MM912G634DV1AER2

Freescale Semiconductor Technical Data Document Number: MM912_634D1 Rev. 13.0, 6/2015 Integrated S12 Based Relay Driver with LIN 912_634 The MM912G634 (48 kB) and MM912H634 (64 kB) are integrated, single package solutions which integrate an HCS12 microcontroller with a SMARTMOS analog control IC. The Die to Die Interface (D2D) controlled analog die combines system base chip and application specific functions, including a LIN transceiver. Features • • • • • • • • • • • • • • • • • • • AE SUFFIX (PB-FREE) 98ASA00173D 48 PIN LQFP-EP (7.0 X7.0 mm) AP SUFFIX (PB-FREE) 98ASH00962A 48 PIN LQFP (7.0 X7.0 mm) 16-Bit S12 CPU, 64/48 kByte P-FLASH 6.0 kByte RAM; 4/2 kByte D-FLASH Background debug (BDM) & debug module (DBG) Die to Die bus interface for transparent memory mapping On-chip oscillator & two independent watchdogs LIN 2.1 Physical layer interface with integrated SCI 10 digital MCU GPIOs shared with SPI (PA7…0, PE1…0) 10-Bit, 15 Channel - Analog to Digital converter (ADC) 16-Bit, 4 Channel - Timer module (TIM16B4C) 8-Bit, 2 Channel - Pulse width modulation module (PWM) Six high-voltage / Wake-up inputs (L5…0) Three low voltage GPIOs (PB2…0) Low power modes with cyclic sense & forced wake-up Current sense module with selectable gain Reverse battery protected voltage sense module Two protected low-side outputs to drive inductive loads Two protected high-side outputs Chip temperature sensor Hall sensor supply & integrated voltage regulator(s) Battery Sense Power Supply LIN Interface ADC Supply 2.5 V Supply 5.0 V Supply Digital Ground Reset 5.0 V Digital I/O Debug and External Oscillator MCU Test VSENSE VS1 MM912_634 VS2 LS1 PGND LIN LGND LS2 ADC25 AGND ISENSEH* VDD ISENSEL* VDDD2D HSUP VDDX VDDRX DGND VSSD2D PTB0/AD0/RX/TIM0CH0 VSSRX PTB1/AD1/TX/TIM0CH1 RESET PTB2/AD2/PWM/TIM0CH2 RESET_A HS1 PA0/MISO PA1/MOSI HS2* PA2/SCK PA3/SS PA4 L0 PA5 L1 PA6 L2 PA7 L3 BKGD/MODC L4* PE0/EXTAL L5* PE1/XTAL TCLK TEST TEST_A M Current Sense Mode Hall Sensor Hall Sensor * Feature not availablre in all Analog Options Figure 1. Simplified Application Diagram © Freescale Semiconductor, Inc., 2010 - 2015. All rights reserved. Low-side Drivers Hall Sensor Supply 5.0 V GPI/O with optional pull-up (shared with ADC, PWM, Timer, and SCI) 12 V Light/LED and Switch Supply Analog/Digital inputs (High Voltage and Wake-up capable) Analog Test 1 Ordering Information Table 1. Ordering Information Device (Add an R2 suffix for Tape and Reel orders) Temperature Range (TA) MM912G634DM1AE -40°C to 125°C MM912G634DV1AE -40°C to 105°C MM912G634DV2AP MM912H634DM1AE -40°C to 125°C MM912H634DV1AE -40°C to 105°C Package Max. Bus Frequency in MHz (fBUSMAX) LQFP48-EP 20 LQFP48 16 LQFP48-EP 20 Flash (kB) Data Flash (kB) RAM (kB) 48(2) 2(3) 2(4) Analog Option(1) A1 A2 64 4 6 A1 Note: 1. See Table 2. 2. The 48 kB Flash option (MM912G634) using the same S12I64 MCU with the tested FLASHSIZE reduced to 48 kB. This limits the usable Flash area to the first 48 kB (0x3_4000-0x3_FFFF). 3. The 48 kB Flash option (MM912G634) using the same S12I64 MCU with the tested Data - FLASHSIZE reduced to 2.0 kB. This limits the usable Data Flash area to the first 2.0 kB (0x0_4400-0x0_4BFF). 4. The 48 kB Flash option (MM912G634) using the same S12I64 MCU with the tested RAMSIZE reduced to 2.0 kB. This limits the usable RAM area to the first 2.0 kB (0x0_2800-0x0_2FFF). Table 2. Analog Options(5) Feature A1 A2 Battery Sense Module YES YES Current Sense Module YES NO 2nd High-side Output (HS2) YES YES L0…L5 L0…L3 Hall Supply Output (HSUP) YES YES LIN Module YES YES Wake-up Inputs (Lx) Note: 5. This table only highlights the analog die differences between the derivatives. Features highlighted as “NO” or the Lx Inputs not mentioned are not available in the specific option and not bonded out and/or not tested. See Analog Die Options for detailed information. MM912_634 2 Analog Integrated Circuit Device Data Freescale Semiconductor Table of Contents 1 2 3 4 5 6 7 Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Internal Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Pin Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.1 MM912_634 Pin Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 3.2 MCU Die Signal Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 4.2 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 4.3 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 4.4 Supply Currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 4.5 Static Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 4.6 Dynamic Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 4.7 Thermal Protection Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 4.8 ESD Protection and Latch-up Immunity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 4.9 Additional Test Information ISO7637-2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Functional Description and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 5.2 Device Register Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 5.3 MM912_634 - Analog Die Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 5.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 5.5 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 5.6 Die to Die Interface - Target . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 5.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 5.8 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 5.9 Wake-up / Cyclic Sense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 5.10 Window Watchdog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 5.11 Hall Sensor Supply Output - HSUP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 5.12 High-side Drivers - HS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 5.13 Low-side Drivers - LSx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 5.14 PWM Control Module (PWM8B2C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 5.15 LIN Physical Layer Interface - LIN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 5.16 Serial Communication Interface (S08SCIV4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 5.17 High Voltage Inputs - Lx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 5.18 General Purpose I/O - PTB[0…2] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 5.19 Basic Timer Module - TIM (TIM16B4C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 5.20 Analog Digital Converter - ADC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 5.21 Current Sense Module - ISENSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 5.22 Temperature Sensor - TSENSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 5.23 Supply Voltage Sense - VSENSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 5.24 Internal Supply Voltage Sense - VS1SENSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 5.25 Internal Bandgap Reference Voltage Sense - BANDGAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 5.26 MM912_634 - Analog Die Trimming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 5.27 MM912_634 - MCU Die Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 5.28 Port Integration Module (S12IPIMV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 5.29 Memory Map Control (S12PMMCV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 5.30 Interrupt Module (S12SINTV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 5.31 Background Debug Module (S12SBDMV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 5.32 S12S Debug Module (S12SDBGV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 5.33 Security (S12X9SECV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 5.34 Impact on MCU modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 5.35 Secure firmware Code Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 5.36 Initialization of a Virgin Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 5.37 Impact of Security on Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 5.38 S12 Clock, Reset and Power Management Unit (S12CPMU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 5.39 Serial Peripheral Interface (S12SPIV5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268 5.40 64 KByte Flash Module (S12FTMRC64K1V1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 5.41 Die-to-Die Initiator (D2DIV1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322 Packaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 6.1 Package Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 Revision History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338 MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 3 PA6 XTAL /XTAL TEST PA5 PA4 PA3 PA2 PORTE[0:1] CPU 12-V1 CPU Register Flash 64k Bytes with ECC ALU Reset Generation and Test Entry PLL with Freq. Modulation option OSC Clock Monitor Amplitude Contr. Low Power Pierce OSC RESET RAM 6k Byte SPI Data Flash 4k Bytes with ECC SS SCK MOSI Internal Bus VREG 1.8V Core 2.7V Flash Single-Wire Background Debug Module COP Watchdog Interrupt Module Periodic Interrupt Debug Module include 64 byte Trace Buffer RAM D2DI D2DCLK D2DDAT0 D2DDAT1 D2DDAT2 D2DDAT3 D2DINT Test Interface Reset Control Module Window Watchdog Module OSC (trimmable) Interrupt Control Module Die To Die Interface Analog Multiplexer Chip Temp Sense Module Wake Up Module 2 Channel PWM Module Current Sense Module ISENSEL 4 Channel Timer Module LS1 Low Side Control Module PGND GPIO ADC 10bit Lx Input Module SCI LIN Physical Layer LIN Internal Bus VS2 LS2 18V clamped Output Module HSUP Cascaded Voltage Regulators VDD = 2.5 V VDDX = 5.0 V VS1 PA1 MISO MCU Die VDDX ISENSEH High Side Control Module HS2 PA0 VDDD2D TCLK VBAT Sense Module HS1 RESET_A Analog Die VSENSE SSRX DDRX VSSD2D BKGD/MODC PORTA DDRA L5 L4 L3 L2 L1 L0 AGND ADC2p5 PTB2/AD2/PWM/TIMCH2 PTB1/AD1/TX/TIMCH1 PTB0/AD0/RX/TIMCH0 LGND Analog Integrated Circuit Device Data Freescale Semiconductor 4 Internal Block Diagram 2 PA7 VDD DGND TEST_A Figure 2. MM912_634 Block Diagram MM912_634 3 Pin Assignment PA7 BKGD RESET RESET_A TCLK TEST_A NC ISENSEH ISENSEL LS2 PGND LS1 48 47 46 45 44 43 42 41 40 39 38 37 PA6 1 36 L5 PE0/EXTAL 2 35 L4 PE1/XTAL 3 34 L3 TEST 4 33 L2 PA5 5 32 L1 PA4 6 31 L0 PA3 7 30 AGND PA2 8 29 ADC2p5 PA1 9 28 PTB2 PA0 10 27 PTB1 VSSRX 11 26 PTB0 VDDRX 12 25 LGND 13 14 15 16 17 18 19 20 21 22 23 24 VSSD2D VDDD2D VDD VDDX DGND VSENSE VS1 VS2 HS1 HS2 HSUP LIN Figure 3. MM912_634 Pin Out NOTE The device exposed pad (package option AE only) is recommended to be connected to GND. Not all pins are available for analog die option 2. See Analog Die Options for details. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 5 3.1 MM912_634 Pin Description The following table gives a brief description of all available pins on the MM912_634 package. Refer to the highlighted chapter for detailed information. Table 3. MM912_634 Pin Description Pin # Pin Name Formal Name 1 PA6 MCU PA6 Description General purpose port A input or output pin 6. See Section 5.28, “Port Integration Module (S12IPIMV1)" 2 PE0/EXTAL MCU Oscillator EXTAL is one of the optional crystal/resonator driver and external clock pins. On reset, all the device clocks are derived from the Internal Reference Clock and port PE may be used for general purpose I/O. See Section 5.38.2.2, “EXTAL and XTAL" and Section 5.28, “Port Integration Module (S12IPIMV1)". 3 PE1/XTAL MCU Oscillator XTAL is one of the optional crystal/resonator driver and external clock pins. On reset, all the device clocks are derived from the Internal Reference Clock and port PE may be used for general purpose I/O. See Section 5.38.2.2, “EXTAL and XTAL" and Section 5.28, “Port Integration Module (S12IPIMV1)". 4 TEST MCU Test This input only pin is reserved for test. This pin has a pull-down device. The TEST pin must be tied to EVSS in user mode. 5 PA5 MCU PA5 General purpose port A input or output pin 5. See Section 5.28, “Port Integration Module (S12IPIMV1)" 6 PA4 MCU PA4 General purpose port A input or output pin 4. See Section 5.28, “Port Integration Module (S12IPIMV1)". 7 PA3 MCU PA3 / SS 8 PA2 MCU PA2 / SCK General purpose port A input or output pin 2, shared with the SCLK signal of the integrated SPI Interface. See Section 5.28, “Port Integration Module (S12IPIMV1)". 9 PA1 MCU PA1 / MOSI General purpose port A input or output pin 1, shared with the MOSI signal of the integrated SPI Interface. See Section 5.28, “Port Integration Module (S12IPIMV1)". 10 PA0 MCU PA0 / MISO General-purpose port A input or output pin 0, shared with the MISO signal of the integrated SPI Interface. See Section 5.28, “Port Integration Module (S12IPIMV1)". 11 VSSRX MCU 5.0 V Ground Ground for the MCU 5.0 V power supply. 12 VDDRX MCU 5.0 V Supply MCU 5.0 V - Core- and Flash Voltage Regulator supply. See Section 5.27, “MM912_634 - MCU Die Overview". 13 VSSD2D MCU 2.5 V Ground Ground for the MCU 2.5 V power supply. 14 VDDD2D MCU 2.5 V Supply MCU 2.5 V - MCU Die-to-Die Interface power supply. See Section 5.27, “MM912_634 - MCU Die Overview". 15 VDD Voltage Regulator Output 2.5 V +2.5 V main voltage regulator output pin. External capacitor (CVDD) needed. See Section 5.5, “Power Supply". 16 VDDX Voltage Regulator Output 5.0 V +5.0 V main voltage regulator output pin. External capacitor (CVDDX) needed. See Section 5.5, “Power Supply". 17 DGND Digital Ground This pin is the device digital ground connection for the 5.0 V and 2.5V logic. DGND, LGND, and AGND are internally connected to PGND via a back to back diode. Voltage Sense Battery voltage sense input. This pin can be connected directly to the battery line for voltage measurements. The voltage present at this input is scaled down by an internal voltage divider, and can be routed to the internal ADC via the analog multiplexer.The pin is self-protected against reverse battery connections. An external resistor (RVSENXSE) is needed for protection (6). See Section 5.23, “Supply Voltage Sense - VSENSE". Note: This pin function is not available on all device configurations. 18 VSENSE General purpose port A input or output pin 3, shared with the SS signal of the integrated SPI Interface. See Section 5.28, “Port Integration Module (S12IPIMV1)". Note: 6. An optional filter capacitor CVSENSE is recommended to be placed between the board connector and DVSENSE to GND for increased ESD performance. MM912_634 6 Analog Integrated Circuit Device Data Freescale Semiconductor Table 3. MM912_634 Pin Description (continued) Pin # Pin Name Formal Name Description 19 VS1 Power Supply Pin 1 This pin is the device power supply pin 1. VS1 is primarily supplying the VDDX Voltage regulator and the Hall Sensor Supply Regulator (HSUP). VS1 can be sensed via a voltage divider through the AD converter. Reverse battery protection diode is required. See Section 5.5, “Power Supply". 20 VS2 Power Supply Pin 2 This pin is the device power supply pin 2. VS2 supplies the High-side Drivers (HSx). Reverse battery protection diode required. See Section 5.5, “Power Supply". 21 HS1 High-side Output 1 This pin is the first High-side output. It is supplied through the VS2 pin. It is designed to drive small resistive loads with optional PWM. In cyclic sense mode, this output activates periodically during low power mode. See Section 5.12, “High-side Drivers - HS". High-side Output 2 This pin is the second High-side output. It is supplied through the VS2 pin. It is designed to drive small resistive loads with optional PWM. In cyclic sense mode, this output activates periodically during low power mode. See Section 5.12, “High-side Drivers - HS". Note: This pin function is not available on all device configurations. 22 HS2 23 HSUP 24 LIN LIN Bus I/O 25 LGND LIN Ground Pin 26 27 PTB0 PTB1 This pin is designed as an 18 V Regulator to drive Hall Sensor Elements. It is supplied through Hall Sensor Supply Output the VS1 pin. An external capacitor (CHSUP) is needed. See Section 5.11, “Hall Sensor Supply Output - HSUP". Note: This pin function is not available on all device configurations. This pin represents the single-wire bus transmitter and receiver. See Section 5.15, “LIN Physical Layer Interface - LIN". Note: This pin function is not available on all device configurations. This pin is the device LIN Ground connection. DGND, LGND, and AGND are internally connected to PGND via a back to back diode. General Purpose I/O 0 This is the General Purpose I/O pin 0 based on VDDX with the following shared functions: • PTB0 - Bidirectional 5.0 V (VDDX) digital port I/O with selectable internal pull-up resistor. • AD0 - Analog Input Channel 0, 0…2.5V (ADC2p5) analog input • TIM0CH0 - Timer Channel 0 Input/Output • Rx - Selectable connection to LIN / SCI See Section 5.18, “General Purpose I/O - PTB[0…2]". General Purpose I/O 1 This is the General Purpose I/O pin 1 based on VDDX with the following shared functions: • PTB1 - Bidirectional 5.0 V (VDDX) digital port I/O with selectable internal pull-up resistor. • AD1 - Analog Input Channel 1, 0…2.5 V (ADC2p5) analog input • TIM0CH1 - Timer Channel 1 Input/Output • Tx - Selectable connection to LIN / SCI See Section 5.18, “General Purpose I/O - PTB[0…2]". 28 PTB2 General Purpose I/O 2 This is the General Purpose I/O pin 2 based on VDDX with the following shared functions: • PTB2 - Bidirectional 5.0 V (VDDX) digital port I/O with selectable internal pull-up resistor. • AD2 - Analog Input Channel 2, 0…2.5V (ADC2p5) analog input • TIM0CH2 - Timer Channel 2 Input/Output • PWM - Selectable connection to PWM Channel 0 or 1 See Section 5.18, “General Purpose I/O - PTB[0…2]". 29 ADC2p5 ADC Reference Voltage This pin represents the ADC reference voltage and has to be connected to a filter capacitor. See Section 5.20, “Analog Digital Converter - ADC". 30 AGND Analog Ground Pin This pin is the device Analog to Digital converter ground connection. DGND, LGND and AGND are internally connected to PGND via a back to back diode. High Voltage Input 0 This pins is the High Voltage Input 0 with the following shared functions: • L0 - Digital High Voltage Input 0. When used as digital input, a series resistor (RLX) must be used to protect against automotive transients.(7) • AD3 - Analog Input 3 with selectable divider for 0…5.0 V and 0…18 V measurement range. • WU0 - Selectable Wake-up input 0 for wake up and cyclic sense during low power mode. See Section 5.17, “High Voltage Inputs - Lx". 31 L0 Note: 7. An optional filter capacitor CLX is recommended to be placed between the board connector and RLX to GND for increased ESD performance. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 7 Table 3. MM912_634 Pin Description (continued) Pin # Pin Name 32 L1 33 L2 34 L3 35 L4 Formal Name Description High Voltage Input 1 This pins is the High Voltage Input 1 with the following shared functions: • L1 - Digital High Voltage Input 1. When used as digital input, a series resistor (RLX) must be used to protect against automotive transients.(8) • AD4 - Analog Input 4 with selectable divider for 0…5.0 V and 0…18 V measurement range. • WU1 - Selectable Wake-up input 1 for wake-up and cyclic sense during low power mode. See Section 5.17, “High Voltage Inputs - Lx". High Voltage Input 2 This pins is the High Voltage Input 2 with the following shared functions: • L2 - Digital High Voltage Input 2. When used as digital input, a series resistor (RLX) must be used to protect against automotive transients.(8) • AD5 - Analog Input 5 with selectable divider for 0…5.0 V and 0…18 V measurement range. • WU2 - Selectable Wake-up input 2 for wake-up and cyclic sense during low power mode. See Section 5.17, “High Voltage Inputs - Lx". Note: This pin function is not available on all device configurations. High Voltage Input 3 This pins is the High Voltage Input 3 with the following shared functions: • L3 - Digital High Voltage Input 3. When used as digital input, a series resistor (RLX) must be used to protect against automotive transients.(8) • AD6 - Analog Input 6 with selectable divider for 0…5.0 V and 0…18 V measurement range. • WU3 - Selectable Wake-up input 3 for wake-up and cyclic sense during low power mode. See Section 5.17, “High Voltage Inputs - Lx". Note: This pin function is not available on all device configurations. High Voltage Input 4 This pins is the High Voltage Input 4 with the following shared functions: • L4 - Digital High Voltage Input 4. When used as digital input, a series resistor (RLX) must be used to protect against automotive transients.