﬁeld of the CAN frame, is received into the next available RxBG. If the MSCAN receives an invalid message in its RxBG (wrong identiﬁer, transmission errors, etc.) the actual contents of the buffer will be over-written by the next message. The buffer will then not be shifted into the FIFO. When the MSCAN module is transmitting, the MSCAN receives its own transmitted messages into the background receive buffer, RxBG, but does not shift it into the receiver FIFO, generate a receive interrupt, or acknowledge its own messages on the CAN bus. The exception to this rule is in loopback mode (see Section 21.3.2.2, “MSCAN Control Register 1 (CANCTL1)”) where the MSCAN treats its own messages exactly like all other incoming messages. The MSCAN receives its own transmitted messages in the event that it loses arbitration. If arbitration is lost, the MSCAN must be prepared to become a receiver. An overrun condition occurs when all receive message buffers in the FIFO are ﬁlled with correctly received messages with accepted identiﬁers and another message is correctly received from the CAN bus with an accepted identiﬁer. The latter message is discarded and an error interrupt with overrun indication is generated if enabled (see Section 21.4.7.5, “Error Interrupt”). The MSCAN remains able to transmit messages while the receiver FIFO is being ﬁlled, but all incoming messages are discarded. As soon as a receive buffer in the FIFO is available again, new valid messages will be accepted. 21.4.3 Identiﬁer Acceptance Filter The MSCAN identiﬁer acceptance registers (see Section 21.3.2.12, “MSCAN Identiﬁer Acceptance Control Register (CANIDAC)”) deﬁne the acceptable patterns of the standard or extended identiﬁer (ID[10:0] or ID[28:0]). Any of these bits can be marked ‘don’t care’ in the MSCAN identiﬁer mask registers (see Section 21.3.2.17, “MSCAN Identiﬁer Mask Registers (CANIDMR0–CANIDMR7)”). A ﬁlter hit is indicated to the application software by a set receive buffer full ﬂag (RXF = 1) and three bits in the CANIDAC register (see Section 21.3.2.12, “MSCAN Identiﬁer Acceptance Control Register (CANIDAC)”). These identiﬁer hit ﬂags (IDHIT[2:0]) clearly identify the ﬁlter section that caused the acceptance. They simplify the application software’s task to identify the cause of the receiver interrupt. If more than one hit occurs (two or more ﬁlters match), the lower hit has priority. A very ﬂexible programmable generic identiﬁer acceptance ﬁlter has been introduced to reduce the CPU interrupt loading. The ﬁlter is programmable to operate in four different modes: • Two identiﬁer acceptance ﬁlters, each to be applied to: — The full 29 bits of the extended identiﬁer and to the following bits of the CAN 2.0B frame: – Remote transmission request (RTR) – Identiﬁer extension (IDE) – Substitute remote request (SRR) — The 11 bits of the standard identiﬁer plus the RTR and IDE bits of the CAN 2.0A/B messages. This mode implements two ﬁlters for a full length CAN 2.0B compliant extended identiﬁer. Although this mode can be used for standard identiﬁers, it is recommended to use the four or eight identiﬁer acceptance ﬁlters. 1. The receive interrupt occurs only if not masked. A polling scheme can be applied on RXF also. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 995 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) • • • Figure 21-39 shows how the ﬁrst 32-bit ﬁlter bank (CANIDAR0–CANIDAR3, CANIDMR0–CANIDMR3) produces a ﬁlter 0 hit. Similarly, the second ﬁlter bank (CANIDAR4–CANIDAR7, CANIDMR4–CANIDMR7) produces a ﬁlter 1 hit. Four identiﬁer acceptance ﬁlters, each to be applied to: — The 14 most signiﬁcant bits of the extended identiﬁer plus the SRR and IDE bits of CAN 2.0B messages. — The 11 bits of the standard identiﬁer, the RTR and IDE bits of CAN 2.0A/B messages. Figure 21-40 shows how the ﬁrst 32-bit ﬁlter bank (CANIDAR0–CANIDA3, CANIDMR0–3CANIDMR) produces ﬁlter 0 and 1 hits. Similarly, the second ﬁlter bank (CANIDAR4–CANIDAR7, CANIDMR4–CANIDMR7) produces ﬁlter 2 and 3 hits. Eight identiﬁer acceptance ﬁlters, each to be applied to the ﬁrst 8 bits of the identiﬁer. This mode implements eight independent ﬁlters for the ﬁrst 8 bits of a CAN 2.0A/B compliant standard identiﬁer or a CAN 2.0B compliant extended identiﬁer. Figure 21-41 shows how the ﬁrst 32-bit ﬁlter bank (CANIDAR0–CANIDAR3, CANIDMR0–CANIDMR3) produces ﬁlter 0 to 3 hits. Similarly, the second ﬁlter bank (CANIDAR4–CANIDAR7, CANIDMR4–CANIDMR7) produces ﬁlter 4 to 7 hits. Closed ﬁlter. No CAN message is copied into the foreground buffer RxFG, and the RXF ﬂag is never set. IDR0 IDR0 ID21 ID3 ID20 ID2 IDR1 IDR1 ID15 IDE ID14 ID10 IDR2 IDR2 ID7 ID3 ID6 ID10 IDR3 IDR3 RTR ID3 CAN 2.0B Extended Identiﬁer ID28 CAN 2.0A/B Standard Identiﬁer ID10 AM7 CANIDMR0 AM0 AM7 CANIDMR1 AM0 AM7 CANIDMR2 AM0 AM7 CANIDMR3 AM0 AC7 CANIDAR0 AC0 AC7 CANIDAR1 AC0 AC7 CANIDAR2 AC0 AC7 CANIDAR3 AC0 ID Accepted (Filter 0 Hit) Figure 21-39. 32-bit Maskable Identiﬁer Acceptance Filter MC9S12XF - Family Reference Manual, Rev.1.19 996 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) CAN 2.0B Extended Identiﬁer CAN 2.0A/B Standard Identiﬁer ID28 ID10 IDR0 IDR0 ID21 ID3 ID20 ID2 IDR1 IDR1 ID15 IDE ID14 ID10 IDR2 IDR2 ID7 ID3 ID6 ID10 IDR3 IDR3 RTR ID3 AM7 CANIDMR0 AM0 AM7 CANIDMR1 AM0 AC7 CANIDAR0 AC0 AC7 CANIDAR1 AC0 ID Accepted (Filter 0 Hit) AM7 CANIDMR2 AM0 AM7 CANIDMR3 AM0 AC7 CANIDAR2 AC0 AC7 CANIDAR3 AC0 ID Accepted (Filter 1 Hit) Figure 21-40. 16-bit Maskable Identiﬁer Acceptance Filters MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 997 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) CAN 2.0B Extended Identiﬁer ID28 CAN 2.0A/B Standard Identiﬁer ID10 IDR0 IDR0 ID21 ID3 ID20 ID2 IDR1 IDR1 ID15 IDE ID14 ID10 IDR2 IDR2 ID7 ID3 ID6 ID10 IDR3 IDR3 RTR ID3 AM7 CIDMR0 AM0 AC7 CIDAR0 AC0 ID Accepted (Filter 0 Hit) AM7 CIDMR1 AM0 AC7 CIDAR1 AC0 ID Accepted (Filter 1 Hit) AM7 CIDMR2 AM0 AC7 CIDAR2 AC0 ID Accepted (Filter 2 Hit) AM7 CIDMR3 AM0 AC7 CIDAR3 AC0 ID Accepted (Filter 3 Hit) Figure 21-41. 8-bit Maskable Identiﬁer Acceptance Filters MC9S12XF - Family Reference Manual, Rev.1.19 998 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.4.3.1 Protocol Violation Protection The MSCAN protects the user from accidentally violating the CAN protocol through programming errors. The protection logic implements the following features: • The receive and transmit error counters cannot be written or otherwise manipulated. • All registers which control the conﬁguration of the MSCAN cannot be modiﬁed while the MSCAN is on-line. The MSCAN has to be in Initialization Mode. The corresponding INITRQ/INITAK handshake bits in the CANCTL0/CANCTL1 registers (see Section 21.3.2.1, “MSCAN Control Register 0 (CANCTL0)”) serve as a lock to protect the following registers: — MSCAN control 1 register (CANCTL1) — MSCAN bus timing registers 0 and 1 (CANBTR0, CANBTR1) — MSCAN identiﬁer acceptance control register (CANIDAC) — MSCAN identiﬁer acceptance registers (CANIDAR0–CANIDAR7) — MSCAN identiﬁer mask registers (CANIDMR0–CANIDMR7) • The TXCAN is immediately forced to a recessive state when the MSCAN goes into the power down mode or initialization mode (see Section 21.4.5.6, “MSCAN Power Down Mode,” and Section 21.4.4.5, “MSCAN Initialization Mode”). • The MSCAN enable bit (CANE) is writable only once in normal system operation modes, which provides further protection against inadvertently disabling the MSCAN. 21.4.3.2 Clock System Figure 21-42 shows the structure of the MSCAN clock generation circuitry. MSCAN Bus Clock CANCLK CLKSRC Prescaler (1 .. 64) Time quanta clock (Tq) CLKSRC Oscillator Clock Figure 21-42. MSCAN Clocking Scheme The clock source bit (CLKSRC) in the CANCTL1 register (21.3.2.2/21-965) deﬁnes whether the internal CANCLK is connected to the output of a crystal oscillator (oscillator clock) or to the bus clock. The clock source has to be chosen such that the tight oscillator tolerance requirements (up to 0.4%) of the CAN protocol are met. Additionally, for high CAN bus rates (1 Mbps), a 45% to 55% duty cycle of the clock is required. If the bus clock is generated from a PLL, it is recommended to select the oscillator clock rather than the bus clock due to jitter considerations, especially at the faster CAN bus rates. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 999 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) For microcontrollers without a clock and reset generator (CRG), CANCLK is driven from the crystal oscillator (oscillator clock). A programmable prescaler generates the time quanta (Tq) clock from CANCLK. A time quantum is the atomic unit of time handled by the MSCAN. Eqn. 21-2 f CANCLK = ----------------------------------------------------Tq ( Prescaler value ) A bit time is subdivided into three segments as described in the Bosch CAN speciﬁcation. (see Figure 2143): • SYNC_SEG: This segment has a ﬁxed length of one time quantum. Signal edges are expected to happen within this section. • Time Segment 1: This segment includes the PROP_SEG and the PHASE_SEG1 of the CAN standard. It can be programmed by setting the parameter TSEG1 to consist of 4 to 16 time quanta. • Time Segment 2: This segment represents the PHASE_SEG2 of the CAN standard. It can be programmed by setting the TSEG2 parameter to be 2 to 8 time quanta long. Eqn. 21-3 f Tq Bit Rate = -------------------------------------------------------------------------------( number of Time Quanta ) NRZ Signal SYNC_SEG Time Segment 1 (PROP_SEG + PHASE_SEG1) 4 ... 16 8 ... 25 Time Quanta = 1 Bit Time Time Segment 2 (PHASE_SEG2) 2 ... 8 1 Transmit Point Sample Point (single or triple sampling) Figure 21-43. Segments within the Bit Time MC9S12XF - Family Reference Manual, Rev.1.19 1000 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-35. Time Segment Syntax Syntax SYNC_SEG Transmit Point Description System expects transitions to occur on the CAN bus during this period. A node in transmit mode transfers a new value to the CAN bus at this point. A node in receive mode samples the CAN bus at this point. If the three samples per bit option is selected, then this point marks the position of the third sample. Sample Point The synchronization jump width (see the Bosch CAN speciﬁcation for details) can be programmed in a range of 1 to 4 time quanta by setting the SJW parameter. The SYNC_SEG, TSEG1, TSEG2, and SJW parameters are set by programming the MSCAN bus timing registers (CANBTR0, CANBTR1) (see Section 21.3.2.3, “MSCAN Bus Timing Register 0 (CANBTR0)” and Section 21.3.2.4, “MSCAN Bus Timing Register 1 (CANBTR1)”). Table 21-36 gives an overview of the CAN compliant segment settings and the related parameter values. NOTE It is the user’s responsibility to ensure the bit time settings are in compliance with the CAN standard. Table 21-36. CAN Standard Compliant Bit Time Segment Settings Time Segment 1 5 .. 10 4 .. 11 5 .. 12 6 .. 13 7 .. 14 8 .. 15 9 .. 16 TSEG1 4 .. 9 3 .. 10 4 .. 11 5 .. 12 6 .. 13 7 .. 14 8 .. 15 Time Segment 2 2 3 4 5 6 7 8 TSEG2 1 2 3 4 5 6 7 Synchronization Jump Width 1 .. 2 1 .. 3 1 .. 4 1 .. 4 1 .. 4 1 .. 4 1 .. 4 SJW 0 .. 1 0 .. 2 0 .. 3 0 .. 3 0 .. 3 0 .. 3 0 .. 3 21.4.4 21.4.4.1 Modes of Operation Normal System Operating Modes The MSCAN module behaves as described within this speciﬁcation in all normal system operating modes. Write restrictions exist for some registers. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1001 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.4.4.2 Special System Operating Modes The MSCAN module behaves as described within this speciﬁcation in all special system operating modes. Write restrictions which exist on speciﬁc registers in normal modes are lifted for test purposes in special modes. 21.4.4.3 Emulation Modes In all emulation modes, the MSCAN module behaves just like in normal system operating modes as described within this speciﬁcation. 21.4.4.4 Listen-Only Mode In an optional CAN bus monitoring mode (listen-only), the CAN node is able to receive valid data frames and valid remote frames, but it sends only “recessive” bits on the CAN bus. In addition, it cannot start a transmission. If the MAC sub-layer is required to send a “dominant” bit (ACK bit, overload ﬂag, or active error ﬂag), the bit is rerouted internally so that the MAC sub-layer monitors this “dominant” bit, although the CAN bus may remain in recessive state externally. 21.4.4.5 MSCAN Initialization Mode The MSCAN enters initialization mode when it is enabled (CANE=1). When entering initialization mode during operation, any on-going transmission or reception is immediately aborted and synchronization to the CAN bus is lost, potentially causing CAN protocol violations. To protect the CAN bus system from fatal consequences of violations, the MSCAN immediately drives TXCAN into a recessive state. NOTE The user is responsible for ensuring that the MSCAN is not active when initialization mode is entered. The recommended procedure is to bring the MSCAN into sleep mode (SLPRQ = 1 and SLPAK = 1) before setting the INITRQ bit in the CANCTL0 register. Otherwise, the abort of an on-going message can cause an error condition and can impact other CAN bus devices. In initialization mode, the MSCAN is stopped. However, interface registers remain accessible. This mode is used to reset the CANCTL0, CANRFLG, CANRIER, CANTFLG, CANTIER, CANTARQ, CANTAAK, and CANTBSEL registers to their default values. In addition, the MSCAN enables the conﬁguration of the CANBTR0, CANBTR1 bit timing registers; CANIDAC; and the CANIDAR, CANIDMR message ﬁlters. See Section 21.3.2.1, “MSCAN Control Register 0 (CANCTL0),” for a detailed description of the initialization mode. MC9S12XF - Family Reference Manual, Rev.1.19 1002 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Bus Clock Domain CAN Clock Domain INIT Flag INITRQ CPU Init Request SYNC sync. INITRQ INITAK Flag sync. INITAK SYNC INITAK Figure 21-44. Initialization Request/Acknowledge Cycle Due to independent clock domains within the MSCAN, INITRQ must be synchronized to all domains by using a special handshake mechanism. This handshake causes additional synchronization delay (see Figure 21-44). If there is no message transfer ongoing on the CAN bus, the minimum delay will be two additional bus clocks and three additional CAN clocks. When all parts of the MSCAN are in initialization mode, the INITAK ﬂag is set. The application software must use INITAK as a handshake indication for the request (INITRQ) to go into initialization mode. NOTE The CPU cannot clear INITRQ before initialization mode (INITRQ = 1 and INITAK = 1) is active. 21.4.5 Low-Power Options If the MSCAN is disabled (CANE = 0), the MSCAN clocks are stopped for power saving. If the MSCAN is enabled (CANE = 1), the MSCAN has two additional modes with reduced power consumption, compared to normal mode: sleep and power down mode. In sleep mode, power consumption is reduced by stopping all clocks except those to access the registers from the CPU side. In power down mode, all clocks are stopped and no power is consumed. Table 21-37 summarizes the combinations of MSCAN and CPU modes. A particular combination of modes is entered by the given settings on the CSWAI and SLPRQ/SLPAK bits. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1003 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) Table 21-37. CPU vs. MSCAN Operating Modes MSCAN Mode CPU Mode Normal Sleep CSWAI = X(1) SLPRQ = 0 SLPAK = 0 CSWAI = 0 SLPRQ = 0 SLPAK = 0 CSWAI = X SLPRQ = 1 SLPAK = 1 CSWAI = 0 SLPRQ = 1 SLPAK = 1 CSWAI = 1 SLPRQ = X SLPAK = X CSWAI = X SLPRQ = X SLPAK = X Power Down Reduced Power Consumption Disabled (CANE=0) CSWAI = X SLPRQ = X SLPAK = X CSWAI = X SLPRQ = X SLPAK = X CSWAI = X SLPRQ = X SLPAK = X RUN WAIT STOP 1. ‘X’ means don’t care. 21.4.5.1 Operation in Run Mode As shown in Table 21-37, only MSCAN sleep mode is available as low power option when the CPU is in run mode. 21.4.5.2 Operation in Wait Mode The WAI instruction puts the MCU in a low power consumption stand-by mode. If the CSWAI bit is set, additional power can be saved in power down mode because the CPU clocks are stopped. After leaving this power down mode, the MSCAN restarts and enters normal mode again. While the CPU is in wait mode, the MSCAN can be operated in normal mode and generate interrupts (registers can be accessed via background debug mode). 21.4.5.3 Operation in Stop Mode The STOP instruction puts the MCU in a low power consumption stand-by mode. In stop mode, the MSCAN is set in power down mode regardless of the value of the SLPRQ/SLPAK and CSWAI bits (Table 21-37). 21.4.5.4 MSCAN Normal Mode This is a non-power-saving mode. Enabling the MSCAN puts the module from disabled mode into normal mode. In this mode the module can either be in initialization mode or out of initialization mode. See Section 21.4.4.5, “MSCAN Initialization Mode”. MC9S12XF - Family Reference Manual, Rev.1.19 1004 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.4.5.5 MSCAN Sleep Mode The CPU can request the MSCAN to enter this low power mode by asserting the SLPRQ bit in the CANCTL0 register. The time when the MSCAN enters sleep mode depends on a ﬁxed synchronization delay and its current activity: • If there are one or more message buffers scheduled for transmission (TXEx = 0), the MSCAN will continue to transmit until all transmit message buffers are empty (TXEx = 1, transmitted successfully or aborted) and then goes into sleep mode. • If the MSCAN is receiving, it continues to receive and goes into sleep mode as soon as the CAN bus next becomes idle. • If the MSCAN is neither transmitting nor receiving, it immediately goes into sleep mode. Bus Clock Domain CAN Clock Domain SLPRQ Flag SLPRQ CPU Sleep Request SYNC sync. SLPRQ SLPAK Flag sync. SLPAK SYNC SLPAK MSCAN in Sleep Mode Figure 21-45. Sleep Request / Acknowledge Cycle NOTE The application software must avoid setting up a transmission (by clearing one or more TXEx ﬂag(s)) and immediately request sleep mode (by setting SLPRQ). Whether the MSCAN starts transmitting or goes into sleep mode directly depends on the exact sequence of operations. If sleep mode is active, the SLPRQ and SLPAK bits are set (Figure 21-45). The application software must use SLPAK as a handshake indication for the request (SLPRQ) to go into sleep mode. When in sleep mode (SLPRQ = 1 and SLPAK = 1), the MSCAN stops its internal clocks. However, clocks that allow register accesses from the CPU side continue to run. If the MSCAN is in bus-off state, it stops counting the 128 occurrences of 11 consecutive recessive bits due to the stopped clocks. TXCAN remains in a recessive state. If RXF = 1, the message can be read and RXF can be cleared. Shifting a new message into the foreground buffer of the receiver FIFO (RxFG) does not take place while in sleep mode. It is possible to access the transmit buffers and to clear the associated TXE ﬂags. No message abort takes place while in sleep mode. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1005 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) If the WUPE bit in CANCTL0 is not asserted, the MSCAN will mask any activity it detects on CAN. RXCAN is therefore held internally in a recessive state. This locks the MSCAN in sleep mode. WUPE must be set before entering sleep mode to take effect. The MSCAN is able to leave sleep mode (wake up) only when: • CAN bus activity occurs and WUPE = 1 or • the CPU clears the SLPRQ bit NOTE The CPU cannot clear the SLPRQ bit before sleep mode (SLPRQ = 1 and SLPAK = 1) is active. After wake-up, the MSCAN waits for 11 consecutive recessive bits to synchronize to the CAN bus. As a consequence, if the MSCAN is woken-up by a CAN frame, this frame is not received. The receive message buffers (RxFG and RxBG) contain messages if they were received before sleep mode was entered. All pending actions will be executed upon wake-up; copying of RxBG into RxFG, message aborts and message transmissions. If the MSCAN remains in bus-off state after sleep mode was exited, it continues counting the 128 occurrences of 11 consecutive recessive bits. 21.4.5.6 MSCAN Power Down Mode The MSCAN is in power down mode (Table 21-37) when • CPU is in stop mode or • CPU is in wait mode and the CSWAI bit is set When entering the power down mode, the MSCAN immediately stops all ongoing transmissions and receptions, potentially causing CAN protocol violations. To protect the CAN bus system from fatal consequences of violations to the above rule, the MSCAN immediately drives TXCAN into a recessive state. NOTE The user is responsible for ensuring that the MSCAN is not active when power down mode is entered. The recommended procedure is to bring the MSCAN into Sleep mode before the STOP or WAI instruction (if CSWAI is set) is executed. Otherwise, the abort of an ongoing message can cause an error condition and impact other CAN bus devices. In power down mode, all clocks are stopped and no registers can be accessed. If the MSCAN was not in sleep mode before power down mode became active, the module performs an internal recovery cycle after powering up. This causes some ﬁxed delay before the module enters normal mode again. MC9S12XF - Family Reference Manual, Rev.1.19 1006 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.4.5.7 Disabled Mode The MSCAN is in disabled mode out of reset (CANE=0). All module clocks are stopped for power saving, however the register map can still be accessed as speciﬁed. 21.4.5.8 Programmable Wake-Up Function The MSCAN can be programmed to wake up from sleep or power down mode as soon as CAN bus activity is detected (see control bit WUPE in MSCAN Control Register 0 (CANCTL0). The sensitivity to existing CAN bus action can be modiﬁed by applying a low-pass ﬁlter function to the RXCAN input line (see control bit WUPM in Section 21.3.2.2, “MSCAN Control Register 1 (CANCTL1)”). This feature can be used to protect the MSCAN from wake-up due to short glitches on the CAN bus lines. Such glitches can result from—for example—electromagnetic interference within noisy environments. 21.4.6 Reset Initialization The reset state of each individual bit is listed in Section 21.3.2, “Register Descriptions,” which details all the registers and their bit-ﬁelds. 21.4.7 Interrupts This section describes all interrupts originated by the MSCAN. It documents the enable bits and generated ﬂags. Each interrupt is listed and described separately. 21.4.7.1 Description of Interrupt Operation The MSCAN supports four interrupt vectors (see Table 21-38), any of which can be individually masked (for details see Section 21.3.2.6, “MSCAN Receiver Interrupt Enable Register (CANRIER)” to Section 21.3.2.8, “MSCAN Transmitter Interrupt Enable Register (CANTIER)”). Refer to the device overview section to determine the dedicated interrupt vector addresses. Table 21-38. Interrupt Vectors Interrupt Source Wake-Up Interrupt (WUPIF) Error Interrupts Interrupt (CSCIF, OVRIF) Receive Interrupt (RXF) Transmit Interrupts (TXE[2:0]) CCR Mask I bit I bit I bit I bit Local Enable CANRIER (WUPIE) CANRIER (CSCIE, OVRIE) CANRIER (RXFIE) CANTIER (TXEIE[2:0]) 21.4.7.2 Transmit Interrupt At least one of the three transmit buffers is empty (not scheduled) and can be loaded to schedule a message for transmission. The TXEx ﬂag of the empty message buffer is set. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1007 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.4.7.3 Receive Interrupt A message is successfully received and shifted into the foreground buffer (RxFG) of the receiver FIFO. This interrupt is generated immediately after receiving the EOF symbol. The RXF ﬂag is set. If there are multiple messages in the receiver FIFO, the RXF ﬂag is set as soon as the next message is shifted to the foreground buffer. 21.4.7.4 Wake-Up Interrupt A wake-up interrupt is generated if activity on the CAN bus occurs during MSCAN sleep or power-down mode. NOTE This interrupt can only occur if the MSCAN was in sleep mode (SLPRQ = 1 and SLPAK = 1) before entering power down mode, the wake-up option is enabled (WUPE = 1), and the wake-up interrupt is enabled (WUPIE = 1). 21.4.7.5 Error Interrupt An error interrupt is generated if an overrun of the receiver FIFO, error, warning, or bus-off condition occurrs. MSCAN Receiver Flag Register (CANRFLG) indicates one of the following conditions: • Overrun — An overrun condition of the receiver FIFO as described in Section 21.4.2.3, “Receive Structures,” occurred. • CAN Status Change — The actual value of the transmit and receive error counters control the CAN bus state of the MSCAN. As soon as the error counters skip into a critical range (Tx/Rxwarning, Tx/Rx-error, bus-off) the MSCAN ﬂags an error condition. The status change, which caused the error condition, is indicated by the TSTAT and RSTAT ﬂags (see Section 21.3.2.5, “MSCAN Receiver Flag Register (CANRFLG)” and Section 21.3.2.6, “MSCAN Receiver Interrupt Enable Register (CANRIER)”). 21.4.7.6 Interrupt Acknowledge Interrupts are directly associated with one or more status ﬂags in either the MSCAN Receiver Flag Register (CANRFLG) or the MSCAN Transmitter Flag Register (CANTFLG). Interrupts are pending as long as one of the corresponding ﬂags is set. The ﬂags in CANRFLG and CANTFLG must be reset within the interrupt handler to handshake the interrupt. The ﬂags are reset by writing a 1 to the corresponding bit position. A ﬂag cannot be cleared if the respective condition prevails. NOTE It must be guaranteed that the CPU clears only the bit causing the current interrupt. For this reason, bit manipulation instructions (BSET) must not be used to clear interrupt ﬂags. These instructions may cause accidental clearing of interrupt ﬂags which are set after entering the current interrupt service routine. MC9S12XF - Family Reference Manual, Rev.1.19 1008 Freescale Semiconductor Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) 21.5 21.5.1 Initialization/Application Information MSCAN initialization The procedure to initially start up the MSCAN module out of reset is as follows: 1. Assert CANE 2. Write to the conﬁguration registers in initialization mode 3. Clear INITRQ to leave initialization mode If the conﬁguration of registers which are only writable in initialization mode shall be changed: 1. Bring the module into sleep mode by setting SLPRQ and awaiting SLPAK to assert after the CAN bus becomes idle. 2. Enter initialization mode: assert INITRQ and await INITAK 3. Write to the conﬁguration registers in initialization mode 4. Clear INITRQ to leave initialization mode and continue MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1009 Chapter 21 Freescale’s Scalable Controller Area Network (S12MSCANV2) MC9S12XF - Family Reference Manual, Rev.1.19 1010 Freescale Semiconductor Chapter 22 Enhanced Programmable Interrupt Timer (S12XEPIT24B8CV1) 22.1 Revision History Author Description of Changes Initial Draft, based on PIT V01.01 - reworked channel restart register “PITCSTP”, reordered new registers - added PITTRIGEDGE conﬁg bits to PITTRIGCTL register - clariﬁed channels in external trigger mode are bypassing the microtimers, thus running at bus-speed - cleaned up register description based on feedback by Joachim - renamed PITTRIGIN register to PITTRIGE (PIT trigger channel enable register) - added timing diagram for externally triggered mode - updated block diagram in Introduction section (block diagram in Functional Description section is not complete) - renamed PITTRIGOUT register bits: PITTRIGO -> PITCOTEn - ﬁxed register offsets in register descriptions (AS) - clariﬁed PITCSTP register function (AS, JK) - added NOTE to disable channel before changing the time-base for the channel by writing to PITMUX or PITTRIGE (AS) - removed wrong visible borders from PITLDn and PITCNTn register description (JK) Version Revision Effective Number Date Date 00.01 00.02 18-Aug-06 18-Aug-06 21-Aug-06 21-Aug-06 00.03 15-Sep-06 20-Sep-06 00.04 13-Oct-06 13-Oct-06 22.2 Introduction The enhanced period interrupt timer (EPIT) is an array of 24-bit timers that can be used to trigger peripheral modules or raise periodic interrupts. Refer to Figure 22-1 for a simpliﬁed block diagram. 22.2.1 Glossary Acronyms and Abbreviations EPIT ISR CCR SoC Enhanced Programmable Interrupt Timer Interrupt Service Routine Condition Code Register System on Chip MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1011 Chapter 22 Enhanced Programmable Interrupt Timer (S12XEPIT24B8CV1) Acronyms and Abbreviations micro time bases clock periods of the 16-bit timer modulus down-counters, which are generated by the 8-bit modulus down-counters. 22.2.2 Features The EPIT includes these features: • Eight timers implemented as modulus down-counters with independent time-out periods. • Time-out periods selectable between 1 and 224 bus clock cycles. Time-out equals m*n bus clock cycles with 1 TCx IOCx=OMx/OLx IOC7=OC7D7 Note: in Table 26-11,the IOS7 and IOSx should be set to 1 IOSx is the register TIOS bit x, OC7Mx is the register OC7M bit x, TCx is timer Input Capture/Output Compare register, IOCx is channel x, OMx/OLx is the register TCTL1/TCTL2, OC7Dx is the register OC7D bit x. IOCx = OC7Dx+ OMx/OLx, means that both OC7 event and OCx event will change channel x value. 26.3.2.9 Timer Control Register 3/Timer Control Register 4 (TCTL3/TCTL4) Module Base + 0x000A 7 6 5 4 3 2 1 0 R W Reset EDG7B 0 EDG7A 0 EDG6B 0 EDG6A 0 EDG5B 0 EDG5A 0 EDG4B 0 EDG4A 0 Figure 26-13. Timer Control Register 3 (TCTL3) Module Base + 0x000B 7 6 5 4 3 2 1 0 R W Reset EDG3B 0 EDG3A 0 EDG2B 0 EDG2A 0 EDG1B 0 EDG1A 0 EDG0B 0 EDG0A 0 Figure 26-14. Timer Control Register 4 (TCTL4) Read or write: Anytime All bits reset to zero. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1139 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-12. TCTL3/TCTL4 Field Descriptions Field EDG[7:0]B 7, 5, 3, 1 EDG[7:0]A 6, 4, 2, 0 Description Input Capture Edge Control — These eight pairs of control bits conﬁgure the input capture edge detector circuits for each input capture channel. The four pairs of control bits in TCTL4 also conﬁgure the input capture edge control for the four 8-bit pulse accumulators PAC0–PAC3.EDG0B and EDG0A in TCTL4 also determine the active edge for the 16-bit pulse accumulator PACB. See Table 26-13. Table 26-13. Edge Detector Circuit Conﬁguration EDGxB 0 0 1 1 EDGxA 0 1 0 1 Conﬁguration Capture disabled Capture on rising edges only Capture on falling edges only Capture on any edge (rising or falling) 26.3.2.10 Timer Interrupt Enable Register (TIE) Module Base + 0x000C 7 6 5 4 3 2 1 0 R W Reset C7I 0 C6I 0 C5I 0 C4I 0 C3I 0 C2I 0 C1I 0 C0I 0 Figure 26-15. Timer Interrupt Enable Register (TIE) Read or write: Anytime All bits reset to zero. The bits C7I–C0I correspond bit-for-bit with the ﬂags in the TFLG1 status register. Table 26-14. TIE Field Descriptions Field 7:0 C[7:0]I Description Input Capture/Output Compare “x” Interrupt Enable 0 The corresponding ﬂag is disabled from causing a hardware interrupt. 1 The corresponding ﬂag is enabled to cause an interrupt. MC9S12XF - Family Reference Manual, Rev.1.19 1140 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.11 Timer System Control Register 2 (TSCR2) Module Base + 0x000D 7 6 5 4 3 2 1 0 R W Reset TOI 0 0 0 0 0 0 0 TCRE 0 PR2 0 PR1 0 PR0 0 = Unimplemented or Reserved Figure 26-16. Timer System Control Register 2 (TSCR2) Read or write: Anytime All bits reset to zero. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1141 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-15. TSCR2 Field Descriptions Field 7 TOI Description Timer Overﬂow Interrupt Enable 0 Timer overﬂow interrupt disabled. 1 Hardware interrupt requested when TOF ﬂag set. Timer Counter Reset Enable — This bit allows the timer counter to be reset by a successful channel 7 output compare. This mode of operation is similar to an up-counting modulus counter. 0 Counter reset disabled and counter free runs. 1 Counter reset by a successful output compare on channel 7. Note: If register TC7 = 0x0000 and TCRE = 1, then the TCNT register will stay at 0x0000 continuously. If register TC7 = 0xFFFF and TCRE = 1, the TOF ﬂag will never be set when TCNT is reset from 0xFFFF to 0x0000. Note: TCRE=1 and TC7!=0, the TCNT cycle period will be TC7 x "prescaler counter width" + "1 Bus Clock". 3 TCRE When TCRE is set and TC7 is not equal to 0, TCNT will cycle from 0 to TC7. When TCNT reaches TC7 value, it will last only one bus cycle then reset to 0. for a more detail explanation please refer to Figure 26-17. Note: in Figure 26-17,if PR[2:0] is equal 2:0 PR[2:0] to 0, one prescaler counter equal to one bus clock Timer Prescaler Select — These three bits specify the division rate of the main Timer prescaler when the PRNT bit of register TSCR1 is set to 0. The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. See Table 26-16. Figure 26-17. The TCNT cycle diagram under TCRE=1 condition prescaler counter TC7 0 1 bus clock 1 ----TC7-1 TC7 0 TC7 event TC7 event Table 26-16. Prescaler Selection PR2 0 0 0 0 1 1 1 1 PR1 0 0 1 1 0 0 1 1 PR0 0 1 0 1 0 1 0 1 Prescale Factor 1 2 4 8 16 32 64 128 MC9S12XF - Family Reference Manual, Rev.1.19 1142 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.12 Main Timer Interrupt Flag 1 (TFLG1) Module Base + 0x000E 7 6 5 4 3 2 1 0 R W Reset C7F 0 C6F 0 C5F 0 C4F 0 C3F 0 C2F 0 C1F 0 C0F 0 Figure 26-18. Main Timer Interrupt Flag 1 (TFLG1) Read: Anytime Write used in the ﬂag clearing mechanism. Writing a one to the ﬂag clears the ﬂag. Writing a zero will not affect the current status of the bit. NOTE When TFFCA = 1, the ﬂags cannot be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag). Reference Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”. All bits reset to zero. TFLG1 indicates when interrupt conditions have occurred. The ﬂags can be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag) or via the fast ﬂag clearing mechanism (reference TFFCA bit in Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”). Use of the TFMOD bit in the ICSYS register in conjunction with the use of the ICOVW register allows a timer interrupt to be generated after capturing two values in the capture and holding registers, instead of generating an interrupt for every capture. Table 26-17. TFLG1 Field Descriptions Field 7:0 C[7:0]F Description Input Capture/Output Compare Channel “x” Flag — A CxF ﬂag is set when a corresponding input capture or output compare is detected. C0F can also be set by 16-bit Pulse Accumulator B (PACB). C3F–C0F can also be set by 8-bit pulse accumulators PAC3–PAC0. If the delay counter is enabled, the CxF ﬂag will not be set until after the delay. 26.3.2.13 Main Timer Interrupt Flag 2 (TFLG2) Module Base + 0x000F 7 6 5 4 3 2 1 0 R W Reset TOF 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 26-19. Main Timer Interrupt Flag 2 (TFLG2) Read: Anytime MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1143 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Write used in the ﬂag clearing mechanism. Writing a one to the ﬂag clears the ﬂag. Writing a zero will not affect the current status of the bit. NOTE When TFFCA = 1, the ﬂag cannot be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag). Reference Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”. All bits reset to zero. TFLG2 indicates when interrupt conditions have occurred. The ﬂag can be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag) or via the fast ﬂag clearing mechanism (Reference TFFCA bit in Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”). Table 26-18. TFLG2 Field Descriptions Field 7 TOF Description Timer Overﬂow Flag — Set when 16-bit free-running timer overﬂows from 0xFFFF to 0x0000. 26.3.2.14 Timer Input Capture/Output Compare Registers 0–7 Module Base + 0x0010 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-20. Timer Input Capture/Output Compare Register 0 High (TC0) Module Base + 0x0011 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-21. Timer Input Capture/Output Compare Register 0 Low (TC0) Module Base + 0x0012 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-22. Timer Input Capture/Output Compare Register 1 High (TC1) MC9S12XF - Family Reference Manual, Rev.1.19 1144 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Module Base + 0x0013 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-23. Timer Input Capture/Output Compare Register 1 Low (TC1) Module Base + 0x0014 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-24. Timer Input Capture/Output Compare Register 2 High (TC2) Module Base + 0x0015 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-25. Timer Input Capture/Output Compare Register 2 Low (TC2) Module Base + 0x0016 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-26. Timer Input Capture/Output Compare Register 3 High (TC3) Module Base + 0x0017 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-27. Timer Input Capture/Output Compare Register 3 Low (TC3) Module Base + 0x0018 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-28. Timer Input Capture/Output Compare Register 4 High (TC4) MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1145 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Module Base + 0x0019 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-29. Timer Input Capture/Output Compare Register 4 Low (TC4) Module Base + 0x001A 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-30. Timer Input Capture/Output Compare Register 5 High (TC5) Module Base + 0x001B 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-31. Timer Input Capture/Output Compare Register 5 Low (TC5) Module Base + 0x001C 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-32. Timer Input Capture/Output Compare Register 6 High (TC6) Module Base + 0x001D 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-33. Timer Input Capture/Output Compare Register 6 Low (TC6) Module Base + 0x001E 15 14 13 12 11 10 9 8 R W Reset Bit 15 0 Bit 14 0 Bit 13 0 Bit 12 0 Bit 11 0 Bit 10 0 Bit 9 0 Bit 8 0 Figure 26-34. Timer Input Capture/Output Compare Register 7 High (TC7) MC9S12XF - Family Reference Manual, Rev.1.19 1146 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Module Base + 0x001F 7 6 5 4 3 2 1 0 R W Reset Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Figure 26-35. Timer Input Capture/Output Compare Register 7 Low (TC7) Read: Anytime Write anytime for output compare function. Writes to these registers have no meaning or effect during input capture. All bits reset to zero. Depending on the TIOS bit for the corresponding channel, these registers are used to latch the value of the free-running counter when a deﬁned transition is sensed by the corresponding input capture edge detector or to trigger an output action for output compare. 26.3.2.15 16-Bit Pulse Accumulator A Control Register (PACTL) Module Base + 0x0020 7 6 5 4 3 2 1 0 R W Reset 0 0 PAEN 0 PAMOD 0 PEDGE 0 CLK1 0 CLK0 0 PAOVI 0 PAI 0 = Unimplemented or Reserved Figure 26-36. 16-Bit Pulse Accumulator Control Register (PACTL) Read: Anytime Write: Anytime All bits reset to zero. Table 26-19. PACTL Field Descriptions Field 6 PAEN Description Pulse Accumulator A System Enable — PAEN is independent from TEN. With timer disabled, the pulse accumulator can still function unless pulse accumulator is disabled. 0 16-Bit Pulse Accumulator A system disabled. 8-bit PAC3 and PAC2 can be enabled when their related enable bits in ICPAR are set. Pulse Accumulator Input Edge Flag (PAIF) function is disabled. 1 16-Bit Pulse Accumulator A system enabled. The two 8-bit pulse accumulators PAC3 and PAC2 are cascaded to form the PACA 16-bit pulse accumulator. When PACA in enabled, the PACN3 and PACN2 registers contents are respectively the high and low byte of the PACA. PA3EN and PA2EN control bits in ICPAR have no effect. Pulse Accumulator Input Edge Flag (PAIF) function is enabled. The PACA shares the input pin with IC7. Pulse Accumulator Mode — This bit is active only when the Pulse Accumulator A is enabled (PAEN = 1). 0 Event counter mode 1 Gated time accumulation mode 5 PAMOD MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1147 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-19. PACTL Field Descriptions (continued) Field 4 PEDGE Description Pulse Accumulator Edge Control — This bit is active only when the Pulse Accumulator A is enabled (PAEN = 1). Refer to Table 26-20. For PAMOD bit = 0 (event counter mode). 0 Falling edges on IC7 pin cause the count to be incremented 1 Rising edges on IC7 pin cause the count to be incremented For PAMOD bit = 1 (gated time accumulation mode). 0 IC7 input pin high enables bus clock divided by 64 to Pulse Accumulator and the trailing falling edge on IC7 sets the PAIF ﬂag. 1 IC7 input pin low enables bus clock divided by 64 to Pulse Accumulator and the trailing rising edge on IC7 sets the PAIF ﬂag. If the timer is not active (TEN = 0 in TSCR1), there is no divide-by-64 since the ÷64 clock is generated by the timer prescaler. 3:2 CLK[1:0] Clock Select Bits — For the description of PACLK please refer to Figure 26-72. If the pulse accumulator is disabled (PAEN = 0), the prescaler clock from the timer is always used as an input clock to the timer counter. The change from one selected clock to the other happens immediately after these bits are written. Refer to Table 26-21. Pulse Accumulator A Overﬂow Interrupt Enable 0 Interrupt inhibited 1 Interrupt requested if PAOVF is set Pulse Accumulator Input Interrupt Enable 0 Interrupt inhibited 1 Interrupt requested if PAIF is set 2 PAOVI 0 PAI . Table 26-20. Pin Action PAMOD 0 0 1 1 PEDGE 0 1 0 1 Falling edge Rising edge Divide by 64 clock enabled with pin high level Divide by 64 clock enabled with pin low level Pin Action Table 26-21. Clock Selection CLK1 0 0 1 1 CLK0 0 1 0 1 Clock Source Use timer prescaler clock as timer counter clock Use PACLK as input to timer counter clock Use PACLK/256 as timer counter clock frequency Use PACLK/65536 as timer counter clock frequency MC9S12XF - Family Reference Manual, Rev.1.19 1148 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.16 Pulse Accumulator A Flag Register (PAFLG) Module Base + 0x0021 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 PAOVF 0 PAIF 0 = Unimplemented or Reserved Figure 26-37. Pulse Accumulator A Flag Register (PAFLG) Read: Anytime Write used in the ﬂag clearing mechanism. Writing a one to the ﬂag clears the ﬂag. Writing a zero will not affect the current status of the bit. NOTE When TFFCA = 1, the ﬂags cannot be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag). Reference Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”. All bits reset to zero. PAFLG indicates when interrupt conditions have occurred. The ﬂags can be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag) or via the fast ﬂag clearing mechanism (Reference TFFCA bit in Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”). Table 26-22. PAFLG Field Descriptions Field 1 PAOVF Description Pulse Accumulator A Overﬂow Flag — Set when the 16-bit pulse accumulator A overﬂows from 0xFFFF to 0x0000, or when 8-bit pulse accumulator 3 (PAC3) overﬂows from 0x00FF to 0x0000. When PACMX = 1, PAOVF bit can also be set if 8-bit pulse accumulator 3 (PAC3) reaches 0x00FF followed by an active edge on IC3. 0 PAIF Pulse Accumulator Input edge Flag — Set when the selected edge is detected at the IC7 input pin. In event mode the event edge triggers PAIF and in gated time accumulation mode the trailing edge of the gate signal at the IC7 input pin triggers PAIF. 26.3.2.17 Pulse Accumulators Count Registers (PACN3 and PACN2) Module Base + 0x0022 7 6 5 4 3 2 1 0 R W Reset PACNT7(15) PACNT6(14) PACNT5(13) PACNT4(12) PACNT3(11) PACNT2(10) 0 0 0 0 0 0 PACNT1(9) 0 PACNT0(8) 0 Figure 26-38. Pulse Accumulators Count Register 3 (PACN3) MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1149 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Module Base + 0x0023 7 6 5 4 3 2 1 0 R W Reset PACNT7 0 PACNT6 0 PACNT5 0 PACNT4 0 PACNT3 0 PACNT2 0 PACNT1 0 PACNT0 0 Figure 26-39. Pulse Accumulators Count Register 2 (PACN2) Read: Anytime Write: Anytime All bits reset to zero. The two 8-bit pulse accumulators PAC3 and PAC2 are cascaded to form the PACA 16-bit pulse accumulator. When PACA in enabled (PAEN = 1 in PACTL), the PACN3 and PACN2 registers contents are respectively the high and low byte of the PACA. When PACN3 overﬂows from 0x00FF to 0x0000, the interrupt ﬂag PAOVF in PAFLG is set. Full count register access will take place in one clock cycle. NOTE A separate read/write for high byte and low byte will give a different result than accessing them as a word. When clocking pulse and write to the registers occurs simultaneously, write takes priority and the register is not incremented. 26.3.2.18 Pulse Accumulators Count Registers (PACN1 and PACN0) Module Base + 0x0024 7 6 5 4 3 2 1 0 R W Reset PACNT7(15) PACNT6(14) PACNT5(13) PACNT4(12) PACNT3(11) PACNT2(10) 0 0 0 0 0 0 PACNT1(9) 0 PACNT0(8) 0 Figure 26-40. Pulse Accumulators Count Register 1 (PACN1) Module Base + 0x0025 7 6 5 4 3 2 1 0 R W Reset PACNT7 0 PACNT6 0 PACNT5 0 PACNT4 0 PACNT3 0 PACNT2 0 PACNT1 0 PACNT0 0 Figure 26-41. Pulse Accumulators Count Register 0 (PACN0) Read: Anytime Write: Anytime MC9S12XF - Family Reference Manual, Rev.1.19 1150 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) All bits reset to zero. The two 8-bit pulse accumulators PAC1 and PAC0 are cascaded to form the PACB 16-bit pulse accumulator. When PACB in enabled, (PBEN = 1 in PBCTL) the PACN1 and PACN0 registers contents are respectively the high and low byte of the PACB. When PACN1 overﬂows from 0x00FF to 0x0000, the interrupt ﬂag PBOVF in PBFLG is set. Full count register access will take place in one clock cycle. NOTE A separate read/write for high byte and low byte will give a different result than accessing them as a word. When clocking pulse and write to the registers occurs simultaneously, write takes priority and the register is not incremented. 26.3.2.19 16-Bit Modulus Down-Counter Control Register (MCCTL) Module Base + 0x0026 7 6 5 4 3 2 1 0 R W Reset MCZI 0 MODMC 0 RDMCL 0 0 ICLAT 0 0 FLMC 0 MCEN 0 MCPR1 0 MCPR0 0 Figure 26-42. 16-Bit Modulus Down-Counter Control Register (MCCTL) Read: Anytime Write: Anytime All bits reset to zero. Table 26-23. MCCTL Field Descriptions Field 7 MCZI 6 MODMC Modulus Counter Underﬂow Interrupt Enable 0 Modulus counter interrupt is disabled. 1 Modulus counter interrupt is enabled. Modulus Mode Enable 0 The modulus counter counts down from the value written to it and will stop at 0x0000. 1 Modulus mode is enabled. When the modulus counter reaches 0x0000, the counter is loaded with the latest value written to the modulus count register. Note: For proper operation, the MCEN bit should be cleared before modifying the MODMC bit in order to reset the modulus counter to 0xFFFF. Read Modulus Down-Counter Load 0 Reads of the modulus count register (MCCNT) will return the present value of the count register. 1 Reads of the modulus count register (MCCNT) will return the contents of the load register. Description 5 RDMCL MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1151 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-23. MCCTL Field Descriptions (continued) Field 4 ICLAT Description Input Capture Force Latch Action — When input capture latch mode is enabled (LATQ and BUFEN bit in ICSYS are set), a write one to this bit immediately forces the contents of the input capture registers TC0 to TC3 and their corresponding 8-bit pulse accumulators to be latched into the associated holding registers. The pulse accumulators will be automatically cleared when the latch action occurs. Writing zero to this bit has no effect. Read of this bit will always return zero. 3 FLMC Force Load Register into the Modulus Counter Count Register — This bit is active only when the modulus down-counter is enabled (MCEN = 1). A write one into this bit loads the load register into the modulus counter count register (MCCNT). This also resets the modulus counter prescaler. Write zero to this bit has no effect. Read of this bit will return always zero. 2 MCEN Modulus Down-Counter Enable 0 Modulus counter disabled. The modulus counter (MCCNT) is preset to 0xFFFF. This will prevent an early interrupt ﬂag when the modulus down-counter is enabled. 1 Modulus counter is enabled. Modulus Counter Prescaler Select — These two bits specify the division rate of the modulus counter prescaler when PRNT of TSCR1 is set to 0. The newly selected prescaler division rate will not be effective until a load of the load register into the modulus counter count register occurs. 1:0 MCPR[1:0] Table 26-24. Modulus Counter Prescaler Select MCPR1 0 0 1 1 MCPR0 0 1 0 1 Prescaler Division 1 4 8 16 26.3.2.20 16-Bit Modulus Down-Counter FLAG Register (MCFLG) Module Base + 0x0027 7 6 5 4 3 2 1 0 R W Reset MCZF 0 0 0 0 0 0 0 POLF3 0 POLF2 0 POLF1 0 POLF0 0 = Unimplemented or Reserved Figure 26-43. 16-Bit Modulus Down-Counter FLAG Register (MCFLG) Read: Anytime Write only used in the ﬂag clearing mechanism for bit 7. Writing a one to bit 7 clears the ﬂag. Writing a zero will not affect the current status of the bit. MC9S12XF - Family Reference Manual, Rev.1.19 1152 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) NOTE When TFFCA = 1, the ﬂag cannot be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag). Reference Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”. All bits reset to zero. Table 26-25. MCFLG Field Descriptions Field 7 MCZF Description Modulus Counter Underﬂow Flag — The ﬂag is set when the modulus down-counter reaches 0x0000. The ﬂag indicates when interrupt conditions have occurred. The ﬂag can be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag) or via the fast ﬂag clearing mechanism (Reference TFFCA bit in Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”). First Input Capture Polarity Status — These are read only bits. Writes to these bits have no effect. Each status bit gives the polarity of the ﬁrst edge which has caused an input capture to occur after capture latch has been read. Each POLFx corresponds to a timer PORTx input. 0 The ﬁrst input capture has been caused by a falling edge. 1 The ﬁrst input capture has been caused by a rising edge. 3:0 POLF[3:0] 26.3.2.21 ICPAR — Input Control Pulse Accumulators Register (ICPAR) Module Base + 0x0028 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 PA3EN 0 PA2EN 0 PA1EN 0 PA0EN 0 = Unimplemented or Reserved Figure 26-44. Input Control Pulse Accumulators Register (ICPAR) Read: Anytime Write: Anytime. All bits reset to zero. The 8-bit pulse accumulators PAC3 and PAC2 can be enabled only if PAEN in PACTL is cleared. If PAEN is set, PA3EN and PA2EN have no effect. The 8-bit pulse accumulators PAC1 and PAC0 can be enabled only if PBEN in PBCTL is cleared. If PBEN is set, PA1EN and PA0EN have no effect. Table 26-26. ICPAR Field Descriptions Field 3:0 PA[3:0]EN 8-Bit Pulse Accumulator ‘x’ Enable 0 8-Bit Pulse Accumulator is disabled. 1 8-Bit Pulse Accumulator is enabled. Description MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1153 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.22 Delay Counter Control Register (DLYCT) Module Base + 0x0029 7 6 5 4 3 2 1 0 R W Reset DLY7 0 DLY6 0 DLY5 0 DLY4 0 DLY3 0 DLY2 0 DLY1 0 DLY0 0 Figure 26-45. Delay Counter Control Register (DLYCT) Read: Anytime Write: Anytime All bits reset to zero. Table 26-27. DLYCT Field Descriptions Field 7:0 DLY[7:0] Description Delay Counter Select — When the PRNT bit of TSCR1 register is set to 0, only bits DLY0, DLY1 are used to calculate the delay.Table 26-28 shows the delay settings in this case. When the PRNT bit of TSCR1 register is set to 1, all bits are used to set a more precise delay. Table 26-29 shows the delay settings in this case. After detection of a valid edge on an input capture pin, the delay counter counts the pre-selected number of [(dly_cnt + 1)*4]bus clock cycles, then it will generate a pulse on its output if the level of input signal, after the preset delay, is the opposite of the level before the transition.This will avoid reaction to narrow input pulses. Delay between two active edges of the input signal period should be longer than the selected counter delay. Note: It is recommended to not write to this register while the timer is enabled, that is when TEN is set in register TSCR1. Table 26-28. Delay Counter Select when PRNT = 0 DLY1 0 0 1 1 DLY0 0 1 0 1 Delay Disabled 256 bus clock cycles 512 bus clock cycles 1024 bus clock cycles Table 26-29. Delay Counter Select Examples when PRNT = 1 DLY7 0 0 0 0 0 0 0 DLY6 0 0 0 0 0 0 0 DLY5 0 0 0 0 0 0 0 DLY4 0 0 0 0 0 0 0 DLY3 0 0 0 0 0 0 0 DLY2 0 0 0 0 1 1 1 DLY1 0 0 1 1 0 0 1 DLY0 0 1 0 1 0 1 0 Delay Disabled (bypassed) 8 bus clock cycles 12 bus clock cycles 16 bus clock cycles 20 bus clock cycles 24 bus clock cycles 28 bus clock cycles MC9S12XF - Family Reference Manual, Rev.1.19 1154 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-29. Delay Counter Select Examples when PRNT = 1 DLY7 0 0 0 0 0 1 DLY6 0 0 0 0 1 1 DLY5 0 0 0 1 1 1 DLY4 0 0 1 1 1 1 DLY3 0 1 1 1 1 1 DLY2 1 1 1 1 1 1 DLY1 1 1 1 1 1 1 DLY0 1 1 1 1 1 1 Delay 32 bus clock cycles 64 bus clock cycles 128 bus clock cycles 256 bus clock cycles 512 bus clock cycles 1024 bus clock cycles 26.3.2.23 Input Control Overwrite Register (ICOVW) Module Base + 0x002A 7 6 5 4 3 2 1 0 R W Reset NOVW7 0 NOVW6 0 NOVW5 0 NOVW4 0 NOVW3 0 NOVW2 0 NOVW1 0 NOVW0 0 Figure 26-46. Input Control Overwrite Register (ICOVW) Read: Anytime Write: Anytime All bits reset to zero. Table 26-30. ICOVW Field Descriptions Field 7:0 NOVW[7:0] Description No Input Capture Overwrite 0 The contents of the related capture register or holding register can be overwritten when a new input capture or latch occurs. 1 The related capture register or holding register cannot be written by an event unless they are empty (see Section 26.4.1.1, “IC Channels”). This will prevent the captured value being overwritten until it is read or latched in the holding register. 26.3.2.24 Input Control System Control Register (ICSYS) Module Base + 0x002B 7 6 5 4 3 2 1 0 R W Reset SH37 0 SH26 0 SH15 0 SH04 0 TFMOD 0 PACMX 0 BUFEN 0 LATQ 0 Figure 26-47. Input Control System Register (ICSYS) Read: Anytime Write: Once in normal modes MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1155 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) All bits reset to zero. Table 26-31. ICSYS Field Descriptions Field 7:4 SHxy Description Share Input action of Input Capture Channels x and y 0 Normal operation 1 The channel input ‘x’ causes the same action on the channel ‘y’. The port pin ‘x’ and the corresponding edge detector is used to be active on the channel ‘y’. Timer Flag Setting Mode — Use of the TFMOD bit in conjunction with the use of the ICOVW register allows a timer interrupt to be generated after capturing two values in the capture and holding registers instead of generating an interrupt for every capture. By setting TFMOD in queue mode, when NOVWx bit is set and the corresponding capture and holding registers are emptied, an input capture event will ﬁrst update the related input capture register with the main timer contents. At the next event, the TCx data is transferred to the TCxH register, the TCx is updated and the CxF interrupt ﬂag is set. In all other input capture cases the interrupt ﬂag is set by a valid external event on ICx. 0 The timer ﬂags C3F–C0F in TFLG1 are set when a valid input capture transition on the corresponding port pin occurs. 1 If in queue mode (BUFEN = 1 and LATQ = 0), the timer ﬂags C3F–C0F in TFLG1 are set only when a latch on the corresponding holding register occurs. If the queue mode is not engaged, the timer ﬂags C3F–C0F are set the same way as for TFMOD = 0. 8-Bit Pulse Accumulators Maximum Count 0 Normal operation. When the 8-bit pulse accumulator has reached the value 0x00FF, with the next active edge, it will be incremented to 0x0000. 1 When the 8-bit pulse accumulator has reached the value 0x00FF, it will not be incremented further. The value 0x00FF indicates a count of 255 or more. IC Buffer Enable 0 Input capture and pulse accumulator holding registers are disabled. 1 Input capture and pulse accumulator holding registers are enabled. The latching mode is deﬁned by LATQ control bit. Input Control Latch or Queue Mode Enable — The BUFEN control bit should be set in order to enable the IC and pulse accumulators holding registers. Otherwise LATQ latching modes are disabled. Write one into ICLAT bit in MCCTL, when LATQ and BUFEN are set will produce latching of input capture and pulse accumulators registers into their holding registers. 0 Queue mode of Input Capture is enabled. The main timer value is memorized in the IC register by a valid input pin transition. With a new occurrence of a capture, the value of the IC register will be transferred to its holding register and the IC register memorizes the new timer value. 1 Latch mode is enabled. Latching function occurs when modulus down-counter reaches zero or a zero is written into the count register MCCNT (see Section 26.4.1.1.2, “Buffered IC Channels”). With a latching event the contents of IC registers and 8-bit pulse accumulators are transferred to their holding registers. 8-bit pulse accumulators are cleared. 