(8) • AD7 - Analog Input 7 with selectable divider for 0…5.0 V and 0…18 V measurement range. • WU4 - Selectable Wake-up input 4 for wake-up and cyclic sense during low power mode. See Section 5.17, “High Voltage Inputs - Lx". Note: This pin function is not available on all device configurations. This pins is the High Voltage Input 5 with the following shared functions: • L5 - Digital High Voltage Input 5. When used as digital input, a series resistor (RLX) must be used to protect against automotive transients.(8) • AD8 - Analog Input 8 with selectable divider for 0…5.0 V and 0…18 V measurement range. • WU5 - Selectable Wake-up input 5 for wake-up and cyclic sense during low power mode. See Section 5.17, “High Voltage Inputs - Lx". Note: This pin function is not available on all device configurations. 36 L5 High Voltage Input 5 37 LS1 Low-side Output 1 Low-side output 1 used to drive small inductive loads like relays. The output is short-circuit protected, includes active clamp circuitry and can be also controlled by the PWM module. See Section 5.17, “High Voltage Inputs - Lx" 38 PGND Power Ground Pin This pin is the device Low-side Ground connection. DGND, LGND and AGND are internally connected to PGND via a back to back diode. 39 LS2 Low-side Output 2 Low-side output 2 used to drive small inductive loads like relays. The output is short-circuit protected, includes active clamp circuitry and can be also controlled by the PWM module. See Section 5.17, “High Voltage Inputs - Lx". 40 ISENSEL Current Sense Pin L Current Sense differential input “Low”. This pin is used in combination with ISENSEH to measure the voltage drop across a shunt resistor. See Section 5.21, “Current Sense Module - ISENSE". Note: This pin function is not available on all device configurations. 41 ISENSEH Current Sense Pin H Current Sense differential input “High”. This pin is used in combination with ISENSEL to measure the voltage drop across a shunt resistor. See Section 5.21, “Current Sense Module ISENSE". Note: This pin function is not available on all device configurations. 42 NC Not connected 43 TEST_A Test Mode This pin is reserved for alternative function and should be left floating. Analog die Test Mode pin for Test Mode only. This pin must be grounded in user mode. Note: 8. An optional filter capacitor CLX is recommended to be placed between the board connector and RLX to GND for increased ESD performance. MM912_634 8 Analog Integrated Circuit Device Data Freescale Semiconductor Table 3. MM912_634 Pin Description (continued) Pin # Pin Name Formal Name Description 44 TCLK Test Clock Input Test Mode Clock Input pin for Test Mode only. The pin can be used to disable the internal watchdog for development purpose in user mode. See Section 5.10, “Window Watchdog". The pin is recommended to be grounded in user mode. 45 RESET_A Reset I/O Bidirectional Reset I/O pin of the analog die. Active low signal. Internal pull-up. VDDX based. See Section 5.8, “Resets". To be externally connected to the RESET pin. 46 RESET MCU Reset The RESET pin is an active low bidirectional control signal. It acts as an input to initialize the MCU to a known start-up state, and an output when an internal MCU function causes a reset. The RESET pin has an internal pull-up device to VDDRX. 47 BKGD MCU Background Debug and Mode The BKGD/MODC pin is used as a pseudo-open-drain pin for the background debug communication. It is used as MCU operating mode select pin during reset. The state of this pin is latched to the MODC bit at the rising edge of RESET. The BKGD pin has a pull-up device. 48 PA7 MCU PA7 3.2 General purpose port A input or output pin 7. See Section 5.28, “Port Integration Module (S12IPIMV1)" MCU Die Signal Properties This section describes the external MCU signals. It includes a table of signal properties. Table 4. Signal Properties Summary Internal Pull Resistor Pin Name Function 1 Pin Name Function 2 Power Supply PE0 EXTAL PE1 Description CTRL Reset State VDDRX PUPEE/ OSCPINS_EN DOWN Port E I/O, Oscillator pin XTAL VDDRX PUPBE/ OSCPINS_EN DOWN Port E I/O, Oscillator pin RESET — VDDRX TEST — N.A. RESET pin DOWN Test input BKGD MODC VDDRX BKPUE UP Background debug PA7 — VDDRX NA NA Port A I/O PA6 — VDDRX NA NA Port A I/O PA5 — VDDRX NA NA Port A I/O PA4 — VDDRX NA NA Port A I/O PA3 SS VDDRX NA NA Port A I/O, SPI PA2 SCK VDDRX NA NA Port A I/O, SPI PA1 MOSI VDDRX NA NA Port A I/O, SPI PA0 MISO VDDRX NA NA Port A I/O, SPI PULLUP External reset MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 9 4 Electrical Characteristics 4.1 General This section contains electrical information for the embedded 9S12I64 microcontroller die, as well as the 912_634 analog die. 4.2 Absolute Maximum Ratings Absolute maximum ratings are stress ratings only. A functional operation under or outside those maxima is not guaranteed. Stress beyond those limits may affect the reliability or cause permanent damage of the device. This device contains circuitry protecting against damage due to high static voltage or electrical fields. However, it is advised normal precautions be taken to avoid application of any voltages higher than maximum rated voltages to this high-impedance circuit. Reliability of operation is enhanced if unused inputs are tied to an appropriate voltage level. All voltages are with respect to ground, unless otherwise noted. Table 5. Absolute Maximum Electrical Ratings - Analog Die Symbol Ratings Value Unit -0.3 to 27 -0.3 to 40 V VSUP(SS) VSUP(PK) VSUP(TR) Supply Voltage at VS1 and VS2 Normal operation (DC) Transient conditions (load dump) Transient input voltage with external component (according to LIN Conformance Test Specification / ISO7637-2) VLxDC VLxTR L0…L5 - Pin Voltage Normal operation with a series RLX resistor (DC) Transient input voltage with external component (according to LIN Conformance Test Specification / ISO7637-2) VBUSDC VBUSTR LIN Pin Voltage Normal operation (DC) Transient input voltage with external component (according to LIN Conformance Test Specification / ISO7637-2) -33 to 40 V VDDX Supply Voltage at VDDX -0.3 to 5.5 V VDD Supply Voltage at VDD (10) -0.3 to 2.75 V IVDD VDD Output Current Internally Limited A IVDDX VDDX Output Current Internally Limited A VTCLK TCLK Pin Voltage -0.3 to 10 V (9) 27 to 40 V (9) (9) VIN RESET_A Pin Voltage -0.3 to VDDx+0.3 V VIN Input / Output Pins PTB[0:2] Voltage -0.3 to VDDx+0.3 V VHS HS1 and HS2 Pin Voltage (DC) - 0.3 to VS2+0.3 V VLS LS1 and LS2 Pin Voltage (DC) -0.3 to 45 V ISENSEH and ISENSEL Pin Voltage (DC) -0.3 to 40 V -0.3 to VS1+0.3 V -27 to 40 V VISENSE VHSUP VVSENSE HSUP Pin Voltage (DC) VSENSE Pin Voltage (DC) Note: 9. See Section 4.9, “Additional Test Information ISO7637-2" 10. Caution: As this pin is adjacent to the VDDX pin, care should be taken to avoid a short between VDD and VDDX, for example during soldering process. A short-circuit between these pins might lead to permanent damage. MM912_634 10 Analog Integrated Circuit Device Data Freescale Semiconductor Table 6. Maximum Electrical Ratings - MCU Die(11) Symbol Ratings Value Unit VDDRX 5.0 V Supply Voltage (Supplying the MCU internal regulator for core and flash) -0.3 to 6.0 V VDDD2D 2.5 V D2D - Supply Voltage -0.3 to 3.6 V VIN Digital I/O input voltage (PA0...PA7, PE0, PE1) -0.3 to 6.0 V VILV EXTAL, XTAL (PE0 and PE1 in alternative configuration) -0.3 to 2.16 V TEST Input -0.3 to 10.0 V VTEST ID Instantaneous Maximum Current Single pin limit for all digital I/O pins -25 to 25 mA I Instantaneous Maximum Current Single pin limit for EXTAL, XTAL -25 to 25 mA Value Unit -55 to 150 C DL Note: 11. All digital I/O pins are internally clamped to VSSRX and VDDRX. Table 7. Maximum Thermal Ratings Symbol TSTG Ratings Storage Temperature Package, Thermal Resistance - LQFP48-EP Four layer board (JEDEC 2s2p) RJA RJB RJA Junction to Ambient Natural Convection (12) Junction to Board (14) Two layer board (JEDEC 1s) Junction to Ambient Natural Convection (12), (13) °C/W 38 16 91 Package, Thermal Resistance - LQFP48 Four layer board (JEDEC 2s2p) RJA RJB RJA TPPRT Junction to Ambient Natural Convection (12) Junction to Board (14) Two layer board (JEDEC 1s) Junction to Ambient Natural Convection (12), (13) Peak Package Reflow Temperature During Reflow(15), (16) °C/W 59 31 96 Note 16 °C Notes 12. Junction temperature is a function of die size, on-chip power dissipation, package thermal resistance, mounting site (board) temperature, ambient temperature, air flow, power dissipation of other components on the board, and board thermal resistance. 13. Per JEDEC JESD51-6 with the board (JESD51-7) horizontal. 14. Thermal resistance between the die and the printed circuit board per JEDEC JESD51-8. Board temperature is measured on the top surface of the board near the package. 15. Pin soldering temperature limit is for 10 seconds maximum duration. Not designed for immersion soldering. Exceeding these limits may cause malfunction or permanent damage to the device. 16. Freescale’s Package Reflow capability meets Pb-free requirements for JEDEC standard J-STD-020C. For Peak Package Reflow Temperature and Moisture Sensitivity Levels (MSL), Go to www.freescale.com, search by part number [e.g. remove prefixes/suffixes and enter the core ID to view all orderable parts (i.e. MC33xxxD enter 33xxx), and review parametrics. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 11 4.3 Operating Conditions This section describes the operating conditions of the device. Unless otherwise noted those conditions apply to all the following data. Table 8. Operating Conditions Symbol Value Unit Analog Die Nominal Operating Voltage 5.5 to 18 V VSUPOP Analog Die Functional Operating Voltage - Device is fully functional. All features are operating. 5.5 to 27 V VDDRX MCU I/O and Supply Voltage(17) 4.75 to 5.25 V VDDD2D MCU Digital Logic Supply Voltage(17) 2.25 to 2.75 V 4.0 to 16 4.0 to 16 MHz fBUSMAX(18) MHz Operating Ambient Temperature MM912x634xMxxx MM912x634xVxxx -40 to 125 -40 to 105 C TJ_A Operating Junction Temperature - Analog Die -40 to 150 C TJ_M Operating Junction Temperature - MCU Die -40 to 150 C VSUP Ratings fOSC MCU Oscillator MM912x634xxxAE MM912x634xxxAP fBUS MCU Bus frequency MM912x634xxxAE MM912x634xxxAP TA Note: 17. During power up and power down sequence always VDDD2D < VDDRX 18. fBUSMAX frequency ratings differ by device and is specified in Table 1 MM912_634 12 Analog Integrated Circuit Device Data Freescale Semiconductor 4.4 Supply Currents This section describes the current consumption characteristics of the device as well as the conditions for the measurements. 