3 TFMOD 2 PACMX 1 BUFFEN 0 LATQ MC9S12XF - Family Reference Manual, Rev.1.19 1156 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.25 Output Compare Pin Disconnect Register (OCPD) Module Base + 0x002C 7 6 5 4 3 2 1 0 R W Reset OCPD7 0 OCPD6 0 OCPD5 0 OCPD4 0 OCPD3 0 OCPD2 0 OCPD1 0 OCPD0 0 Figure 26-48. Output Compare Pin Disconnect Register (OCPD) Read: Anytime Write: Anytime All bits reset to zero. Table 26-32. OCPD Field Descriptions Field 7:0 OCPD[7:0] Description Output Compare Pin Disconnect Bits 0 Enables the timer channel IO port. Output Compare actions will occur on the channel pin. These bits do not affect the input capture or pulse accumulator functions. 1 Disables the timer channel IO port. Output Compare actions will not affect on the channel pin; the output compare flag will still be set on an Output Compare event. 26.3.2.26 Precision Timer Prescaler Select Register (PTPSR) Module Base + 0x002E 7 6 5 4 3 2 1 0 R W Reset PTPS7 0 PTPS6 0 PTPS5 0 PTPS4 0 PTPS3 0 PTPS2 0 PTPS1 0 PTPS0 0 Figure 26-49. Precision Timer Prescaler Select Register (PTPSR) Read: Anytime Write: Anytime All bits reset to zero. Table 26-33. PTPSR Field Descriptions Field 7:0 PTPS[7:0] Description Precision Timer Prescaler Select Bits — These eight bits specify the division rate of the main Timer prescaler. These are effective only when the PRNT bit of TSCR1 is set to 1. Table 26-34 shows some selection examples in this case. The newly selected prescale factor will not take effect until the next synchronized edge where all prescale counter stages equal zero. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1157 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-34. Precision Timer Prescaler Selection Examples when PRNT = 1 PTPS7 0 0 0 0 0 0 0 0 0 0 0 0 1 PTPS6 0 0 0 0 0 0 0 0 0 0 0 1 1 PTPS5 0 0 0 0 0 0 0 0 0 0 1 1 1 PTPS4 0 0 0 0 0 0 0 0 0 1 1 1 1 PTPS3 0 0 0 0 0 0 0 0 1 1 1 1 1 PTPS2 0 0 0 0 1 1 1 1 1 1 1 1 1 PTPS1 0 0 1 1 0 0 1 1 1 1 1 1 1 PTPS0 0 1 0 1 0 1 0 1 1 1 1 1 1 Prescale Factor 1 2 3 4 5 6 7 8 16 32 64 128 256 26.3.2.27 Precision Timer Modulus Counter Prescaler Select Register (PTMCPSR) Module Base + 0x002F 7 6 5 4 3 2 1 0 R W Reset PTMPS7 0 PTMPS6 0 PTMPS5 0 PTMPS4 0 PTMPS3 0 PTMPS2 0 PTMPS1 0 PTMPS0 0 Figure 26-50. Precision Timer Modulus Counter Prescaler Select Register (PTMCPSR) Read: Anytime Write: Anytime All bits reset to zero. Table 26-35. PTMCPSR Field Descriptions Field Description 7:0 Precision Timer Modulus Counter Prescaler Select Bits — These eight bits specify the division rate of the PTMPS[7:0] modulus counter prescaler. These are effective only when the PRNT bit of TSCR1 is set to 1. Table 26-36 shows some possible division rates. The newly selected prescaler division rate will not be effective until a load of the load register into the modulus counter count register occurs. MC9S12XF - Family Reference Manual, Rev.1.19 1158 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-36. Precision Timer Modulus Counter Prescaler Select Examples when PRNT = 1 PTMPS7 0 0 0 0 0 0 0 0 0 0 0 0 1 PTMPS6 0 0 0 0 0 0 0 0 0 0 0 1 1 PTMPS5 0 0 0 0 0 0 0 0 0 0 1 1 1 PTMPS4 0 0 0 0 0 0 0 0 0 1 1 1 1 PTMPS3 0 0 0 0 0 0 0 0 1 1 1 1 1 PTMPS2 0 0 0 0 1 1 1 1 1 1 1 1 1 PTMPS1 0 0 1 1 0 0 1 1 1 1 1 1 1 PTMPS0 0 1 0 1 0 1 0 1 1 1 1 1 1 Prescaler Division Rate 1 2 3 4 5 6 7 8 16 32 64 128 256 26.3.2.28 16-Bit Pulse Accumulator B Control Register (PBCTL) Module Base + 0x0030 7 6 5 4 3 2 1 0 R W Reset 0 0 PBEN 0 0 0 0 0 0 0 0 0 PBOVI 0 0 0 = Unimplemented or Reserved Figure 26-51. 16-Bit Pulse Accumulator B Control Register (PBCTL) Read: Anytime Write: Anytime All bits reset to zero. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1159 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Table 26-37. PBCTL Field Descriptions Field 6 PBEN Description Pulse Accumulator B System Enable — PBEN is independent from TEN. With timer disabled, the pulse accumulator can still function unless pulse accumulator is disabled. 0 16-bit pulse accumulator system disabled. 8-bit PAC1 and PAC0 can be enabled when their related enable bits in ICPAR are set. 1 Pulse accumulator B system enabled. The two 8-bit pulse accumulators PAC1 and PAC0 are cascaded to form the PACB 16-bit pulse accumulator B. When PACB is enabled, the PACN1 and PACN0 registers contents are respectively the high and low byte of the PACB. PA1EN and PA0EN control bits in ICPAR have no effect. The PACB shares the input pin with IC0. Pulse Accumulator B Overﬂow Interrupt Enable 0 Interrupt inhibited 1 Interrupt requested if PBOVF is set 1 PBOVI 26.3.2.29 Pulse Accumulator B Flag Register (PBFLG) Module Base + 0x0031 7 6 5 4 3 2 1 0 R W Reset 0 0 0 0 0 0 0 0 0 0 0 0 PBOVF 0 0 0 = Unimplemented or Reserved Figure 26-52. Pulse Accumulator B Flag Register (PBFLG) Read: Anytime Write used in the ﬂag clearing mechanism. Writing a one to the ﬂag clears the ﬂag. Writing a zero will not affect the current status of the bit. NOTE When TFFCA = 1, the ﬂag cannot be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag). Reference Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”. All bits reset to zero. PBFLG indicates when interrupt conditions have occurred. The ﬂag can be cleared via the normal ﬂag clearing mechanism (writing a one to the ﬂag) or via the fast ﬂag clearing mechanism (Reference TFFCA bit in Section 26.3.2.6, “Timer System Control Register 1 (TSCR1)”). Table 26-38. PBFLG Field Descriptions Field 1 PBOVF Description Pulse Accumulator B Overﬂow Flag — This bit is set when the 16-bit pulse accumulator B overﬂows from 0xFFFF to 0x0000, or when 8-bit pulse accumulator 1 (PAC1) overﬂows from 0x00FF to 0x0000. When PACMX = 1, PBOVF bit can also be set if 8-bit pulse accumulator 1 (PAC1) reaches 0x00FF and an active edge follows on IC1. MC9S12XF - Family Reference Manual, Rev.1.19 1160 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.30 8-Bit Pulse Accumulators Holding Registers (PA3H–PA0H) Module Base + 0x0032 7 6 5 4 3 2 1 0 R W Reset PA3H7 0 PA3H6 0 PA3H5 0 PA3H4 0 PA3H3 0 PA3H2 0 PA3H1 0 PA3H0 0 = Unimplemented or Reserved Figure 26-53. 8-Bit Pulse Accumulators Holding Register 3 (PA3H) Module Base + 0x0033 7 6 5 4 3 2 1 0 R W Reset PA2H7 0 PA2H6 0 PA2H5 0 PA2H4 0 PA2H3 0 PA2H2 0 PA2H1 0 PA2H0 0 = Unimplemented or Reserved Figure 26-54. 8-Bit Pulse Accumulators Holding Register 2 (PA2H) Module Base + 0x0034 7 6 5 4 3 2 1 0 R W Reset PA1H7 0 PA1H6 0 PA1H5 0 PA1H4 0 PA1H3 0 PA1H2 0 PA1H1 0 PA1H0 0 = Unimplemented or Reserved Figure 26-55. 8-Bit Pulse Accumulators Holding Register 1 (PA1H) Module Base + 0x0035 7 6 5 4 3 2 1 0 R W Reset PA0H7 0 PA0H6 0 PA0H5 0 PA0H4 0 PA0H3 0 PA0H2 0 PA0H1 0 PA0H0 0 = Unimplemented or Reserved Figure 26-56. 8-Bit Pulse Accumulators Holding Register 0 (PA0H) Read: Anytime. Write: Has no effect. All bits reset to zero. These registers are used to latch the value of the corresponding pulse accumulator when the related bits in register ICPAR are enabled (see Section 26.4.1.3, “Pulse Accumulators”). MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1161 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.31 Modulus Down-Counter Count Register (MCCNT) Module Base + 0x0036 15 14 13 12 11 10 9 8 R W Reset MCCNT15 1 MCCNT14 1 MCCNT13 1 MCCNT12 1 MCCNT11 1 MCCNT10 1 MCCNT9 1 MCCNT8 1 Figure 26-57. Modulus Down-Counter Count Register High (MCCNT) Module Base + 0x0037 7 6 5 4 3 2 1 0 R W Reset MCCNT7 1 MCCNT6 1 MCCNT5 1 MCCNT4 1 MCCNT3 1 MCCNT2 1 MCCNT1 1 MCCNT0 1 Figure 26-58. Modulus Down-Counter Count Register Low (MCCNT) Read: Anytime Write: Anytime. All bits reset to one. A full access for the counter register will take place in one clock cycle. NOTE A separate read/write for high byte and low byte will give different results than accessing them as a word. If the RDMCL bit in MCCTL register is cleared, reads of the MCCNT register will return the present value of the count register. If the RDMCL bit is set, reads of the MCCNT will return the contents of the load register. If a 0x0000 is written into MCCNT when LATQ and BUFEN in ICSYS register are set, the input capture and pulse accumulator registers will be latched. With a 0x0000 write to the MCCNT, the modulus counter will stay at zero and does not set the MCZF ﬂag in MCFLG register. If the modulus down counter is enabled (MCEN = 1) and modulus mode is enabled (MODMC = 1), a write to MCCNT will update the load register with the value written to it. The count register will not be updated with the new value until the next counter underﬂow. If modulus mode is not enabled (MODMC = 0), a write to MCCNT will clear the modulus prescaler and will immediately update the counter register with the value written to it and down-counts to 0x0000 and stops. The FLMC bit in MCCTL can be used to immediately update the count register with the new value if an immediate load is desired. MC9S12XF - Family Reference Manual, Rev.1.19 1162 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.3.2.32 Timer Input Capture Holding Registers 0–3 (TCxH) Module Base + 0x0038 15 14 13 12 11 10 9 8 R W Reset TC15 0 TC14 0 TC13 0 TC12 0 TC11 0 TC10 0 TC9 0 TC8 0 = Unimplemented or Reserved Figure 26-59. Timer Input Capture Holding Register 0 High (TC0H) Module Base + 0x0039 7 6 5 4 3 2 1 0 R W Reset TC7 0 TC6 0 TC5 0 TC4 0 TC3 0 TC2 0 TC1 0 TC0 0 = Unimplemented or Reserved Figure 26-60. Timer Input Capture Holding Register 0 Low (TC0H) Module Base + 0x003A 15 14 13 12 11 10 9 8 R W Reset TC15 0 TC14 0 TC13 0 TC12 0 TC11 0 TC10 0 TC9 0 TC8 0 = Unimplemented or Reserved Figure 26-61. Timer Input Capture Holding Register 1 High (TC1H) Module Base + 0x003B 7 6 5 4 3 2 1 0 R W Reset TC7 0 TC6 0 TC5 0 TC4 0 TC3 0 TC2 0 TC1 0 TC0 0 = Unimplemented or Reserved Figure 26-62. Timer Input Capture Holding Register 1 Low (TC1H) Module Base + 0x003C 15 14 13 12 11 10 9 8 R W Reset TC15 0 TC14 0 TC13 0 TC12 0 TC11 0 TC10 0 TC9 0 TC8 0 = Unimplemented or Reserved Figure 26-63. Timer Input Capture Holding Register 2 High (TC2H) MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1163 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Module Base + 0x003D 7 6 5 4 3 2 1 0 R W Reset TC7 0 TC6 0 TC5 0 TC4 0 TC3 0 TC2 0 TC1 0 TC0 0 = Unimplemented or Reserved Figure 26-64. Timer Input Capture Holding Register 2 Low (TC2H) Module Base + 0x003E 15 14 13 12 11 10 9 8 R W Reset TC15 0 TC14 0 TC13 0 TC12 0 TC11 0 TC10 0 TC9 0 TC8 0 = Unimplemented or Reserved Figure 26-65. Timer Input Capture Holding Register 3 High (TC3H) Module Base + 0x003F 7 6 5 4 3 2 1 0 R W Reset TC7 0 TC6 0 TC5 0 TC4 0 TC3 0 TC2 0 TC1 0 TC0 0 = Unimplemented or Reserved Figure 26-66. Timer Input Capture Holding Register 3 Low (TC3H) Read: Anytime Write: Has no effect. All bits reset to zero. These registers are used to latch the value of the input capture registers TC0–TC3. The corresponding IOSx bits in TIOS should be cleared (see Section 26.4.1.1, “IC Channels”). 26.4 Functional Description This section provides a complete functional description of the ECT block, detailing the operation of the design from the end user perspective in a number of subsections. MC9S12XF - Family Reference Manual, Rev.1.19 1164 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) ÷ 1, 2, ..., 128 Bus Clock Timer Prescaler 16-Bit Free-Running 16 BITMain Timer MAIN TIMER Bus Clock ÷ 1, 4, 8, 16 Modulus Prescaler 16-Bit Load Register 16-Bit Modulus Down Counter 0 RESET Underﬂow RESET RESET RESET LATCH P0 Pin Logic Comparator Delay Counter EDG0 TC0 Capture/Compare Reg. PAC0 TC0H Hold Reg. PA0H Hold Reg. 0 P1 Pin Logic Comparator Delay Counter EDG1 TC1 Capture/Compare Reg. PAC1 TC1H Hold Reg. PA1H Hold Reg. 0 P2 Pin Logic Comparator Delay Counter EDG2 TC2 Capture/Compare Reg. PAC2 TC2H Hold Reg. Comparator Delay Counter EDG3 TC3 Capture/Compare Reg. PA2H Hold Reg. 0 P3 Pin Logic PAC3 TC3H Hold Reg. PA3H Hold Reg. P4 Pin Logic Comparator EDG4 EDG0 SH04 Comparator EDG5 EDG1 SH15 Comparator EDG6 EDG2 SH26 Comparator EDG7 EDG3 SH37 MUX TC7 Capture/Compare Reg. MUX TC6 Capture/Compare Reg. MUX TC5 Capture/Compare Reg. Write 0x0000 to Modulus Counter MUX TC4 Capture/Compare Reg. ICLAT, LATQ, BUFEN (Force Latch) P5 Pin Logic P6 Pin Logic LATQ (MDC Latch Enable) P7 Pin Logic Figure 26-67. Detailed Timer Block Diagram in Latch Mode when PRNT = 0 MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1165 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) ÷ 1, 2,3, ..., 256 Bus Clock Timer Prescaler 16-Bit Free-Running 16 BITMain Timer MAIN TIMER Bus Clock ÷ 1, 2,3, ..., 256 Modulus Prescaler 16-Bit Load Register 16-Bit Modulus Down Counter 0 RESET Underﬂow RESET RESET RESET LATCH P0 Pin Logic Comparator Delay Counter EDG0 TC0 Capture/Compare Reg. PAC0 8, 12, 16, ..., 1024 TC0H Hold Reg. PA0H Hold Reg. 0 P1 Pin Logic Comparator Delay Counter EDG1 TC1 Capture/Compare Reg. PAC1 8, 12, 16, ..., 1024 TC1H Hold Reg. PA1H Hold Reg. 0 P2 Pin Logic Comparator Delay Counter EDG2 TC2 Capture/Compare Reg. PAC2 8, 12, 16, ..., 1024 TC2H Hold Reg. Comparator Delay Counter EDG3 TC3 Capture/Compare Reg. PAC3 PA2H Hold Reg. 0 P3 Pin Logic 8, 12, 16, ..., 1024 TC3H Hold Reg. PA3H Hold Reg. P4 Pin Logic Comparator EDG4 EDG0 SH04 Comparator EDG5 EDG1 SH15 Comparator EDG6 EDG2 SH26 Comparator EDG7 EDG3 SH37 MUX TC7 Capture/Compare Reg. MUX TC6 Capture/Compare Reg. MUX TC5 Capture/Compare Reg. Write 0x0000 to Modulus Counter MUX TC4 Capture/Compare Reg. ICLAT, LATQ, BUFEN (Force Latch) P5 Pin Logic P6 Pin Logic LATQ (MDC Latch Enable) P7 Pin Logic Figure 26-68. Detailed Timer Block Diagram in Latch Mode when PRNT = 1 MC9S12XF - Family Reference Manual, Rev.1.19 1166 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Bus Clock ÷1, 2, ..., 128 Timer Prescaler 16-Bit Free-Running 16 BIT MAIN TIMER Main Timer Bus Clock ÷ 1, 4, 8, 16 Modulus Prescaler 16-Bit Load Register 16-Bit Modulus Down Counter 0 RESET P0 Pin Logic Comparator Delay Counter EDG0 TC0 Capture/Compare Reg. PAC0 LATCH0 LATCH3 LATCH2 LATCH1 TC0H Hold Reg. Comparator Delay Counter EDG1 TC1 Capture/Compare Reg. PA0H Hold Reg. 0 RESET P1 Pin Logic PAC1 TC1H Hold Reg. Comparator Delay Counter EDG2 TC2 Capture/Compare Reg. PA1H Hold Reg. 0 RESET P2 Pin Logic PAC2 TC2H Hold Reg. Comparator Delay Counter EDG3 TC3 Capture/Compare Reg. PA2H Hold Reg. 0 RESET P3 Pin Logic PAC3 TC3H Hold Reg. Comparator EDG4 EDG0 MUX SH04 P5 Pin Logic Comparator EDG5 EDG1 MUX SH15 P6 Pin Logic Comparator EDG6 EDG2 MUX SH26 P7 Pin Logic Comparator EDG7 EDG3 SH37 MUX TC7 Capture/Compare Reg. TC6 Capture/Compare Reg. TC5 Capture/Compare Reg. TC4 Capture/Compare Reg. PA3H Hold Reg. P4 Pin Logic LATQ, BUFEN (Queue Mode) Read TC3H Hold Reg. Read TC2H Hold Reg. Read TC1H Hold Reg. Read TC0H Hold Reg. Figure 26-69. Detailed Timer Block Diagram in Queue Mode when PRNT = 0 MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1167 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) ÷1, 2, 3, ... 256 Bus Clock Timer Prescaler 16-Bit Free-Running 16 BIT MAIN TIMER Main Timer Bus Clock ÷ 1, 2, 3, ... 256 Modulus Prescaler 0 P0 Pin Logic Comparator Delay Counter EDG0 TC0 Capture/Compare Reg. PAC0 LATCH0 LATCH3 LATCH2 LATCH1 16-Bit Load Register 16-Bit Modulus Down Counter RESET 8, 12, 16, ... 1024 TC0H Hold Reg. Comparator Delay Counter EDG1 TC1 Capture/Compare Reg. PAC1 PA0H Hold Reg. 0 P1 Pin Logic RESET 8, 12, 16, ... 1024 TC1H Hold Reg. Comparator Delay Counter EDG2 TC2 Capture/Compare Reg. PAC2 PA1H Hold Reg. 0 P2 Pin Logic RESET 8, 12, 16, ... 1024 TC2H Hold Reg. Comparator Delay Counter EDG3 TC3 Capture/Compare Reg. PAC3 PA2H Hold Reg. 0 P3 Pin Logic RESET 8, 12, 16, ... 1024 TC3H Hold Reg. Comparator EDG4 EDG0 MUX SH04 P5 Pin Logic Comparator EDG5 EDG1 MUX SH15 P6 Pin Logic Comparator EDG6 EDG2 MUX SH26 P7 Pin Logic Comparator EDG7 EDG3 SH37 MUX TC7 Capture/Compare Reg. Read TC0H Hold Reg. TC6 Capture/Compare Reg. Read TC1H Hold Reg. Read TC2H Hold Reg. TC5 Capture/Compare Reg. TC4 Capture/Compare Reg. PA3H Hold Reg. P4 Pin Logic LATQ, BUFEN (Queue Mode) Read TC3H Hold Reg. Figure 26-70. Detailed Timer Block Diagram in Queue Mode when PRNT = 1 MC9S12XF - Family Reference Manual, Rev.1.19 1168 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) Load Holding Register and Reset Pulse Accumulator 0 EDG0 P0 Edge Detector Delay Counter 8-Bit PAC0 (PACN0) 8, 12,16, ..., 1024 PA0H Holding Register Interrupt 8, 12,16, ..., 1024 EDG1 P1 Edge Detector Delay Counter 0 8-Bit PAC1 (PACN1) PA1H Holding Register 8, 12,16, ..., 1024 EDG2 P2 Edge Detector Delay Counter 0 8-Bit PAC2 (PACN2) PA2H Holding Register Interrupt 8, 12,16, ..., 1024 P3 Edge Detector Delay Counter 0 EDG3 8-Bit PAC3 (PACN3) PA3H Holding Register Figure 26-71. 8-Bit Pulse Accumulators Block Diagram MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1169 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) TIMCLK (Timer Clock) CLK1 CLK0 4:1 MUX PACLK / 65536 PACLK / 256 Prescaled Clock (PCLK) Clock Select (PAMOD) PACLK Edge Detector P7 Interrupt 8-Bit PAC3 (PACN3) PACA 8-Bit PAC2 (PACN2) MUX Divide by 64 Bus Clock Interrupt 8-Bit PAC1 (PACN1) PACB 8-Bit PAC0 (PACN0) Delay Counter Edge Detector P0 Figure 26-72. 16-Bit Pulse Accumulators Block Diagram 16-Bit Main Timer Px Edge Detector Delay Counter TCx Input Capture Register Set CxF Interrupt TCxH I.C. Holding Register BUFEN • LATQ • TFMOD Figure 26-73. Block Diagram for Port 7 with Output Compare/Pulse Accumulator A MC9S12XF - Family Reference Manual, Rev.1.19 1170 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.4.1 Enhanced Capture Timer Modes of Operation The enhanced capture timer has 8 input capture, output compare (IC/OC) channels, same as on the HC12 standard timer (timer channels TC0 to TC7). When channels are selected as input capture by selecting the IOSx bit in TIOS register, they are called input capture (IC) channels. Four IC channels (channels 7–4) are the same as on the standard timer with one capture register each that memorizes the timer value captured by an action on the associated input pin. Four other IC channels (channels 3–0), in addition to the capture register, also have one buffer each called a holding register. This allows two different timer values to be saved without generating any interrupts. Four 8-bit pulse accumulators are associated with the four buffered IC channels (channels 3–0). Each pulse accumulator has a holding register to memorize their value by an action on its external input. Each pair of pulse accumulators can be used as a 16-bit pulse accumulator. The 16-bit modulus down-counter can control the transfer of the IC registers and the pulse accumulators contents to the respective holding registers for a given period, every time the count reaches zero. The modulus down-counter can also be used as a stand-alone time base with periodic interrupt capability. 26.4.1.1 IC Channels The IC channels are composed of four standard IC registers and four buffered IC channels. • An IC register is empty when it has been read or latched into the holding register. • A holding register is empty when it has been read. 26.4.1.1.1 Non-Buffered IC Channels The main timer value is memorized in the IC register by a valid input pin transition. If the corresponding NOVWx bit of the ICOVW register is cleared, with a new occurrence of a capture, the contents of IC register are overwritten by the new value. If the corresponding NOVWx bit of the ICOVW register is set, the capture register cannot be written unless it is empty. This will prevent the captured value from being overwritten until it is read. 26.4.1.1.2 Buffered IC Channels There are two modes of operations for the buffered IC channels: 1. IC latch mode (LATQ = 1) The main timer value is memorized in the IC register by a valid input pin transition (see Figure 2667 and Figure 26-68). The value of the buffered IC register is latched to its holding register by the modulus counter for a given period when the count reaches zero, by a write 0x0000 to the modulus counter or by a write to ICLAT in the MCCTL register. If the corresponding NOVWx bit of the ICOVW register is cleared, with a new occurrence of a capture, the contents of IC register are overwritten by the new value. In case of latching, the contents of its holding register are overwritten. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1171 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) If the corresponding NOVWx bit of the ICOVW register is set, the capture register or its holding register cannot be written by an event unless they are empty (see Section 26.4.1.1, “IC Channels”). This will prevent the captured value from being overwritten until it is read or latched in the holding register. 2. IC Queue Mode (LATQ = 0) The main timer value is memorized in the IC register by a valid input pin transition (see Figure 2669 and Figure 26-70). If the corresponding NOVWx bit of the ICOVW register is cleared, with a new occurrence of a capture, the value of the IC register will be transferred to its holding register and the IC register memorizes the new timer value. If the corresponding NOVWx bit of the ICOVW register is set, the capture register or its holding register cannot be written by an event unless they are empty (see Section 26.4.1.1, “IC Channels”). if the TFMOD bit of the ICSYS register is set,the timer ﬂags C3F--C0F in TFLG register are set only when a latch on the corresponding holding register occurs,after C3F--C0F are set,user should clear ﬂag C3F--C0F,then read TCx and TCxH to make TCx and TCxH be empty. In queue mode, reads of the holding register will latch the corresponding pulse accumulator value to its holding register. 26.4.1.1.3 Delayed IC Channels There are four delay counters in this module associated with IC channels 0–3. The use of this feature is explained in the diagram and notes below. BUS CLOCK DLY_CNT INPUT ON CH0–3 INPUT ON CH0–3 INPUT ON CH0–3 INPUT ON CH0–3 0 1 2 3 253 254 255 256 Rejected 255 Cycles Rejected 255.5 Cycles 255.5 Cycles Accepted 256 Cycles Accepted Figure 26-74. Channel Input Validity with Delay Counter Feature In Figure 26-74 a delay counter value of 256 bus cycles is considered. 1. Input pulses with a duration of (DLY_CNT – 1) cycles or shorter are rejected. 2. Input pulses with a duration between (DLY_CNT – 1) and DLY_CNT cycles may be rejected or accepted, depending on their relative alignment with the sample points. MC9S12XF - Family Reference Manual, Rev.1.19 1172 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 3. Input pulses with a duration between (DLY_CNT – 1) and DLY_CNT cycles may be rejected or accepted, depending on their relative alignment with the sample points. 4. Input pulses with a duration of DLY_CNT or longer are accepted. 26.4.1.2 OC Channel Initialization An internal compare channel whose output drives OCx may be programmed before the timer drives the output compare state (OCx). The required output of the compare logic can be disconnected from the pin, leaving it driven by the GP IO port, by setting the appropriate OCPDx bit before enabling the output compare channel (by default the OCPD bits are cleared which would enable the output compare logic to drive the pin as soon as the timer output compare channel is enabled). The desired initial state can then be conﬁgured in the internal output compare logic by forcing a compare action with the logic disconnected from the IO (by writing a one to CFORCx bit with TIOSx, OCPDx and TEN bits set to one). Clearing the output compare disconnect bit (OCPDx) will then allow the internal compare logic to drive the programmed state to OCx. This allows a glitch free switching between general purpose I/O and timer output functionality. 26.4.1.3 Pulse Accumulators There are four 8-bit pulse accumulators with four 8-bit holding registers associated with the four IC buffered channels 3–0. A pulse accumulator counts the number of active edges at the input of its channel. The minimum pulse width for the PAI input is greater than two bus clocks.The maximum input frequency on the pulse accumulator channel is one half the bus frequency or Eclk. The user can prevent the 8-bit pulse accumulators from counting further than 0x00FF by utilizing the PACMX control bit in the ICSYS register. In this case, a value of 0x00FF means that 255 counts or more have occurred. Each pair of pulse accumulators can be used as a 16-bit pulse accumulator (see Figure 26-72). Pulse accumulator B operates only as an event counter, it does not feature gated time accumulation mode. The edge control for pulse accumulator B as a 16-bit pulse accumulator is deﬁned by TCTL4[1:0]. To operate the 16-bit pulse accumulators A and B (PACA and PACB) independently of input capture or output compare 7 and 0 respectively, the user must set the corresponding bits: IOSx = 1, OMx = 0, and OLx = 0. OC7M7 or OC7M0 in the OC7M register must also be cleared. There are two modes of operation for the pulse accumulators: • Pulse accumulator latch mode The value of the pulse accumulator is transferred to its holding register when the modulus downcounter reaches zero, a write 0x0000 to the modulus counter or when the force latch control bit ICLAT is written. At the same time the pulse accumulator is cleared. • Pulse accumulator queue mode When queue mode is enabled, reads of an input capture holding register will transfer the contents of the associated pulse accumulator to its holding register. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1173 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) At the same time the pulse accumulator is cleared. 26.4.1.4 Modulus Down-Counter The modulus down-counter can be used as a time base to generate a periodic interrupt. It can also be used to latch the values of the IC registers and the pulse accumulators to their holding registers. The action of latching can be programmed to be periodic or only once. 26.4.1.5 Precision Timer By enabling the PRNT bit of the TSCR1 register, the performance of the timer can be enhanced. In this case, it is possible to set additional prescaler settings for the main timer counter and modulus down counter and enhance delay counter settings compared to the settings in the present ECT timer. 26.4.1.6 Flag Clearing Mechanisms The ﬂags in the ECT can be cleared one of two ways: 1. Normal ﬂag clearing mechanism (TFFCA = 0) Any of the ECT ﬂags can be cleared by writing a one to the ﬂag. 2. Fast ﬂag clearing mechanism (TFFCA = 1) With the timer fast ﬂag clear all (TFFCA) enabled, the ECT ﬂags can only be cleared by accessing the various registers associated with the ECT modes of operation as described below. The ﬂags cannot be cleared via the normal ﬂag clearing mechanism. This fast ﬂag clearing mechanism has the advantage of eliminating the software overhead required by a separate clear sequence. Extra care must be taken to avoid accidental ﬂag clearing due to unintended accesses. — Input capture A read from an input capture channel register causes the corresponding channel ﬂag, CxF, to be cleared in the TFLG1 register. — Output compare A write to the output compare channel register causes the corresponding channel flag, CxF, to be cleared in the TFLG1 register. — Timer counter Any access to the TCNT register clears the TOF flag in the TFLG2 register. — Pulse accumulator A Any access to the PACN3 and PACN2 registers clears the PAOVF and PAIF flags in the PAFLG register. — Pulse accumulator B Any access to the PACN1 and PACN0 registers clears the PBOVF flag in the PBFLG register. — Modulus down counter Any access to the MCCNT register clears the MCZF flag in the MCFLG register. MC9S12XF - Family Reference Manual, Rev.1.19 1174 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.4.2 Reset The reset state of each individual bit is listed within the register description section (Section 26.3, “Memory Map and Register Deﬁnition”) which details the registers and their bit-ﬁelds. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1175 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.4.3 Interrupts This section describes interrupts originated by the ECT block. The MCU must service the interrupt requests. Table 26-39 lists the interrupts generated by the ECT to communicate with the MCU. Table 26-39. ECT Interrupts Interrupt Source Timer channel 7–0 Modulus counter underﬂow Pulse accumulator B overﬂow Pulse accumulator A input Pulse accumulator A overﬂow Timer overﬂow Description Active high timer channel interrupts 7–0 Active high modulus counter interrupt Active high pulse accumulator B interrupt Active high pulse accumulator A input interrupt Pulse accumulator overﬂow interrupt Timer 0verﬂow interrupt The ECT only originates interrupt requests. The following is a description of how the module makes a request and how the MCU should acknowledge that request. The interrupt vector offset and interrupt number are chip dependent. 26.4.3.1 Channel [7:0] Interrupt This active high output will be asserted by the module to request a timer channel 7–0 interrupt to be serviced by the system controller. 26.4.3.2 Modulus Counter Interrupt This active high output will be asserted by the module to request a modulus counter underﬂow interrupt to be serviced by the system controller. 26.4.3.3 Pulse Accumulator B Overﬂow Interrupt This active high output will be asserted by the module to request a timer pulse accumulator B overﬂow interrupt to be serviced by the system controller. 26.4.3.4 Pulse Accumulator A Input Interrupt This active high output will be asserted by the module to request a timer pulse accumulator A input interrupt to be serviced by the system controller. 26.4.3.5 Pulse Accumulator A Overﬂow Interrupt This active high output will be asserted by the module to request a timer pulse accumulator A overﬂow interrupt to be serviced by the system controller. MC9S12XF - Family Reference Manual, Rev.1.19 1176 Freescale Semiconductor Chapter 26 Enhanced Capture Timer (ECT16B8CV3) 26.4.3.6 Timer Overﬂow Interrupt This active high output will be asserted by the module to request a timer overﬂow interrupt to be serviced by the system controller. MC9S12XF - Family Reference Manual Rev.1.19 Freescale Semiconductor 1177 Chapter 26 Enhanced Capture Timer (ECT16B8CV3) MC9S12XF - Family Reference Manual, Rev.1.19 1178 Freescale Semiconductor Appendix A Electrical Characteristics Appendix A Electrical Characteristics A.1 General NOTE The electrical characteristics given in this section should be used as a guide only. Values cannot be guaranteed by Freescale until the qualiﬁcation process for this device has been ﬁnished. Freescale reserves the right to make amendments to the electrical characteristics quoted in this section. Freescale recommends subscribing to device documentation at Freescale.com in order to stay informed of any FURTHER changes to this Reference Manual. This supplement contains the most accurate electrical information for the MC9S12XF-Family microcontroller available at the time of publication. This introduction is intended to give an overview on several common topics like power supply, current injection etc. A.1.1 Parameter Classiﬁcation The electrical parameters shown in this supplement are guaranteed by various methods. To give the customer a better understanding the following classiﬁcation is used and the parameters are tagged accordingly in the tables where appropriate. NOTE This classiﬁcation is shown in the column labeled “C” in the parameter tables where appropriate. P: C: T: Those parameters are guaranteed during production testing on each individual device. Those parameters are achieved by the design characterization by measuring a statistically relevant sample size across process variations. Those parameters are achieved by design characterization on a small sample size from typical devices under typical conditions unless otherwise noted. All values shown in the typical column are within this category. Those parameters are derived mainly from simulations. D: A.1.2 Power Supply The MC9S12XF-Family utilizes several pins to supply power to the I/O ports, A/D converter, oscillator, and PLL as well as the digital core. The VDDA, VSSA pin pairs supply the A/D converter and parts of the internal voltage regulator. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1179 Appendix A Electrical Characteristics The VDDX, VSSX pin pairs [4:1] supply the I/O pins. VDDR supplies the internal voltage regulator. NOTE Connecting VDDR to VSS disables the internal voltage regulator. The VDDF, VSS1 pin pair supplies the internal NVM logic. The VDD, VSS2 are the supply pins for the internal digital logic. VDDPLL, VSSPLL pin pair supply the oscillator and the PLL. VSS1, VSS2 and VSS3 are internally connected by metal. All VDDX pins are internally connected by metal. All VSSX pins are internally connected by metal. VDDA is connected to all VDDX pins by diodes for ESD protection such that VDDX must not exceed VDDA by more than a diode voltage drop. VDDA can exceed VDDX by more than a diode drop in order to support applications with a 5V A/D converter range and 3.3V I/O pin range. VSSA and VSSX are connected by anti-parallel diodes for ESD protection. NOTE In the following context VDD35 is used for either VDDA, VDDR, and VDDX; VSS35 is used for either VSSA and VSSX unless otherwise noted. IDD35 denotes the sum of the currents ﬂowing into the VDDA and VDDR pins. VDD is used for VDD, VSS is used for VSS1, VSS2 and VSS3. VDDPLL is used for VDDPLL, VSSPLL is used for VSSPLL IDD is used for the sum of the currents ﬂowing into VDD, VDDF and VDDPLL. A.1.3 Pins There are four groups of functional pins. A.1.3.1 I/O Pins Those I/O pins have a level in the range of 3.13V to 5.5 V. This class of pins is comprised of all port I/O pins, the analog inputs, BKGD and the RESET pins.The internal structure of all those pins is identical; however, some of the functionality may be disabled. For example the BKGD pin pull up is always enabled. A.1.3.2 Analog Reference This group is made up by the VRH and VRL pins. MC9S12XF - Family Reference Manual, Rev.1.19 1180 Freescale Semiconductor Appendix A Electrical Characteristics A.1.3.3 Oscillator The pins EXTAL, XTAL dedicated to the oscillator have a nominal 1.8 V level. They are supplied by VDDPLL. A.1.3.4 TEST This pin is used for production testing only. A.1.4 Current Injection Power supply must maintain regulation within operating VDD35 or VDD range during instantaneous and operating maximum current conditions. If positive injection current (Vin > VDD35) is greater than IDD35, the injection current may ﬂow out of VDD35 and could result in external power supply going out of regulation. Ensure external VDD35 load will shunt current greater than maximum injection current. This will be the greatest risk when the MCU is not consuming power; e.g., if no system clock is present, or if clock rate is very low which would reduce overall power consumption. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1181 Appendix A Electrical Characteristics A.1.5 Absolute Maximum Ratings Absolute maximum ratings are stress ratings only. A functional operation under or outside those maxima is not guaranteed. Stress beyond those limits may affect the reliability or cause permanent damage of the device. This device contains circuitry protecting against damage due to high static voltage or electrical ﬁelds; however, it is advised that normal precautions be taken to avoid application of any voltages higher than maximum-rated voltages to this high-impedance circuit. Reliability of operation is enhanced if unused inputs are tied to an appropriate logic voltage level (e.g., either VSS35 or VDD35). Table A-1. Absolute Maximum Ratings(1) Num 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Rating I/O, regulator and analog supply voltage Digital logic supply voltage(2) PLL supply voltage2 NVM supply voltage 2 Symbol VDD35 VDD VDDPLL VDDF ∆VDDX ∆VSSX VIN VRH, VRL VILV VTEST ID IDL IDT I DV Min –0.3 –0.3 –0.3 –0.3 –6.0 –0.3 –0.3 –0.3 –0.3 –0.3 –25 –25 –0.25 –100 Max 6.0 2.16 2.16 3.6 0.3 0.3 6.0 6.0 2.16 10.0 +25 +25 0 +100 Unit V V V V V V V V V V mA mA mA mA Voltage difference VDDX to VDDA Voltage difference VSSX to VSSA Digital I/O input voltage Analog reference EXTAL, XTAL TEST input Instantaneous maximum current Single pin limit for all digital I/O pins(3) Instantaneous maximum current Single pin limit for EXTAL, XTAL(4) Instantaneous maximum current Single pin limit for TEST (5) Maximum current Single pin limit for power supply pins 15 Storage temperature range Tstg –65 155 °C 1. Beyond absolute maximum ratings device might be damaged. 2. The device contains an internal voltage regulator to generate the logic and PLL supply out of the I/O supply. The absolute maximum ratings apply when the device is powered from an external source. 3. All digital I/O pins are internally clamped to VSSX and VDDX, or VSSA and VDDA. 4. Those pins are internally clamped to VSSPLL and VDDPLL. 5. This pin is clamped low to VSSPLL, but not clamped high. This pin must be tied low in applications. A.1.6 ESD Protection and Latch-up Immunity All ESD testing is in conformity with CDF-AEC-Q100 stress test qualiﬁcation for automotive grade integrated circuits. During the device qualiﬁcation ESD stresses were performed for the Human Body Model (HBM) and the Charge Device Model. MC9S12XF - Family Reference Manual, Rev.1.19 1182 Freescale Semiconductor Appendix A Electrical Characteristics A device will be deﬁned as a failure if after exposure to ESD pulses the device no longer meets the device speciﬁcation. Complete DC parametric and functional testing is performed per the applicable device speciﬁcation at room temperature followed by hot temperature, unless speciﬁed otherwise in the device speciﬁcation. Table A-2. ESD and Latch-up Test Conditions Model Human Body Series resistance Storage capacitance Number of pulse per pin Positive Negative Charged Device Number of pulse per pin Positive Negative Latch-up Minimum input voltage limit Maximum input voltage limit Description Symbol R1 C — — — — Value 1500 100 1 1 3 3 –2.5 7.5 V V Unit Ohm pF Table A-3. ESD and Latch-Up Protection Characteristics Num 1 2 3 C C C C Rating Human Body Model (HBM) Charge Device Model (CDM) corner pins Charge Device Model (CDM) edge pins Latch-up current at TA = 125°C Positive Negative Latch-up current at TA = 27°C Positive Negative Symbol VHBM VCDM ILAT +100 –100 ILAT +200 –200 — — — — mA Min 2000 750 500 Max — — — Unit V V mA 4 C MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1183 Appendix A Electrical Characteristics A.1.7 Operating Conditions This section describes the operating conditions of the device. Unless otherwise noted those conditions apply to all the following data. NOTE Please refer to the temperature rating of the device (C, V, M) with regards to the ambient temperature TA and the junction temperature TJ. For power dissipation calculations refer to Section A.1.8, “Power Dissipation and Thermal Characteristics”. Table A-4. Operating Conditions Rating I/O, regulator and analog supply voltage NVM logic supply voltage(1) Voltage difference VDDX to VDDA Voltage difference VDDR to VDDX Voltage difference VSSX to VSSA Voltage difference VSS1 , VSS2 , VSS3 , VSSPLL to VSSX Digital logic supply voltage1 PLL supply voltage Oscillator (Loop Controlled Pierce) (Full Swing Pierce) Bus frequency(3) MC9S12XF512C Operating junction temperature range Operating ambient temperature range(4) MC9S12XF512V Operating junction temperature range Operating ambient temperature range2 (2) Symbol VDD35 VDDF ∆VDDX ∆VDDR ∆VSSX ∆VSS VDD VDDPLL fosc fbus TJ TA TJ TA Min 3.13 2.7 Typ 5 2.8 Max 5.5 2.9 Unit V V refer to Table A-12 –0.1 0 0.1 V refer to Table A-12 –0.1 1.72 1.72 4 2 0.5 –40 –40 –40 –40 0 1.8 1.8 — — — — 27 — 27 0.1 1.98 1.98 16 40 50 110 85 °C 130 105 V V V MHz MHz °C MC9S12XF512M °C Operating junction temperature range TJ –40 — 150 Operating ambient temperature range2 TA –40 27 125 1. The device contains an internal voltage regulator to generate the logic, NVM and PLL supply out of the I/O supply. 2. This refers to the oscillator base frequency. Typical crystal & resonator tolerances are supported. 3. Please refer to Table A-22 for maximum bus frequency limits with frequency modulation enabled. 4. Please refer to Section A.1.8, “Power Dissipation and Thermal Characteristics” for more details about the relation between ambient temperature TA and device junction temperature TJ. NOTE Using the internal voltage regulator, operation is guaranteed in a power down until a low voltage reset assertion. MC9S12XF - Family Reference Manual, Rev.1.19 1184 Freescale Semiconductor Appendix A Electrical Characteristics A.1.8 Power Dissipation and Thermal Characteristics Power dissipation and thermal characteristics are closely related. The user must assure that the maximum operating junction temperature is not exceeded. The average chip-junction temperature (TJ) in °C can be obtained from: T T T J A D = Junction Temperature, [ ° C ] = Ambient Temperature, [ ° C ] = Total Chip Power Dissipation, [W] = Package Thermal Resistance, [ ° C/W] J = T + (P • Θ ) A D JA P Θ JA The total power dissipation can be calculated from: P P D =P INT +P IO INT = Chip Internal Power Dissipation, [W] P IO = ∑ RDSON ⋅ IIOi2 i PIO is the sum of all output currents on I/O ports associated with VDDX, whereby R V OL = ----------- ;for outputs driven low DSON I OL R V –V DD35 OH = --------------------------------------- ;for outputs driven high DSON I OH Two cases with internal voltage regulator enabled and disabled must be considered: 1. Internal voltage regulator disabled P INT =I DD ⋅V DD +I DDPLL ⋅V DDPLL +I DDA ⋅V DDA 2. Internal voltage regulator enabled P INT =I DDR ⋅V DDR +I DDA ⋅V DDA MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1185 Appendix A Electrical Characteristics Table A-5. Thermal Package Characteristics (MC9S12XF512) (1) Num C Rating LQFP144 1 2 3 4 5 D D D D D Thermal resistance LQFP144, single sided PCB2 Thermal resistance LQFP144, double sided PCB with 2 internal planes3 Junction to Board LQFP 144 Junction to Case LQFP 1444 Junction to Package Top LQFP1445 LQFP112 6 7 8 9 10 D D D D D Thermal resistance LQFP112, single sided PCB(2) Thermal resistance LQFP112, double sided PCB with 2 internal planes(3) Junction to Board LQFP112 Junction to Case LQFP1124 Junction to Package Top LQFP112 5 Symbol Min Typ Max Unit θJA θJA θJB θJC ΨJT θJA θJA θJB θJC ΨJT — — — — — — — — — — 48 40 28 9 2 °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W °C/W — — — — — — — — — — 49 40 28 9 2 LQFP64 11 12 13 14 D D D D Thermal resistance LQFP 64, single sided PCB2 Thermal resistance LQFP 64, double sided PCB with 2 internal planes3 Junction to Board LQFP 64 Junction to Case LQFP 64 (4) (5) θJA θJA θJB θJC — — — — — — — — 62 44 27 10 ΨJT — — 2 °C/W 15 D Junction to Package Top LQFP 64 1. The values for thermal resistance are achieved by package simulations 2. Junction to ambient thermal resistance, θJA was simulated to be equivalent to the JEDEC speciﬁcation JESD51-2 in a horizontal conﬁguration in natural convection. 3. Junction to ambient thermal resistance, θJA was simulated to be equivalent to the JEDEC speciﬁcation JESD51-7 in a horizontal conﬁguration in natural convection. 4. Junction to case thermal resistance was simulated to be equivalent to the measured values using the cold plate technique with the cold plate temperature used as the “case” temperature. This basic cold plate measurement technique is described by MILSTD 883D, Method 1012.1. This is the correct thermal metric to use to calculate thermal performance when the package is being used with a heat sink. 5. Thermal characterization parameter ΨJT is the “resistance” from junction to reference point thermocouple on top center of the case as deﬁned in JESD51-2. ΨJT is a useful value to use to estimate junction temperature in a steady state customer enviroment. MC9S12XF - Family Reference Manual, Rev.1.19 1186 Freescale Semiconductor Appendix A Electrical Characteristics A.1.9 I/O Characteristics This section describes the characteristics of all I/O pins except EXTAL, XTAL, TEST and supply pins. Table A-6. 3.3-V I/O Characteristics ALL 3.3V RANGE I/O PARAMETERS ARE SUBJECT TO CHANGE FOLLOWING CHARACTERIZATION Conditions are 3.13 V < VDD35 < 3.6 V temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C 1 P Input high voltage T Input high voltage 2 P Input low voltage T Input low voltage 3 4a T Input hysteresis C Input leakage current (pins in high impedance input mode)(1) Vin = VDD35 or VSS35 M Temperature range -40°C to 150°C V Temperature range -40°C to 130°C C Temperature range -40°C to 110°C C Input leakage current (pins in high impedance input mode) Vin = VDD35 or VSS35 -40°C 27°C 70°C 85°C 100°C 105°C 110°C 120°C 125°C 130°C 150°C C Output high voltage (pins in output mode) Partial drive IOH = –0.75 mA P Output high voltage (pins in output mode) Full drive IOH = –4 mA C Output low voltage (pins in output mode) Partial Drive IOL = +0.9 mA P Output low voltage (pins in output mode) Full Drive IOL = +4.75 mA P Internal pull up resistance VIH min > input voltage > VIL max P Internal pull down resistance VIH min > input voltage > VIL max D Input capacitance I in Rating Symbol VIH VIH VIL VIL VHYS Min 0.65*VDD35 — — VSS35 – 0.3 — Typ — — — — 250 Max — VDD35 + 0.3 0.35*VDD35 — — Unit V V V V mV –1 –0.75 –0.5 I in — — — — — ±1 ±1 ±8 ±14 ±26 ±32 ±40 ±60 ±74 ±92 ±240 — — — — — — 6 1 0.75 0.5 — µA 4b — nA 5 6 7 8 9 10 11 VOH VOH VOL VOL RPUL RPDH Cin VDD35 – 0.4 VDD35 – 0.4 — — 25 25 — — — 0.4 0.4 50 50 — V V V V KΩ KΩ pF MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1187 Appendix A Electrical Characteristics Table A-6. 3.3-V I/O Characteristics ALL 3.3V RANGE I/O PARAMETERS ARE SUBJECT TO CHANGE FOLLOWING CHARACTERIZATION Conditions are 3.13 V < VDD35 < 3.6 V temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. 12 T Injection current(2) Single pin limit Total device limit, sum of all injected currents D Port H, J, P interrupt input pulse ﬁltered (STOP)(3) D Port H, J, P interrupt input pulse passed(STOP) 3 — IICS IICP tPULSE tPULSE tPULSE tPULSE PWIRQ –2.5 –25 — 10 — 4 1 4 — — — — — — 2.5 25 3 — 3 — — — mA 13 14 15 16 17 µs µs tcyc tcyc tcyc tosc D Port H, J, P interrupt input pulse ﬁltered (STOP) D Port H, J, P interrupt input pulse passed(STOP) D IRQ pulse width, edge-sensitive mode (STOP) PWXIRQ 18 D XIRQ pulse width with X-bit set (STOP) 1. Maximum leakage current occurs at maximum operating temperature. 2. Refer to Section A.1.4, “Current Injection” for more details 3. Parameter only applies in stop or pseudo stop mode. MC9S12XF - Family Reference Manual, Rev.1.19 1188 Freescale Semiconductor Appendix A Electrical Characteristics Table A-7. 5-V I/O Characteristics Conditions are 4.5 V < VDD35 < 5.5 V temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. Num C 1 P Input high voltage T Input high voltage 2 P Input low voltage T Input low voltage 3 4a T Input hysteresis P Input leakage current (pins in high impedance input mode)(1) Vin = VDD35 or VSS35 M Temperature range -40°C to 150°C V Temperature range -40°C to 130°C C Temperature range -40°C to 110°C C Input leakage current (pins in high impedance input mode) Vin = VDD35 or VSS35 -40°C 27°C 70°C 85°C 100°C 105°C 110°C 120°C 125°C 130°C 150°C C Output high voltage (pins in output mode) Partial drive IOH = –2 mA P Output high voltage (pins in output mode) Full drive IOH = –10 mA C Output low voltage (pins in output mode) Partial drive IOL = +2 mA P Output low voltage (pins in output mode) Full drive IOL = +10 mA P Internal pull up resistance VIH min > input voltage > VIL max P Internal pull down resistance VIH min > input voltage > VIL max D Input capacitance T Injection current Single pin limit Total device Limit, sum of all injected currents P Port H, J, P interrupt input pulse ﬁltered(STOP)(3) P Port H, J, P interrupt input pulse passed(STOP) 3 (2) Rating Symbol V IH Min 0.65*VDD35 — — VSS35 – 0.3 — Typ — — — — 250 Max — VDD35 + 0.3 0.35*VDD35 — — Unit V V V V mV VIH VIL VIL VHYS I in –1 –0.75 –0.5 I in — — — — — ±1 ±1 ±8 ±14 ±26 ±32 40 ±60 ±74 ±92 ±240 — — — — — — 6 — 1 0.75 0.5 — µA 4b — nA 5 6 7 8 9 10 11 12 V OH VDD35 – 0.8 VDD35 – 0.8 — — 25 25 — –2.5 –25 — 10 — — — 0.8 0.8 50 50 — 2.5 25 V V V V KΩ KΩ pF mA VOH VOL V OL RPUL RPDH Cin IICS IICP tPULSE tPULSE tPULSE 13 14 15 — — — 3 — 3 µs µs tcyc D Port H, J, P interrupt input pulse ﬁltered (STOP) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1189 Appendix A Electrical Characteristics Table A-7. 5-V I/O Characteristics Conditions are 4.5 V < VDD35 < 5.5 V temperature from –40°C to +150°C, unless otherwise noted I/O Characteristics for all I/O pins except EXTAL, XTAL,TEST and supply pins. 16 17 D Port H, J, P interrupt input pulse passed (STOP) D IRQ pulse width, edge-sensitive mode (STOP) tPULSE PWIRQ 4 1 4 — — — — — — tcyc tcyc tosc PWXIRQ 18 D XIRQ pulse width with X-bit set (STOP) 1. Maximum leakage current occurs at maximum operating temperature. 2. Refer to Section A.1.4, “Current Injection” for more details 3. Parameter only applies in stop or pseudo stop mode. MC9S12XF - Family Reference Manual, Rev.1.19 1190 Freescale Semiconductor Appendix A Electrical Characteristics Table A-8. Characteristics of Expantion Bus Inputs Port C, D, PE5, PE6, and PE7 for Reduced Input Voltage Thresholds Conditions are 4.5 V < VDD35 < 5.5 V Temperature from –40°C to +150°C, unless otherwise noted Num C 1 2 3 D Input high voltage D Input low voltage T Input hysteresis Rating Symbol VIH VIL VHYS Min 1.75 — — Typ — — 100 Max — 0.75 — Unit V V mV A.1.10 Supply Currents This section describes the current consumption characteristics of the device as well as the conditions for the measurements. A.1.10.1 Typical Current Measurement Conditions Since the current consumption of the output drivers is load dependent, all measurements are without output loads and with minimum I/O activity. Unless otherwise noted the currents are measured in single chip mode, S12X CPU code is executed from Flash and XGATE code is executed from RAM. VDD35=5V, internal voltage regulator is enabled and the bus frequency is 50MHz using a 4-MHz oscillator in loop controlled Pierce mode. Furthermore in expanded modes the currents ﬂowing in the system are highly dependent on the load at the address, data, and control signals as well as on the duty cycle of those signals. No generally applicable numbers can be given. A very good estimate is to take the single chip currents and add the currents due to the external loads. Since the DBG and BDM modules are typically not used in the end application, the supply current values for these modules is not speciﬁed. An overhead of current consumption exisits independent of the listed modules, due to voltage regulation and clock logic that is not dedicated to a speciﬁc module. This is listed in a separate table row named “overhead”. A.1.10.2 Maximum Current Measurement Conditions Currents are measured in single chip mode, S12XCPU and XGATE code is executed from RAM with VDD35=5.5V, internal voltage regulator enabled and a 50MHz bus frequency from a 4-MHz input. Characterized parameters are derived using a 4MHz loop controlled Pierce oscillator. Production test parameters are tested with a 4MHz square wave oscillator. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1191 Appendix A Electrical Characteristics Table A-9. Module Conﬁgurations for Maximum Run Supply(VDDR+VDDA) Current VDD35=5.5V Peripheral S12XCPU XGATE MSCAN SPI SCI PMF ECT ATD RTI API EPIT FLEXRAY Overhead Conﬁguration 420 cycle loop: 384 DBNE cycles plus subroutine entry to stimulate stacking (RAM access) XGATE fetches code from RAM, XGATE runs in an inﬁnite loop, reading the Status and Flag registers of CAN’s, SPI’s, SCI’s in sequence and doing some bit manipulation on the data Conﬁgured to loop-back mode using a bit rate of 1Mbit/s Conﬁgured to master mode, continuously transmit data (0x55 or 0xAA) at 4Mbit/s Conﬁgured into loop mode, continuously transmit data (0x55) at speed of 57600 baud Conﬁgured to toggle its pins at the rate of 24MHz The peripheral shall be conﬁgured in output compare mode. Pulse accumulator and modulus counter enabled. The peripheral is conﬁgured to operate at its maximum speciﬁed frequency and to continuously convert voltages on all input channels in sequence. Enabled with RTI Control Register (RTICTL) set to $FF The module is conﬁgured to run from the RC oscillator clock source. PIT is enabled, Micro-timer register 0 and 1 loaded with $0F and timer registers 0 to 3 are loaded with $03/07/0F/1F. Conﬁgure FlexRay and perform Startup procedure. VREG supplying 1.8V from a 5V input voltage, PLL on Table A-10. Run and Wait Current Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating Peripheral Set(1) fosc=4MHz, fbus=50MHz Peripheral Set ,PLL on XGATE executing code from RAM 1 Symbol Min Typ Max Unit Run supply current (Peripheral Conﬁguration see Table A-9.) 1 P IDD35 Wait supply current 2 P IDDW — — 95 10 mA — — 110 mA 3 P All modules disabled, RTI enabled, PLL off — — 1. The following peripherals are on: ATD/ECT/PMF/SPI0-SPI1/SCI0-SCI1/CAN/XGATE/FLEXRAY MC9S12XF - Family Reference Manual, Rev.1.19 1192 Freescale Semiconductor Appendix A Electrical Characteristics Table A-11. Pseudo Stop and Full Stop Current - Subject to Change Conditions are shown in Table A-4 unless otherwise noted Num C –40°C 27°C 70°C 85°C 110°C 130°C 150°C –40°C 27°C 70°C 85°C 110°C 130°C 150°C Stop Current 12 C P C C P P P T T T T T T T T T –40°C 27°C 70°C 85°C 110°C 130°C 150°C -40°C 27°C 85°C 110°C 130°C 27°C 85°C 110°C 130°C IDDS — — — — — — — — — — — — — — — — 15 25 75 115 280 550 1050 20 30 120 280 245 290 400 565 835 — 100 — — 2000 3500 7500 — — — — — — — — — µA Rating Symbol Min Typ Max Unit µA Pseudo stop current (API, RTI, and COP disabled) PLL off 10 C P C C P P P C C C C C C C IDDPS — — — — — — — — — — — — — — 45 55 100 145 295 555 1035 65 75 120 160 315 570 1045 — 255 — — 2155 3655 7000 — — — — — — — Pseudo stop current (API, RTI, and COP enabled) PLL off 11 IDDPS µA Stop Current (API active) 13 IDDS µA Stop Current (ATD active) 14 IDDS µA MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1193 Appendix A Electrical Characteristics A.2 ATD Characteristics This section describes the characteristics of the analog-to-digital converter. A.2.1 ATD Operating Characteristics The Table A-12 and Table A-13 show conditions under which the ATD operates. The following constraints exist to obtain full-scale, full range results: VSSA ≤ VRL ≤ VIN ≤ VRH ≤ VDDA. This constraint exists since the sample buffer ampliﬁer can not drive beyond the power supply levels that it ties to. If the input level goes outside of this range it will effectively be clipped. Table A-12. ATD Operating Characteristics Conditions are shown in Table A-4 unless otherwise noted, supply voltage 3.13 V < VDDA < 5.5 V Num C 1 D Reference potential Low High D Voltage difference VDDX to VDDA D Voltage difference VSSX to VSSA C Differential reference voltage(1) C ATD Clock Frequency (derived from bus clock via the prescaler) P ATD Clock Frequency in Stop mode (internal generated temperature and voltage dependent clock, ICLK) D ADC conversion in stop, recovery time(2) ATD Conversion Period(3) 12 bit resolution: D 10 bit resolution: 8 bit resolution: tATDSTPRC V Rating Symbol VRL VRH ∆VDDX ∆VSSX VRH-VRL fATDCLk Min VSSA VDDA/2 –2.35 –0.1 3.13 0.25 0.6 — Typ — — 0 0 5.0 — 1 — Max VDDA/2 VDDA 0.1 0.1 5.5 8.3 1.7 1.5 Unit V V V V V MHz MHz us 2 3 4 5 6 7 8 NCONV12 NCONV10 NCONV8 20 19 17 — — — 42 41 39 ATD clock Cycles 1. Full accuracy is not guaranteed when differential voltage is less than 4.50 V 2. When converting in Stop Mode (ICLKSTP=1) an ATD Stop Recovery time tATDSTPRCV is required to switch back to bus clock based ATDCLK when leaving Stop Mode. Do not access ATD registers during this time. 3. The minimum time assumes a sample time of 4 ATD clock cycles. The maximum time assumes a sample time of 24 ATD clock cycles and the discharge feature (SMP_DIS) enabled, which adds 2 ATD clock cycles. A.2.2 Factors Inﬂuencing Accuracy Source resistance, source capacitance and current injection have an inﬂuence on the accuracy of the ATD. A further factor is that PortAD pins that are conﬁgured as output drivers switching. MC9S12XF - Family Reference Manual, Rev.1.19 1194 Freescale Semiconductor Appendix A Electrical Characteristics A.2.2.1 Port AD Output Drivers Switching PortAD output drivers switching can adversely affect the ATD accuracy whilst converting the analog voltage on other PortAD pins because the output drivers are supplied from the VDDA/VSSA ATD supply pins. Although internal design measures are implemented to minimize the affect of output driver noise, it is recommended to conﬁgure PortAD pins as outputs only for low frequency, low load outputs. The impact on ATD accuracy is load dependent and not speciﬁed. The values speciﬁed are valid under condition that no PortAD output drivers switch during conversion. A.2.2.2 Source Resistance Due to the input pin leakage current as speciﬁed in Table A-7 in conjunction with the source resistance there will be a voltage drop from the signal source to the ATD input. The maximum source resistance RS speciﬁes results in an error (10-bit resolution) of less than 1/2 LSB (2.5 mV) at the maximum leakage current. If device or operating conditions are less than worst case or leakage-induced error is acceptable, larger values of source resistance of up to 10Kohm are allowed. A.2.2.3 Source Capacitance When sampling an additional internal capacitor is switched to the input. This can cause a voltage drop due to charge sharing with the external and the pin capacitance. For a maximum sampling error of the input voltage ≤ 1LSB (10-bit resilution), then the external ﬁlter capacitor, Cf ≥ 1024 * (CINS–CINN). A.2.2.4 Current Injection There are two cases to consider. 