4.4.1 Measurement Conditions All measurements are without output loads. Currents are measured in MCU special single chip mode and the CPU code is executed from RAM, unless otherwise noted. Table 9. Supply Currents Symbol Ratings Min Typ(19) Max Unit IRUN_A Normal Mode analog die only, excluding external loads, LIN Recessive State (5.5 V  VSUP  18 V, 2.25 V  VDD  2.75 V, 4.5 V  VDDX  5.5 V, -40 °C  TJ_A  150 °C). - 5.0 8.0 mA IRUN_M Normal Mode MCU die only (TJ_M=150 °C; VDDD2D = 2.75 V, VDDRX = 5.5 V, fOSC = 4.0 MHz, fBUS= fBUSMAX(20)(21) - 18 20 mA ISTOP_A Stop Mode internal analog die only, excluding external loads, LIN Recessive State, Lx enabled, measured at VS1+VS2 (5.5 V  VSUP  18 V, 2.25 V  VDD  2.75 V, 4.5 V  VDDX  5.5 V) -40 °C  TJ_A  125 °C ISTOP_M - 20 40 - 85 31 31 150 50 50 µA Sleep Mode (VDD = VDDX = OFF; 5.5 V  VSUP  18 V; -40 °C  TJ_A  125 °C; 3.0 V  Lx  1.0 V) - 15 28 µA Cyclic Sense Supply Current Adder (5.0 ms Cycle) - 15 20 µA Stop Mode MCU die only (VDDD2D = 2.75 V, VDDRX = 5.5 V, fOSC= 4.0 MHz;  MCU in STOP; RTI and COP off)(22) TJ_M=150°C TJ_M=-40°C TJ_M=25°C ISLEEP ICS Note: 19. 20. 21. 22. µA Typical values noted reflect the approximate parameter mean at TA = 25 °C fBUSMAX frequency ratings differ by device and is specified in Table 1 IRUN_M denotes the sum of the currents flowing into VDD and VDDX. ISTOP_M denotes the sum of the currents flowing into VDD and VDDX. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 13 4.5 Static Electrical Characteristics All characteristics noted under the following conditions: • 5.5 V  VSUP  18 V • -40 °C  TA  125 °C (MM912x634xMxxx) • -40 °C  TA  105 °C (MM912x634xVxxx) Typical values noted reflect the approximate parameter mean at TA = 25 °C under nominal conditions, unless otherwise noted. 4.5.1 Static Electrical Characteristics Analog Die Table 10. Static Electrical Characteristics - Power Supply Symbol Ratings Min Typ Max Unit VPOR Power-On Reset (POR) Threshold (measured on VS1) 1.5 - 3.5 V VLVI VLVI_H Low Voltage Warning (LVI) Threshold (measured on VS1, falling edge) Hysteresis (measured on VS1) 5.55 - 6.0 1.0 6.6 - V VHVI VHVI_H High Voltage Warning (HVI) Threshold (measured on VS2, rising edge) Hysteresis (measured on VS2) 18 - 19.25 1.0 20.5 - V VLBI VLBI_H Low Battery Warning (LBI) Threshold (measured on VSENSE, falling edge) Hysteresis (measured on VSENSE) 5.55 - 6.0 1.0 6.6 - V J2602 Undervoltage threshold 5.5 5.7 6.2 V VLVRX Low VDDX Voltage (LVRX) Threshold 2.7 3.0 3.3 V VLVR Low VDD Voltage Reset (LVR) Threshold Normal Mode 2.30 2.35 2.4 V 1.6 1.85 2.1 V VJ2602UV VLVRS Low VDD Voltage Reset (LVR) Threshold Stop Mode (23) VVDDOV VDD Overvoltage Threshold (VROV) 2.575 2.7875 3.0 V VVDDXOV VDDX Overvoltage Threshold (VROVX) 5.25 5.675 6.1 V Min Typ Max Unit - - 0.8 V 25 - 50 k Note: 23. See MM912_634ER - MM912_634, Silicon Analog Mask (M91W) / Digital Mask (N53A) Errata Table 11. Static Electrical Characteristics - Resets Symbol VOL RRPU Ratings Low-state Output Voltage IOUT = 2.0 mA Pull-up Resistor VIL Low-state Input Voltage - - 0.3VDDX V VIH High-state Input Voltage 0.7VDDX - - V Reset Release Voltage (VDDX) - 1.5 - V RESET_A pin Current Limitation 5.0 7.5 10 mA Min Typ Max Unit VRSTRV Table 12. Static Electrical Characteristics - Window Watchdog Symbol Ratings VTST Watchdog Disable Voltage (fixed voltage) 7.0 - 10 V VTSTEN Watchdog Enable Voltage (fixed voltage) - - 5.5 V MM912_634 14 Analog Integrated Circuit Device Data Freescale Semiconductor Table 13. Static Electrical Characteristics - Voltage Regulator 5.0 V (VDDX) Symbol VDDXRUN Ratings Min Typ Max 4.75 5.00 5.25 80 130 200 mA - 5.0 5.5 V 1.0 - 20 mA - 20 - 25 200 mV - 15 - 80 200 250 1.0 - 10 µF - - 10  Min Typ Max Unit 2,425 2.5 2,575 - 80 80 120 143 mA 2.25 2.5 2.75 V Stop Mode Output Current Limitation (IVDD) - - 10 mA Line Regulation Normal Mode, IVDD = 45 mA Stop Mode, IVDD = 1.0 mA - 10 - 12.5 200 mV - 7.5 - 40 40 200 1.0 - 10 µF - - 10  Normal Mode Output Voltage 1.0 mA < IVDDX + IVDDXINTERNAL < 80 mA; 5.5 V < VSUP < 27 V (24) IVDDXRUN Normal Mode Output Current Limitation (IVDDX) VDDXSTOP Stop Mode Output Voltage (IVDDX + IVDDXINTERNAL < 500 μA for TJ ≥ 25 °C; IVDDX + IVDDXINTERNAL < 400 μA for TJ < 25 °C) (24) IVDDXSTOP Stop Mode Output Current Limitation (IVDDX) LRXRUN LRXSTOP LDXRUN LDXCRK LDXSTOP CVDDX CVDDX_R Line Regulation Normal Mode, IVDDX = 80 mA Stop Mode, IVDDX = 500 µA Load Regulation Normal Mode, 1.0 mA < IVDDX < 80 mA Normal Mode, VSUP = 3.6 V, 1.0 mA < IVDDX < 40 mA Stop Mode, 0.1 mA < IVDDX < 500 µA External Capacitor External Capacitor ESR Unit V mV Note: 24. IVDDXINTERNAL includes internal consumption from both analog and MCU die. Table 14. Static Electrical Characteristics - Voltage Regulator 2.5 V (VDD) Symbol VDDRUN IVDDLIMRUN VDDSTOP IVDDLIMSTOP LRRUN LRSTOP LDRUN LDCRK LDSTOP CVDD CVDD_R Ratings Normal Mode Output Voltage 1.0 mA < IVDD + IVDDINTERNAL  45 mA; 5.5 V < VSUP < 27 V (25) Normal Mode Output Current Limitation (IVDD) TJ < 25 °C TJ  25 °C Stop Mode Output Voltage (IVDD + IVDDINTERNAL < 500 μA for TJ  25 °C; IVDD + IVDDINTERNAL < 400 μA for TJ < 25 °C) (25) Load Regulation Normal Mode, 1.0 mA < IVDD < 45 mA Normal Mode, VSUP = 3.6 V, 1.0 mA < IVDD < 30 mA Stop Mode, 0.1 mA < IVDD < 1.0 mA External Capacitor External Capacitor ESR V mV Note: 25. IVDDINTERNAL includes internal consumption from both analog and MCU die. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 15 Table 15. Static Electrical Characteristics - Hall Sensor Supply Output - HSUP Symbol IHSUP RDS(ON) Ratings Current Limitation Output Drain-to-Source On resistance TJ = 150 °C, ILOAD = 30 mA; 5.5 V  VSUP  16 V TJ = 150 °C, ILOAD = 30 mA; 3.7 V  VSUP < 5.5 V VHSUPMAX Output Voltage: (18 V  VSUP  27 V) LDHSUP Load Regulation (1.0 mA < IHSUP < 30 mA; VSUP > 18 V) CHSUP Hall Supply Capacitor Range CHSUP_R External Capacitor ESR Min Typ Max Unit 40 70 90 mA - - 10 13  16 17.5 18 V - - 500 mV 0.22 - 10 µF - - 10  Min Typ Max Unit - - 7.0 10 14 60 110 250 mA Table 16. Static Electrical Characteristics - High-side Drivers - HS Symbol RDS(on) Ratings Output Drain-to-Source On resistance TJ = 25 °C, ILOAD = 50 mA; VSUP > 9.0 V TJ = 150 °C, ILOAD = 50 mA; VSUP > 9.0 V TJ = 150 °C, ILOAD = 30 mA; 5.5 V < VSUP < 9.0 V  ILIMHSX Output Current Limitation (0 V < VOUT < VSUP - 2.0 V) IOLHSX Open Load Current Detection - 5.0 7.5 mA ILEAK Leakage Current (-0.2 V < VHSx < VS2 + 0.2 V) - - 10 µA VTHSC Current Limitation Flag Threshold (5.5 V < VSUP < 27 V) VSUP -2 - - V Min Typ Max Unit – – – – – – 2.5 4.5 10 180 275 380 mA Table 17. Static Electrical Characteristics - Low-side Drivers - LS Symbol RDS(on) Ratings Output Drain-to-Source On resistance TJ = 25 °C, ILOAD = 150 mA, VSUP > 9.0 V TJ = 150 °C, ILOAD = 150 mA, VSUP > 9.0 V TJ = 150 °C, ILOAD = 120 mA, 5.5 V < VSUP < 9.0 V  ILIMLSX Output Current Limitation (2.0 V < VOUT < VSUP) IOLLSX Open Load Current Detection - 8.0 12 mA ILEAK Leakage Current (-0.2 V < VOUT < VS1) - - 10 µA Active Output Energy Clamp (IOUT = 150 mA) 40 - 45 V RCOIL Coil Series Resistance (IOUT = 150 mA) 120 - RCOIL Coil Inductance (IOUT = 150 mA) - - 400 m VTHSC Current Limitation Flag Threshold (5.5 V < VSUP < 27 V) 2.0 - - V VCLAMP  MM912_634 16 Analog Integrated Circuit Device Data Freescale Semiconductor Table 18. Static Electrical Characteristics - LIN Physical Layer Interface - LIN Symbol IBUSLIM Ratings Current Limitation for Driver dominant state. VBUS = 18 V Min Typ Max Unit 40 120 200 mA IBUS_PAS_DOM Input Leakage Current at the Receiver incl. Pull-up Resistor RSLAVE; Driver OFF; VBUS = 0 V; VBAT = 12 V -1.0 - - mA IBUS_PAS_REC Input Leakage Current at the Receiver incl. Pull-up Resistor RSLAVE; Driver OFF; 8.0 V < VBAT < 18 V; 8.0 V < VBUS < 18 V; VBUS  VBAT - - 20 µA IBUS_NO_GND Input Leakage Current; GND Disconnected; GNDDEVICE = VSUP; 0 < VBUS < 18 V; VBAT = 12 V -1.0 - 1.0 mA IBUS_NO_BAT Input Leakage Current; VBAT disconnected; VSUP_DEVICE = GND; 0 < VBUS < 18 V - - 100 µA VBUSDOM Receiver Input Voltage; Receiver Dominant State - - 0.4 VSUP VBUSREC Receiver Input Voltage; Receiver Recessive State 0.6 - - VSUP VBUS_CNT Receiver Threshold Center (VTH_DOM + VTH_REC)/2 0.475 0.5 0.525 VSUP VBUS_HYS Receiver Threshold Hysteresis (VTH_REC - VTH_DOM) - - 0.175 VSUP DSER_INT Voltage Drop at the serial Diode 0.4 0.7 1.0 V LIN Pull-up Resistor 20 30 60 k VWUP Bus Wake-up Threshold from Stop or Sleep 4.0 5.0 6.0 V VDOM Bus Dominant Voltage - - 2.5 V Min Typ Max Unit 2.2 1.5 2.5 2.5 3.4 4.0 (5.5 V  VSUP  7.0 V) 2.6 2.0 3.0 3.0 3.7 4.5 Hysteresis (5.5 V < VSUP < 27 V) 0.25 0.45 1.0 Input Current Lx (-0.2 V < VIN < VS1) -10 - 10 µA - - 1.2 M 9.5 10 10.5 k nF RSLAVE Table 19. Static Electrical Characteristics - High Voltage Inputs - Lx Symbol VTHL Ratings Low Detection Threshold (7.0 V  VSUP  27 V) (5.5 V  VSUP  7.0 V) VTHH VHYS IIN RLxIN High Detection Threshold (7.0 V  VSUP  27 V) Analog Input Impedance Lx V V V RLX Lx Series Resistor CLX Lx Capacitor (optional)(26) - 100 - RATIOLx Analog Input Divider Ratio (RATIOLx = VLx / VADOUT0) LXDS (Lx Divider Select) = 0 LXDS (Lx Divider Select) = 1 - 2.0 7.2 - RATIOLX Analog Input Divider Ratio Accuracy -5.5 - 5.5 % MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 17 Table 19. Static Electrical Characteristics - High Voltage Inputs - Lx Symbol LxMATCH Ratings Analog Inputs Channel Ratio - Mismatch LXDS (Lx Divider Select) = 0 LXDS (Lx Divider Select) = 1 Min Typ Max Unit - - 5.0 5.0 % Note: 26. The ESD behavior specified in Section 4.8, “ESD Protection and Latch-up Immunity" are guaranteed without the optional capacitor. Table 20. Static Electrical Characteristics - General Purpose I/O - PTB[0…2] Symbol Ratings Min Typ Max Unit VIH Input High Voltage 0.7VDDX - VDDX+0.3 V VIL Input Low Voltage VSS-0.3 - 0.35VDDX V - 140 - mV VHYS Input Hysteresis VIH3.7 Input High Voltage (VS1 = 3.7 V) 2.1 - VDDX+0.3 V VIL3.7 Input Low Voltage (VS1 = 3.7 V) VSS-0.3 - 1.4 V Input Hysteresis (VS1 = 3.7 V) 100 200 300 mV Input Leakage Current (pins in high-impedance input mode) (VIN = VDDX or VSSX) -1.0 - 1.0 µA VDDX-0.8 - - V - - 0.8 V 26.25 37.5 48.75 k - 6.0 - pF VDD - - V VHYS3.7 IIN VOH Output High Voltage (pins in