1. A current is injected into the channel being converted. The channel being stressed has conversion values of $3FF (in 10-bit mode) for analog inputs greater than VRH and $000 for values less than VRL unless the current is higher than speciﬁed as disruptive condition. 2. Current is injected into pins in the neighborhood of the channel being converted. A portion of this current is picked up by the channel (coupling ratio K), This additional current impacts the accuracy of the conversion depending on the source resistance. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1195 Appendix A Electrical Characteristics The additional input voltage error on the converted channel can be calculated as: VERR = K * RS * IINJ with IINJ being the sum of the currents injected into the two pins adjacent to the converted channel. Table A-13. ATD Electrical Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C 1 2 3 4 5 6 Rating Symbol RS CINN CINS RINA INA Kp Kn Min — — — — –2.5 — — Typ — — — 5 — — — Max 1 10 16 15 2.5 1E-4 2E-3 Unit KΩ pF kΩ mA A/A A/A C Max input source resistance T Total input capacitance Non sampling Total input capacitance Sampling T Input internal Resistance C Disruptive analog input current C Coupling ratio positive current injection C Coupling ratio negative current injection MC9S12XF - Family Reference Manual, Rev.1.19 1196 Freescale Semiconductor Appendix A Electrical Characteristics A.2.3 ATD Accuracy Table A-14 and Table A-15 specify the ATD conversion performance excluding any errors due to current injection, input capacitance and source resistance. A.2.3.1 ATD Accuracy Deﬁnitions For the following deﬁnitions see also Figure A-1. Differential non-linearity (DNL) is deﬁned as the difference between two adjacent switching steps. V –V i i–1 DNL ( i ) = ------------------------- – 1 1LSB The integral non-linearity (INL) is deﬁned as the sum of all DNLs: n INL ( n ) = i=1 ∑ V –V n 0 DNL ( i ) = -------------------- – n 1LSB MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1197 Appendix A Electrical Characteristics DNL Vi-1 $3FF $3FE $3FD $3FC $3FB $3FA $3F9 $3F8 $3F7 $3F6 $3F5 $3F4 10-Bit Resolution $3F3 LSB 10-Bit Absolute Error Boundary Vi 8-Bit Absolute Error Boundary $FF $FE $FD 8-Bit Resolution Vin mV 9 8 7 6 5 4 3 2 1 0 5 10 15 20 25 30 35 40 50 Ideal Transfer Curve 2 10-Bit Transfer Curve 1 8-Bit Transfer Curve 50555060506550705075508050855090509551005105511051155120 Figure A-1. ATD Accuracy Deﬁnitions NOTE Figure A-1 shows only deﬁnitions, for speciﬁcation values refer to Table A-14 and Table A-15 MC9S12XF - Family Reference Manual, Rev.1.19 1198 Freescale Semiconductor Appendix A Electrical Characteristics Table A-14. ATD Conversion Performance 5V range Conditions are shown in Table A-4 unless otherwise noted. VREF = VRH - VRL = 5.12V. fATDCLK = 8.3MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Num C 1 2 3 4 5 6 7 8 9 10 11 P Resolution P Differential Nonlinearity P Integral Nonlinearity P Absolute Error(3) C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error3. C Resolution C Differential Nonlinearity C Integral Nonlinearity Rating(1) ,(2) 12-Bit 12-Bit 12-Bit 12-Bit 10-Bit 10-Bit 10-Bit 10-Bit 8-Bit 8-Bit 8-Bit Symbol LSB DNL INL AE LSB DNL INL AE LSB DNL INL Min — -4 -5 -7 — -1 -2 -3 — -0.5 -1 Typ 1.25 ±2 ±2.5 ±4 5 ±0.5 ±1 ±2 20 ±0.3 ±0.5 Max — 4 5 7 — 1 2 3 — 0.5 1 Unit mV counts counts counts mV counts counts counts mV counts counts 12 C Absolute Error3. 8-Bit AE -1.5 ±1 1.5 counts 1. The 8-bit and 10-bit mode operation is structurally tested in production test. Absolute values are tested in 12-bit mode. 2. Better performance is possible using specially designed multi-layer PCBs or averaging techniques. 3. These values include the quantization error which is inherently 1/2 count for any A/D converter. Table A-15. ATD Conversion Performance 3.3V range Conditions are shown in Table A-4 unless otherwise noted. VREF = VRH - VRL = 3.3V. fATDCLK = 8.3MHz The values are tested to be valid with no PortAD output drivers switching simultaneous with conversions. Num C 1 2 3 4 5 6 7 8 9 10 11 P Resolution P Differential Nonlinearity P Integral Nonlinearity P Absolute Error(3) Rating(1),(2) 12-Bit 12-Bit 12-Bit 12-Bit 10-Bit 10-Bit 10-Bit 10-Bit 8-Bit 8-Bit 8-Bit Symbol LSB DNL INL AE LSB DNL INL AE LSB DNL INL Min — -6 -7 -8 — -1.5 -2 -3 — -0.5 -1 Typ 0.80 ±3 ±3 ±4 3.22 ±1 ±1 ±2 12.89 ±0.3 ±0.5 Max — 6 7 8 — 1.5 2 3 — 0.5 1 Unit mV counts counts counts mV counts counts counts mV counts counts C Resolution C Differential Nonlinearity C Integral Nonlinearity C Absolute Error3. C Resolution C Differential Nonlinearity C Integral Nonlinearity 12 C Absolute Error3. 8-Bit AE -1.5 ±1 1.5 counts 1. The 8-bit and 10-bit mode operation is structurally tested in production test. Absolute values are tested in 12-bit mode. 2. Better performance is possible using specially designed multi-layer PCBs or averaging techniques. 3. These values include the quantization error which is inherently 1/2 count for any A/D converter. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1199 Appendix A Electrical Characteristics A.3 A.3.1 NVM, Flash and Emulated EEPROM Timing Parameters The time base for all NVM program or erase operations is derived from the oscillator. A minimum oscillator frequency fNVMOSC is required for performing program or erase operations. The NVM modules do not have any means to monitor the frequency and will not prevent program or erase operation at frequencies above or below the speciﬁed minimum. When attempting to program or erase the NVM modules at a lower frequency, a full program or erase transition is not assured. The program and erase operations are timed using a clock derived from the oscillator using the FCLKDIV register. The frequency of this clock must be set within the limits speciﬁed as fNVMOP. The minimum program and erase times shown in Table A-16 are calculated for maximum fNVMOP and maximum fNVMBUS unless otherwise shown. The maximum times are calculated for minimum fNVMOP A.3.1.1 Erase Verify All Blocks (Blank Check) (FCMD=0x01) The time it takes to perform a blank check is dependant on the location of the ﬁrst non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming that no non blank location is found, then the erase verify all blocks is given by. 1 t check = 33500 ⋅ -------------------f NVMBUS A.3.1.2 Erase Verify Block (Blank Check) (FCMD=0x02) The time it takes to perform a blank check is dependant on the location of the ﬁrst non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming that no non blank location is found, then the erase verify time for a single 256K NVM array is given by 1 t check = 33500 ⋅ -------------------f NVMBUS For a 128K NVM or D-Flash array the erase verify time is given by 1 t check = 17200 ⋅ -------------------f NVMBUS A.3.1.3 Erase Verify P-Flash Section (FCMD=0x03) The maximum time depends on the number of phrases being veriﬁed (NVP) 1 t check = ( 752 + N VP ) ⋅ -------------------f NVMBUS MC9S12XF - Family Reference Manual, Rev.1.19 1200 Freescale Semiconductor Appendix A Electrical Characteristics A.3.1.4 Read Once (FCMD=0x04) The maximum read once time is given by 1 t = ( 400 ) ⋅ -------------------f NVMBUS A.3.1.5 Load Data Field (FCMD=0x05) The maximum load data ﬁeld time is given by 1 t = ( 450 ) ⋅ -------------------f NVMBUS A.3.1.6 Program P-Flash (FCMD=0x06) The programming time for a single phrase of four P-Flash words + associated eight ECC bits is dependant on the bus frequency as a well as on the frequency fNVMOP and can be calculated according to the following formulas, whereby NDLOAD is the number of extra blocks being programmed by the Load Data Field command (DLOAD), i.e. programming 2 blocks using DLOAD, NDLOAD =1 respectively. The typical phrase programming time can be calculated using the following equation 1 1 t bwpgm = ( 128 + ( 12 ⋅ N DLOAD ) ) ⋅ ------------------------ + ( 1725 + ( 510 ⋅ N DLOAD ) ) ⋅ ---------------------------f NVMBUS f NVMOP The maximum phrase programming time can be calculated using the following equation 1 1 t bwpgm = ( 130 + ( 14 ⋅ N DLOAD ) ) ⋅ ------------------------ + ( 2125 + ( 510 ⋅ N DLOAD ) ) ⋅ ---------------------------f NVMBUS f NVMOP A.3.1.7 P-Flash Program Once (FCMD=0x07) The maximum P-Flash Program Once time is given by 1 1 t bwpgm ≈ 162 ⋅ ------------------------ + 2400 ⋅ ---------------------------f NVMBUS f NVMOP A.3.1.8 Erase All Blocks (FCMD=0x08) For S12XF512, S12XF384, S12XF256 and S12XF128 erasing all blocks takes: 1 1 t mass ≈ 100100 ⋅ ------------------------ + 70000 ⋅ ---------------------------f NVMBUS f NVMOP MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1201 Appendix A Electrical Characteristics A.3.1.9 Erase P-Flash Block (FCMD=0x09) Erasing a 256K NVM block takes 1 1 t mass ≈ 100100 ⋅ ------------------------ + 70000 ⋅ ---------------------------f NVMBUS f NVMOP Erasing a 128K NVM block takes 1 1 t mass ≈ 100100 ⋅ ------------------------ + 35000 ⋅ ---------------------------f NVMBUS f NVMOP A.3.1.10 Erase P-Flash Sector (FCMD=0x0A) The typical time to erase a1024-byte P-Flash sector can be calculated using 1 1 t era = ⎛ 20020 ⋅ ----------------- ⎞ + ⎛ 700 ⋅ -------------------- ⎞ ⎝ f NVMBUS⎠ f NVMOP⎠ ⎝ The maximum time to erase a1024-byte P-Flash sector can be calculated using 1 1 t era = ⎛ 20020 ⋅ ----------------- ⎞ + ⎛ 1100 ⋅ -------------------- ⎞ ⎝ f NVMBUS⎠ f NVMOP⎠ ⎝ A.3.1.11 Unsecure Flash (FCMD=0x0B) The maximum time for unsecuring the ﬂash is given by 1 1 t uns = ⎛ 100100 ⋅ ------------------------ + 70000 ⋅ ---------------------------- ⎞ ⎝ f NVMBUS⎠ f NVMOP A.3.1.12 Verify Backdoor Access Key (FCMD=0x0C) The maximum verify backdoor access key time is given by 1 t = 400 ⋅ ---------------------------f NVMBUS A.3.1.13 Set User Margin Level (FCMD=0x0D) The maximum set user margin level time is given by 1 t = 350 ⋅ ---------------------------f NVMBUS A.3.1.14 Set Field Margin Level (FCMD=0x0E) The maximum set ﬁeld margin level time is given by MC9S12XF - Family Reference Manual, Rev.1.19 1202 Freescale Semiconductor Appendix A Electrical Characteristics 1 t = 350 ⋅ ---------------------------f NVMBUS A.3.1.15 Full Partition D-Flash (FCMD=0x0F) The maximum time for partitioning the D-ﬂash (ERPART=16, DFPART=0) is given by : 1 1 t part ≈ 21800 ⋅ ------------------------ + 400000 ⋅ ---------------------------- + t f NVMOP f NVMBUS mass A.3.1.16 Erase Verify D-Flash Section (FCMD=0x10) Erase Verify D-Flash for a given number of words NW is given by . 1 t check ≈ ( 840 + N W ) ⋅ ---------------------------f NVMBUS A.3.1.17 D-Flash Programming (FCMD=0x11) D-Flash programming time is dependent on the number of words being programmed and their location with respect to a row boundary, because programming across a row boundary requires extra steps. The DFlash programming time is speciﬁed for different cases (1,2,3,4 words and 4 words across a row boundary) at a 50MHz bus frequency. The typical programming time can be calculated using the following equation, whereby Nw denotes the number of words; BC=0 if no boundary is crossed and BC=1 if a boundary is crossed. 1 1 t dpgm = ⎛ ( 15 + ( 54 ⋅ N w ) + ( 16 ⋅ BC ) ) ⋅ ----------------- ⎞ + ⎛ ( 460 + ( 640 ⋅ N W ) + ( 500 ⋅ BC ) ) ⋅ -------------------- ⎞ ⎝ f NVMOP⎠ ⎝ f NVMBUS⎠ The maximum programming time can be calculated using the following equation 1 1 t dpgm = ⎛ ( 15 + ( 56 ⋅ N w ) + ( 16 ⋅ BC ) ) ⋅ ----------------- ⎞ + ⎛ ( 460 + ( 840 ⋅ N W ) + ( 500 ⋅ BC ) ) ⋅ -------------------- ⎞ ⎝ f NVMOP⎠ ⎝ f NVMBUS⎠ A.3.1.18 Erase D-Flash Sector (FCMD=0x12) Typical D-Flash sector erase times are those expected on a new device, where no margin verify fails occur. They can be calculated using the following equation. 1 1 t eradf ≈ 5025 ⋅ ------------------------ + 700 ⋅ ---------------------------f NVMBUS f NVMOP Maximum D-Fash sector erase times can be calculated using the following equation. 1 1 t eradf ≈ 20100 ⋅ ------------------------ + 3300 ⋅ ---------------------------f NVMBUS f NVMOP The D-Flash sector erase time on a new device is ~5ms and can extend to 20ms as the ﬂash is cycled. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1203 Appendix A Electrical Characteristics A.3.1.19 Enable EEE (FCMD=0x13) Maximum time to enable EPROM emulation is given by 1 t = ⎛ ⎛ ( ( 1100 ⋅ BWN + ( 176 ⋅ ( 1 + BWN ) + ( BWN + N SEC ) ⋅ 32364 ) ) ) ⋅ ----------------- ⎞ + ⎝⎝ f NVMOP⎠ 1 ⎛ ( 3050 ⋅ ( 1 + BWN ) + ( N -⎞ ⎞ SEC + BWN ) ⋅ 290500 ) ⋅ -------------------- ⎠ ⎠ ⎝ f NVMBUS where NSEC is the number of sectors of constant data. A constant sector is one in which all 63 records contain the latest active data and would need to be copied. The maximum possible is 33 (2048 EEE RAM words /63 =32.5) although this is a highly unlikely scenario. The impact of a worst case brownout recovery scenario is denoted by BWN = 2 for non brownout situations BWN =0. MC9S12XF - Family Reference Manual, Rev.1.19 1204 Freescale Semiconductor Appendix A Electrical Characteristics A.3.1.20 Maximum CCOB Latency The maximum time a CCOB command has to wait to be actioned due to an EEE clean up is given where BWN = 1 if a brownout has occured otherwise BWN = 0. BWN = 1 only for the ﬁrst ENEEE after reset. 1 1 t ≈ ⎛ 32364 ⋅ ------------------------ + 292600 ⋅ ---------------------------- ⎞ ⋅ ( 1 + BWN ) ⎝ f NVMBUS⎠ f NVMOP 1100 1 + BWN ⋅ ⎛ 350 ⋅ -------------------- + ------------------------⎞ ⎝ f NVMOP f NVMBUS⎠ A.3.1.21 Disable EEE (FCMD=0x14) Maximum time to disable EPROM emulation is given by 1 t = 300 ⋅ ---------------------------f NVMBUS A.3.1.22 EEE Query (FCMD=0x15) Maximum time for the EEE query command is given by 1 t = 300 ⋅ ---------------------------f NVMBUS A.3.1.23 Partition D-Flash (FCMD=0x20) The maximum time for partitioning the D-ﬂash (ERPART=16, DFPART=0) is given by 1 1 t ≈ 21800 ⋅ ------------------------ + 400000 ⋅ ---------------------------f NVMBUS f NVMOP MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1205 Appendix A Electrical Characteristics A.3.1.24 EEE Copy Down The typical EEE copy down time is given by the following equation 1 t dfcd = ( 14000 + ( 316 ⋅ ERPART ) + ( 1500 ⋅ ( 124 – DFPART ) ) ) × -------------------f NVMBUS The maximum EEE copy down time is given by the following equation 1 t dfcd = ( 34000 + ( 316 ⋅ ERPART ) + ( 1500 ⋅ ( 124 – DFPART ) ) ) × -------------------f NVMBUS Worse case for Enable EEPROM Emulation allows for all the EEE records to have to be copied which is a very low probability scenario only likely in the case that the EEE is mostly full of unchanging data (the records for which are stored in consecutive D-Flash sectors). Table A-16. NVM Timing Characteristics Conditions are as shown in Table A-4, with 50MHz bus and fNVMOP= 1MHz unless otherwise noted. Num C 1 2 3 4 5 6 7 7a 8 9a 9b 9c 9d 9e 10 11 12 D External oscillator clock D Bus frequency for programming or erase operations D Operating frequency D P-Flash phrase programming D P-Flash phrase program time using D-LOAD on 2 blocks P P-Flash sector erase time P Erase All Blocks (Mass erase) time D Unsecure Flash D P-Flash erase verify (blank check) time(2) D D-Flash word programming one word D D-Flash word programming two words D D-Flash word programming three words D D-Flash word programming four words D D-Flash word programming four words crossing row boundary D D-Flash sector erase time D D-Flash erase verify (blank check) time D EEE copy down (2M64J Maskset) Rating Symbol fNVMOSC fNVMBUS fNVMOP tbwpgm tbwpgm2 tera tmass tuns tcheck tdpgm tdpgm tdpgm tdpgm tdpgm teradf tcheck tdfrcd Min 2 1 800 — — — — — — — — — — — — — — Typ — — — 162 185 20 101 101 — 88 153 212 282 298 5.2(3) — 255000 Max 50(1) 50 1050 173 202 21 102 102 335002 95 165 230 316 342 21 17500 275000(4) 225000(5) Unit MHz MHz kHz µs µs ms ms ms tcyc µs µs µs µs µs ms tcyc tcyc tcyc 12 D EEE copy down (Other Masksets) tdfrcd — 205000 1. Restrictions for oscillator in crystal mode apply. 2. Valid for both “Erase verify all” or “Erase verify block” on 256K block without failing locations 3. This is a typical value for a new device 4. Maximum partitioning 5. Maximum partitioning MC9S12XF - Family Reference Manual, Rev.1.19 1206 Freescale Semiconductor Appendix A Electrical Characteristics A.3.2 NVM Reliability Parameters The reliability of the NVM blocks is guaranteed by stress test during qualiﬁcation, constant process monitors and burn-in to screen early life failures. The data retention and program/erase cycling failure rates are speciﬁed at the operating conditions noted. The program/erase cycle count on the sector is incremented every time a sector or mass erase event is executed. The standard shipping condition for both the D-Flash and P-Flash memory is erased with security disabled. However it is recommended that each block or sector is erased before factory programming to ensure that the full data retention capability is achieved. Data retention time is measured from the last erase operation. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1207 Appendix A Electrical Characteristics Table A-17. NVM Reliability Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C Rating P-Flash Arrays 1 2 3 C Data retention at an average junction temperature of TJavg = 85°C(1) after up to 10,000 program/erase cycles C Data retention at an average junction temperature of TJavg = 85°C(3) after less than 100 program/erase cycles C P-Flash number of program/erase cycles (-40°C ≤ tj ≤ 150°C) D-Flash Array 4 5 6 7 C Data retention at an average junction temperature of TJavg = 85°C3 after up to 50,000 program/erase cycles C Data retention at an average junction temperature of TJavg = 85°C3 after less than 10,000 program/erase cycles C Data retention at an average junction temperature of TJavg = 85°C3 after less than 100 program/erase cycles C D-Flash number of program/erase cycles (-40°C ≤ tj ≤ 150°C) Emulated EEPROM 8 9 C Data retention at an average junction temperature of TJavg = 1 85°C after spec. program/erase cycles C Data retention at an average junction temperature of TJavg = 3 85°C after less than 20% spec.program/erase cycles. (e.g. after = 0 t During power sequencing VDDA can be powered up before VDDR, VDDX. VDDR and VDDX must be powered up together adhering to the operating conditions differential. VRH power up must follow VDDA to avoid current injection. MC9S12XF - Family Reference Manual, Rev.1.19 1212 Freescale Semiconductor Appendix A Electrical Characteristics A.6 Reset, Oscillator and PLL This section summarizes the electrical characteristics of the various startup scenarios for oscillator and phase-locked loop (PLL). A.6.1 Startup Table A-20 summarizes several startup characteristics explained in this section. Detailed description of the startup behavior can be found in the Clock and Reset Generator (CRG) block description Table A-20. Startup Characteristics Conditions are shown in Table A-4.unless otherwise noted Num C 1 2 3 Rating Symbol PWRSTL tRST tWRS Min 2 96 — Typ — — — 50 Max — 4000(1) 14 100 Unit tosc nbus tcyc µs D Reset input pulse width, minimum input time D Startup from reset D Wait recovery startup time 4 D Fast wakeup from STOP(2) — tfws 1. This is the time between RESET deassertion and start of CPU code execution. 2. Including voltage regulator startup; VDD /VDDF ﬁlter capacitors 220 nF, VDD35 = 5 V, T= 25°C A.6.1.1 POR The release level VPORR and the assert level VPORA are derived from the VDD supply. They are also valid if the device is powered externally. After releasing the POR reset the oscillator and the clock quality check are started. If after a time tCQOUT no valid oscillation is detected, the MCU will start using the internal self clock. The fastest startup time possible is given by nuposc. A.6.1.2 SRAM Data Retention Provided an appropriate external reset signal is applied to the MCU, preventing the CPU from executing code when VDD35 is out of speciﬁcation limits, the SRAM contents integrity is guaranteed if after the reset the PORF bit in the CRG ﬂags register has not been set. A.6.1.3 External Reset When external reset is asserted for a time greater than PWRSTL the CRG module generates an internal reset, and the CPU starts fetching the reset vector without doing a clock quality check, if there was an oscillation before reset. A.6.1.4 Stop Recovery Out of stop the controller can be woken up by an external interrupt. A clock quality check as after POR is performed before releasing the clocks to the system. If the MCU is woken-up by an interrupt and the fast wake-up feature is enabled (FSTWKP = 1 and SCME = 1), the system will resume operation in self-clock mode after tfws. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1213 Appendix A Electrical Characteristics A.6.1.5 Pseudo Stop and Wait Recovery The recovery from pseudo stop and wait is essentially the same since the oscillator is not stopped in both modes. The controller can be woken up by internal or external interrupts. After twrs the CPU starts fetching the interrupt vector. MC9S12XF - Family Reference Manual, Rev.1.19 1214 Freescale Semiconductor Appendix A Electrical Characteristics A.6.2 Oscillator Table A-21. Oscillator Characteristics Conditions are shown in Table A-4. unless otherwise noted Num C 1a 1b 2 3a 3b 3c 4a 4b 4c 4d 4e 5 6 7 8 9 10 11 12 13 Rating Symbol fOSC fOSC iOSC tUPOSC tUPOSC tUPOSC tUPOSC tUPOSC tUPOSC tUPOSC tUPOSC tCQOUT fCMFA fEXT tEXTL tEXTH tEXTR tEXTF CIN VIH,EXTAL VIH,EXTAL VIL,EXTAL VIL,EXTAL VHYS,EXTAL Min 4.0 2.0 100 — — — — — — — — 0.45 200 2.0 9.5 9.5 — — — 0.75*VDDPLL — — VSSPLL - 0.3 — Typ — — — 2 1.6 1 8 4 2 1 0.8 — 400 — — — — — 7 — — — — Max 16 40 — 10 8 5 40 20 10 5 4 2.5 1000 50 — — 1 1 — — VDDPLL + 0.3 0.25*VDDPLL — — Unit MHz MHz µA ms ms ms ms ms ms ms ms s KHz MHz ns ns ns ns pF V V V V mV V C Crystal oscillator range (loop controlled Pierce) C Crystal oscillator range (full swing Pierce) (1),(2) P Startup Current C Oscillator start-up time (LCP, 4MHz)(3) C Oscillator start-up time (LCP, 8MHz)3 C Oscillator start-up time (LCP, 16MHz)3 C Oscillator start-up time (full swing Pierce, 2MHz)3 C Oscillator start-up time (full swing Pierce, 4MHz)3 C Oscillator start-up time (full swing Pierce, 8MHz)3 C Oscillator start-up time (full swing Pierce, 16MHz)3 C Oscillator start-up time (full swing Pierce, 40MHz)3 D Clock Quality check time-out P Clock Monitor Failure Assert Frequency P External square wave input frequency D External square wave pulse width low D External square wave pulse width high D External square wave rise time D External square wave fall time D Input Capacitance (EXTAL, XTAL pins) P EXTAL Pin Input High Voltage T EXTAL Pin Input High Voltage,(4) 14 P EXTAL Pin Input Low Voltage ,4 T EXTAL Pin Input Low Voltage 15 16 C EXTAL Pin Input Hysteresis C 180 EXTAL Pin oscillation amplitude (loop controlled — — VPP,EXTAL 0.9 Pierce) 1. Depending on the crystal a damping series resistor might be necessary 2. Only valid if full swing Pierce oscillator/external clock mode is selected 3. These values apply for carefully designed PCB layouts with capacitors that match the crystal/resonator requirements.. 4. Only applies if EXTAL is externally driven MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1215 Appendix A Electrical Characteristics A.6.3 A.6.3.1 Phase Locked Loop Jitter Information With each transition of the clock fcmp, the deviation from the reference clock fref is measured and input voltage to the VCO is adjusted accordingly.The adjustment is done continuously with no abrupt changes in the clock output frequency. Noise, voltage, temperature and other factors cause slight variations in the control loop resulting in a clock jitter. This jitter affects the real minimum and maximum clock periods as illustrated in Figure A-5. 0 1 2 3 N-1 N tmin1 tnom tmax1 tminN tmaxN Figure A-5. Jitter Deﬁnitions The relative deviation of tnom is at its maximum for one clock period, and decreases towards zero for larger number of clock periods (N). MC9S12XF - Family Reference Manual, Rev.1.19 1216 Freescale Semiconductor Appendix A Electrical Characteristics Deﬁning the jitter as: t (N) t (N) ⎞ ⎛ max min J ( N ) = max ⎜ 1 – ---------------------- , 1 – ---------------------- ⎟ N⋅t N⋅t ⎝ nom nom ⎠ For N < 10000, the following equation is a good ﬁt for the maximum jitter: j1 J ( N ) = ------- + j 2 N J(N) 1 5 10 20 N Figure A-6. Maximum bus clock or CGMPLL clock jitter approximation MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1217 Appendix A Electrical Characteristics This is important to note with respect to timers, serial modules where a prescaler will eliminate the effect of the jitter to a large extent. Table A-22. IPLL Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C 1 2 3 4 5 7 8 9 10 11 12 13 14 15 16 Rating Symbol fSCM fVCO fREF |∆Lock| |∆unl| tstab j1 j2 fbus fbus fbus |∆Lock| |∆unl| tstab j1 0 0.5 0.25 1.7 Min 1 32 1 0 0.5 0.25 1.2 0 48 49 49 1.5 2.5 Typ Max 5.5 120 40 1.5 2.5 Unit MHz MHz MHz %(1) %1 ms % % MHz MHz MHz %1 %1 ms % P Self Clock Mode frequency T VCO locking range T Reference Clock D System IPLL: Lock Detection D System IPLL: Un-Lock Detection C System IPLL: PLLON Stabilization delay(2) C System IPLL: Jitter ﬁt parameter 12 C System IPLL: Jitter ﬁt parameter 22 D System IPLL: Bus Frequency for FM1=1, FM0=1 (frequency modulation in PLLCTL register of s12xe_crg) D System IPLL: Bus Frequency for FM1=1, FM0=0 (frequency modulation in PLLCTL register of s12xe_crg) D System IPLL: Bus Frequency for FM1=0, FM0=1 (frequency modulation in PLLCTL register of s12xe_crg) D FlexRay IPLL: Lock Detection D FlexRay IPLL: Un-Lock Detection C FlexRay IPLL: PLLON Stabilization delay(3) C FlexRay IPLL: Jitter ﬁt parameter 13 3 j2 0 % 17 C FlexRay IPLL: Jitter ﬁt parameter 2 1. System IPLL: % deviation from target frequency 2. System IPLL: fOSC = 8MHz, fBUS = 50MHz equivalent fPLL = 100MHz: REFDIV=$03, REFRQ=00, SYNDIV=$18, VCOFRQ=11, POSTDIV=$ 00. Jitter spec is valid for N=1 to 10000 bus clock cycles 3. FlexRay IPLL: fOSC = 8MHz equivalent fCGMPLL = 80MHz: REFDIV=$00, REFRQ=10, SYNDIV=$04, VCOFRQ=01, POSTDIV=$ 00. Jitter spec is valid for N=1 to 10000 CGMPLL clock cycles A.7 A.7.1 External Interface Timing MSCAN Table A-23. MSCAN Wake-up Pulse Characteristics Conditions are shown in Table A-4 unless otherwise noted Num C 1 2 Rating Symbol tWUP tWUP Min — 5 Typ — — Max 1.5 — Unit µs µs P MSCAN wakeup dominant pulse ﬁltered P MSCAN wakeup dominant pulse pass A.7.2 SPI Timing MC9S12XF - Family Reference Manual, Rev.1.19 1218 Freescale Semiconductor Appendix A Electrical Characteristics This section provides electrical parametrics and ratings for the SPI. In Table A-24 the measurement conditions are listed. Table A-24. Measurement Conditions Description Drive mode Load capacitance CLOAD(1), on all outputs Thresholds for delay measurement points 1. Timing speciﬁed for equal load on all SPI output pins. Avoid asymmetric load. Value Full drive mode 50 (20% / 80%) VDDX Unit — pF V A.7.2.1 Master Mode In Figure A-7 the timing diagram for master mode with transmission format CPHA = 0 is depicted. SS1 (Output) 2 SCK (CPOL = 0) (Output) SCK (CPOL = 1) (Output) 5 MISO (Input) 6 Bit MSB-1. . . 1 9 Bit MSB-1. . . 1 LSB OUT LSB IN 11 1 4 4 12 13 12 13 3 MSB IN2 10 MOSI (Output) MSB OUT2 1. If conﬁgured as an output. 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1, bit 2... MSB. Figure A-7. SPI Master Timing (CPHA = 0) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1219 Appendix A Electrical Characteristics In Figure A-8 the timing diagram for master mode with transmission format CPHA=1 is depicted. SS1 (Output) 1 2 SCK (CPOL = 0) (Output) 4 SCK (CPOL = 1) (Output) 5 MISO (Input) 9 MOSI (Output) Port Data Master MSB OUT2 6 Bit MSB-1. . . 1 11 Bit MSB-1. . . 1 Master LSB OUT Port Data LSB IN MSB IN2 4 12 13 12 13 3 1.If conﬁgured as output 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1,bit 2... MSB. Figure A-8. SPI Master Timing (CPHA = 1) MC9S12XF - Family Reference Manual, Rev.1.19 1220 Freescale Semiconductor Appendix A Electrical Characteristics In Table A-25 the timing characteristics for master mode are listed. Table A-25. SPI Master Mode Timing Characteristics Num 1 1 2 3 4 5 6 9 10 11 12 C D D D D D D D D D D D SCK period Enable lead time Enable lag time Clock (SCK) high or low time Data setup time (inputs) Data hold time (inputs) Data valid after SCK edge Data valid after SS fall (CPHA = 0) Data hold time (outputs) Rise and fall time inputs Characteristic SCK frequency Symbol fsck tsck tlead tlag twsck tsu thi tvsck tvss tho trﬁ trfo Min 1/2048 21 — — — 8 8 — — 0 — — Typ — — 1/2 1/2 1/2 — — — — — — — Max 1/2 (1) Unit fbus tbus tsck tsck tsck ns ns ns ns ns ns ns 2048 — — — — — 15 15 — 8 8 13 D Rise and fall time outputs 1. See Figure A-9. fSCK/fbus 1/2 1/4 5 10 15 20 25 30 35 40 fbus [MHz] Figure A-9. Derating of maximum fSCK to fbus ratio in Master Mode MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1221 Appendix A Electrical Characteristics A.7.2.2 Slave Mode In Figure A-10 the timing diagram for slave mode with transmission format CPHA = 0 is depicted. SS (Input) 1 SCK (CPOL = 0) (Input) 2 SCK (CPOL = 1) (Input) 10 7 MISO (Output) See Note 5 MOSI (Input) NOTE: Not deﬁned MSB IN Slave MSB 6 Bit MSB-1. . . 