output mode) Full drive IOH = -10 mA VOL Output Low Voltage (pins in output mode) Full drive IOL = 10 mA RPUL Internal Pull-up Resistance (VIH min > Input voltage > VIL max) CIN VCL_AIN Input Capacitance Clamp Voltage when selected as analog input RAIN Analog Input impedance = 10 k max, Capacitance = 12 pF - - 10 k CAIN Analog Input Capacitance = 12 pF - 12 - pF IBMAX Maximum current all PTB combined (VDDX capability) -15 - 15 mA COUT Output Drive strength at 10 MHz - - 100 pF Min Typ Max Unit 2,45 2.5 2.55 V Table 21. Static Electrical Characteristics - Analog Digital Converter - ADC(27) Symbol Ratings VADC2p5RUN ADC2p5 Reference Voltage, 5.5 V < VSUP < 27 V VADC2p5STOP ADC2p5 Reference Stop Mode Output Voltage - - 100 mV LRRUNA Line Regulation, Normal Mode - 10 12.5 mV CADC2p5 External Capacitor 0.1 - 1.0 µF CVDD_R External Capacitor ESR - - 10  ESCALE Scale Factor Error -1 - 1 LSB EDNL Differential Linearity Error -1.5 - 1.5 LSB EINL Integral Linearity Error -1.5 - 1.5 LSB EOFF Zero Offset Error -2.0 - 2.0 LSB Quantization Error -0.5 - 0.5 LSB EQ MM912_634 18 Analog Integrated Circuit Device Data Freescale Semiconductor Table 21. Static Electrical Characteristics - Analog Digital Converter - ADC(27) Symbol TE ADCH14 Ratings Min Typ Max Unit Total Error with offset compensation -5.0 - 5.0 LSB Bandgap measurement Channel (CH14) Valid Result Range (including ±7.0% bg1p25sleep accuracy + high-impedance measurement error of ±5.0% at fADC)(28) 1.1 1.25 1.4 V Min Typ Max Unit - 7 9 10 12 14 18 24 36 - Gain Accuracy -3.0 - 3.0 % Offset -1.5 - 1.5 % - 51 - mA/LSB -0.2 - 3.0 V - 600 - µA Min Typ Max Unit - 9.17 - mV/k –5.0 - 5.0 °C Note: 27. No external load allowed on the ADC2p5 pin. 28. Reduced ADC frequency lowers measurement error. Table 22. Static Electrical Characteristics - Current Sense Module - ISENSE Symbol G Ratings Gain CSGS (Current Sense Gain Select) = 000 CSGS (Current Sense Gain Select) = 001 CSGS (Current Sense Gain Select) = 010 CSGS (Current Sense Gain Select) = 011 CSGS (Current Sense Gain Select) = 100 CSGS (Current Sense Gain Select) = 101 CSGS (Current Sense Gain Select) = 110 CSGS (Current Sense Gain Select) = 111 RES Resolution(29) VIN ISENSEH, ISENSEL Input Common Mode Voltage Range IISENSE Current Sense Module - Normal Mode Current Consumption Adder  (CSE = 1) Note: 29. RES = 2.44 mV/(GAIN*RSHUNT) Table 23. Static Electrical Characteristics - Temperature Sensor - TSENSE Symbol TSG Ratings Internal Chip Temperature Sense Gain(30) (30) TSERR Internal Chip Temperature Sense Error at the end of conversion T0.15V Temperature represented by a ADCIN Voltage of 0.150 V(30) -55 -50 -45 °C T1.984V (30) 145 150 155 °C Temperature represented by a ADCIN Voltage of 1.984 V Note: 30. Guaranteed by design and characterization. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 19 Table 24. Static Electrical Characteristics - Supply Voltage Sense - VSENSE and VS1SENSE Symbol Ratings RATIOVSENSE ErVSENSE RATIOVS1SENSE ErVS1SENSE Min Typ Max VSENSE Input Divider Ratio (RATIOVSENSE = VVSENSE / ADCIN)  5.5 V < VSUP < 27 V - 10.8 5.0% VSENSE error - whole path (VSENSE pad to Digital value) - - 5.0 VS1SENSE Input Divider Ratio (RATIOVS1SENSE = VVS1SENSE / ADCIN) 5.5 V < VSUP < 27 V - 10.8 5.0% VS1SENSE error - whole path (VS1 pad to Digital value) - - 5.0 % 9.5 10 10.5 k - 100 - nF RVSENSE VSENSE Series Resistor CVSENSE VSENSE Capacitor (optional)(31) Unit % Note: 31. The ESD behavior specified in Section 4.8, “ESD Protection and Latch-up Immunity" is guaranteed without the optional capacitor. 4.5.2 Static Electrical Characteristics MCU Die 4.5.2.1 I/O Characteristics This section describes the characteristics of all I/O pins except EXTAL, XTAL, TEST and supply pins. Table 25. 5.0 V I/O Characteristics for PTA, PTE, RESET and BKGD Pins Symbol Ratings Min Typ Max Unit VIH Input high voltage 0.65 *VDDRX - - V VIH Input high voltage - - VDDRX + 0.3 V VIL Input low voltage - - 0.35*VDDR V VIL Input low voltage VSSRX 0.3 - - V VHYS Input hysteresis - 250 - mV -1.0 - 1.0 A X IN Input leakage current (pins in high-impedance input mode) VIN = VDDRX or VSSRX OH Output high voltage (pins in output mode) IOH = -4.0 mA VDDRX – 0.8 - - V VOL Output low voltage (pins in output mode) IOL = +4.0 mA - - 0.8 V RPUL Internal pull-up resistance (VIHmin > input voltage > VILmax) 25 - 50 k RPDH Internal pull-down resistance (VIHmin > input voltage > VILmax) 25 - 50 k - 6.0 - pF -2.5 -25 - 2.5 25 mA I V Cin Input capacitance IICS IICP Injection current(32) Single pin limit Total device Limit, sum of all injected currents Note: 32. Refer to Section 4.8, “ESD Protection and Latch-up Immunity" for more details. MM912_634 20 Analog Integrated Circuit Device Data Freescale Semiconductor 4.5.2.2 Electrical Specification for MCU internal Voltage Regulator Table 26. IVREG Characteristics Symbol Characteristic VVDDRA VLVIA VLVID Min Typical Max Unit Input Voltages 3.13 — 5.5 V VDDRX Low Voltage Interrupt Assert Level VDDRX Low Voltage Interrupt Deassert Level 4.04 4.19 4.23 4.38 4.40 4.49 V — 3.05 3.13 V 2.95 3.02 — V VLVRXD VDDRX Low Voltage Reset Deassert (33) (34) (35) VLVRXA VDDRX Low Voltage Reset Assert (33) (34) (35) Note: 33. Device functionality is guaranteed on power down to the LVR assert level. 34. Monitors VDDRX, active only in Full Performance mode. MCU is monitored by the POR in RPM (see Figure 4). 35. Monitors VDDRX, active only in Full Performance mode. VLVRA and VPORD. NOTE The LVR monitors the voltages VDD_CORE, VDDFLASH and VDDRX. As soon as voltage drops on these supplies which would prohibit the correct function of the microcontroller, the LVR is triggering a reset. 4.5.2.3 Chip Power-up and Voltage Drops LVI (low voltage interrupt), POR (power-on reset) and LVRs (low voltage reset) handle chip power-up or drops of the supply voltage. V VDDRX VLVID VLVIA VDD_Core VLVRD VLVRA VPORD t LVI LVI enabled POR LVI disabled due to LVR LVR Figure 4. MC9S12I64 - Chip Power-up and Voltage Drops (not scaled) MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 21 4.6 Dynamic Electrical Characteristics Dynamic characteristics noted under conditions 5.5 V  VSUP  18 V, -40 °C  TA 125 °C, unless otherwise noted. Typical values noted reflect the approximate parameter mean at TA = 25 °C under nominal conditions, unless otherwise noted. 4.6.1 Dynamic Electrical Characteristics Analog Die Table 27. Dynamic Electrical Characteristics - Modes of Operation Symbol Ratings Min Typ Max Unit tVTO VDD Short Timeout 110 150 205 ms fBASE Analog Base Clock - 100 - kHz tRST Reset Delay 140 200 280 µs Min Typ Max Unit Table 28. Dynamic Electrical Characteristics - Power Supply(36) Symbol Ratings tLB Glitch Filter Low Battery Warning (LBI) - 2.0 - µs tLV Glitch Filter Low Voltage Warning (LVI) - 2.0 - µs tHV Glitch Filter High Voltage Warning (HVI) - 2.0 - µs Min Typ Max Unit - - fBUSMAX(37) MHz Min Typ Max Unit Note: 36. Guaranteed by design. Table 29. Dynamic Electrical Characteristics - Die to Die Interface - D2D Symbol fD2D Ratings Operating Frequency (D2DCLK, D2D[0:3]) Note: 37. fBUSMAX frequency ratings differ by device and is specified in Table 1 Table 30. Dynamic Electrical Characteristics - Resets Symbol Ratings tRSTDF Reset Deglitch Filter Time 1.2 2.0 3.0 µs tRSTLOW Reset Low Level Duration 140 200 280 µs Min Typ Max Unit - 20 -35 - 35 % -5.0 - 5.0 % Table 31. Dynamic Electrical Characteristics - Wake-up / Cyclic Sense Symbol Ratings tWUF Lx Wake-up Filter Time CSAC Cyclic Sense/Forced Wake-up Timing Accuracy - not trimmed CSACT tS Cyclic Sense/Forced Wake-up Timing Accuracy - trimmed Time Between HSx on and Lx sense during cyclic sense (38) s same as tHSON / tHSONT - tHSON HSx ON Duration During Cyclic Sense 140 200 280 s tHSONT HSx ON Duration During Cyclic Sense - trimmed(38) 180 200 220 s Note: 38. No trimming possible in Sleep mode. MM912_634 22 Analog Integrated Circuit Device Data Freescale Semiconductor Table 32. Dynamic Electrical Characteristics - Window Watchdog Symbol Ratings Min Typ Max Unit tIWDTO Initial Non-window Watchdog Timeout 110 150 190 ms WDAC Watchdog Timeout Accuracy - not trimmed -35 - 35 % WDACT Watchdog Timeout Accuracy - trimmed -5.0 - 5.0 % Min Typ Max Unit - - 50 kHz Min Typ Max Unit - - 50 kHz Min Typ Max Unit 60 80 100 µs Table 33. Dynamic Electrical Characteristics - High-side Drivers - HS Symbol Ratings (39) fHS High-side Operating Frequency Load Condition: CLOAD2.2 nF; RLOAD500  Note: 39. Guaranteed by design. Table 34. Dynamic Electrical Characteristics - Low-side Drivers - LS Symbol fLS Ratings Low-side Operating Frequency (40) Load Condition: CLOAD2.2 nF; RLOAD500  Note: 40. Guaranteed by design. Table 35. Dynamic Electrical Characteristics - LIN Physical Layer Interface - LIN Symbol Ratings tPROPWL Bus Wake-up Deglitcher (Sleep and Stop mode) BRFAST Fast Bit Rate (Programming mode) - - 100 kBit/s tREC_PD Propagation Delay of Receiver, tREC_PD = MAX (tREC_PDR, tREC_PDF) - - 6.0 µs -2.0 - 2.0 µs tREC_SYM Symmetry of Receiver Propagation Delay, tREC_PDF - tREC_PDR LIN Driver - 20.0 kBit/s; Bus load conditions (CBUS; RBUS): 1.0 nF; 1.0 k / 6,8 nF;660  / 10 nF;500 . Measurement thresholds: 50% of TXD signal to LIN signal threshold defined at each parameter. See Figure 5 and Figure 6. D1 Duty Cycle 1: THREC(MAX) = 0.744 x VSUP THDOM(MAX) = 0.581 x VSUP 0.396 - - - - 0.581 7.0 V VSUP18 V; tBit = 50 µs; D1 = tBUS_REC(MIN)/(2 x tBit) D2 Duty Cycle 2: THREC(MIN) = 0.422 x VSUP THDOM(MIN) = 0.284 x VSUP 7.6 V VSUP18 V; tBIT = 50 µs D2 = tBUS_REC(MAX)/(2 x tBIT) LIN Driver - 10.0 kBit/s; Bus load conditions (CBUS; RBUS): 1.0 nF; 1.0 k / 6,8 nF;660  / 10 nF;500  Measurement thresholds: 50% of TXD signal to LIN signal threshold defined at each parameter. See Figure 5 and Figure 7. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 23 Table 35. Dynamic Electrical Characteristics - LIN Physical Layer Interface - LIN Symbol D3 Ratings Duty Cycle 3: THREC(MAX) = 0.778 x VSUP THDOM(MAX) = 0.616 x VSUP Min Typ Max 0.417 - - - - 0.590 -7.25 0 7.25 Unit 7.0 V VSUP18 V; tBIT = 96 µs D3 = TBUS_REC(MIN)/(2 x tBIT) Duty Cycle 4: THREC(MIN) = 0.389 x VSUP D4 THDOM(MIN) = 0.251 x VSUP 7.6 V VSUP18 V; tBIT = 96 µs D4 = tBUS_REC(MAX)/(2 x tBIT) LIN Transmitter Timing, (VSUP from 7.0 to 18 V) - See Figure 9 tTRAN_SYM Transmitter Symmetry tTRAN_SYM < MAX (tTRAN_SYM 60%, tTRAN_SYM40%) tTRAN_SYM60% = tTRAN_PDF60% - tTRAN_PDR60% tTRAN_SYM40% = tTRAN_PDF40% - tTRAN_PDR40% µs Note: R0 and C0 = 1.0 k1.0 nF, 660 /6.8 nF, a, d 500 /10 nF Figure 5. Test Circuit for Timing Measurements Figure 6. LIN Timing Measurements for Normal Baud Rate MM912_634 24 Analog Integrated Circuit Device Data Freescale Semiconductor Figure 7. LIN Timing Measurements for Slow Baud Rate Figure 8. LIN Receiver Timing TX BUS 60% 40% ttran_pdf60% ttran_pdr40% ttran_pdf40% ttran_pdr60% Figure 9. LIN Transmitter Timing MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 25 Table 36. Dynamic Electrical Characteristics - General Purpose I/O - PTB[0…2](41) Symbol Ratings Min Typ Max Unit fPTB GPIO Digital Frequency - - 10 MHz tPDR Propagation Delay - Rising Edge(42) - - 20 ns tRISE Rise Time - Rising Edge(41) - - 17.5 ns tPDF Propagation Delay - Falling Edge(41) - - 20 ns tFALL Rise Time - Falling Edge(41) - - 17.5 ns Min Typ Max Unit 1.6 2.0 2.4 MHz Note: 41. Guaranteed by design. 42. Load PTBx = 100 pF. Table 37. Dynamic Electrical Characteristics - Analog Digital Converter - ADC(43) Symbol fADC Ratings ADC Operating Frequency tCONV Conversion Time (from ACCR write to CC Flag) fCH14 Sample Frequency Channel 14 (Bandgap) 26 - - clk 2.5 kHz Note: 43. Guaranteed by design. 4.6.2 4.6.2.1 4.6.2.1.1 Dynamic Electrical Characteristics MCU Die NVM Timing Parameters The time base for all NVM program or erase operations is derived from the bus clock using the FCLKDIV register. The frequency of this derived clock must be set within the limits specified as fNVMOP. The NVM module does not have any means to monitor the frequency and does not prevent program or erase operations at frequencies above or below the specified minimum. When attempting to program or erase the NVM module at a lower frequency, a full program or erase transition is not assured. The following sections provide equations which can be used to determine the time required to execute specific flash commands. All timing parameters are a function of the bus clock frequency, fNVMBUS. All program and erase times are also a function of the NVM operating frequency, fNVMOP. A summary of key timing parameters can be found in Table 38. 4.6.2.1.1.1 Erase Verify All Blocks (Blank Check) (FCMD=0x01) The time required to perform a blank check on all blocks is dependent on the location of the first non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming no non-blank location is found, then the time to erase verify all blocks is given by: 1 t check = 19200  --------------------f NVMBUS 4.6.2.1.1.2 Erase Verify Block (Blank Check) (FCMD=0x02) The time required to perform a blank check is dependent on the location of the first non-blank word starting at relative address zero. It takes one bus cycle per phrase to verify plus a setup of the command. Assuming no non-blank location is found, then the time to erase verify a P-Flash block is given by: 1 t pcheck = 17200  --------------------f NVMBUS MM912_634 26 Analog Integrated Circuit Device Data Freescale Semiconductor Assuming no non-blank location is found, then the time to erase verify a D-Flash block is given by: 1 t dcheck = 2800  --------------------f NVMBUS 4.6.2.1.1.3 Erase Verify P-Flash Section (FCMD=0x03) The maximum time to erase verify a section of P-Flash depends on the number of phrases being verified (NVP) and is given by: 1 t   450 + N VP   --------------------f NVMBUS 4.6.2.1.1.4 Read Once (FCMD=0x04) The maximum read once time is given by: 1 t = 400  --------------------f NVMBUS 4.6.2.1.1.5 Program P-Flash (FCMD=0x06) The programming time for a single phrase of four P-Flash words and the two seven-bit ECC fields is dependent on the bus frequency, fNVMBUS, as well as on the NVM operating frequency, fNVMOP. The typical phrase programming time is given by: 1 1 t ppgm  164  ------------------ + 2000  --------------------f NVMBUS f NVMOP The maximum phrase programming time is given by: 1 1 t ppgm  164  ------------------ + 2500  --------------------f NVMOP f NVMBUS 4.6.2.1.1.6 Program Once (FCMD=0x07) The maximum time required to program a P-Flash Program Once field is given by: 1 1 t  164  ------------------ + 2150  --------------------f NVMOP f NVMBUS 4.6.2.1.1.7 Erase All Blocks (FCMD=0x08) The time required to erase all blocks is given by: 1 1 t mass  100100  ------------------ + 38000  --------------------f NVMBUS f NVMOP 4.6.2.1.1.8 Erase P-Flash Block (FCMD=0x09) The time required to erase the P-Flash block is given by: 1 1 t pmass  100100  ------------------ + 35000  --------------------f NVMOP f NVMBUS 4.6.2.1.1.9 Erase P-Flash Sector (FCMD=0x0A) The typical time to erase a 512-byte P-Flash sector is given by: 1 1 t pera  20020  ------------------ + 700  --------------------f NVMOP f NVMBUS MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 27 The maximum time to erase a 512-byte P-Flash sector is given by: 1 1 t pera  20020  ------------------ + 1400  --------------------f NVMOP f NVMBUS 4.6.2.1.1.10 Unsecure Flash (FCMD=0x0B) The maximum time required to erase and unsecure the Flash is given by: 1 1 t uns  100100  ------------------ + 38000  --------------------f NVMOP f NVMBUS 4.6.2.1.1.11 Verify Back door Access Key (FCMD=0x0C) The maximum verify back door access key time is given by: 1 t = 400  --------------------f NVMBUS 4.6.2.1.1.12 Set User Margin Level (FCMD=0x0D) The maximum set user margin level time is given by: 1 t = 350  --------------------f NVMBUS 4.6.2.1.1.13 Set Field Margin Level (FCMD=0x0E) The maximum set field margin level time is given by: 1 t = 350  --------------------f NVMBUS 4.6.2.1.1.14 Erase Verify D-Flash Section (FCMD=0x10) The time required to Erase Verify D-Flash for a given number of words NW is given by: 1 t dcheck   450 + N W   --------------------f NVMBUS 4.6.2.1.1.15 Program D-Flash (FCMD=0x11) D-Flash programming time is dependent on the number of words being programmed and their location with respect to a row boundary, since programming across a row boundary requires extra steps. The D-Flash programming time is specified for different cases: 1,2,3,4 words and 4 words across a row boundary. The typical D-Flash programming time is given by the following equation, where NW denotes the number of words; BC=0 if no row boundary is crossed and BC=1 if a row boundary is crossed: 1 1 t dpgm    14 +  54  N W  +  14  BC    ------------------  +   500 +  525  N W  +  100  BC    ---------------------  f NVMOP f NVMBUS The maximum D-Flash programming time is given by: 1 1 t dpgm    14 +  54  N W  +  14  BC    ------------------  +   500 +  750  N W  +  100  BC    ---------------------   f NVMOP   f NVMBUS  4.6.2.1.1.16 Erase D-Flash Sector (FCMD=0x12) Typical D-Flash sector erase times, expected on a new device where no margin verify fails occur, is given by: 1 1 t dera  5025  ------------------ + 700  --------------------f NVMBUS f NVMOP MM912_634 28 Analog Integrated Circuit Device Data Freescale Semiconductor Maximum D-Flash sector erase times is given by: 1 1 t dera  20100  ------------------ + 3400  --------------------f NVMOP f NVMBUS The D-Flash sector erase time is ~5.0 ms on a new device and can extend to ~20 ms as the flash is cycled. Table 38. NVM Timing Characteristics (FTMRC) Symbol Min Typ(44) Max(45) Unit(46) Bus frequency(47) fNVMBUS 1 — 32 MHz Operating frequency fNVMOP 0.8 1.0 1.05 MHz tmass — 100 130 ms tCHECK — — 19200 tCYC tUNS — 100 130 ms C Rating D Erase all blocks (mass erase) time D Erase verify all blocks (blank check) time D Unsecure Flash time D P-Flash block erase time tPMASS — 100 130 ms D P-Flash erase verify (blank check) time tPCHECK — — 17200 tCYC D P-Flash sector erase time tPERA — 20 26 ms D P-Flash phrase programming time tPPGM — 226 285 s 26 ms D D-Flash sector erase time D tDERA — D-Flash erase verify (blank check) time tDCHECK — — 2800 tCYC D D-Flash one word programming time tDPGM1 — 100 107 s D D-Flash two word programming time tDPGM2 — 170 185 s D D-Flash three word programming time tDPGM3 — 241 262 s D D-Flash four word programming time tDPGM4 — 311 339 s D D-Flash four word programming time crossing row boundary tDPGM4C — 328 357 s Note: 44. 45. 46. 47. 48. 5.0 (48) Typical program and erase times are based on typical fNVMOP and maximum fNVMBUS. Maximum program and erase times are based on minimum fNVMOP and maximum fNVMBUS. tCYC = 1 / fNVMBUS The maximum device bus clock is specified as fBUS. Typical value for a new device. 4.6.2.1.2 NVM Reliability Parameters The reliability of the NVM blocks is guaranteed by stress test during qualification, constant process monitors, and burn-in to screen early life failures. The data retention and program/erase cycling failure rates are specified at the operating conditions noted. The program/erase cycle count on the sector is incremented every time a sector or mass erase event is executed. NOTE All values shown in Table 39 are preliminary and subject to further characterization. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 29 Table 39. NVM Reliability Characteristics Symbol Rating Min Typ Max Unit 20 100(50) — Years 10K 100K(51) — Cycles Program Flash Arrays tNVMRET nFLPE Data retention at an average junction temperature of TJAVG = 85 C(49) after up to 10,000 program/erase cycles Program Flash number of program/erase cycles  (-40 C  TJ  150 C Data Flash Array tNVMRET Data retention at an average junction temperature of TJAVG = 85 C(49) after up to 50,000 program/erase cycles 5 100(50) — Years tNVMRET Data retention at an average junction temperature of TJAVG = 85 C(49) after up to 10,000 program/erase cycles 10 100(50) — Years tNVMRET Data retention at an average junction temperature of TJAVG = 85 C(49) after less than 100 program/erase cycles 20 100(50) — Years 50K 500K(51) — Cycles nFLPE Data Flash number of program/erase cycles (-40 C  TJ  150 C Note: 49. TJAVG does not exceed 85 C in a typical temperature profile over the lifetime of a consumer, industrial or automotive application. 50. Typical data retention values are based on intrinsic capability of the technology measured at high temperature and de-rated to 25 C using the Arrhenius equation. For additional information on how Freescale defines Typical Data Retention, refer to Engineering Bulletin EB618 51. Spec table quotes typical endurance evaluated at 25 C for this product family. For additional information on how Freescale defines Typical Endurance, refer to Engineering Bulletin EB619. 4.6.2.2 4.6.2.2.1 Phase Locked Loop Jitter Definitions With each transition of the feedback clock, the deviation from the reference clock is measured and input voltage to the VCO is adjusted accordingly.The adjustment is done continuously with no abrupt changes in the VCOCLK frequency. Noise, voltage, temperature, and other factors cause slight variations in the control loop resulting in a clock jitter. This jitter affects the real minimum and maximum clock periods, as illustrated in Figure 10. 0 1 2 3 N-1 N tMIN1 tNOM tMAX1 tMINN tMAXN Figure 10. Jitter Definitions The relative deviation of tNOM is at its maximum for one clock period, and decreases towards zero for larger number of clock periods (N). Jitter is defined as: t N t N   max min J  N  = max  1 – ----------------------- , 1 – -----------------------  Nt Nt  nom nom  MM912_634 30 Analog Integrated Circuit Device Data Freescale Semiconductor For N < 100, the following equation is a good fit for the maximum jitter: j 1 J  N  = -------N J(N) 1 5 10 20 N Figure 11. Maximum Bus Clock Jitter Approximation NOTE On timers and serial modules a prescaler eliminates the effect of the jitter to a large extent. 4.6.2.2.2 Electrical Characteristics for the PLL(52) Table 40. PLL Characteristics Symbol Min Typ Max Unit VCO Frequency During System Reset 8.0 — 32 MHz fVCO VCO Locking Range 32 — 64 MHz fREF Reference Clock 1.0 — — MHz 0 — 1.5 %(53) fVCORST Rating LOCK| Lock Detection UNL| Un-lock Detection 0.5 — 2.5 %(53) tLOCK Time to Lock — — 150 + 256/fREF s Jitter Fit Parameter 1(54) — — 1.2 % j1 Note: 52. the maximum device bus clock is specified as fBUS. 53. % deviation from target frequency. 54. fREF = 1.0 MHz, fBUS = 32 MHz equivalent fPLL = 64 MHz, REFRQ=00, SYNDIV=$1F, VCOFRQ=01, POSTDIV=$00. 4.6.2.3 Electrical Characteristics for the IRC1M Table 41. IRC1M Characteristics Symbol fIRC1M_TRIM Rating Internal Reference Frequency, Factory Trimmed -40 °C  TJ  150 °C Min Typ Max Unit 0.987 1.0 1.013 MHz MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 31 4.6.2.4 Electrical Characteristics for the Oscillator (OSCLCP) Table 42. OSCLCP Characteristics Symbol Rating Min Typ Max Unit fOSC Crystal Oscillator Range 4.0 — 16 MHz iOSC Startup Current 100 — — A tUPOSC Oscillator Start-up time (LCP, 4.0 MHz)(55) — 2.0 10 ms tUPOSC Oscillator Start-up time (LCP, 8.0 MHz) (55) — 1.6 8.0 ms tUPOSC Oscillator Start-up time (LCP, 16 MHz)(55) — 1.0 5.0 ms fCMFA Clock Monitor Failure Assert Frequency 200 450 1200 KHz CIN Input Capacitance (EXTAL, XTAL pins) — 7.0 — pF EXTAL Pin Input Hysteresis — 120 — mV EXTAL Pin Oscillation Amplitude (loop controlled Pierce) — 0.9 — V VHYS,EXTAL VPP,EXTAL Note: 55. These values apply for carefully designed PCB layouts with capacitors which match the crystal/resonator requirements. 56. Only applies if EXTAL is externally driven. 4.6.2.5 Reset Characteristics Table 43. Reset and Stop Characteristics Symbol Rating PWRSTL nRST tSTP_REC 4.6.2.6 Min Typ Max Unit Reset Input Pulse Width, Minimum Input Time 2.0 — — tVCORST Startup from Reset — 768 — tVCORST STOP Recovery Time — 50 — s SPI Timing This section provides electrical parametrics and ratings for the SPI. In Table 44 the measurement conditions are listed. Table 44. Measurement Conditions Description Drive mode Load capacitance CLOAD(57), on all outputs Thresholds for delay measurement points Value Unit Full drive mode — 50 pF (20% / 80%) VDDRX V Note: 57. Timing specified for equal load on all SPI output pins. Avoid asymmetric load. MM912_634 32 Analog Integrated Circuit Device Data Freescale Semiconductor 4.6.2.6.1 Master Mode In Figure 12 the timing diagram for master mode with transmission format CPHA = 0 is depicted. SS (Output) 2 1 SCK (CPOL = 0) (Output) 12 13 12 13 3 4 4 SCK (CPOL = 1) (Output) 5 MISO (Input) 6 Bit MSB-1… 1 MSB IN2 10 MOSI (Output) LSB IN 9 11 Bit MSB-1…1 MSB OUT2 LSB OUT 1. If configured as an output. 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1, bit 2... MSB. Figure 12. SPI Master Timing (CPHA = 0) In Figure 13 the timing diagram for master mode with transmission format CPHA=1 is depicted. SS (Output) 1 2 SCK (CPOL = 0) (Output) 4 SCK (CPOL = 1) (Output) 4 5 MISO (Input) MSB IN2 Port Data 13 12 13 3 6 Bit MSB-1... 1 LSB IN 11 9 MOSI (Output) 12 Master MSB OUT2 Bit MSB-1... 1 Master LSB OUT Port Data 1.If configured as output 2. LSBF = 0. For LSBF = 1, bit order is LSB, bit 1,bit 2... MSB. Figure 13. SPI Master Timing (CPHA = 1) In Table 45 the timing characteristics for master mode are listed. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 33 Table 45. SPI Master Mode Timing Characteristics Symbol Characteristic Min Typ Max Unit 1/2048 — 12 fBUS fSCK SCK Frequency tSCK SCK Period 2.0 — 2048 tBUS tLEAD Enable Lead Time — 1/2 — tSCK tLAG Enable Lag Time — 1/2 — tSCK Clock (SCK) High or Low Time — 1/2 — tSCK tSU Data Setup Time (inputs) 8.0 — — ns tHI Data Hold Time (inputs) 8.0 — — ns tVSCK Data Valid After SCK Edge — — 29 ns tVSS Data Valid After SS Fall (CPHA = 0) — — 15 ns tHO Data Hold Time (outputs) 20 — — ns tRFI Rise and Fall Time Inputs — — 8.0 ns tRFO Rise and Fall Time Outputs — — 8.0 ns tWSCK 4.6.2.6.2 Slave Mode In Figure 14 the timing diagram for slave mode with transmission format CPHA = 0 is depicted. SS (Input) 1 12 13 3 12 13 SCK (CPOL = 0) (Input) 4 2 SCK (CPOL = 1) (Input) 10 4 8 7 MISO (Output) 9 See Note Slave MSB 5 MOSI (Input) Bit MSB-1... 1 11 11 Slave LSB OUT See Note 6 MSB IN Bit MSB-1... 1 LSB IN NOTE: Not defined Figure 14. SPI Slave Timing (CPHA = 0) In Figure 15 the timing diagram for slave mode with transmission format CPHA = 1 is depicted. MM912_634 34 Analog Integrated Circuit Device Data Freescale Semiconductor SS (Input) 3 1 2 SCK (CPOL = 0) (Input) 4 SCK (CPOL = 1) (Input) 4 See Note 7 Slave MSB OUT 5 MOSI (Input) 13 12 13 11 9 MISO (Output) 12 Bit MSB-1... 1 8 Slave LSB OUT 6 MSB IN Bit MSB-1… 1 LSB IN NOTE: Not defined Figure 15. SPI Slave Timing (CPHA = 1) In Table 46 the timing characteristics for slave mode are listed. Table 46. SPI Slave Mode Timing Characteristics Symbol Characteristic Min Typ Max Unit DC — 14 fBUS fSCK SCK Frequency tSCK SCK Period 4 —  tBUS tLEAD Enable Lead Time 4 — — tBUS tLAG Enable Lag Time 4.0 — — tBUS Clock (SCK) High or Low Time 4.0 — — tBUS tSU Data Setup Time (inputs) 8.0 — — ns tHI Data Hold Time (inputs) 8.0 — — ns tA Slave Access Time (time to data active) — — 20 ns tDIS Slave MISO Disable Time — — 22 ns tVSCK Data Valid After SCK Edge — — 29 + 0.5  tBUS(58) ns tVSS Data Valid After SS Fall — — 29 + 0.5  tBUS(58) ns tHO Data Hold Time (outputs) 20 — — ns tRFI Rise and Fall Time Inputs — — 8.0 ns tRFO Rise and Fall Time Outputs — — 8.0 ns tWSCK Note: 58. 0.5 tBUS added due to internal synchronization delay MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 35 4.7 Thermal Protection Characteristics Characteristics noted under conditions 5.5 V  VSUP  18 V, -40 °C  TA 125 °C, unless otherwise noted. Typical values noted reflect the approximate parameter mean at TA = 25 °C under nominal conditions, unless otherwise noted. Table 47. Thermal Characteristics - Voltage Regulators VDD (2.5 V) & VDDX (5.0 V)(59) Symbol Ratings Min Typ Max Unit THTI THTI_H VDD/VDDX High-temperature Warning (HTI) Threshold Hysteresis 110 - 125 10 140 - °C TSD TSD_H VDD/VDDX Overtemperature Shutdown Threshold Hysteresis 155 - 170 10 185 - °C HSUP Overtemperature Shutdown 150 165 180 °C - 10 - °C 150 165 180 °C - 10 - °C 150 165 180 °C - 10 - °C 150 165 200 °C - 20 - °C THSUPSD THSUPSD_HYS THSSD HSUP Overtemperature Shutdown Hysteresis HS Overtemperature Shutdown THSSD_HYS TLSSD HS Overtemperature Shutdown Hysteresis LS Overtemperature Shutdown TLSSD_HYS TLINSD TLINSD_HYS LS Overtemperature Shutdown Hysteresis LIN Overtemperature Shutdown LIN Overtemperature Shutdown Hysteresis Note: 59. Guaranteed by characterization. Functionality tested. 4.8 ESD Protection and Latch-up Immunity All ESD testing is in conformity with CDF-AEC-Q100 stress test qualification for automotive grade integrated circuits. During the device qualification, ESD stresses were performed for the Human Body Model (HBM), Machine Model (MM), Charge Device Model (CDM), as well as LIN transceiver specific specifications. A device is defined as a failure if after exposure to ESD pulses, the device no longer meets the device specification. Complete DC parametric and functional testing is performed per the applicable device specification at room temperature, followed by hot temperature, unless specified otherwise in the device specification. Table 48. ESD and Latch-up Protection Characteristics Symbol Ratings Value Unit VHBM ESD - Human Body Model (HBM) following AEC-Q100 / JESD22-A114 (CZAP = 100 pF, RZAP = 1500 ) - LIN (DGND, PGND, AGND, and LGND shorted) - VS1, VS2, VSENSE, Lx - HSx - All other Pins ±8000 ±4000 ±3000 ±2000 VCDM ESD - Charged Device Model (CDM) following AEC-Q100, Corner Pins (1, 12, 13, 24, 25, 36, 37, and 48) All other Pins ±750 ±500 V VMM ESD - Machine Model (MM) following AEC-Q100 (CZAP = 200 pF, RZAP = 0 ), All Pins ±200 V ILAT Latch-up current at TA = 125 C(60) ±100 mA V MM912_634 36 Analog Integrated Circuit Device Data Freescale Semiconductor Table 48. ESD and Latch-up Protection Characteristics (continued) Symbol Ratings Value Unit ±15000 ±20000 ±6000 V (62) ESD GUN - LIN Conformance Test Specification discharge, CZAP= 150 pF, RZAP = 330 . - LIN (with or without bus filter CBUS=220 pF) - VS1, VS2 with CVS , unpowered, contact - Lx with serial RLX ESD GUN - following IEC 61000-4-2 Test Specification(63), unpowered, contact discharge, CZAP= 150 pF, RZAP = 330  - LIN (with or without bus filter CBUS=220 pF) - VSENSE with serial RVSENSE(61) - VS1, VS2 with CVS - Lx with serial RLX ESD GUN - following ISO10605 Test Specification(63), unpowered, contact discharge, CZAP= 150 pF, RZAP = 2.0 k - LIN (with or without bus filter CBUS=220pF) - VSENSE with serial RVSENSE(61) - VS1, VS2 with CVS - Lx with serial RLX ESD GUN - following ISO10605 Test Specification(63), powered, contact discharge, CZAP= 330 pF, RZAP = 2.0 k - LIN (with or without bus filter CBUS=220 pF) - VSENSE with serial RVSENSE(61) - VS1, VS2 with CVS - Lx with serial RLX Note: 60. 