1 LSB IN 9 Bit MSB-1 . . . 1 4 4 12 13 8 11 11 See Note 12 13 3 Slave LSB OUT Figure A-10. SPI Slave Timing (CPHA = 0) MC9S12XF - Family Reference Manual, Rev.1.19 1222 Freescale Semiconductor Appendix A Electrical Characteristics In Figure A-11 the timing diagram for slave mode with transmission format CPHA = 1 is depicted. SS (Input) 1 2 SCK (CPOL = 0) (Input) 4 SCK (CPOL = 1) (Input) 9 MISO (Output) See Note 7 MOSI (Input) NOTE: Not deﬁned Slave 5 MSB OUT 6 MSB IN Bit MSB-1 . . . 1 LSB IN 4 12 13 12 13 3 11 Bit MSB-1 . . . 1 Slave LSB OUT 8 Figure A-11. SPI Slave Timing (CPHA = 1) In Table A-26 the timing characteristics for slave mode are listed. Table A-26. SPI Slave Mode Timing Characteristics Num 1 1 2 3 4 5 6 7 8 9 10 11 12 C D D D D D D D D D D D D D Characteristic SCK frequency SCK period Enable lead time Enable lag time Clock (SCK) high or low time Data setup time (inputs) Data hold time (inputs) Slave access time (time to data active) Slave MISO disable time Data valid after SCK edge Data valid after SS fall Data hold time (outputs) Rise and fall time inputs Symbol fsck tsck tlead tlag twsck tsu thi ta tdis tvsck tvss tho trﬁ trfo Min DC 4 4 4 4 8 8 — — — — 20 — — Typ — — — — — — — — — — — — — — Max 1/4 ∞ — — — — — 20 22 28 + 0.5 ⋅ tbus(1) 28 + 0.5 ⋅ tbus — 8 8 1 Unit fbus tbus tbus tbus tbus ns ns ns ns ns ns ns ns ns 13 D Rise and fall time outputs 1. 0.5 tbus added due to internal synchronization delay MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1223 Appendix A Electrical Characteristics A.7.3 External Bus Timing The following conditions are assumed for all following external bus timing values: • Crystal input within 45% to 55% duty • Equal loads of pins • Pad full drive (reduced drive must be off) A.7.3.1 Normal Expanded Mode (External Wait Feature Disabled) 1 1 CSx ADDRx ADDR1 ADDR2 2 RE 3 4 WE 8 6 7 10 DATAx (Read) DATA1 5 11 (Write) DATA2 9 EWAIT UDS, LDS Figure A-12. Example 1a: Normal Expanded Mode — Read Followed by Write MC9S12XF - Family Reference Manual, Rev.1.19 1224 Freescale Semiconductor Appendix A Electrical Characteristics Table A-27. Example 1a: Normal Expanded Mode Timing 50 MHz bus (EWAIT disabled) No. 1 2 3 4 5 6 7 8 9 10 Characteristic Frequency of internal bus Internal cycle time Frequency of external bus External cycle time (selected by EXSTR) Address (1) valid to RE fall Pulse width, RE Address valid to WE fall Pulse width, WE Read data setup time (if ITHRS = 0) Read data setup time (if ITHRS = 1) Read data hold time Read enable access time Write data valid to WE fall Write data setup time Symbol C fi tcyc fo tcyce tADRE PWRE tADWE PWWE tDSR tDSR tDHR tACCR tWDWE tDSW D D D D D D D D D D D VDD35=5.0V Min D.C. 20 D.C. 40 4 28 4 18 19 23 0 4 5 23 6 Max 50.0 ∞ 25.0 ∞ MHz ns MHz ns ns ns ns ns ns ns ns ns ns ns ns Unit 11 Write data hold time tDHW 1. Includes the following signals: ADDRx, UDS, LDS, and CSx. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1225 Appendix A Electrical Characteristics A.7.3.2 Normal Expanded Mode (External Wait Feature Enabled) 1 CSx ADDRx ADDR1 ADDR2 2 RE 3 WE 8 6 7 DATAx 12 13 EWAIT (Read) DATA1 UDS, LDS Figure A-13. Example 1b: Normal Expanded Mode — Stretched Read Access MC9S12XF - Family Reference Manual, Rev.1.19 1226 Freescale Semiconductor Appendix A Electrical Characteristics 1 CSx ADDRx ADDR1 ADDR2 RE 4 WE 9 5 10 DATAx 12 13 EWAIT (Write) DATA1 11 UDS, LDS Figure A-14. Example 1b: Normal Expanded Mode — Stretched Write Access MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1227 Appendix A Electrical Characteristics Table A-28. Example 1b: Normal Expanded Mode Timing at 50MHz bus (EWAIT enabled) VDD5 = 5.0V No. Characteristic Symbol C 1 2 3 4 5 6 Frequency of internal bus Internal cycle time Frequency of external bus External cycle time (selected by EXSTR) External cycle time (EXSTR+1EWAIT) Address (1) valid to RE fall Pulse width, RE (2) Address valid to WE fall Pulse width, WE Read data setup time (if ITHRS = 0) Read data setup time (if ITHRS = 1) 7 8 9 Read data hold time Read enable access time Write data valid to WE fall fi tcyc fo tcyce tcycew tADRE PWRE tADWE PWWE tDSR tDSR tDHR tACCR tWDWE tDSW tDHW tADWF D D D D D D D D D D D D 2 stretch cycles Min D.C. 20 D.C. 60 80 4 68 4 58 19 23 0 49 5 63 6 0 Max 50.0 ∞ 16.7 ∞ ∞ 16 3 stretch cycles Min D.C. 20 D.C. 80 100 4 88 4 78 19 23 0 69 5 93 6 0 50 Max 50.0 ∞ 12.5 ∞ ∞ 36 58 MHz ns MHz ns ns ns ns ns ns ns ns ns ns ns ns ns ns ns Unit 10 Write data setup time 11 Write data hold time 12 Address to EWAIT fall 13 Address to EWAIT rise tADWR D 30 39 1. Includes the following signals: ADDRx, UDS, LDS, and CSx. 2. Affected by EWAIT. MC9S12XF - Family Reference Manual, Rev.1.19 1228 Freescale Semiconductor Appendix A Electrical Characteristics A.7.3.3 Emulation Single-Chip Mode (Without Wait States) 1 2 3 1 ECLK2X ECLK 4 ADDR [22:20]/ ACC [2:0] ADDR [19:16]/ IQSTAT [3:0] ADDR [15:0]/ IVD [15:0] 5 6 7 addr1 acc1 addr2 acc2 addr3 addr1 iqstat0 addr2 iqstat1 addr3 addr1 ivd0 addr2 ivd1 addr3 8 9 DATAx data0 (read) data1 10 12 R/W 12 (write) data2 11 LSTRB Figure A-15. Example 2a: Emulation Single-Chip Mode — Read Followed by Write MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1229 Appendix A Electrical Characteristics Table A-29. Example 2a: Emulation Single-Chip Mode Timing 50 Mhz bus, VDD5=5.0V (EWAIT disabled) No. 1 2 3 4 5 6 7 8 9 10 11 C D D D D D D D D D D Cycle time Pulse width, E high Pulse width, E low Address delay time Address hold time IVDx delay time (2) IVDx hold time Read data setup time (ITHRS = 1 only) Read data hold time Write data delay time Write data hold time Characteristic (1) Frequency of internal bus Symbol fi tcyc PWEH PWEL tAD tAH tIVDD tIVDH tDSR tDHR tDDW tDHW tRWD Min D.C. 20 9 9 0 0 12 0 0 -1 Max 50.0 ∞ 5 4.5 5 5 Unit MHz ns ns ns ns ns ns ns ns ns ns ns ns 12 D Read/write data delay time (3) 1. Typical Supply and Silicon, Room Temperature Only 2. Includes also ACCx, IQSTATx 3. Includes LSTRB MC9S12XF - Family Reference Manual, Rev.1.19 1230 Freescale Semiconductor Appendix A Electrical Characteristics A.7.3.4 Emulation Expanded Mode (With Optional Access Stretching) 1 2 3 ECLK2X ECLK 4 ADDR [22:20]/ ACC [2:0] ADDR [19:16]/ IQSTAT [3:0] ADDR [15:0]/ IVD [15:0] 5 6 7 ADDR1 ACC1 ADDR1 000 ADDR2 ADDR1 IQSTAT0 ADDR1 IQSTAT1 ADDR2 ADDR1 ? ADDR1 IVD1 ADDR2 8 9 DATAx DATA0 (Read) DATA1 12 12 R/W LSTRB Figure A-16. Example 2b: Emulation Expanded Mode — Read with 1 Stretch Cycle MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1231 Appendix A Electrical Characteristics 1 2 3 ECLK2X ECLK 4 ADDR [22:20]/ ACC [2:0] ADDR [19:16]/ IQSTAT [3:0] ADDR [15:0]/ IVD [15:0] 5 6 ADDR1 ACC1 ADDR1 000 ADDR2 7 ADDR1 IQSTAT0 ADDR1 IQSTAT1 ADDR2 ADDR1 ? ADDR1 x ADDR2 10 DATAx (write) data1 11 12 12 R/W LSTRB Figure A-17. Example 2b: Emulation Expanded Mode Ò Write with 1 Stretch Cycle MC9S12XF - Family Reference Manual, Rev.1.19 1232 Freescale Semiconductor Appendix A Electrical Characteristics Table A-30. Example 2b: Emulation Expanded Mode Timing 50 MHz bus, VDD5=5.0V (EWAIT disabled) No. 1 2 3 4 5 6 7 8 9 10 11 C D D D D D D D D D D Characteristic Internal cycle time Cycle time Pulse width, E high E falling to sampling E rising Address delay time Address hold time IVD delay time (2) IVD hold time Read data setup time Read data hold time Write data delay time Write data hold time (1) Symbol tcyc tcyce PWEH tEFSR tAD tAH tIVDD tIVDH tDSR tDHR tDDW tDHW tRWD 1 stretch cycle Min 20 40 9 28 Max ∞ ∞ 11 32 2 stretch cycles Min 20 60 9 48 Max ∞ ∞ 11 52 3 stretch cycles Min 20 80 9 68 Max ∞ ∞ 11 72 Unit ns ns ns ns ns ns ns ns ns ns ns ns ns refer to table Table A-29 refer to table Table A-29 refer to table Table A-29 12 D Read/write data delay time (3) 1. Typical Supply and Silicon, Room Temperature Only 2. Includes also ACCx, IQSTATx 3. Includes LSTRB MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1233 Appendix A Electrical Characteristics A.7.3.5 External Tag Trigger Timing 1 ECLK ADDR ADDR DATAx DATA R/W TAGHI/TAGLO 2 3 Figure A-18. External Trigger Timing Table A-31. External Tag Trigger Timing VDD35 = 5.0 V No. 1 2 C D D D Characteristic (1) Frequency of internal bus Cycle time TAGHI/TAGLO setup time Symbol fi tcyc tTS tTH Min D.C. 20 10 0 Max 50.0 ∞ — — Unit MHz ns ns ns 3 D TAGHI/TAGLO hold time 1. Typical supply and silicon, room temperature only MC9S12XF - Family Reference Manual, Rev.1.19 1234 Freescale Semiconductor Appendix B Package Physical Dimension Information. Appendix B Package Physical Dimension Information. B.1 4X 144-Pin LQFP Package1 0.20 T L-M N 4X 36 TIPS 0.20 T L-M N PIN 1 IDENT 1 144 109 108 J1 J1 L M B V 140X 4X P C L X G VIEW Y 36 73 B1 V1 VIEW Y NOTES: 1. DIMENSIONS AND TOLERANCING PER ASME Y14.5M, 1994. 2. DIMENSIONS IN MILLIMETERS. 3. DATUMS L, M, N TO BE DETERMINED AT THE SEATING PLANE, DATUM T. 4. DIMENSIONS S AND V TO BE DETERMINED AT SEATING PLANE, DATUM T. 5. DIMENSIONS A AND B DO NOT INCLUDE MOLD PROTRUSION. ALLOWABLE PROTRUSION IS 0.25 PER SIDE. DIMENSIONS A AND B DO INCLUDE MOLD MISMATCH AND ARE DETERMINED AT DATUM PLANE H. 6. DIMENSION D DOES NOT INCLUDE DAMBAR PROTRUSION. ALLOWABLE DAMBAR PROTRUSION SHALL NOT CAUSE THE D DIMENSION TO EXCEED 0.35. 37 72 N A1 S1 A S VIEW AB C θ2 θ2 T PLATING 0.1 T 144X SEATING PLANE J F AA C2 0.05 θ R2 R1 D 0.08 M BASE METAL 0.25 GAGE PLANE T L-M N (K) C1 (Y) VIEW AB (Z) E θ1 SECTION J1-J1 (ROTATED 90 ° ) 144 PL MILLIMETERS DIM MIN MAX A 20.00 BSC A1 10.00 BSC B 20.00 BSC B1 10.00 BSC C 1.40 1.60 C1 0.05 0.15 C2 1.35 1.45 D 0.17 0.27 E 0.45 0.75 F 0.17 0.23 G 0.50 BSC J 0.09 0.20 K 0.50 REF P 0.25 BSC R1 0.13 0.20 R2 0.13 0.20 S 22.00 BSC S1 11.00 BSC V 22.00 BSC V1 11.00 BSC Y 0.25 REF Z 1.00 REF AA 0.09 0.16 θ 0° θ1 0° 7° θ2 11° 13 ° 1. The 144-Pin LQFP version will not be qualified for production and is intended to be used for emulation (development tools) only. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1235 Appendix B Package Physical Dimension Information. Figure B-1. 144-Pin LQFP Mechanical Dimensions (Case No. 918-03) B.2 PIN 1 IDENT 112-Pin LQFP Package 4X 112 1 0.20 T L-M N 4X 28 TIPS 85 84 0.20 T L-M N J1 J1 C L 4X P VIEW Y 108X G X X=L, M OR N VIEW Y B L M B1 V1 V J AA 28 57 F D 0.13 M BASE METAL 29 56 T L-M N N A1 S1 A S SECTION J1-J1 ROTATED 90 ° COUNTERCLOCKWISE NOTES: 1. DIMENSIONING AND TOLERANCING PER ASME Y14.5M, 1994. 2. DIMENSIONS IN MILLIMETERS. 3. DATUMS L, M AND N TO BE DETERMINED AT SEATING PLANE, DATUM T. 4. DIMENSIONS S AND V TO BE DETERMINED AT SEATING PLANE, DATUM T. 5. DIMENSIONS A AND B DO NOT INCLUDE MOLD PROTRUSION. ALLOWABLE PROTRUSION IS 0.25 PER SIDE. DIMENSIONS A AND B INCLUDE MOLD MISMATCH. 6. DIMENSION D DOES NOT INCLUDE DAMBAR PROTRUSION. ALLOWABLE DAMBAR PROTRUSION SHALL NOT CAUSE THE D DIMENSION TO EXCEED 0.46. 112X C2 C 0.050 θ2 VIEW AB 0.10 T SEATING PLANE θ3 T θ R R2 0.25 GAGE PLANE R R1 C1 (Y) (Z) VIEW AB (K) E θ1 DIM A A1 B B1 C C1 C2 D E F G J K P R1 R2 S S1 V V1 Y Z AA θ θ1 θ2 θ3 MILLIMETERS MIN MAX 20.000 BSC 10.000 BSC 20.000 BSC 10.000 BSC --1.600 0.050 0.150 1.350 1.450 0.270 0.370 0.450 0.750 0.270 0.330 0.650 BSC 0.090 0.170 0.500 REF 0.325 BSC 0.100 0.200 0.100 0.200 22.000 BSC 11.000 BSC 22.000 BSC 11.000 BSC 0.250 REF 1.000 REF 0.090 0.160 8° 0° 7° 3° 13 ° 11 ° 11 ° 13 ° Figure B-2. 112-Pin LQFP Mechanical Dimensions (Case No. 987) MC9S12XF - Family Reference Manual, Rev.1.19 1236 Freescale Semiconductor Appendix B Package Physical Dimension Information. 4X 4X 16 TIPS 0.2 H A-B D 64 1 49 48 0.2 C A-B D A2 0.05 (S) θ1 2X R R1 S A B E1 E A1 0.25 θ (L2) L (L1) VIEW AA NOTES: 1. DIMENSIONING AND TOLERANCING PER ANSI Y14.5M, 1982. 2. CONTROLLING DIMENSION: MILLIMETER. 3. DATUM PLANE H IS LOCATED AT BOTTOM OF LEAD AND IS COINCIDENT WITH THE LEAD WHERE THE LEAD EXISTS THE PLASTIC BODY AT THE BOTTOM OF THE PARTING LINE. 4. DATUMS A, B AND D TO BE DETERMINED AT DATUM PLANE DATUM C. 5. DIMENSIONS D AND E TO BE DETERMINED AT SEATING PLANE DATUM C. DIMENSIONS D AND E TO BE DETERMINED AT SEATING PLANE DATUM C. 6. DIMENSIONS D1 AND E1 DO NOT INCLUDE MOLD PROTRUSION. ALLOWABLE PROTRUSION IS 0.25 PER SIDE. 7. DIMENSION b DOES NOT INCLUDE DAMBAR PROTRUSION. DAMBAR PROTRUSION SHALL NOT CAUSE THE b DIMENSION TO EXCEED 0.35. MINIMUM SPACE BETWEEN PROTRUSION AND ADJACENT LEAD OR PROTRUSION 0.07. DIM A A1 A2 b b1 c c1 D D1 e E E1 L L1 L2 R1 S θ θ1 θ2 θ3 MILLIMETERS MIN MAX --1.60 0.05 0.15 1.35 1.45 0.17 0.27 0.17 0.23 0.09 0.20 0.09 0.16 12.00 BSC 10.00 BSC 0.50 BSC 12.00 BSC 10.00 BSC 0.45 0.75 1.00 REF 0.50 REF 0.10 0.20 0.20 REF 0˚ 7˚ 0˚ --12˚ REF 12˚ REF GAGE PLANE 3X VIEW Y 16 17 32 33 E1/2 E/2 D D1/2 D/2 D1 D H A 4X (θ 2) 0.08 C C SEATING PLANE 4X (θ 3) VIEW AA BASE METAL b1 X X=A, B OR D c c1 C L AB AB VIEW Y e/2 60X PLATING b 0.08 M e C A-B D SECTION AB-AB ROTATED 90˚ CLOCKWISE CASE 840F-02 ISSUE B B.3 64-Pin LQFP Package Figure B-3. 64-Pin LQFP Mechanical Dimensions (case no. 840F-02) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1237 Appendix C PCB Layout Guidelines Appendix C PCB Layout Guidelines The PCB must be carefully laid out to ensure proper operation of the voltage regulator as well as of the MCU itself. The following rules must be observed: • Every supply pair must be decoupled by a ceramic capacitor connected as near as possible to the corresponding pins . • Central point of the ground star should be the VSS2 pin. • Use low ohmic low inductance connections between VSS1, VSS2 and VSS3. • VSSPLL must be directly connected to VSS3. • Keep traces of VSSPLL, EXTAL, and XTAL as short as possible and occupied board area for C7, C8, and Q1 as small as possible. • Do not place other signals or supplies underneath area occupied by C7, C8, and Q1 and the connection area to the MCU. • Central power input should be fed in at the VDDA/VSSA pins. Example layouts are illustrated on the following pages. Table C-1. Recommended Decoupling Capacitor Choice Component C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 Purpose VDDF ﬁlter capacitor VDDX3 ﬁlter capacitor (LQFP144 only) VDDX2 ﬁlter capacitor VDDPLL ﬁlter capacitor OSC load capacitor OSC load capacitor VDDR ﬁlter capacitor VDDX4 ﬁlter capacitor (LQFP144 only) VDD ﬁlter capacitor VDDA ﬁlter capacitor VDDX1 ﬁlter capacitor X7R/tantalum X7R/tantalum Ceramic X7R Ceramic X7R X7R/tantalum >=100 nF >=100 nF 220 nF >=100 nF >=100 nF Type Ceramic X7R X7R/tantalum X7R/tantalum Ceramic X7R Value 220 nF >=100 nF >=100 nF 220 nF From crystal manufacturer MC9S12XF - Family Reference Manual, Rev.1.19 1238 Freescale Semiconductor Appendix C PCB Layout Guidelines Figure C-1. 144-Pin LQFP Recommended PCB Layout (Loop Controlled Pierce Oscillator) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1239 Appendix C PCB Layout Guidelines Figure C-2. 112-Pin LQFP Recommended PCB Layout (Loop Controlled Pierce Oscillator) MC9S12XF - Family Reference Manual, Rev.1.19 1240 Freescale Semiconductor Appendix C PCB Layout Guidelines Figure C-3. 64-Pin LQFP Recommended PCB Layout (Loop Controlled Pierce Oscillator) MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1241 Appendix D Derivative Differences Appendix D Derivative Differences D.1 Memory Sizes and Package Options S12XF - Family Table D-1. Package and Memory Options of MC9S12XF-Family Device Package 144 LQFP 112 LQFP 64 LQFP 144 LQFP 112 LQFP 64 LQFP 144 LQFP 112 LQFP 64 LQFP 144 LQFP 112 LQFP 64 LQFP DATA Flash RAM EEPROM FLASH 512K 32K 4K 384K 24K 32K 256K 20K 2K 128K 16K 9S12XF512 9S12XF384 9S12XF256 9S12XF128 MC9S12XF - Family Reference Manual, Rev.1.19 1242 Freescale Semiconductor Appendix D Derivative Differences D.2 • • • • • • • Pinout explanations: A/D is the number of modules/total number of A/D channels. I/O is the sum of ports capable to act as digital input or output. For details see Table 1-10. Versions with 1 CAN module will have CAN0. Versions with 2 SPI modules will have SPI0 and SPI1. Versions with 1 SPI modules will have SPI0. Versions with 2 SCI modules will have SCI0 and SCI1. Versions with 1 SCI module will have SCI0. MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1243 Appendix E Detailed Register Address Map Appendix E Detailed Register Address Map The following tables show the detailed register map of the MC9S12XF512. 0x0000–0x0009 Port Integration Module (PIM) Map 1 of 5 Address 0x0000 0x0001 0x0002 0x0003 0x0004 0x0005 0x0006 0x0007 0x0008 0x0009 Name PORTA PORTB DDRA DDRB PORTC PORTD DDRC DDRD PORTE DDRE R W R W R W R W R W R W R W R W R W R W Bit 7 PA7 PB7 DDRA7 DDRB7 PC7 PD7 DDRC7 DDRD7 PE7 DDRE7 Bit 6 PA6 PB6 DDRA6 DDRB6 PC6 PD6 DDRC6 DDRD6 PE6 DDRE6 Bit 5 PA5 PB5 DDRA5 DDRB5 PC5 PD5 DDRC5 DDRD5 PE5 DDRE5 Bit 4 PA4 PB4 DDRA4 DDRB4 PC4 PD4 DDRC4 DDRD4 PE4 DDRE4 Bit 3 PA3 PB3 DDRA3 DDRB3 PC3 PD3 DDRC3 DDRD3 PE3 DDRE3 Bit 2 PA2 PB2 DDRA2 DDRB2 PC2 PD2 DDRC2 DDRD2 PE2 DDRE2 Bit 1 PA1 PB1 DDRA1 DDRB1 PC1 PD1 DDRC1 DDRD1 PE1 0 Bit 0 PA 0 PB0 DDRA0 DDRB0 PC0 PD0 DDRC0 DDRD0 PE0 0 0x000A–0x000B Module Mapping Control (S12XMMC) Map 1 of 2 Address 0x000A 0x000B Name MMCCTL0 MODE R W R W Bit 7 CS3E1 MODC Bit 6 CS2E1 MODB Bit 5 CS1E1 MODA Bit 4 CS0E1 0 Bit 3 CS3E0 0 Bit 2 CS2E0 0 Bit 1 CS1E0 0 Bit 0 CS0E0 0 0x000C–0x000D Port Integration Module (PIM) Map 2 of 5 Address 0x000C 0x000D Name PUCR RDRIV R W R W Bit 7 PUPKE RDPK Bit 6 BKPUE 0 Bit 5 0 0 Bit 4 PUPEE RDPE Bit 3 PUPDE RDPD Bit 2 PUPCE RDPC Bit 1 PUPBE RDPB Bit 0 PUPAE RDPA MC9S12XF - Family Reference Manual, Rev.1.19 1244 Freescale Semiconductor Appendix E Detailed Register Address Map 0x000E–0x000F External Bus Interface (S12XEBI) Map Address 0x000E 0x000F Name EBICTL0 EBICTL1 R W R W Bit 7 ITHRS 0 Bit 6 0 Bit 5 HDBE Bit 4 ASIZ4 Bit 3 ASIZ3 0 Bit 2 ASIZ2 Bit 1 ASIZ1 Bit 0 ASIZ0 EXSTR12 EXSTR11 EXSTR10 EXSTR02 EXSTR01 EXSTR00 0x0010–0x0017 Module Mapping Control (S12XMMC) Map 2 of 2 Address 0x0010 0x0011 0x0012 0x0013 0x0014 0x0015 0x0016 0x0017 Name GPAGE DIRECT Reserved MMCCTL1 Reserved PPAGE RPAGE EPAGE Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 GP3 DP11 0 Bit 2 GP2 DP10 0 Bit 1 GP1 DP9 0 Bit 0 GP0 DP8 0 R 0 GP6 GP5 GP4 W R DP15 DP14 DP13 DP12 W R 0 0 0 0 W R TGMRAM MGROMO EEEIFRO PGMIFRO ON N N N W R 0 0 0 0 W R PIX7 PIX6 PIX5 PIX4 W R RP7 RP6 RP5 RP4 W R EP7 EP6 EP5 EP4 W RAMHM 0 EROMON 0 ROMHM 0 ROMON 0 PIX3 RP3 EP3 PIX2 RP2 EP2 PIX1 RP1 EP1 PIX0 RP0 EP0 0x0018–0x001B Miscellaneous Peripheral Address 0x0018 Name Reserved Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 0 0 1 0 Bit 1 0 0 0 0 Bit 0 0 0 0 0 R 0 0 0 0 0 W R 0 0 0 0 0 0x0019 Reserved W R 1 1 0 1 0 0x001A PARTIDH(1) W R 1 0 0 0 0 0x001B PARTIDL W 1. Part ID of initial mask set. For the latest Part ID assignment see 1.1.6 Part ID Assignment. 0x001C–0x001D Port Integration Module (PIM) Map 3 of 5 Address 0x001C 0x001D Name ECLKCTL Reserved R W R W Bit 7 NECLK 0 Bit 6 NCLKX2 0 Bit 5 DIV16 0 Bit 4 EDIV4 0 Bit 3 EDIV3 0 Bit 2 EDIV2 0 Bit 1 EDIV1 0 Bit 0 EDIV0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1245 Appendix E Detailed Register Address Map 0x001E–0x001F Port Integration Module (PIM) Map 3 of 5 Address 0x001E 0x001F Name IRQCR Reserved R W R W Bit 7 IRQE 0 Bit 6 IRQEN 0 Bit 5 0 0 Bit 4 0 0 Bit 3 0 0 Bit 2 0 0 Bit 1 0 0 Bit 0 0 0 0x0020–0x002F Debug Module (S12XDBG) Map Address 0x0020 Name DBGC1 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R 0 ARM XGSBPE BDM DBGBRK W TRIG R TBF EXTF 0 0 0 SSF2 0x0021 DBGSR W R 0x0022 DBGTCR TSOURCE TRANGE TRCMOD W R 0 0 0 0 0x0023 DBGC2 CDCM W R Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 0x0024 DBGTBH W R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 0x0025 DBGTBL W R 0 CNT 0x0026 DBGCNT W R 0 0 0 0 0x0027 DBGSCRX SC3 SC2 W R 0 0 0 0 MC3 MC2 0x0027 DBGMFR W R 0 DBGXCTL 0x0028 NDB TAG BRK RW RWE (1) (COMPA/C) W R DBGXCTL 0x0028 SZE SZ TAG BRK RW RWE (2) (COMPB/D) W R 0 0x0029 DBGXAH Bit 22 21 20 19 18 W R 0x002A DBGXAM Bit 15 14 13 12 11 10 W R 0x002B DBGXAL Bit 7 6 5 4 3 2 W R 0x002C DBGXDH Bit 15 14 13 12 11 10 W R 0x002D DBGXDL Bit 7 6 5 4 3 2 W R 0x002E DBGXDHM Bit 15 14 13 12 11 10 W R 0x002F DBGXDLM Bit 7 6 5 4 3 2 W 1. This represents the contents if the Comparator A or C control register is blended into this address 2. This represents the contents if the Comparator B or D control register is blended into this address COMRV SSF1 SSF0 TALIGN ABCM Bit 9 Bit 1 Bit 8 Bit 0 SC1 MC1 SC0 MC0 SRC SRC 17 9 1 9 1 9 1 COMPE COMPE Bit 16 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 MC9S12XF - Family Reference Manual, Rev.1.19 1246 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0030–0x0031 Reserved Register Space 0x0030 0x0031 Reserved Reserved R W R W 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0x0032–0x0033 Port Integration Module (PIM) Map 4 of 5 Address 0x0032 0x0033 Name PORTK DDRK R W R W Bit 7 PK7 DDRK7 Bit 6 PK6 DDRK6 Bit 5 PK5 DDRK5 Bit 4 PK4 DDRK4 Bit 3 PK3 DDRK3 Bit 2 PK2 DDRK2 Bit 1 PK1 DDRK1 Bit 0 PK0 DDRK0 0x0034–0x003F Clock and Reset Generator (CRG) Map Address 0x0034 0x0035 0x0036 0x0037 0x0038 0x0039 0x003A 0x003B 0x003C 0x003D 0x003E 0x003F Name SYNR REFDV POSTDIV CRGFLG CRGINT CLKSEL PLLCTL RTICTL COPCTL FORBYP CTCTL ARMCOP R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 SYN5 REFDV5 Bit 4 SYN4 REFDV4 Bit 3 SYN3 REFDV3 Bit 2 SYN2 REFDV2 Bit 1 SYN1 REFDV1 Bit 0 SYN0 REFDV0 VCOFRQ[1:0] REFFRQ[1:0] 0 0 0 LOCK 0 POSTDIV[4:0]] LOCKIF LOCKIE 0 ILAF 0 0 PRE RTR2 RTIF RTIE PLLSEL CME RTDEC PORF 0 LVRF 0 XCLKS FME RTR5 SCMIF SCMIE RTIWAI PCE RTR1 SCM 0 PSTP PLLON RTR6 PLLWAI FSTWKP COPWAI SCME RTR0 RTR4 RTR3 WCOP 0 0 0 Bit 7 RSBCK 0 0 0 6 0 WRTMASK 0 0 0 5 0 0 CR2 0 0 0 2 CR1 0 0 0 1 CR0 0 0 0 Bit 0 0 0 Reserved For Factory Test 0 Reserved For Factory Test 0 0 4 3 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1247 Appendix E Detailed Register Address Map 0x0040–0x007F Enhanced Capture Timer 16-Bit 8-Channels (ECT) Map (Sheet 1 of 3) Address 0x0040 0x0041 0x0042 0x0043 0x0044 0x0045 0x0046 0x0047 0x0048 0x0049 0x004A 0x004B 0x004C 0x004D 0x004E 0x004F 0x0050 0x0051 0x0052 0x0053 0x0054 0x0055 Name TIOS CFORC OC7M OC7D TCNT (hi) TCNT (lo) TSCR1 TTOV TCTL1 TCTL2 TCTL3 TCTL4 TIE TSCR2 TFLG1 TFLG2 TC0 (hi) TC0 (lo) TC1 (hi) TC1 (lo) TC2 (hi) TC2 (lo) R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 IOS7 0 FOC7 OC7M7 OC7D7 Bit 15 Bit 7 Bit 6 IOS6 0 FOC6 OC7M6 OC7D6 14 6 Bit 5 IOS5 0 FOC5 OC7M5 OC7D5 13 5 Bit 4 IOS4 0 FOC4 OC7M4 OC7D4 12 4 Bit 3 IOS3 0 FOC3 OC7M3 OC7D3 11 3 Bit 2 IOS2 0 FOC2 OC7M2 OC7D2 10 2 0 Bit 1 IOS1 0 FOC1 OC7M1 OC7D1 9 1 0 Bit 0 IOS0 0 FOC0 OC7M0 OC7D0 Bit 8 Bit 0 0 TEN TOV7 OM7 OM3 EDG7B EDG3B C7I TOI C7F TOF Bit 15 Bit 7 Bit 15 Bit 7 Bit 15 Bit 7 TSWAI TOV6 OL7 OL3 EDG7A EDG3A C6I 0 TSFRZ TOV5 OM6 OM2 EDG6B EDG2B C5I 0 TFFCA TOV4 OL6 OL2 EDG6A EDG2A C4I 0 PRNT TOV3 OM5 OM1 EDG5B EDG1B C3I TCRE C3F 0 TOV2 OL5 OL1 EDG5A EDG1A C2I PR2 C2F 0 TOV1 OM4 OM0 EDG4B EDG0B C1I PR1 C1F 0 TOV0 OL4 OL0 EDG4A EDG0A C0I PR0 C0F 0 C6F 0 C5F 0 C4F 0 14 6 14 6 14 6 13 5 13 5 13 5 12 4 12 4 12 4 11 3 11 3 11 3 10 2 10 2 10 2 9 1 9 1 9 1 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 MC9S12XF - Family Reference Manual, Rev.1.19 1248 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0040–0x007F Enhanced Capture Timer 16-Bit 8-Channels (ECT) Map (Sheet 2 of 3) Address 0x0056 0x0057 0x0058 0x0059 0x005A 0x005B 0x005C 0x005D 0x005E 0x005F 0x0060 0x0061 0x0062 0x0063 0x0064 0x0065 0x0066 0x0067 0x0068 0x0069 0x006A 0x006B 0x006C Name TC3 (hi) TC3 (lo) TC4 (hi) TC4 (lo) TC5 (hi) TC5 (lo) TC6 (hi) TC6 (lo) TC7 (hi) TC7 (lo) PACTL PAFLG PACN3 (hi) PACN2 (lo) PACN1 (hi) PACN0 (lo) MCCTL MCFLG ICPAR DLYCT ICOVW ICSYS OCPD Bit 7 R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R 0 W R 0 W R Bit 7 W R Bit 7 W R Bit 7 W R Bit 7 W R MCZI W R MCZF W R 0 W R DLY7 W R NOVW7 W R SH37 W R OCPD7 W Bit 6 14 6 14 6 14 6 14 6 14 6 PAEN 0 Bit 5 13 5 13 5 13 5 13 5 13 5 PAMOD 0 Bit 4 12 4 12 4 12 4 12 4 12 4 PEDGE 0 Bit 3 11 3 11 3 11 3 11 3 11 3 CLK1 0 Bit 2 10 2 10 2 10 2 10 2 10 2 CLK0 0 Bit 1 9 1 9 1 9 1 9 1 9 1 PAOVI PAOVF 1 1 1 1 MCPR1 POLF1 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 PAI PAIF Bit 0 Bit 0 Bit 0 Bit 0 MCPR0 POLF0 6 6 6 6 MODMC 0 0 5 5 5 5 RDMCL 0 0 4 4 4 4 0 ICLAT 0 0 3 3 3 3 0 FLMC POLF3 2 2 2 2 MCEN POLF2 PA3EN DLY3 NOVW3 TFMOD OCPD3 PA2EN DLY2 NOVW2 PACMX OCPD2 PA1EN DLY1 NOVW1 BUFEN OCPD1 PA0EN DLY0 NOVW0 LATQ OCPD0 DLY6 NOVW6 SH26 OCPD6 DLY5 NOVW5 SH15 OCPD5 DLY4 NOVW4 SH04 OCPD4 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1249 Appendix E Detailed Register Address Map 0x0040–0x007F Enhanced Capture Timer 16-Bit 8-Channels (ECT) Map (Sheet 3 of 3) Address 0x006D 0x006E 0x006F 0x0070 0x0071 0x0072 0x0073 0x0074 0x0075 0x0076 0x0077 0x0078 0x0079 0x007A 0x007B 0x007C 0x007D 0x007E 0x007F Name TIMTST PTPSR PTMCPSR PBCTL PBFLG PA3H PA2H PA1H PA0H MCCNT (hi) MCCNT (lo) TC0H (hi) TC0H (lo) TC1H (hi) TC1H (lo) TC2H (hi) TC2H (lo) TC3H (hi) TC3H (lo) Bit 7 R 0 W R PTPS7 W R PTMPS7 W R 0 W R 0 W R PA3H7 W R PA2H7 W R PA1H7 W R PA0H7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W R Bit 15 W R Bit 7 W Bit 6 0 Bit 5 0 Bit 4 Bit 3 Bit 2 0 Bit 1 0 Bit 0 0 0 0 Reserved For Factory Test PTPS4 PTMPS4 0 0 PA3H4 PA2H4 PA1H4 PA0H4 PTPS3 PTMPS3 0 0 PA3H3 PA2H3 PA1H3 PA0H3 PTPS6 PTMPS6 PBEN 0 PA3H6 PA2H6 PA1H6 PA0H6 PTPS5 PTMPS5 0 0 PA3H5 PA2H5 PA1H5 PA0H5 PTPS2 PTMPS2 0 0 PA3H2 PA2H2 PA1H2 PA0H2 PTPS1 PTMPS1 PBOVI PBOVF PA3H1 PA2H1 PA1H1 PA0H1 PTPS0 PTMPS0 0 0 PA3H0 PA2H0 PA1H 0 PA0H0 14 6 14 6 14 6 14 6 14 6 13 5 13 5 13 5 13 5 13 5 12 4 12 4 12 4 12 4 12 4 11 3 11 3 11 3 11 3 11 3 10 2 10 2 10 2 10 2 10 2 9 1 9 1 9 1 9 1 9 1 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 Bit 8 Bit 0 MC9S12XF - Family Reference Manual, Rev.1.19 1250 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0080–0x00AF Analog-to-Digital Converter 12-bit 16-Channels (ATD) Map (Sheet 1 of 3) Address 0x0080 0x0081 0x0082 0x0083 0x0084 0x0085 0x0086 0x0087 0x0088 0x0089 0x008A 0x008B 0x008C 0x008D 0x008E 0x008F 0x0090 0x0091 0x0092 0x0093 0x0094 0x0095 0x0096 Name ATDCTL0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 WRAP1 ETRIG CH1 ASCIE FRZ1 PRS1 CB CC1 0 Bit 0 WRAP0 ETRIG CH0 ACMPIE FRZ0 PRS0 CA CC0 0 R 0 0 0 0 WRAP3 WRAP2 W R ETRIG ETRIG ETRIG ATDCTL1 SRES1 SRES0 SMP_DIS SEL CH3 CH2 W R 0 ATDCTL2 AFFC ICLKSTP ETRIGLE ETRIGP ETRIGE W R ATDCTL3 DJM S8C S4C S2C S1C FIFO W R ATDCTL4 SMP2 SMP1 SMP0 PRS4 PRS3 PRS2 W R 0 ATDCTL5 SC SCAN MULT CD CC W R 0 CC3 CC2 ATDSTAT0 SCF ETORF FIFOR W R 0 0 0 0 0 0 Reserved W R ATDCMPEH CMPE15 CMPE14 CMPE13 CMPE12 CMPE11 CMPE10 W R ATDCMPEL CMPE7 CMPE6 CMPE5 CMPE4 CMPE3 CMPE2 W R CCF15 CCF14 CCF13 CCF12 CCF11 CCF10 ATDSTAT2H W R CCF7 CCF6 CCF5 CCF4 CCF3 CCF2 ATDSTATL W R ATDDIENH IEN15 IEN14 IEN13 IEN12 IEN11 IEN10 W R ATDDIENL IEN7 IEN6 IEN5 IEN4 IEN3 IEN2 W R ATDCMPHTH CMPHT15 CMPHT14 CMPHT13 CMPHT12 CMPHT11 CMPHT10 W R ATDCMPHTL CMPHT7 CMPHT6 CMPHT5 CMPHT4 CMPHT3 CMPHT2 W R Bit15 14 13 12 11 10 ATDDR0H W R Bit7 Bit6 0 0 0 0 ATDDR0L W R Bit15 14 13 12 11 10 ATDDR1H W R Bit7 Bit6 0 0 0 0 ATD1DR1L W R Bit15 14 13 12 11 10 ATDDR2H W R Bit7 Bit6 0 0 0 0 ATDDR2L W R Bit15 14 13 12 11 10 ATDDR3H W MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1251 CMPE9 CMPE1 CCF9 CCF1 CMPE8 CMPE0 CCF8 CCF0 IEN9 IEN1 CMPHT9 CMPHT1 9 0 9 0 9 0 9 IEN8 IEN0 CMPHT8 CMPHT0 Bit8 0 Bit8 0 Bit8 0 Bit8 Appendix E Detailed Register Address Map 0x0080–0x00AF Analog-to-Digital Converter 12-bit 16-Channels (ATD) Map (Sheet 2 of 3) Address 0x0097 0x0098 0x0099 0x009A 0x009B 0x009C 0x009D 0x009E 0x009F 0x00A0 0x00A1 0x00A2 0x00A3 0x00A4 0x00A5 0x00A6 0x00A7 0x00A8 0x00A9 0x00AA 0x00AB 0x00AC Name ATDDR3L ATDDR4H ATDDR4L ATDDR5H ATDDR5L ATDDR6H ATDDR6L ATDDR7H ATDDR7L ATDDR8H ATDDR8L ATDDR9H ATDDR9L ATDDR10H ATDDR10L ATDDR11H ATDDR11L ATDDR12H ATDDR12L ATDDR13H ATDDR13L ATDDR14H R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit7 Bit15 Bit 6 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit6 14 Bit 5 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 0 13 Bit 4 0 12 0 12 0 12 0 12 0 12 0 12 0 12 0 12 0 12 0 12 0 12 Bit 3 0 11 0 11 0 11 0 11 0 11 0 11 0 11 0 11 0 11 0 11 0 11 Bit 2 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 0 10 Bit 1 0 9 0 9 0 9 0 9 0 9 0 9 0 9 0 9 0 9 0 9 0 9 Bit 0 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 0 Bit8 MC9S12XF - Family Reference Manual, Rev.1.19 1252 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0080–0x00AF Analog-to-Digital Converter 12-bit 16-Channels (ATD) Map (Sheet 3 of 3) Address 0x00AD 0x00AE 0x00AF Name ATDDR14L ATDDR15H ATDDR15L R W R W R W Bit 7 Bit7 Bit15 Bit7 Bit 6 Bit6 14 Bit6 Bit 5 0 13 0 Bit 4 0 12 0 Bit 3 0 11 0 Bit 2 0 10 0 Bit 1 0 9 0 Bit 0 0 Bit8 0 0x00B0–0x00B7 Reserved Register Space Address 0x00B0 0x00C7 Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1253 Appendix E Detailed Register Address Map 0x00C8–0x00CF Asynchronous Serial Interface (SCI0) Map Address 0x00C8 Name SCI0BDH(1) Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 SBR10 SBR2 ILT BERRV 0 Bit 1 SBR9 SBR1 PE BERRIF BERRIE BERRM0 RWU FE Bit 0 SBR8 SBR0 PT BKDIF BKDIE BKDFE SBK PF RAF 0 R0 T0 R IREN TNP1 TNP0 SBR12 SBR11 W R SBR7 SBR6 SBR5 SBR4 SBR3 0x00C9 SCI0BDL1 W R LOOPS SCISWAI RSRC M WAKE 0x00CA SCI0CR11 W R 0 0 0 0 RXEDGIF 0x00C8 SCI0ASR1(2) W R 0 0 0 0 RXEDGIE 0x00C9 SCI0ACR2 W R 0 0 0 0 0 0x00CA SCI0ACR22 W R 0x00CB SCI0CR2 TIE TCIE RIE ILIE TE W R TDRE TC RDRF IDLE OR 0x00CC SCI0SR1 W R 0 0 0x00CD SCI0SR2 AMAP TXPOL RXPOL W R R8 0 0 0 0x00CE SCI0DRH T8 W R R7 R6 R5 R4 R3 0x00CF SCI0DRL W T7 T6 T5 T4 T3 1. Those registers are accessible if the AMAP bit in the SCI0SR2 register is set to zero 2. Those registers are accessible if the AMAP bit in the SCI0SR2 register is set to one BERRM1 RE NF BRK13 0 R2 T2 TXDIR 0 R1 T1 0x00D0–0x00D7 Asynchronous Serial Interface (SCI1) Map Address 0x00D0 0x00D1 0x00D2 0x00D0 0x00D1 0x00D2 0x00D3 0x00D4 Name Bit 7 Bit 6 TNP1 SBR6 SCISWAI 0 0 0 Bit 5 TNP0 SBR5 RSRC 0 0 0 Bit 4 SBR12 SBR4 M 0 0 0 Bit 3 SBR11 SBR3 WAKE 0 0 0 Bit 2 SBR10 SBR2 ILT BERRV 0 Bit 1 SBR9 SBR1 PE BERRIF BERRIE BERRM0 RWU FE Bit 0 SBR8 SBR0 PT BKDIF BKDIE BKDFE SBK PF R IREN SCI1BDH(1) W R SBR7 SCI1BDL1 W R LOOPS SCI1CR11 W R RXEDGIF SCI1ASR1(2) W R RXEDGIE SCI1ACR12 W R 0 SCI1ACR22 W R SCI1CR2 TIE W R TDRE SCI1SR1 W BERRM1 RE NF TCIE TC RIE RDRF ILIE IDLE TE OR MC9S12XF - Family Reference Manual, Rev.1.19 1254 Freescale Semiconductor Appendix E Detailed Register Address Map 0x00D0–0x00D7 Asynchronous Serial Interface (SCI1) Map (continued) Address 0x00D5 Name SCI1SR2 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 BRK13 0 R2 T2 Bit 1 TXDIR 0 R1 T1 Bit 0 RAF 0 R0 T0 R 0 0 AMAP TXPOL RXPOL W R R8 0 0 0 0x00D6 SCI1DRH T8 W R R7 R6 R5 R4 R3 0x00D7 SCI1DRL W T7 T6 T5 T4 T3 1. Those registers are accessible if the AMAP bit in the SCI1SR2 register is set to zero 2. Those registers are accessible if the AMAP bit in the SCI1SR2 register is set to one 0x00D8–0x00DF Serial Peripheral Interface (SPI0) Map Address 0x00D8 0x00D9 0x00DA 0x00DB 0x00DC 0x00DD 0x00DE 0x00DF Name SPI0CR1 SPI0CR2 SPI0BR SPI0SR SPI0DRH SPI0DRL Reserved Reserved R W R W R W R W R W R W R W R W Bit 7 SPIE 0 0 SPIF R15 T15 R7 T7 0 0 Bit 6 SPE XFRW SPPR2 0 R14 T14 R6 T6 0 0 Bit 5 SPTIE 0 Bit 4 MSTR MODFEN SPPR0 MODF R12 T12 R4 T4 0 0 Bit 3 CPOL BIDIROE 0 0 R11 T11 R3 T3 0 0 Bit 2 CPHA 0 Bit 1 SSOE SPISWAI SPR1 0 R9 T9 R1 T1 0 0 Bit 0 LSBFE SPC0 SPR0 0 R8 T8 R0 T0 0 0 SPPR1 SPTEF R13 T13 R5 T5 0 0 SPR2 0 R10 T10 R2 T2 0 0 0x00E0–0x00EF Reserved Register Space Address 0x00E0 0x00EF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x00F0–0x00F7 Serial Peripheral Interface (SPI1) Map Address 0x00F0 0x00F1 0x00F2 0x00F3 Name SPI1CR1 SPI1CR2 SPI1BR SPI1SR R W R W R W R W Bit 7 SPIE 0 0 SPIF Bit 6 SPE XFRW SPPR2 0 Bit 5 SPTIE 0 Bit 4 MSTR MODFEN SPPR0 MODF Bit 3 CPOL BIDIROE 0 0 Bit 2 CPHA 0 Bit 1 SSOE SPISWAI SPR1 0 Bit 0 LSBFE SPC0 SPR0 0 SPPR1 SPTEF SPR2 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1255 Appendix E Detailed Register Address Map 0x00F0–0x00F7 Serial Peripheral Interface (SPI1) Map Address 0x00F4 0x00F5 0x00F6 0x00F7 Name SPI1DRH SPI1DRL Reserved Reserved R W R W R W R W Bit 7 R15 T15 R7 T7 0 0 Bit 6 R14 T14 R6 T6 0 0 Bit 5 R13 T13 R5 T5 0 0 Bit 4 R12 T12 R4 T4 0 0 Bit 3 R11 T11 R3 T3 0 0 Bit 2 R10 T10 R2 T2 0 0 Bit 1 R9 T9 R1 T1 0 0 Bit 0 R8 T8 R0 T0 0 0 0x00F8–0x00FF Reserved Register Space Address 0x00F8 0x00FF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x0100–0x0113 NVM Control Register (FTM) Map Address 0x0100 0x0101 0x0102 0x0103 0x0104 0x0105 0x0106 0x0107 0x0108 0x0109 0x010A 0x010B 0x010C 0x010D Name FCLKDIV FSEC FCCOBIX FECCRIX FCNFG FERCNFG FSTAT FERSTAT FPROT EPROT FCCOBHI FCCOBLO ETAGHI ETAGLO R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 FDIVLD KEYEN1 0 0 Bit 6 FDIV6 KEYEN0 0 0 0 Bit 5 FDIV5 RNV5 0 0 0 0 Bit 4 FDIV4 RNV4 0 0 Bit 3 FDIV3 RNV3 0 0 0 Bit 2 FDIV2 RNV2 Bit 1 FDIV1 SEC1 Bit 0 FDIV0 SEC0 CCOBIX2 ECCRIX2 0 CCOBIX1 ECCRIX1 FDFD DFDIE CCOBIX0 ECCRIX0 FSFD SFDIE CCIE IGNSF EPVIOLIE FPVIOL EPVIOLIF FPHS1 RNV4 ERSERIE PGMERIE CCIF 0 ERSVIE1 MGBUSY ERSVIE0 RSVD ACCERR 0 MGSTAT1 MGSTAT0 ERSERIF PGMERIF FPOPEN EPOPEN CCOB15 CCOB7 ETAG15 ETAG7 RNV6 RNV6 ERSVIF1 FPHS0 EPDIS CCOB11 CCOB3 ETAG11 ETAG3 ERSVIF0 FPLDIS EPS2 CCOB10 CCOB2 ETAG10 ETAG2 DFDIF FPLS1 EPS1 CCOB9 CCOB1 ETAG9 ETAG1 SFDIF FPLS0 EPS0 CCOB8 CCOB0 ETAG8 ETAG0 FPHDIS RNV5 CCOB14 CCOB6 ETAG14 ETAG6 CCOB13 CCOB5 ETAG13 ETAG5 CCOB12 CCOB4 ETAG12 ETAG4 MC9S12XF - Family Reference Manual, Rev.1.19 1256 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0100–0x0113 NVM Control Register (FTM) Map (continued) Address 0x010E 0x010F 0x0110 0x0111 0x0112 0x0113 Name FECCRHI FECCRLO FOPT Reserved Reserved Reserved Bit 7 R ECCR15 W R ECCR7 W R NV7 W R 0 W R 0 W R 0 W Bit 6 ECCR14 ECCR6 NV6 0 0 0 Bit 5 ECCR13 ECCR5 NV5 0 0 0 Bit 4 ECCR12 ECCR4 NV4 0 0 0 Bit 3 ECCR11 ECCR3 NV3 0 0 0 Bit 2 ECCR10 ECCR2 NV2 0 0 0 Bit 1 ECCR9 ECCR1 NV1 0 0 0 Bit 0 ECCR8 ECCR0 NV0 0 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1257 Appendix E Detailed Register Address Map 0x0114–0x011F Memory Protection Unit (MPU) Map Address 0x0114 Name MPUFLG Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R WPF NEXF 0 0 0 0 SVSF AEF W R 0 ADDR[22:16] 0x0115 MPUASTAT0 W R ADDR[15:8] 0x0116 MPUASTAT1 W R ADDR[7:0] 0x0117 MPUASTAT2 W R 0 0 0 0 0 0 0 0 0x0118 Reserved W R 0 0 0 0 0x0119 MPUSEL SVSEN SEL[2:0] W R MSTR0 MSTR1 MSTR2 MSTR3 LOW_ADDR[22:19] 0x011A MPUDESC0(1) W R LOW_ADDR[18:11] 0x011B MPUDESC11 W R LOW_ADDR[10:3] 0x011C MPUDESC21 W R 0 0 WP NEX HIGH_ADDR[22:19] 0x011D MPUDESC31 W R HIGH_ADDR[18:11] 0x011E MPUDESC41 W R HIGH_ADDR[10:3] 0x011F MPUDESC51 W 1. The module addresses 0x03C6−0x03CB represent a window in the register map through which different descriptor registers are visible. 0x0120–0x012F Interrupt Module (S12XINT) Map Address 0x0120 0x0121 0x0122 0x0123 0x0124 0x0125 0x0126 0x0127 Name R W R IVBR W R Reserved W R Reserved W R Reserved W R Reserved W R INT_XGPRIO W R INT_CFADDR W Reserved Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 IVB_ADDR[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 XILVL[2:0] 0 0 INT_CFADDR[7:4] MC9S12XF - Family Reference Manual, Rev.1.19 1258 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0120–0x012F Interrupt Module (S12XINT) Map Address Name R W R W R W R W R W R W R W R W Bit 7 RQST RQST RQST RQST RQST RQST RQST RQST Bit 6 0 0 0 0 0 0 0 0 Bit 5 0 0 0 0 0 0 0 0 Bit 4 0 0 0 0 0 0 0 0 Bit 3 0 0 0 0 0 0 0 0 Bit 2 Bit 1 PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] Bit 0 0x0128 INT_CFDATA0 0x0129 INT_CFDATA1 0x012A INT_CFDATA2 0x012B INT_CFDATA3 0x012C INT_CFDATA4 0x012D INT_CFDATA5 0x012E INT_CFDATA6 0x012F INT_CFDATA7 0x00130–0x013F Reserved Register Space Address 0x0130 0x013F Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x0140–0x017F MSCAN (CAN0) Map Address 0x0140 0x0141 0x0142 0x0143 0x0144 0x0145 0x0146 0x0147 0x0148 0x0149 Name CAN0CTL0 CAN0CTL1 CAN0BTR0 CAN0BTR1 CAN0RFLG CAN0RIER CAN0TFLG CAN0TIER CAN0TARQ CAN0TAAK Bit 7 R RXFRM W R CANE W R SJW1 W R SAMP W R WUPIF W R WUPIE W R 0 W R 0 W R 0 W R 0 W Bit 6 RXACT Bit 5 CSWAI LOOPB BRP5 TSEG21 RSTAT1 Bit 4 SYNCH Bit 3 TIME BORM BRP3 TSEG13 TSTAT1 Bit 2 WUPE WUPM BRP2 TSEG12 TSTAT0 Bit 1 SLPRQ SLPAK Bit 0 INITRQ INITAK CLKSRC SJW0 TSEG22 CSCIF CSCIE 0 0 0 0 LISTEN BRP4 TSEG20 RSTAT0 BRP1 TSEG11 OVRIF OVRIE TXE1 TXEIE1 ABTRQ1 ABTAK1 BRP0 TSEG10 RXF RXFIE TXE0 TXEIE0 ABTRQ0 ABTAK0 RSTATE1 0 0 0 0 RSTATE0 0 0 0 0 TSTATE1 0 0 0 0 TSTATE0 TXE2 TXEIE2 ABTRQ2 ABTAK2 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1259 Appendix E Detailed Register Address Map 0x0140–0x017F MSCAN (CAN0) Map (continued) Address 0x014A 0x014B 0x014C 0x014D 0x014E 0x014F Name CAN0TBSEL CAN0IDAC Reserved CAN0MISC CAN0RXERR CAN0TXERR Bit 7 R 0 W R 0 W R 0 W R 0 W R RXERR7 W R TXERR7 W R AC7 W R AM7 W R AC7 W R AM7 W R W R W Bit 6 0 0 0 0 RXERR6 TXERR6 Bit 5 0 Bit 4 0 Bit 3 0 0 0 0 RXERR3 TXERR3 Bit 2 TX2 IDHIT2 0 0 RXERR2 TXERR2 Bit 1 TX1 IDHIT1 0 0 RXERR1 TXERR1 Bit 0 TX0 IDHIT0 0 IDAM1 0 0 RXERR5 TXERR5 IDAM0 0 0 RXERR4 TXERR4 BOHOLD RXERR0 TXERR0 0x0150 - CAN0IDAR0 0x0153 CAN0IDAR3 0x015 0x0157 CAN0IDMR0 CAN0IDMR3 AC6 AM6 AC6 AM6 AC5 AM5 AC5 AM5 AC4 AM4 AC4 AM4 AC3 AM3 AC3 AM3 AC2 AM2 AC2 AM2 AC1 AM1 AC1 AM1 AC0 AM0 AC0 AM0 0x0158 - CAN0IDAR4 0x015B CAN0IDAR7 0x015C - CAN0IDMR4 0x015F CAN0IDMR7 0x0160 0x016F 0x0170 0x017F CAN0RXFG FOREGROUND RECEIVE BUFFER (See Detailed MSCAN Foreground Receive and Transmit Buffer Layout) FOREGROUND TRANSMIT BUFFER (See Detailed MSCAN Foreground Receive and Transmit Buffer Layout) CAN0TXFG Detailed MSCAN Foreground Receive and Transmit Buffer Layout Address 0xXXX0 Name R R W R R W R R W R R W R CANxRDSR0– W CANxRDSR7 CANRxDLR R W Extended ID Standard ID CANxRIDR0 Extended ID Standard ID CANxRIDR1 Extended ID Standard ID CANxRIDR2 Extended ID Standard ID CANxRIDR3 Bit 7 ID28 ID10 ID20 ID2 ID14 Bit 6 ID27 ID9 ID19 ID1 ID13 Bit 5 ID26 ID8 ID18 ID0 ID12 Bit 4 ID25 ID7 SRR=1 RTR ID11 Bit 3 ID24 ID6 IDE=1 IDE=0 ID10 Bit 2 ID23 ID5 ID17 Bit 1 ID22 ID4 ID16 Bit 0 ID21 ID3 ID15 0xXXX1 ID9 ID8 ID7 0xXXX2 ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR 0xXXX3 0xXXX4 – 0xXXXB 0xXXXC DB7 DB6 DB5 DB4 DB3 DB2 DB1 DB0 DLC3 DLC2 DLC1 DLC0 MC9S12XF - Family Reference Manual, Rev.1.19 1260 Freescale Semiconductor Appendix E Detailed Register Address Map Detailed MSCAN Foreground Receive and Transmit Buffer Layout (continued) Address 0xXXXD Name Reserved Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R W R 0xXXXE CANxRTSRH W R 0xXXXF CANxRTSRL W Extended ID R CANxTIDR0 W 0xXX10 Standard ID R W Extended ID R 0xXX0x CANxTIDR1 W XX10 Standard ID R W Extended ID R CANxTIDR2 W 0xXX12 Standard ID R W Extended ID R CANxTIDR3 W 0xXX13 Standard ID R W 0xXX14 R CANxTDSR0– – W CANxTDSR7 0xXX1B R 0xXX1C CANxTDLR W R 0xXX1D CANxTTBPR W R 0xXX1E CANxTTSRH W R 0xXX1F CANxTTSRL W TSR15 TSR7 TSR14 TSR6 TSR13 TSR5 TSR12 TSR4 TSR11 TSR3 TSR10 TSR2 TSR9 TSR1 TSR8 TSR0 ID28 ID10 ID20 ID2 ID14 ID27 ID9 ID19 ID1 ID13 ID26 ID8 ID18 ID0 Zaubersoc ke1 ID12 ID25 ID7 SRR=1 RTR ID11 ID24 ID6 IDE=1 IDE=0 ID10 ID23 ID5 ID17 ID22 ID4 ID16 ID21 ID3 ID15 ID9 ID8 ID7 ID6 ID5 ID4 ID3 ID2 ID1 ID0 RTR DB7 DB6 DB5 DB4 DB3 DLC3 DB2 DLC2 PRIO2 TSR10 TSR2 DB1 DLC1 PRIO1 TSR9 TSR1 DB0 DLC0 PRIO0 TSR8 TSR0 PRIO7 TSR15 TSR7 PRIO6 TSR14 TSR6 PRIO5 TSR13 TSR5 PRIO4 TSR12 TSR4 PRIO3 TSR11 TSR3 0x0180–0x01FF Reserved Register Space Address 0x0180 0x01FF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1261 Appendix E Detailed Register Address Map 0x0200–0x023F PMF Address 0x0200 0x0201 0x0202 0x0203 0x0204 0x0205 0x0206 0x0207 0x0208 0x0209 0x020A 0x020B 0x020C 0x020D 0x020E 0x020F 0x0210 0x0211 0x0212 0x0213 0x0214 0x0215 0x0216 Name PMFCFG0 PMFCFG1 PMFCFG2 PMFCFG3 PMFFCTL PMFFPIN PMFFSTA PMFQSMP PMFDMPA PMFDMPB PMFDMPC Reserved PMFOUTC PMFOUTB PMFDTMS PMFCCTL PMFVAL0 PMFVAL0 PMFVAL1 PMFVAL1 PMFVAL2 PMFVAL2 PMFVAL3 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R WP MTG EDGEC EDGEB EDGEA INDEPC INDEPB INDEPA W R 0 ENHA BOTNEGC TOPNEGC BOTNEGB TOPNEGB BOTNEGA TOPNEGA W R 0 0 MSK5 MSK4 MSK3 MSK2 MSK1 MSK0 W R 0 PMFWAI PMFFRZ VLMODE SWAPC SWAPB SWAPA W R FMODE3 FIE3 FMODE2 FIE2 FMODE1 FIE1 FMODE0 FIE0 W R 0 0 0 0 FPINE3 FPINE2 FPINE1 FPINE0 W R 0 0 0 0 FFLAG3 FFLAG2 FFLAG1 FFLAG0 W R QSMP3 QSMP2 QSMP1 QSMP0 W R DMP13 DMP12 DMP11 DMP10 DMP03 DMP02 DMP01 DMP00 W R DMP33 DMP32 DMP31 DMP30 DMP23 DMP22 DMP21 DMP20 W R DMP53 DMP52 DMP51 DMP50 DMP43 DMP42 DMP41 DMP53 W R 0 0 0 0 0 0 0 0 W R 0 0 OUTCTL5 OUTCTL4 OUTCTL3 OUTCTL2 OUTCTL1 OUTCTL0 W R 0 0 OUT5 OUT4 OUT3 OUT2 OUT1 OUT0 W R 0 0 DT5 DT4 DT3 DT2 DT1 DT0 W R 0 0 0 ISENS IPOLC IPOLB IPOLA W R PMFVAL0 W R PMFVAL0 W R PMFVAL1 W R PMFVAL1 W R PMFVAL2 W R PMFVAL2 W R PMFVAL3 W MC9S12XF - Family Reference Manual, Rev.1.19 1262 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0200–0x023F PMF Address 0x0217 0x0218 0x0219 0x021A 0x021B 0x021C 0x021F 0x0220 0x0221 0x0222 0x0223 0x0224 0x0225 0x0226 0x0227 0x0228 0x0229 0x022A 0x022B 0x022C 0x022D 0x022E 0x022F 0x0230 Name PMFVAL3 PMFVAL4 PMFVAL4 PMFVAL5 PMFVAL5 Reserved PMFENCA PMFFQCA PMFCNTA PMFCNTA PMFMODA PMFMODA PMFDTMA PMFDTMA PMFENCB PMFFQCB PMFCNTB PMFENCA PMFMODB PMFMODB PMFDTMB PMFDTMB PMFENCC Bit 7 R W R W R W R W R W R 0 W R PWMENA W R W R 0 W R W R 0 W R W R 0 W R W R PWMENB W R W R 0 W R W R 0 W R W R 0 W R W R PWMENC W Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PMFVAL3 PMFVAL4 PMFVAL4 PMFVAL5 PMFVAL5 0 0 0 0 0 0 0 0 0 0 0 0 LDOKA PRSCA PWMRIEA PWMRFA LDFQA HALFA PMFCNTA PMFCNTA PMFMODA PMFMODA 0 0 0 PMFDTMA PMFDTMA 0 0 0 0 0 LDOKB PRSCB PWMRIEB PWMRFB LDFQB HALFB PMFCNTB PMFCNTB PMFMODB PMFMODB 0 0 0 PMFDTMB PMFDTMB 0 0 0 0 0 LDOKC PWMRIEC MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1263 Appendix E Detailed Register Address Map 0x0200–0x023F PMF Address 0x0231 0x0232 0x0233 0x0234 0x0235 0x0236 0x0237 0x0238 0x023F Name PMFFQCC PMFCNTC PMFCNTC PMFMODC PMFMODC PMFDTMC PMFDTMC Reserved R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 HALFC PMFCNTC PMFCNTC 0 Bit 2 Bit 1 Bit 0 PWMRFC LDFQC 0 PRSCC PMFMODC PMFMODC 0 0 0 0 PMFDTMC PMFDTMC 0 0 0 0 0 0 0 0 0x0240–0x0277 Port Integration Module (PIM) Map 5 of 5 Address 0x0240 0x0241 0x0242 0x0243 0x0244 0x0245 0x0246 0x0247 Name PTT PTIT DDRT RDRT PERT PPST Reserved Reserved R W R W R W R W R W R W R W R W Bit 7 PTT7 PTIT7 Bit 6 PTT6 PTIT6 Bit 5 PTT5 PTIT5 Bit 4 PTT4 PTIT4 Bit 3 PTT3 PTIT3 Bit 2 PTT2 PTIT2 Bit 1 PTT1 PTIT1 Bit 0 PTT0 PTIT0 DDRT7 RDRT7 PERT7 PPST7 0 0 DDRT7 RDRT6 PERT6 PPST6 0 0 DDRT5 RDRT5 PERT5 PPST5 0 0 DDRT4 RDRT4 PERT4 PPST4 0 0 DDRT3 RDRT3 PERT3 PPST3 0 0 DDRT2 RDRT2 PERT2 PPST2 0 0 DDRT1 RDRT1 PERT1 PPST1 0 0 DDRT0 RDRT0 PERT0 PPST0 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 1264 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0240–0x0277 Port Integration Module (PIM) Map 5 of 5 Address 0x0248 0x0249 0x024A 0x024B 0x024C 0x024D 0x024E 0x024F 0x0250 0x0251 0x0252 0x0253 0x0254 0x0255 0x0256 0x0257 0x0258 0x0259 0x025A 0x025B 0x025C 0x025D 0x025E 0x025F Name PTS PTIS DDRS RDRS PERS PPSS WOMS Reserved PTM PTIM DDRM RDRM PERM PPSM WOMM Reserved PTP PTIP DDRP RDRP PERP PPSP Reserved Reserved R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 PTS7 PTIS7 Bit 6 PTS6 PTIS6 Bit 5 PTS5 PTIS5 Bit 4 PTS4 PTIS4 Bit 3 PTS3 PTIS3 Bit 2 PTS2 PTIS2 Bit 1 PTS1 PTIS1 Bit 0 PTS0 PTIS0 DDRS7 RDRS7 PERS7 PPSS7 WOMS7 0 DDRS7 RDRS6 PERS6 PPSS6 WOMS6 0 DDRS5 RDRS5 PERS5 PPSS5 WOMS5 0 DDRS4 RDRS4 PERS4 PPSS4 WOMS4 0 DDRS3 RDRS3 PERS3 PPSS3 WOMS3 0 DDRS2 RDRS2 PERS2 PPSS2 WOMS2 0 DDRS1 RDRS1 PERS1 PPSS1 WOMS1 0 DDRS0 RDRS0 PERS0 PPSS0 WOMS0 0 PTM7 PTIM7 PTM6 PTIM6 PTM5 PTIM5 PTM4 PTIM4 PTM3 PTIM3 PTM2 PTIM2 PTM1 PTIM1 PTM0 PTIM0 DDRM7 RDRM7 PERM7 PPSM7 WOMM7 0 DDRM7 RDRM6 PERM6 PPSM6 WOMM6 0 DDRM5 RDRM5 PERM5 PPSM5 WOMM5 0 DDRM4 RDRM4 PERM4 PPSM4 WOMM4 0 DDRM3 RDRM3 PERM3 PPSM3 WOMM3 0 DDRM2 RDRM2 PERM2 PPSM2 WOMM2 0 DDRM1 RDRM1 PERM1 PPSM1 WOMM1 0 DDRM0 RDRM0 PERM0 PPSM0 WOMM0 0 PTP7 PTIP7 PTP6 PTIP6 PTP5 PTIP5 PTP4 PTIP4 PTP3 PTIP3 PTP2 PTIP2 PTP1 PTIP1 PTP0 PTIP0 DDRP7 RDRP7 PERP7 PPSP7 0 0 DDRP7 RDRP6 PERP6 PPSP6 0 0 DDRP5 RDRP5 PERP5 PPSP5 0 0 DDRP4 RDRP4 PERP4 PPSP4 0 0 DDRP3 RDRP3 PERP3 PPSP3 0 0 DDRP2 RDRP2 PERP2 PPSP2 0 0 DDRP1 RDRP1 PERP1 PPSP1 0 0 DDRP0 RDRP0 PERP0 PPSS0 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1265 Appendix E Detailed Register Address Map 0x0240–0x0277 Port Integration Module (PIM) Map 5 of 5 Address 0x0260 0x0261 0x0262 0x0263 0x0264 0x0265 0x0266 0x0267 0x0268 0x0269 0x026A 0x026B 0x026C 0x026D 0x026E 0x026F 0x0270 0x0271 0x0272 0x0273 0x0274 0x0275 Name PTH PTIH DDRH RDRH PERH PPSH Reserved Reserved PTJ PTIJ DDRJ RDRJ PERJ PPSJ Reserved Reserved PT0AD PT1AD DDR0AD DDR1AD RDR0AD RDR1AD R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 PTH7 PTIH7 Bit 6 PTH6 PTIH6 Bit 5 PTH5 PTIH5 Bit 4 PTH4 PTIH4 Bit 3 PTH3 PTIH3 Bit 2 PTH2 PTIH2 Bit 1 PTH1 PTIH1 Bit 0 PTH0 PTIH0 DDRH7 RDRH7 PERH7 PPSH7 0 0 DDRH7 RDRH6 PERH6 PPSH6 0 0 DDRH5 RDRH5 PERH5 PPSH5 0 0 DDRH4 RDRH4 PERH4 PPSH4 0 0 DDRH3 RDRH3 PERH3 PPSH3 0 0 DDRH2 RDRH2 PERH2 PPSH2 0 0 DDRH1 RDRH1 PERH1 PPSH1 0 0 DDRH0 RDRH0 PERH0 PPSH0 0 0 PTJ7 PTIJ7 PTJ6 PTIJ6 PTJ5 PTIJ5 PTJ4 PTIJ4 PTJ3 PTIJ3 PTJ2 PTIJ2 PTJ1 PTIJ1 PTJ0 PTIJ0 DDRJ7 RDRJ7 PERJ7 PPSJ7 0 0 DDRJ7 RDRJ6 PERJ6 PPSJ6 0 0 DDRJ5 RDRJ5 PERJ5 PPSJ5 0 0 DDRJ4 RDRJ4 PERJ4 PPSJ4 0 0 DDRJ3 RDRJ3 PERJ3 PPSJ3 0 0 DDRJ2 RDRJ2 PERJ2 PPSJ2 0 0 DDRJ1 RDRJ1 PERJ1 PPSJ1 0 0 DDRJ0 RDRJ0 PERJ0 PPSJ0 0 0 PT0AD15 PT1AD7 PT0AD14 PT1AD6 PT0AD13 PT1AD5 PT0AD12 PT1AD4 PT0AD11 PT1AD3 PT0AD10 PT1AD2 PT0AD9 PT1AD1 PT0AD8 PT1AD0 DDR0AD1 DDR0AD1 DDR0AD1 DDR0AD1 DDR0AD1 DDR0AD1 DDR0AD9 DDR0AD8 5 4 3 2 1 0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 7 6 5 4 3 2 1 0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 DDR1AD0 7 6 5 4 3 2 1 0 RDR1AD7 RDR1AD6 RDR1AD5 RDR1AD4 RDR1AD3 RDR1AD2 RDR1AD1 RDR1AD0 MC9S12XF - Family Reference Manual, Rev.1.19 1266 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0240–0x0277 Port Integration Module (PIM) Map 5 of 5 Address 0x0276 0x0277 0x0278 0x027F Name PER0AD PER1AD Reserved Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R PER0AD1 PER0AD1 PER0AD1 PER0AD1 PER0AD1 PER0AD1 PER0AD9 PER0AD8 5 4 3 2 1 0 W R PER1AD7 PER1AD6 PER1AD5 PER1AD4 PER1AD3 PER1AD2 PER1AD1 PER1AD0 W R 0 0 0 0 0 0 0 0 W MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1267 Appendix E Detailed Register Address Map 0x0280–0x02EF Reserved Register Space Address 0x0280 0x02EF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x02F0–0x02F7 Voltage Regulator (VREG_3V3) Map Address 0x02F0 0x02F1 0x02F2 0x02F3 0x02F4 0x02F5 0x02F6 0x02F7 Name VREGHTCL VREGCTRL VREGAPICL VREGAPITR VREGAPIRH VREGAPIRL Reserved VREGHTTR (Factory Test) Bit 7 R 0 W R 0 W R APICLK W R APITR5 W R APIR15 W R APIR7 W R 0 W R W Bit 6 0 0 0 Bit 5 VSEL 0 0 Bit 4 VAE 0 Bit 3 0 0 LVDS Bit 2 Bit 1 0 Bit 0 LVIE APIE 0 LVIF APIF 0 APIFES APITR2 APIR12 APIR4 0 0 APIEA APITR1 APIR11 APIR3 0 APIFE APITR0 APIR10 APIR2 0 APITR4 APIR14 APIR6 0 0 APITR3 APIR13 APIR5 0 0 APIR9 APIR1 0 APIR8 APIR0 0 0x02F8–0x02FF Reserved Register Space Address 0x02F8– 0x02FF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x0300–0x0307 CGMIPLL (IPLL for FlexRay) Address 0x0300 0x0301 0x0302 0x0303 0x0304 Name CGMSYNR Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R VCOFRQ[1:0] W R CGMREFDV REFFRQ[1:0] W R 0 0 RESERVED W R 0 CGMFLG LOCKIE W R 0 0 CGMCTL W SYNDIV[5:0] REFDIV[5:0] 0 0 0 0 0 LOCK 0 0 0 0 0 LOCKIF 0 UNLOCKF PLLON DIV2 FM1 FM0 MC9S12XF - Family Reference Manual, Rev.1.19 1268 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0300–0x0307 CGMIPLL (IPLL for FlexRay) Address 0x0305 0x0306 0x0307 Name CGMTEST0 CGMTEST1 PWMPRSC R W R W R W Bit 7 0 0 0 Bit 6 0 0 0 Bit 5 0 0 0 Bit 4 0 0 0 Bit 3 0 0 0 Bit 2 0 0 0 Bit 1 0 0 0 Bit 0 0 0 0 0x0308–0x033F Reserved Register Space Address 0x0308 0x033F Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1269 Appendix E Detailed Register Address Map 0x00340–0x036F – Enhanced Periodic Interrupt Timer (EPIT) Map Address 0x0340 0x0341 0x0342 0x0343 0x0344 0x0345 0x0346 0x0347 0x0348 0x0349 0x034A 0x034B 0x034C 0x034D 0x034E 0x034F 0x0350 0x0351 0x0352 0x0353 0x0354 0x0355 0x0356 Name PITCFLMT PITFLT PITCE PITMUX PITINTE PITTF PITMTLD0 PITMTLD1 PITLD0 (hi) PITLD0 (lo) PITCNT0 (hi) PITCNT0 (lo) PITLD1 (hi) PITLD1 (lo) PITCNT1 (hi) PITCNT1 (lo) PITLD2 (hi) PITLD2 (lo) PITCNT2 (hi) PITCNT2 (lo) PITLD3 (hi) PITLD3 (lo) PITCNT3 (hi) Bit 7 R PITE W R 0 W PITFLT7 R PITMUX7 W R PITMUX7 W R PITINTE7 W R PITTF7 W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 6 PITSWAI 0 PITFLT6 PITMUX6 PITMUX6 PITINTE6 PITTF6 Bit 5 PITFRZ 0 PITFLT5 PITMUX5 PITMUX5 PITINTE5 PITTF5 Bit 4 0 0 PITFLT4 PITMUX4 PITMUX4 PITINTE4 PITTF4 Bit 3 0 0 PITFLT3 PITMUX3 PITMUX3 PITINTE3 PITTF3 Bit 2 0 0 PITFLT2 PITMUX2 PITMUX2 PITINTE2 PITTF2 Bit 1 Bit 0 0 0 PITFLMT1 PITFLMT0 0 0 PITFLT1 PITFLT0 PITMUX1 PITMUX1 PITINTE1 PITTF1 PITMUX0 PITMUX0 PITINTE0 PITTF0 PITMTLD0[7:0] PITMTLD1[7:0] PITLD0[15:8] PITLD0[7:0] PITCNT0[15:8] PITCNT0[7:0] PITLD1[15:8] PITLD1[7:0] PITCNT1[15:8] PITCNT1[7:0] PITLD2[15:8] PITLD2[7:0] PITCNT2[15:8] PITCNT2[7:0] PITLD3[15:8] PITLD3[7:0] PITCNT3[15:8] MC9S12XF - Family Reference Manual, Rev.1.19 1270 Freescale Semiconductor Appendix E Detailed Register Address Map Address 0x0357 0x0358 0x0359 0x035A 0x035B 0x035C 0x035D 0x035E 0x035F 0x0360 0x0361 0x0362 0x0363 0x0364 0x0365 0x0366 0x0367 0x0368 0x0369 0x036A Name PITCNT3 (lo) PITLD4 (hi) PITLD4 (lo) PITCNT4 (hi) PITCNT4 (lo) PITLD5 (hi) PITLD5 (lo) PITCNT5 (hi) PITCNT5 (lo) PITLD6 (hi) PITLD6 (lo) PITCNT6 (hi) PITCNT6 (lo) PITLD7 (hi) PITLD7 (lo) PITCNT7 (hi) PITCNT7 (lo) PITCSTP PITTRIGOUT PITTRIGCTL R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PITCNT3[7:0] PITLD4[15:8] PITLD4[7:0] PITCNT4[15:8] PITCNT4[7:0] PITLD5[15:8] PITLD5[7:0] PITCNT5[15:8] PITCNT5[7:0] PITLD6[15:8] PITLD6[7:0] PITCNT6[15:8] PITCNT6[7:0] PITLD7[15:8] PITLD7[7:0] PITCNT7[15:8] PITCNT7[7:0] PITCSTP7 PITCSTP6 PITCSTP5 PITCSTP4 PITCSTP3 PITCSTP2 PITCSTP1 PITCSTP0 PITCOTE7 PITCOTE6 PITCOTE5 PITCOTE4 PITCOTE3 PITTRIGIE PITTRIGIF 0 0 PITTRIGEDGE[1:0] 0 0 0 0 PITCOTE2 PITCOTE1 PITCOTE0 0 0 PITTRIGSRC[1:0] 0 0 0x036B PITTRIGSTAT 0x036C PITTRIGE PITTRIGE7 PITTRIGE6 PITTRIGE5 PITTRICE4 PITTRIGE3 PITTRIGE2 PITTRIGE1 PITTRIGE0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1271 Appendix E Detailed Register Address Map Address 0x036D 0x036F Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 1272 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0370–0x037F Reserved Register Space Address 0x0370 0x037F Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x0380–0x03BF XGATE Map (Sheet 1 of 3) Address 0x0380 Name XGMCTL R W R W R W R W Bit 7 0 XGEM XGE 0 0 0 0 0 Bit 6 0 XGFRZM XGFRZ Bit 5 0 XGDBGM XGDBG Bit 4 0 XGSSM XGSS Bit 3 0 XGFACTM XGFACT XGCHID[6:0] 0 0 Bit 2 0 Bit 1 0 XGS WEFM XGSWEF Bit 0 XGIEM 0x0381 0x0382 0x0383 0x0384 0x0385 0x0386 0x0387 0x0388 0x0389 0x038A 0x023B 0x023C 0x038D 0x038E 0x038F 0x0390 0x0391 0x0392 XGMCTL XGCHID XGCHPL Reserved XGISPSEL XGVBR XGVBR XGIF XGIF XGIF XGIF XGIF XGIF XGIF XGIF XGIF XGIF XGIF XGIE XGCHPL[2:0] R W R W R W R W R W R W R W R W R W R W R W R W R W R W 0 0 0 0 0 0 XGISPSEL[1:0] XGVBR[15:8] XGVBR[7:1] 0 0 0 0 0 0 0 0 XGIF_78 XGIF_70 XGIF_68 XGIF_60 XGIF_58 XGIF_50 XGIF_48 XGIF_40 XGIF_38 XGIF_30 XGIF_28 XGIF_77 XGIF_6F XGIF_67 XGIF_5F XGIF_57 XGIF_4F XGIF_47 XGIF_3F XGIF_37 XGIF_2F XGIF_76 XGIF_6E XGIF_66 XGIF_5E XGIF_56 XGIF_4E XGIF_46 XGIF_3E XGIF_36 XGIF_2E XGIF_75 XGIF_6D XGIF_65 XGIF_5D XGIF_55 XGIF_4D XGIF_45 XGIF_3D XGIF_35 XGIF_2D XGIF_74 XGIF_6C XGIF_64 XGIF_5C XGIF_54 XGIF_4C XGIF_44 XGIF_3C XGIF_34 XGIF_2C XGIF_73 XGIF_6B XGIF_63 XGIF_5B XGIF_53 XGIF_4B XGIF_43 XGIF_3B XGIF_33 XGIF_2B XGIF_72 XGIF_6A XGIF_62 XGIF_5A XGIF_52 XGIF_4A XGIF_42 XGIF_3A XGIF_32 XGIF_2A XGIF_71 XGIF_69 XGIF_61 XGIF_59 XGIF_51 XGIF_49 XGIF_41 XGIF_39 XGIF_31 XGIF_29 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1273 Appendix E Detailed Register Address Map 0x0380–0x03BF XGATE Map (Sheet 2 of 3) Address 0x0393 0x0394 0x0395 0x0396 0x0397 0x0398 0x0399 0x039A 0x039B 0x039C 0x039D 0x039E 0x039F 0x03A0 0x03A1 0x03A2 0x03A3 0x03A4 0x03A5 0x03A6 0x03A7 0x03A8 0x03A9 Name XGIF XGIF XGIF XGIF XGIF XGSWT XGSWT XGSEM XGSEM Reserved XGCCR XGPC (hi) XGPC (lo) Reserved Reserved XGR1 (hi) XGR1 (lo) XGR2 (hi) XGR2 (lo) XGR3 (hi) XGR3 (lo) XGR4 (hi) XGR4 (lo) R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 XGIF_27 XGIF_1F XGIF_17 XGIF_0F 0 0 Bit 6 XGIF_26 XGIF_1E XGIF_16 XGIF_0E 0 0 Bit 5 XGIF_25 XGIF_1D XGIF_15 XGIF_0D 0 0 Bit 4 XGIF_24 XGIF_1C XGIF_14 0 0 Bit 3 XGIF_23 XGIF_1B XGIF_13 0 0 Bit 2 XGIF_22 XGIF_1A XGIF_12 0 0 0 Bit 1 XGIF_21 XGIF_19 XGIF_11 0 0 0 Bit 0 XGIF_20 XGIF_18 XGIF_10 0 0 0 0 0 XGSWTM[7:0] XGSWT[7:0] 0 0 0 0 0 XGSEMM[7:0] XGSEM[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 XGN XGZ XGV XGC XGPC[15:8] XGPC[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 XGR1[15:8] XGR1[7:0] XGR2[15:8] XGR2[7:0] XGR3[15:8] XGR3[7:0] XGR4[15:8] XGR4[7:0] MC9S12XF - Family Reference Manual, Rev.1.19 1274 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0380–0x03BF XGATE Map (Sheet 3 of 3) Address 0x03AA 0x03AB 0x03AC 0x03AD 0x03AE 0x03AF 0x03B0 0x03BF Name XGR5 (hi) XGR5(lo) XGR6 (hi) XGR6 (lo) XGR7 (hi) XGR7 (lo) Reserved R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 XGR5[15:8] XGR5[7:0] XGR6[15:8] XGR6[7:0] XGR7[15:8] XGR7[7:0] 0 0 0 0 0 0 0 0 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1275 Appendix E Detailed Register Address Map 0x03C0–0x03FF Reserved Register Space Address 0x03C0 0x03FF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 0x0400–0x05FF FlexRayRegister Space Address 0x0400 0x0401 0x0402 0x0403 0x0404 0x0405 0x0406 0x0407 0x0408 0x0409 0x040A 0x040B 0x040C 0x040D 0x040E 0x040F 0x0410 0x0413 0x0414 0x0415 Name R W R MVR W R MCR W R MCR W R SYMBADHR W R SYMBADHR W R SYMBADLR W R SYMBADLR W R STBSCR W R STBSCR W R STBPCR W R STBPCR W R MBDSR W R MBDSR W R MBSSUTR W R MBSSUTR W R Reserved W R POCR W R POCR W MVR Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CHIVER PEVER 0 0 0 0 MEN 0 0 0 SCM 0 0 CHB CLKSEL 0 CHA SFFE BITRATE R 0 0 0 0 0 SYS_MEM_BASE_ADDR[22:16] SYS_MEM_BASE_ADDR[15:8] SYS_MEM_BASE_ADDR[7:4] 0 0 0 0 0 WMD 0 0 0 0 0 R W 0 0 0 WME BSY WMC SEL 0 0 0 0 0 0 ENB 0 0 0 0 0 0 0 STBPSEL 0 STB3EN MBSEG2DS MBSEG1DS STB2EN STB1EN STB0EN 0 0 0 0 0 0 0 0 0 0 0 LAST_MB_SEG1 LAST_MB_UTIL 0 0 0 0 0 0 0 EOC_AP POCCMD ERC_AP MC9S12XF - Family Reference Manual, Rev.1.19 1276 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x0416 Name R GIFER W R W R W R 0x0419 PIFR0 W R 0x041A PIFR1 W R 0x041B PIFR1 W R W R W R W R W R W R 0x0421 CHIERFR W R W R W R W R W R W R W R W R W Bit 7 MIF Bit 6 PRIF Bit 5 CHIF Bit 4 WUP IF w1c WUP IE CSA _IF w1c TBVB _IF w1c PSC _IF w1c ODT _IF w1c CSA _IE TBVB _IE PSC _IE ODT _IE Bit 3 FNEBIF w1c FNEBIE MRC _IF w1c TBVA _IF w1c SSI3 _IF w1c 0 Bit 2 FNEAIF w1c FNEAIE MOC_IF w1c TI2 _IF w1c SSI2 _IF w1c 0 RBIE CCL _IF w1c TI1 _IF w1c SSI1 _IF w1c 0 TBIE MXS _IF w1c CYS _IF w1c SSI0 _IF w1c 0 Bit 1 RBIF Bit 0 TBIF 0x0417 GIFER MIE FATL _IF w1c MTX _IF w1c EMC _IF w1c 0 PRIE INTL _IF w1c LTXB_IF w1c IPC _IF w1c 0 CHIE ILCF _IF w1c LTXA_IF w1c PECF_IF w1c EVT _IF w1c ILCF _IE LTXA_IE PECF_IE EVT _IE 0x0418 PIFR0 0x041C 0x041D 0x041E 0x041F PIER0 PIER0 PIER1 PIER1 FATL _IE MTX _IE EMC _IE 0 INTL _IE LTXB_IE IPC _IE 0 MRC _IE TBVA_IE SSI3 _IE 0 MOC_IE TI2 _IE SSI2 _IE 0 MBS _EF w1c NML _EF w1c TBIVEC RBIVEC CCL _IE TI1 _IE SSI1 _IE 0 MBU _EF w1c NMF _EF w1c MXS _IE CYS _IE SSI0 _IE 0 LCK _EF w1c ILSA _EF w1c 0x0420 CHIERFR FRLB_EF w1c DBL _EF w1c 0 0 FRLA_EF w1c SBCF_EF w1c 0 0 PCMI_EF FOVB_EF FOVA_EF w1c FID _EF w1c 0 0 STATUS_ERR_CNT STATUS_ERR_CNT STATUS_ERR_CNT STATUS_ERR_CNT w1c DPL _EF w1c w1c SPL _EF w1c 0x0422 0x0423 0x0424 0x0425 0x0426 0x0427 0x0428 0x0429 MBIVEC MBIVEC CASERCR CASERCR CBSERCR CBSERCR PSR0 PSR0 ERRMODE SLOTMODE 0 0 PROTSTATE WAKEUPSTATUS STARTUPSTATE MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1277 Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x042A 0x042B 0x042C 0x042D 0x042E 0x042F 0x0430 0x0431 0x0432 0x0433 0x0434 0x0435 0x0436 0x0437 0x0438 0x0439 0x043A 0x043B 0x043C Name PSR1 PSR1 PSR2 PSR2 PSR3 PSR3 MTCTR MTCTR CYCTR CYCTR SLTCTAR SLTCTAR SLTCTBR SLTCTBR RTCORVR RTCORVR OFCORVR OFCORVR CIFRR R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 CSAA w1c CPN NBVB STCA 0 0 0 Bit 6 CSP HHR NSEB SBVA 0 0 0 Bit 5 0 FRZ STCB SSEA WUB w1c WUA w1c SBVB MTA ABVB w1c ABVA w1c SSEB Bit 4 Bit 3 Bit 2 REMCSAT APTAC MTB NBVA NSEA Bit 1 Bit 0 CLKCORRFAILCNT AACB ACEB w1c w1c AACA ACEA w1c w1c MTCT ASEB w1c ASEA w1c AVFB w1c AVFA w1c MTCT 0 0 0 0 0 0 0 0 0 0 0 0 CYCCNT SLOTCNTA 0 0 0 SLOTCNTA 0 0 0 0 0 SLOTCNTB SLOTCNTB RATECORR RATECORR OFFSETCORR OFFSETCORR 0 0 0 0 WUP IF 0 0 FNEB IF 0 0 FNEA IF 0 0 0 0x043D CIFRR MIF PRIF CHIF RBIF TBIF 0x043E 0x043F SYMATOR SYMATOR 0 0 0 0 0 0 0 0 TIMEOUT MC9S12XF - Family Reference Manual, Rev.1.19 1278 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x0440 0x0441 0x0442 0x0443 0x0444 0x0445 0x0446 0x0447 0x0448 0x0449 0x044A 0x044B 0x044C 0x044D 0x044E 0x044F 0x0450 0x0451 0x0452 0x0453 0x0454 0x0455 0x0456 Name SFCNTR SFCNTR SFTOR SFTOR SFTCCSR SFTCCSR SFIDRFR SFIDRFR SFIDAFVR SFIDAFVR SFIDAFMR SFIDAFMR NMVR0 NMVR0 NMVR1 NMVR1 NMVR2 NMVR2 NMVR3 NMVR3 NMVR4 NMVR4 NMVR5 R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 SFEVA SFODA Bit 1 Bit 0 SFEVB SFODB SFT_OFFSET[15:8] SFT_OFFSET[7:1] 0 ELKT ELKS 0 0 OLKT OLKS 0 CYCNUM EVAL 0 OVAL 0 0 0 0 OPT 0 SDV EN SID EN 0 SYNFRID SYNFRID 0 0 0 0 0 0 FVAL FVAL 0 0 0 0 0 0 FMSK FMSK NMVP[15:8] NMVP[7:0] NMVP[15:8] NMVP[7:0] NMVP[15:8] NMVP[7:0] NMVP[15:8] NMVP[7:0] NMVP[15:8] NMVP[7:0] NMVP[15:8] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1279 Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x0457 0x0458 0x0459 0x045A 0x045B 0x045C 0x045D 0x045E 0x045F Name NMVR5 NMVLR NMVLR TICCR TICCR TI1CYSR TI1CYSR TI1MTOR TI1MTOR R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 NMVP[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 T2_ CFG 0 0 0 T2_ REP T1_ REP 0 0 0 T2SP 0 T1SP 0 0 0 0 NMVL 0 T2TR 0 T1TR T2ST T1ST T1_CYC_VAL T1_CYC_MSK T1_MTOFFSET T1_MTOFFSET 0x0460 0x0461 TI2CR0 TI2CR0 0 0 Fields for absolute timer T2 (TICCR[T2_CFG] = 0) 0 T2_CYC_VAL 0 T2_CYC_MSK Fields for absolute timer T2 (TICCR[T2_CFG] = 1) 0x0460 0x0461 TI2CR0 TI2CR0 T2_MTCNT[31:24] T2_MTCNT[23:16] Fields for absolute timer T2 (TICCR[T2_CFG] = 0) 0 T2_MTOFFSET T2_MTOFFSET Fields for absolute timer T2 (TICCR[T2_CFG] = 1) 0x0462 0x0463 0x0464 0x0465 0x0466 0x0467 TI2CR1 TI2CR1 SSSR SSSR SSCCR SSCCR T2_MTCNT[15:8] T2_MTCNT[7:0] 0 WMD 0 SEL 0 SLOTNUMBER[10:8] 0x0462 0x0463 TI2CR1 TI2CR1 SLOTNUMBER[7:0] 0 WMD VFR 0 SEL NUF SUF 0 CNTCFG STATUSMASK MCY SYF MC9S12XF - Family Reference Manual, Rev.1.19 1280 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x0468 0x0469 0x046A 0x046B 0x046C 0x046D 0x046E 0x046F 0x0470 0x0471 0x0472 0x0473 0x0474 0x0475 0x0476 0x0477 0x0478 0x0479 0x047A 0x047B 0x047C 0x047D 0x047E Name SSR0 SSR0 SSR1 SSR1 SSR2 SSR2 SSR3 SSR3 SSR4 SSR4 SSR5 SSR5 SSR6 SSR6 SSR7 SSR7 SSCR0 SSCR0 SSCR1 SSCR1 SSCR2 SSCR2 SSCR3 R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 VFB VFA VFB VFA VFB VFA VFB VFA VFB VFA VFB VFA VFB VFA VFB VFA Bit 6 SYB SYA SYB SYA SYB SYA SYB SYA SYB SYA SYB SYA SYB SYA SYB SYA Bit 5 NFB NFA NFB NFA NFB NFA NFB NFA NFB NFA NFB NFA NFB NFA NFB NFA Bit 4 SUB SUA SUB SUA SUB SUA SUB SUA SUB SUA SUB SUA SUB SUA SUB SUA Bit 3 SEB SEA SEB SEA SEB SEA SEB SEA SEB SEA SEB SEA SEB SEA SEB SEA Bit 2 CEB CEA CEB CEA CEB CEA CEB CEA CEB CEA CEB CEA CEB CEA CEB CEA Bit 1 BVB BVA BVB BVA BVB BVA BVB BVA BVB BVA BVB BVA BVB BVA BVB BVA Bit 0 TCB TCA TCB TCA TCB TCA TCB TCA TCB TCA TCB TCA TCB TCA TCB TCA SLOTSTATUSCNT[15:8] SLOTSTATUSCNT[7:0] SLOTSTATUSCNT[15:8] SLOTSTATUSCNT[7:0] SLOTSTATUSCNT[15:8] SLOTSTATUSCNT[7:0] SLOTSTATUSCNT[15:8] MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1281 Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x047F 0x0480 0x0481 0x0482 0x0483 0x0484 0x0485 0x0486 0x0487 0x0488 0x0489 0x048A 0x048B 0x048C 0x048D 0x048E 0x048F 0x0490 0x0491 0x0492 0x0493 0x0494 0x0495 Name SSCR3 MTSACFR MTSACFR MTSBCFR MTSBCFR RSBIR RSBIR RFSR RFSR RFSIR RFSIR RFDSR RFDSR RFARIR RFARIR RFBRIR RFBRIR RFMIDAFVR RFMIDAFVR RFMIAFMR RFMIAFMR RFFIDRFVR RFFIDRFVR R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SLOTSTATUSCNT[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 MTE 0 CYCCNTMSK CYCCNTVAL CYCCNTMSK CYCCNTVAL SEL 0 0 0 0 MTE 0 0 WMD 0 0 0 0 RSBIDX 0 0 0 0 0 0 SEL SIDX[9:8] SIDX[7:0] FIFO_DEPTH 0 0 0 0 0 ENTRY_SIZE 0 0 RDIDX[9:8] RDIDX[7:0] 0 0 0 0 0 0 RDIDX[9:8] RDIDX[7:0] MIDAFVAL[15:8] MIDAFVAL[7:0] MIDAFMSK[15:8] MIDAFMSK[7:0] 0 0 0 0 0 FIDRFVAL[10:8] FIDRFVAL[7:0] MC9S12XF - Family Reference Manual, Rev.1.19 1282 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x0496 0x0497 0x0498 0x0499 0x049A 0x049B 0x049C 0x049D 0x049E 0x049F Name R W R RFFIDRFMR W R RFRFCFR W R RFRFCFR W R RFRFCTR W R RFRFCTR W R LDTXSLAR W R LDTXSLAR R R LDTXSLBR W R LDTXSLBR R RFFIDRFMR R W R W R W R W R W R W R W R W R W R W R tss_transmitter W R wakeup_symbol_tx_low [1:0] W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 Bit 1 FIDRFMSK[10:8] Bit 0 FIDRFMSK[7:0] 0 WMD IBD SEL SID[7:0] 0 0 0 0 0 0 0 0 0 0 0 0 F3MD F3EN 0 F2MD F2EN F1MD F1EN F0MD F0EN 0 SID[10:8] LASTDYNTXSLOTA[10:8] 0 0 0 0 0 0 LASTDYNTXSLOTA[7:0] 0 0 0 0 0 0 0 LASTDYNTXSLOTB[10:8] 0 LASTDYNTXSLOTB[7:0] 0 0 0 0 Protocol Conﬁguration Registers action_point_offset static_slot_length[7:0] 0 0 0 0x04A0 0x04A1 0x04A2 0x04A3 0x04A4 0x04A5 0x04A6 0x04A7 0x04A8 0x04A9 0x04AA 0x04AB PCR0 PCR0 PCR1 PCR1 PCR2 PCR2 PCR3 PCR3 PCR4 PCR4 PCR5 PCR5 static_slot_length[9:8] 0 0 macro_after_ﬁrst_static_slot[13:8] macro_after_ﬁrst_static_slot[7:0] minislot_after_action_point number_of_static_slots[7:0] wakeup_symbol_rx_low minislot_action_point_ offset[4:3] coldstart_attempts wakeup_s ymbol_rx_ window number_of_static_slots [9:8] minislot_action_point_offset[3:0] cas_rx_low_max wakeup_symbol_rx_window wakeup_symbol_tx_low[5:2] wakeup_symbol_rx_idle MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1283 Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x04AC 0x04AD 0x04AE 0x04AF 0x04B0 0x04B1 0x04B2 0x04B3 0x04B4 0x04B5 Name PCR6 PCR6 PCR7 PCR7 PCR8 PCR8 PCR9 PCR9 PCR10 PCR10 Bit 7 R 0 W R symbol_win W ction_point R W R decoding_c W orrection_b R W R W R mini slot_ W exists dow_after_a Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 symbol_window_after_action_point macro_initial_offset_a decoding_correction_b micro_per_macro_nom_half max_without_clock_ correction_fatal wakeup_symbol_tx_idle sym bol_ win dow_ exists offset_correction_out max_without_clock_ correction_passive 0x04B6 PCR11 0x04B7 0x04B8 0x04B9 0x04BA 0x04BB 0x04BC 0x04BD 0x04BE 0x04BF PCR11 PCR12 PCR12 PCR13 PCR13 PCR14 PCR14 PCR15 PCR15 R offset_correction_out W R single_slot wake up_ macro_per_cycle W _en abled chan nel R macro_per_cycle W R key_ key_ slot_ slot_ offset_correction_start used_for_ used_for_ W start sync up R offset_correction_start W R allow_passive_to_active key_slot_header_crc W R key_slot_header_crc W R static_slot_after_action ﬁrst_minislot_action_point_offset _point W R static_slot_after_action_point W R rate_correction_out W R rate_correction_out listen_timeout[20:16] W R listen_timeout[15:8] W R listen_timeout[7:0] W MC9S12XF - Family Reference Manual, Rev.1.19 1284 Freescale Semiconductor Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x04C0 0x04C1 0x04C2 0x04C3 0x04C4 0x04C5 0x04C6 0x04C7 0x04C8 0x04C9 0x04CA 0x04CB 0x04CC 0x04CD 0x04CE 0x04CF 0x04D0 0x04D1 0x04D2 0x04D3 Name R PCR16 PCR16 PCR17 PCR17 PCR18 PCR18 PCR19 PCR19 PCR20 PCR20 PCR21 PCR21 PCR22 PCR22 PCR23 PCR23 PCR24 PCR24 PCR25 PCR25 W R W R W R W R W R W R W R decoding_ correction_ W a R W R W R extern_rate_ correction W R W R W R W R W R W R W R W R W R W R W macro_initial_offset_b noise_listen_timeout[22:16] noise_listen_timeout[15:8] noise_listen_timeout[7:0] wakeup_pattern key_slot_id decoding_correction_a payload_length_static micro_initial_offset_b micro_initial_offset_a latest_tx latest_tx R* comp_accepted_startup_range_a comp_accepted_startup_range_a micro_per_cycle[15:8] micro_per_cycle[7:0] cluster_drift_damping max_payload_length_dynamic micro_per_cycle_min[15:8] micro_per_cycle_min[7:0] allow _halt_ due _to_ clock max_payload_length_dynamic micro_per_cycle_min [19:16] micro_per_cycle[19:16] key_slot_id Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 noise_liste n_timeout [24:23] 0x04D4 PCR26 comp_accepted_startup_range_b MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1285 Appendix E Detailed Register Address Map 0x0400–0x05FF FlexRayRegister Space Address 0x04D5 Name PCR26 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R micro_per_cycle_max comp_accepted_startup_range_b [19:16] W R 0x04D6 PCR27 micro_per_cycle_max[15:8] W R 0x04D7 PCR27 micro_per_cycle_max[7:0] W R dynamic_slot_idle_pha 0x04D8 PCR28 macro_after_offset_correction se W R 0x04D9 PCR28 macro_after_offset_correction W R extern_offset_ 0x04DA PCR29 minislots_max correction W R 0x04DB PCR29 minislots_max W R 0 0 0 0 0 0 0 0x04DC PCR30 W R 0 0 0 0 0x04DD PCR30 sync_node_max W R 0 0 0 0 0 0 0 0x04DE Reserved 0x04FF W This Block of Registers is implemented 32 times Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn) Message Buffer Cycle Counter Filter Registers (MBCCFRn) Message Buffer Frame ID Registers (MBFIDRn) Message Buffer Index Registers (MBIDXRn) R 0 CMT 0 0 0x0500 MBCCSR0 MCM MBT MTD W rwm EDT LCKT R 0 0 0 DUP DVAL EDS LCKS 0x0501 MBCCSR0 W R 0x0502 MBCCSR0 MTM CHA CHB CCFE CCFMSK W R 0x0503 MBCCSR0 CCFMSK CCFVAL W R 0 0 0 0 0 0x0504 MBFIDR0 FID W R 0x0505 MBFIDR0 FID W R 0 0 0 0 0 0 0 0x0506 MBIDXR0 W R 0 0 0x0507 MBIDXR0 MBIDX W ..... ........ 0 0 MBIE MBIF w1c 0 ..... 0x05F8 ......... MBCCSR31 R W 0 MCM MBT MTD CMT rwm 0 EDT 0 LCKT MBIE MC9S12XF - Family Reference Manual, Rev.1.19 1286 Freescale Semiconductor Appendix F Ordering Information 0x0400–0x05FF FlexRayRegister Space Address 0x05F9 0x05FA 0x05FB 0x05FC 0x05FD 0x05FE 0x05FF Name MBCCSR31 MBCCSR31 MBCCSR31 MBFIDR31 MBFIDR31 MBIDXR31 MBIDXR13 R W R W R W R W R W R W R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 DUP Bit 3 DVAL Bit 2 EDS Bit 1 LCKS Bit 0 MBIF w1c MTM CHA CHB CCFE CCFVAL CCFMSK CCFMSK 0 0 0 0 0 FID FID 0 0 0 0 0 0 0 0 0 0 MBIDX 0x0600–0x07FF Reserved Address 0x0600 0x07FF Name Reserved R W Bit 7 0 Bit 6 0 Bit 5 0 Bit 4 0 Bit 3 0 Bit 2 0 Bit 1 0 Bit 0 0 Appendix F Ordering Information The following ﬁgure provides an ordering partnumber example for the devices covered by this data book. There are two options when ordering a device. Customers must choose between ordering either the maskspeciﬁc partnumber or the generic / mask-independent partnumber Ordering the mask-speciﬁc partnumber enables the customer to specify which particular maskset they will receive whereas ordering the generic maskset means that FSL will ship the currently preferred maskset (which may change over time). In either case, the marking on the device will always show the generic / mask-independent partnumber and the mask set number. NOTE The mask identiﬁer sufﬁx and the Tape & Reel sufﬁx are always both omitted from the partnumber which is actually marked on the device. For speciﬁc partnumbers to order, please contact your local sales ofﬁce. The below ﬁgure illustrates the structure of a typical mask-speciﬁc ordering number for the MC9S12XF-Family devices MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1287 Appendix F Ordering Information S 9 S12X F512 J0 C AG R Tape & Reel Package Option R = Tape & Reel No R = No Tape & Reel LH = 64 LQFP LM = 112 LQFP Temperature Option C = -40˚C to 85˚C V = -40˚C to 105˚C M = -40˚C to 125˚C Maskset identifier Suffix First digit usually references wafer fab Second digit usually differentiates mask rev (This suffix is omitted in generic partnumbers) Device Title Controller Family Main Memory Type: 9 = Flash 3 = ROM (if available) Statuts / Partnumber type: S or SC = Maskset specific partnumber MC = Generic / mask-independebt partnumber P or PC = prototype status (pre qualification Figure F-1. Order Part Number Example MC9S12XF - Family Reference Manual, Rev.1.19 1288 Freescale Semiconductor Appendix F Ordering Information MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1289 Appendix F Ordering Information MC9S12XF - Family Reference Manual, Rev.1.19 1290 Freescale Semiconductor Index Symbols (, 1273 A Abort Acknowledge, 975 Abort Request, 974 ABTAK2 - ABTAK0, 975 ABTRQ2 - ABTRQ0, 974 AC7 – AC0, 980, 981 Acceptance Code Bits, 980 Acceptance Mask Bits, 981 ACCERR, 150, 240, 300, 362 ADC instruction, 651 ADD instruction, 652 ADDH instruction, 653 Addition instructions, 651, 652, 653, 654 ADDL instruction, 654 address offset, 961 Addressing mode Dyadic (DYA), 646 Immediate 16 bit wide (IMM16), 645 Immediate 3 bit wide (IMM3), 645 Immediate 4 bit wide (IMM4), 645 Immediate 8 bit wide (IMM8), 645 Index register plus immediate offset (IDO5), 646 Index register plus register offset (IDR), 647 Index register plus register offset with post-increment (IDR+) Post-increment, 647 Index register plus register offset with pre-decrement (-IDR) Pre-decrement, 647 Inherrent (INH), 644 Monadic (MON), 645 Relative 11 Bit Wide (REL11), 646 Relative 9 bit wide (REL9), 646 Triadic (TRI), 646 Addressing modes, 644 Amplitude, 193 AND instruction, 655 ANDH instruction, 656 ANDL instruction, 657 Arithmetic instructions, 648 Addition, 651, 652, 653, 654 Parity, 705 Sign extension, 710 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1291 Subtraction, 709, 715, 716, 717 ASR instruction, 658 Associated functions, 460 B Banked Register, 132, 222, 282, 345 base address, 961 Baud Rate Prescaler, 967 BCC instruction, 659, 660, 674 BEQ instruction, 661 BFEXT instruction, 662 BFFO instruction, 663 BFINS instruction, 664 BFINSI instruction, 665 BFINSX instruction, 666 BGE instruction, 667 BGT instruction, 668 BHI instruction, 669 BHS instruction, 670 bias, 193 BISTREL, 150, 240, 300, 362 Bit ﬁeld instructions, 662, 663, 664, 665, 666 Bit Field Operations, 649 Bit test instructions, 671, 672 BITH instruction, 671 BITL instruction, 672 BKSEL, 151, 241, 301, 363 BLE instruction, 673 Block Diagram, 958 Block diagram, 406, 817, 1096 BLS instruction, 675, 676 BMI instruction, 677 BNE instruction, 678 Boolean logic instructions, 648 AND, 655, 656, 657 OR, 702, 703, 704 XNOR, 720, 721, 722 BOSCH speciﬁcation, 957, 965 BPL instruction, 679 BRA instruction, 680 Branch instructions, 648, 659, 660, 661, 667, 668, 669, 670, 673, 674, 675, 676, 677, 678, 679, 680, 682, 683 BRK instruction, 681 BRP, 967 bus monitoring mode, 1002 Bus-Off, 965, 970, 972, 1005, 1006, 1008 BVC instruction, 682 BVS instruction, 683 C CAN protocol, 957 CAN Status Change, 1008 MC9S12XF - Family Reference Manual, Rev.1.19 1292 Freescale Semiconductor CAN Status Change Interrupt Enable, 972 CAN Status Change Interrupt Flag, 970 CAN Stops in Wait Mode, 964 CAN system, 960 CANBTR0, 965, 967 CANBTR1, 967, 968 CANCTL0, 963, 965 CANCTL1, 965, 967 CANE, 966 CANIDAC, 967, 976 CANIDAR0-7, 967, 979 CANIDMR0-7, 967 CANRFLG, 965, 969 CANRIER, 965, 971 CANRXERR, 978 CANTAAK, 965, 975 CANTARQ, 965, 974 CANTBSEL, 965, 975 CANTFLG, 965, 972 CANTIER, 965, 973 CANTXERR, 979 CCIF, 150, 240, 300, 362 CLKSRC, 966 Clock, 196 clock source, 966 CMP instruction, 684, 687 CMPL instruction, 685 COM instruction, 686, 699 Command Write Sequence, 132, 222, 282, 345 Compare instructions, 684, 685, 687, 688 Complement instructions, 686, 699, 700 CPCH instruction, 688 CRC, 971 Cross reference, 1096 crystal, 999 CSCIE, 972 CSCIF, 970 CSEM instruction, 689 CSL instruction, 690 CSR instruction, 691 CSWAI, 964 Cycle notation, 649 D Data direction register, 895 Data register, 895 data segment register, 988 Debug Features, 641 Diagram block, 817, 1096 distinctive features, 24 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1293 DLR, 989 Dyadic addressing mode, 646 E EBI, 835 electrical, 1219 emulation modes, 1002 EPDIS, 156, 246, 306, 368 EPS, 156, 160, 246, 250, 306, 310, 368, 372 error counter, 965, 966, 970, 999 Expanded Mode, 132, 222, 282, 345 Extended format identiﬁer, 985, 986 extended identiﬁers, 982, 985 F FAIL, 150, 240, 300, 362 FDFD, 147, 148, 237, 238, 297, 298, 359, 360 FDIV, 145, 235, 295, 357 FDIVLD, 143, 233, 293, 355 Features, 616 distinctive, 460, 816 FIFO, 959, 971, 977, 994, 995, 1005, 1008 Figure cross-reference style, 1096 Flash Module, 132, 223, 282, 345 Flash Page, 132, 223, 282, 345 Flash Sector, 133, 223, 283, 345 Functions associated, 460 G Gain, 196 gain, 193 H HALF (Half Cycle Reload) bit, 922, 925, 929 handshake, 965 hard reset, 965 I ID Extended, 985, 987 IDAM1 - IDAM0, 977 Identiﬁer Acceptance Mode, 977 identiﬁer register, 984 IDHIT2 - IDHIT0, 977 IDR0-3, 984 IFS, 993 Immediate addressing mode, 645 Indexed addressing mode, 646, 647 Inherent addressing mode, 644 MC9S12XF - Family Reference Manual, Rev.1.19 1294 Freescale Semiconductor INITAK, 964, 965, 967 Initialization Mode, 965, 967, 1002 Initialization Mode Acknowledge, 967 Initialization Mode Request, 965 Initialization/application information, 217, 608, 814, 829, 1031 INITRQ, 964, 965 Input register, 895 Instruction coding, 723 interrupt enable, 971 Interrupt Operation, 1007 J JAL instruction, 692 K KEYEN, 145, 235, 295, 357 L LDB instruction, 693 LDFQ (Load Frequency) bits, 922 LDH instruction, 694 LDL instruction, 695 LDOK (Load Okay) bit, 921, 925, 928 LDW instruction, 696 LISTEN, 966 Listen Only Mode, 966 Listen-Only, 1002 Load instructions, 647, 693, 694, 695, 696 local priority, 993 Loop Back Self Test Mode, 966 LOOPB, 966 LSL instruction, 697 LSR instruction, 698 M Maximum ratings (electrical), 1182, 1183, 1184 Memory Map, 961 Memory map, 637 message buffer individual, 541 MISR, 132, 222, 282, 345 Monadic addressing mode, 645 MONITOR, 147, 148, 237, 238, 297, 298, 359, 360 Monitor, 196 MSCAN Clock Source, 966 MSK (Mask) bits, 911 N Naming conventions, 644 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1295 NEG instruction, 700 NOP instruction, 701 normal modes, 1001 O operation, 193 OR instruction, 702 ORH instruction, 703 ORL instruction, 704 Overrun, 1008 overrun, 971 Overrun Interrupt Flag, 971 OVRIF, 971 P PAR instruction, 705 PHASE_SEG1, 1000 PHASE_SEG2, 1000 Pin Conﬁguration, 848 pinout diagram, 43 PLL, 999 PMCTL (PWM Control Register), 909, 910, 912, 913, 914, 915, 916, 917, 921, 922, 924, 925, 928 Polarity select register, 896 Power Down Mode, 1006 PRDIV8, 145, 235, 295, 357 prescaler, 1000 priority, 837 Programming model, 636 PROP_SEG, 1000 Pull device enable register, 896 PWM Alignment, 932 Deadtime Generators, 936 Duty Cycle, 933 Generator, 931 Manual Correction, 939 Output Polarity, 944 Period, 932 Top/Bottom Correction, 938 PWM Control Register (PMCTL), 909, 910, 912, 913, 914, 915, 916, 917, 921, 922, 924, 925, 928 PWM Reload Frequency, 914, 922, 926, 929 PWM SOftware Output Control, 916 PWMEN (PWM Enable) bit, 921, 925, 928 PWMF (PWM Reload Flag) bit, 922, 926, 929 PWMRIE (PWM Reload Interrupt Enable) bit, 921, 925, 928 R REC, 970 Receive Buffer Full Flag, 971 Receive Error Counter, 970, 978 MC9S12XF - Family Reference Manual, Rev.1.19 1296 Freescale Semiconductor Received Frame Flag, 209, 210, 964 Receiver Active Status, 964 Receiver Input Pin, 960 Receiver Status Bits, 970 Reduced drive register, 896 Register map, 618 register map, 961 Registers, 618 Channel A Status Error Counter Register (CASERCR), 491 Channel B Status Error Counter Register (CBSERCR), 491 CHI Error Flag Register (CHIERFR), 488 Combined Interrupt Flag Register (CIFRR), 500 Cycle Counter Register (CYCTR), 498 FADDR, 158, 248, 308, 370 FCLKDIV, 143, 233, 293, 355 FCMD, 156, 158, 246, 248, 306, 308, 368, 370 FCNFG, 147, 148, 237, 238, 297, 298, 359, 360 FCTL, 160, 161, 250, 251, 310, 311, 372, 373 FPROT, 151, 241, 301, 363 FSEC, 145, 235, 295, 357 FSTAT, 149, 239, 299, 361 FTSTMOD, 146, 236, 296, 358 Global Interrupt Flag and Enable Register (GIFER), 480 Macrotick Counter Register (MTCTR), 498 Message Buffer Conﬁguration, Control, Status Registers (MBCCSRn), 535, 1286 Message Buffer Cycle Counter Filter Registers (MBCCFRn), 537 Message Buffer Data Size Register (MBDSR), 477 Message Buffer Frame ID Registers (MBFIDRn), 538 Message Buffer Index Registers (MBIDXRn), 539 Message Buffer Interrupt Vector Register (MBIVEC), 490 Message Buffer Segment Size and Utilization Register (MBSSUTR), 478 Module Conﬁguration Register (MCR), 471 Module Version Register (MVR), 470 MTS A Conﬁguration Register (MTSACFR), 516 MTS B Conﬁguration Register (MTSBCFR), 516 Network Management Vector Length Register (NMVLR), 507 Network Management Vector Registers (NMVR0–NMVR5), 506 Offset Correction Value Register (OFCORVR), 500 Protocol Conﬁguration Register 0 (PCR 0), 527 Protocol Conﬁguration Register 1 (PCR 1), 527 Protocol Conﬁguration Register 10 (PCR10), 529 Protocol Conﬁguration Register 11 (PCR11), 530 Protocol Conﬁguration Register 12 (PCR12), 530 Protocol Conﬁguration Register 13 (PCR13), 530 Protocol Conﬁguration Register 14 (PCR14), 530 Protocol Conﬁguration Register 15 (PCR15), 531 Protocol Conﬁguration Register 16 (PCR16), 531 Protocol Conﬁguration Register 17 (PCR17), 531 Protocol Conﬁguration Register 18 (PCR18), 531 Protocol Conﬁguration Register 19 (PCR19), 532 Protocol Conﬁguration Register 2 (PCR2), 527 Protocol Conﬁguration Register 20 (PCR20), 532 Protocol Conﬁguration Register 21 (PCR21), 532 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1297 Protocol Conﬁguration Register 22 (PCR22), 532 Protocol Conﬁguration Register 23 (PCR23), 533 Protocol Conﬁguration Register 24 (PCR24), 533 Protocol Conﬁguration Register 25 (PCR25), 533 Protocol Conﬁguration Register 26 (PCR26), 533 Protocol Conﬁguration Register 27 (PCR27), 534 Protocol Conﬁguration Register 28 (PCR28), 534 Protocol Conﬁguration Register 29 (PCR29), 534 Protocol Conﬁguration Register 3 (PCR3), 527 Protocol Conﬁguration Register 30 (PCR30), 534 Protocol Conﬁguration Register 4 (PCR4), 528 Protocol Conﬁguration Register 5 (PCR5), 528 Protocol Conﬁguration Register 6 (PCR6), 528 Protocol Conﬁguration Register 7 (PCR7), 528 Protocol Conﬁguration Register 8 (PCR8), 529 Protocol Conﬁguration Register 9 (PCR9), 529 Protocol Interrupt Enable Register 0 (PIER0), 486 Protocol Interrupt Enable Register 1 (PIER1), 487 Protocol Interrupt Flag Register 0 (PIFR0), 483 Protocol Interrupt Flag Register 1 (PIFR1), 485 Protocol Operation Control Register (POCR), 478 Protocol Status Register 0 (PSR0), 492 Protocol Status Register 1 (PSR1), 493 Protocol Status Register 2 (PSR2), 494 Protocol Status Register 3 (PSR3), 496 Rate Correction Value Register (RTCORVR), 499 Receive FIFO A Read Index Register (RFARIR), 519 Receive FIFO B Read Index Register (RFBRIR), 520 Receive FIFO Depth and Size Register (RFDSR), 519 Receive FIFO Frame ID Rejection Filter Value Register (RFFIDRFVR), 521 Receive FIFO Message ID Acceptance Filter Mask Register (RFMIAFMR), 521 Receive FIFO Message ID Acceptance Filter Value Register (RFMIDAFVR), 520 Receive FIFO Selection Register (RFSR), 518 Receive FIFO Start Index Register (RFSIR), 518 Receive Shadow Buffer Index Register (RSBIR), 517 Slot Counter Channel A Register (SLTCTAR), 499 Slot Counter Channel B Register (SLTCTBR), 499 Slot Status Counter Condition Register (SSCCR), 512 Slot Status Counter Registers (SSCR0–SSCR3), 515 Slot Status Registers (SSR0–SSR7), 514 Slot Status Selection Register (SSSR), 511 Strobe Signal Control Register (STBCR), 473, 477 Sync Frame Counter Register (SFCNTR), 502 Sync Frame ID Acceptance Filter Mask Register (SFIDAFMR), 505 Sync Frame ID Acceptance Filter Value Register (SFIDAFVR), 505 Sync Frame Table Conﬁguration, Control, Status Register (SFTCCSR), 503 Sync Frame Table Offset Register (SFTOR), 503 System Memory Base Address High Register (SYMBADHR), 473, 502 Timer 1 Cycle Set Register (TI1CYSR), 508 Timer 1 Macrotick Offset Register (TI1MTOR), 509 Timer 2 Conﬁguration Register 0 (TI2CR0), 510 Timer 2 Conﬁguration Register 1 (TI2CR1), 511 Timer Conﬁguration and Control Register (TICCR), 507 MC9S12XF - Family Reference Manual, Rev.1.19 1298 Freescale Semiconductor XGATE Channel ID Register (XGCHID), 623, 624 XGATE Condition Code Register (XGCCR), 631 XGATE Module Control Register (XGMCTL), 621 XGATE Program Counter Register (XGPC), 632 XGATE Register 1 (XGR1), 632 XGATE Register 2 (XGR2), 633 XGATE Register 3 (XGR3), 633 XGATE Register 4 (XGR4), 634 XGATE Register 5 (XGR5), 634 XGATE Register 6 (XGR6), 635 XGATE Register 7 (XGR7), 635 XGATE Semaphore Register (XGSEM), 630 XGATE Software Trigger Register (XGSWT), 629 Relative Addressing Mode, 646 Relative addressing mode, 646 Remote Transmission Request, 986, 987 Reserved Registers, 977 reset, 1007 RNV, 145, 156, 160, 235, 246, 250, 295, 306, 310, 357, 368, 372 ROL instruction, 706 ROR instruction, 707 RSTAT1, RSTAT0, 970 RSTATE1, RSTATE0, 972 RTS instruction, 708 run mode, 965, 1004 RXACT, 964 RXCAN, 960 RXFRM, 209, 210, 964 S SAMP, 968 Sampling, 968 SBC instruction, 709 SEC, 145, 235, 295, 357 Security, 190, 278, 339, 400 Semaphore instructions, 689, 712 Semaphores, 638 SEX instruction, 710 SFDF, 158, 248, 308, 370 Shift instructions, 648, 658, 690, 691, 697, 698, 706, 707 SIF instruction, 711 Sign extension instructions, 710 SJW1, SJW0, 967 Sleep Mode, 964, 965, 967, 1002, 1005, 1006, 1008 Sleep Mode Acknowledge, 967 Sleep Mode Request, 965 SLPRQ, 964, 965 SOF, 989 special modes, 1002 SPI clock, 1100 SSEM instruction, 712 Start of Frame, 989 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1299 STB instruction, 713 STOP, 965 Stop, 196 Stop Mode, 190, 278, 339, 400, 1004 Store instructions, 647, 713, 714 STW instruction, 714 SUB instruction, 715 SUBH instruction, 716 SUBL instruction, 717 Substitute Remote Request, 985 Subtraction instructions, 709, 715, 716, 717 supply, 193 Swap bits, 912 SYNC_SEG, 1000 SYNCH, 964 Synchronization Jump Width, 967, 1001 Synchronized Status, 964 system pins, 43 T TBPR, 981, 989 TEC, 970 TFR instruction, 718 TIME, 964, 990 Time Segment 1, 1000 Time Segment 2, 968, 1000 Time Stamp register, 981 Timer Enable, 964 transceiver, 960 Transfer instructions, 648, 718 Transmit Buffer Priority Register, 981 Transmit Error Counter, 970, 979 Transmitter Output Pin, 960 Triadic addressing mode, 646 TSEG1, 1000 TSEG2, 1000 TSEG22 – TSEG20, 968 TSRH, TSRL, 990 TST instruction, 719 TSTAT1, TSTAT0, 970 TXCAN, 960 V VLMODE (Value Register Load Mode) bits, 911 W WAIT, 965 Wait, 196 Wait Mode, 190, 278, 339, 400, 1004 wake-up, 972 MC9S12XF - Family Reference Manual, Rev.1.19 1300 Freescale Semiconductor Wake-Up Enable, 964 Wake-Up Function, 1007 Wake-up Interrupt Enable, 972 Wake-up Interrupt Flag, 970 warning condition, 1008 Wired-or mode register, 896 WUPE, 964, 965 WUPIE, 965 WUPIF, 970 WUPM, 966 X XGATE Module Control Register (XGMCTL), 621 XGCCR register, 631 XGCHID Register, 623, 624 XGMCTL Register, 621 XGMCTL register, 621 XGPC register, 632 XGR1 register, 632 XGR2 register, 633 XGR3 register, 633 XGR4 register, 634 XGR5 register, 634 XGR6 register, 635 XGR7 register, 635 XGSEM register, 630 XGSWT register, 629 XNOR instruction, 720 XNORH instruction, 721 XNORL instruction, 722 MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1301 MC9S12XF - Family Reference Manual, Rev.1.19 1302 Freescale Semiconductor Reference Manual End Sheet MC9S12XF - Family Reference Manual, Rev.1.19 Freescale Semiconductor 1303 FINAL PAGE OF 1304 PAGES MC9S12XF - Family Reference Manual, Rev.1.19 1304 Freescale Semiconductor How to Reach Us: Home Page: www.freescale.com USA/Europe or Locations Not Listed: Freescale Semiconductor Technical Information Center, CH370 1300 N. Alma School Road Chandler, Arizona 85224 1-800-521-6274 or 480-768-2130 Europe, Middle East, and Africa: +44 1296 380 456 (English) +46 8 52200080 (English) +49 89 92103 559 (German) +33 1 69 35 48 48 (French) Japan: Freescale Semiconductor Japan Ltd. Technical Information Center 3-20-1, Minami-Azabu, Minato-ku Tokyo 106-0047, Japan 0120-191014 or +81-3-3440-3569 Asia/Paciﬁc: Freescale Semiconductor Hong Kong Ltd. Technical Information Center 2 Dai King Street Tai Po Industrial Estate Tai Po, N.T., Hong Kong 852-26668334 For Literature Requests Only: Freescale Semiconductor Literature Distribution Center P.O. Box 5405 Denver, Colorado 80217 1-800-441-2447 or 303-675-2140 Fax: 303-675-2150 Information in this document is provided solely to enable system and software implementers to use Freescale Semiconductor products. There are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. Freescale Semiconductor reserves the right to make changes without further notice to any products herein. Freescale Semiconductor makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does Freescale Semiconductor assume any liability arising out of the application or use of any product or circuit, and speciﬁcally disclaims any and all liability, including without limitation consequential or incidental damages. “Typical” parameters that may be provided in Freescale Semiconductor data sheets and/or speciﬁcations can and do vary in different applications and actual performance may vary over time. All operating parameters, including “Typicals”, must be validated for each customer application by customer’s technical experts. Freescale Semiconductor does not convey any license under its patent rights nor the rights of others. Freescale Semiconductor products are not designed, intended, or authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other application in which the failure of the Freescale Semiconductor product could create a situation where personal injury or death may occur. Should Buyer purchase or use Freescale Semiconductor products for any such unintended or unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor and its ofﬁcers, employees, subsidiaries, afﬁliates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that Freescale Semiconductor was negligent regarding the design or manufacture of the part. Freescale™ and the Freescale logo are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners. Java and all other Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. © Freescale Semiconductor, Inc. 2007, 2008. All rights reserved. MC9S12XF512V1RM Rev.1.19 18-May-2010

下载 PDF

PC3S12XF512J0MLMR 价格&库存

-> 查询更多价格&库存

很抱歉，暂时无法提供与“PC3S12XF512J0MLMR”相匹配的价格&库存，您可以联系我们找货

免费人工找货

搜索历史

PC3S12XF512J0MLMR

推荐型号

相关技术文章