61. 62. 63. 4.9 ±8000 ±8000 ±8000 ±8000 ±6000 ±6000 ±6000 ±6000 ±8000 ±8000 ±8000 ±8000 V V V Input Voltage Limit = -2.5 to 7.5 V. With CVBAT (10…100 nF) as part of the battery path. Certification available on request Tested internally only; certification pending Additional Test Information ISO7637-2 Immunity against transients for the LIN, Lx, and VBAT, is specified according to the LIN Conformance Test Specification - Section LIN EMC Test Specification refer to the LIN Conformance Test Certification Report - available as separate document. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 37 5 Functional Description and Application Information 5.1 Introduction This chapter describes the MM912_634 dual die device functions on a block by block base. To distinguish between the module location being the MCU die or the analog die, the following symbols are shown on all module cover pages: The documented module is physically located on the Analog die. This applies to Section 5.3, “MM912_634 - Analog Die Overview" through Section 5.26, “MM912_634 - Analog Die Trimming". MCU ANALOG The documented module is physically located on the Microcontroller die. This applies to Section 5.27, “MM912_634 - MCU Die Overview" through Section 5.39, “Serial Peripheral Interface (S12SPIV5)". MCU ANALOG Sections concerning both dies or the complete device do not have a specific indication. 5.2 Device Register Maps Table 49 shows the device register memory map overview for the 64 kByte MCU die (MC9S12I64). Table 49. Device Register Memory Map Overview Address Module Size (Bytes) 0x0000–0x0009 PIM (port integration module) 10 0x000A–0x000B MMC (memory map control) 2 0x000C–0x000D PIM (port integration module) 2 0x000E–0x000F Reserved 2 0x0010–0x0015 MMC (memory map control) 8 0x0016–0x0019 Reserved 2 0x001A–0x001B Device ID register 2 0x001C–0x001E Reserved 4 0x001F INT (interrupt module) 1 0x0020–0x002F DBG (debug module) 16 0x0030–0x0033 Reserved 4 0x0034–0x003F CPMU (clock and power management) 12 0x0040–0x00D7 Reserved 152 0x00D8–0x00DF D2DI (die 2 die initiator) 8 0x00E0–0x00E7 Reserved 32 0x00E8–0x00EF SPI (serial peripheral interface) 8 0x00F0–0x00FF Reserved 32 0x0100–0x0113 FTMRC control registers 20 0x0114–0x011F Reserved 12 0x0120–0x017F PIM (port integration module) 96 0x0180–0x01EF Reserved 112 0x01F0–0x01FC CPMU (clock and power management) 13 MM912_634 38 Analog Integrated Circuit Device Data Freescale Semiconductor Table 49. Device Register Memory Map Overview (continued) Address Module Size (Bytes) 0x01FD–0x01FF Reserved 3 0x0200-0x02FF D2DI (die 2 die initiator, blocking access window) 256 0x0300–0x03FF D2DI (die 2 die initiator, non-blocking write window) 256 NOTE Reserved register space shown in Table 49 is not allocated to any module. This register space is reserved for future use, and shows as grayed areas in tables throughout this document. Writing to these locations has no effect. Read access to these locations returns zero. 5.2.1 Detailed Module Register Maps Table 50 to Table 72 show the detailed module maps of the 9S12I64 MCU die. Table 50. 0x0000–0x0007 Port Integration Module (PIM) Map 1 of 3 Address Name 0x0000 PORTA Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PA7 PA6 PA5 PA4 PA3 PA2 PA1 PA0 0 0 0 0 0 0 PE1 PE0 DDRA1 DDRA0 DDRE1 DDRE0 PTC1 PTC0 PTD1 PTD0 DDRC1 DDRC0 DDRD1 DDRD0 R W R 0x0001 PORTE W R 0x0002 DDRA DDRA7 DDRA6 DDRA5 DDRA4 DDRA3 DDRA2 0 0 0 0 0 0 W R 0x0003 DDRE W R 0x0004 0 0 0 0 0 0 PTC W R 0x0005 PTD PTD7 PTD6 PTD5 PTD4 PTD3 PTD2 0 0 0 0 0 0 W R 0x0006 DDRC W R 0x0007 DDRD DDRD7 DDRD6 DDRD5 DDRD4 DDRD3 DDRD2 W 0x0008 0x0009 R Reserved W MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 39 Table 51. 0x000A–0x000B Memory Map Control (MMC) Map 1 of 2 Address Name 0x000A Reserved R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 W R 0x000B MODE MODC W Table 52. 0x000C–0x000D Port Integration Module (PIM) Map 2 of 3 Address Name 0x000C PUCR Bit 7 R Bit 6 0 BKPUE 0 PDPEE W R 0x000D 0 0 0 0 RDRIV RDRD RDRC 0 0 W Table 53. 0x000E–0x000F Reserved Address Name 0x000E0x000F Reserved R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 W Table 54. 0x0010–0x001B Memory Map Control (MMC) Map 2 of 2 Address Name 0x0010 Reserved R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 DP15 DP14 DP13 DP12 DP11 DP10 DP9 DP8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PIX3 PIX2 PIX1 PIX0 W R 0x0011 DIRECT W R 0x0012 Reserved W R 0x0013 Reserved W R 0x0014 Reserved W R 0x0015 PPAGE W MM912_634 40 Analog Integrated Circuit Device Data Freescale Semiconductor Table 55. 0x0016–0x0019 Reserved Address Name 0x00160x0019 Reserved R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 W Table 56. 0x001A–0x001B Device ID Register (PARTIDH/PARTIDL) Address Name 0x001A PARTIDH Bit 7 Bit 6 Bit 5 R PARTIDH W R 0x001B PARTIDL PARTIDL W Table 57. 0x001C–0x001E Reserved Address Name 0x001C0x001E Reserved R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 2 Bit 1 Bit 0 W Table 58. 0x001F Interrupt Module (INT) Address Name 0x001F IVBR Bit 7 R IVB_ADDR[7:0] W Table 59. 0x0020–0x002F Debug Module (DBG) Address Name 0x0020 DBGC1 Bit 7 R Bit 5 Bit 4 Bit 3 0 0 BDM DBGBRK 0 0 0 0 0 ARM W R 0x0021 Bit 6 0 COMRV TRIG TBF 0 SSF2 SSF1 SSF0 DBGSR W R 0x0022 0 DBGTCR 0 TSOURCE TRCMOD TALIGN W R 0x0023 0 0 0 0 0 0 DBGC2 ABCM W R 0x0024 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 DBGTBH W R 0x0025 DBGTBL W MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 41 Table 59. 0x0020–0x002F Debug Module (DBG) (continued) Address Name 0x0026 DBGCNT R Bit 7 Bit 6 TBF 0 0 0 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SC3 SC2 SC1 SC0 CNT W R 0 0 DBGSCRX W 0x0027 R 0 0 0 0 0 MC2 MC1 MC0 SZE SZ TAG BRK RW RWE NDB COMPE SZE SZ TAG BRK RW RWE 0 0 TAG BRK RW RWE 0 0 0 0 DBGMFR W R DBGACTL W R 0x0028 DBGBCTL 0 COMPE W R DBGCCTL 0 COMPE W R 0x0029 0 0 DBGXAH Bit 17 Bit 16 W R 0x002A DBGXAM Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 W R 0x002B DBGXAL W R 0x002C DBGADH W R 0x002D DBGADL W R 0x002E DBGADHM W R 0x002F DBGADLM W Table 60. 0x0030–0x033 Reserved Address Name 0x00300x0033 Reserved R W MM912_634 42 Analog Integrated Circuit Device Data Freescale Semiconductor Table 61. 0x0034–0x003F Clock and Power Management (CPMU) Map 1 of 2 Address Name 0x0034 CPMU SYNR 0x0035 0x0036 CPMU REFDIV CPMU POSTDIV Bit 7 Bit 6 Bit 5 Bit 4 Bit 2 Bit 1 Bit 0 R VCOFRQ[1:0] SYNDIV[5:0] W R 0 0 REFFRQ[1:0] REFDIV[3:0] W R 0 0 0 POSTDIV[4:0] W R 0x0037 Bit 3 CPMUFLG LOCK RTIF PORF LVRF 0 0 LOCKIF UPOSC ILAF OSCIF W R 0x0038 CPMUINT RTIE 0 0 LOCKIE 0 OSCIE W R 0x0039 CPMUCLKS 0 PLLSEL PSTP 0 0 0 PRE PCE RTI OSCSEL COP OSCSEL 0 0 0 0 RTR2 RTR1 RTR0 CR2 CR1 CR0 W R 0x003A CPMUPLL FM1 FM0 RTR5 RTR4 RTR3 0 0 0 W R 0x003B CPMURTI RTDEC RTR6 WCOP RSBCK W R 0x003C CPMUCOP W WRTMASK R 0x003D 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 R 0 0 0 0 0 0 0 0 W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Reserved W R 0x003E Reserved W 0x003F CPMU ARMCOP Table 62. 0x0040–0x0D7 Reserved Address Name 0x00400x00D7 Reserved R W MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 43 Table 63. 0x00D8–0x00DF Die 2 Die Initiator (D2DI) Map 1 of 3 Address Name 0x00D8 D2DCTL0 Bit 7 Bit 6 Bit 5 D2DEN D2DCW D2DSWAI 0 0 R Bit 4 Bit 3 Bit 2 0 0 0 Bit 1 Bit 0 D2DCLKDIV[1:0] W R 0x00D9 D2DCTL1 0 D2DIE TIMEOUT[3:0] W R 0x00DA D2DSTAT0 ACKERF CNCLF TIMEF TERRF PARF PAR1 PAR0 D2DBSY 0 0 0 0 0 0 SZ8 0 NBLK 0 0 0 0 ERRIF W R 0x00DB D2DSTAT1 D2DIF W R 0x00DC RWB D2DADRHI W R 0x00DD ADR[7:0] D2DADRLO W R 0x00DE DATA[15:8] D2DDATAHI W R 0x00DF DATA[7:0] D2DDATALO W Table 64. 0x00E0–0x0E7 Reserved Address Name 0x00E00x00E7 Reserved R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 W Table 65. 0x00E8–0x00EF Serial Peripheral Interface (SPI) Address Name 0x00E8 SPICR1 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 SPIE SPE SPTIE MSTR CPOL CPHA SSOE LSBFE MODFEN BIDIROE SPISWAI SPC0 SPR2 SPR1 SPR0 R W R 0x00E9 0 SPICR2 0 XFRW 0 W R 0x00EA 0 SPIBR 0 SPPR2 SPPR1 SPPR0 SPIF 0 SPTEF MODF 0 0 0 0 R R15 R14 R13 R12 R11 R10 R9 R8 W T15 T14 T13 T12 T11 T10 T9 T8 W R 0x00EB SPISR W 0x00EC SPIDRH MM912_634 44 Analog Integrated Circuit Device Data Freescale Semiconductor Table 65. 0x00E8–0x00EF Serial Peripheral Interface (SPI) (continued) 0x00ED 0x00EE R R7 R6 R5 R4 R3 R2 R1 R0 W T7 T6 T5 T4 T3 T2 T1 T0 R 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 FDIVLCK FDIV5 FDIV4 FDIV3 FDIV2 FDIV1 FDIV0 KEYEN1 KEYEN0 RNV5 RNV4 RNV3 RNV2 SEC1 SEC0 0 0 0 0 0 CCOBIX2 CCOBIX1 CCOBIX0 0 0 0 0 0 0 FDFD FSFD DFDIE SFDIE MGSTAT1 MGSTAT0 DFDIF SFDIF SPIDRL Reserved W R 0x00EF Reserved W Table 66. 0x00F0–0x0FF Reserved Address Name 0x00E00x00FF Reserved R W Table 67. 0x0100–0x011F Flash Module (FTMRC) Address Name 0x0100 FCLKDIV Bit 7 R FDIVLD W R 0x0101 FSEC W R 0x0102 FCCOBIX W R 0x0103 0 0 0 0 0 0 Reserved W R 0x0104 FCNFG CCIE IGNSF W R 0x0105 0 0 0 0 0 0 FERCNFG W R 0x0106 FSTAT 0 CCIF ACCERR FPVIOL 0 0 MGBUSY RSVD 0 0 W R 0x0107 0 0 FERSTAT W R 0x0108 FPROT RNV6 FPOPEN FPHDIS FPHS1 0 0 FPHS0 FPLDIS FPLS1 FPLS0 DPS3 DPS2 DPS1 DPS0 CCOB11 CCOB10 CCOB9 CCOB8 W R 0x0109 DFPROT 0 DPOPEN W R 0x010A FCCOBHI CCOB15 CCOB14 CCOB13 CCOB12 W MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 45 Table 67. 0x0100–0x011F Flash Module (FTMRC) (continued) Address Name 0x010B FCCOBLO Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 CCOB7 CCOB6 CCOB5 CCOB4 CCOB3 CCOB2 CCOB1 CCOB0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 NV7 NV6 NV5 NV4 NV3 NV2 NV1 NV0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 R W R 0x010C Reserved W R 0x010D Reserved W R 0x010E Reserved W R 0x010F Reserved W R 0x0110 FOPT W R 0x0111 Reserved W R 0x0112 Reserved W R 0x0113 Reserved W Table 68. 0x0120 Port Integration Module (PIM) Map 3 of 3 Address Name 0x0120 PTIA R Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 PTIA7 PTIA6 PTIA5 PTIA4 PTIA3 PTIA2 PTIA1 PTIA0 0 0 0 0 0 0 PTIE1 PTIE0 0 0 0 0 0 0 0 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 W R 0x0121 PTIE W 0x01220x017F R Reserved W Table 69. 0x0180–0x1EF Reserved Address Name 0x01800x01EF Reserved R W MM912_634 46 Analog Integrated Circuit Device Data Freescale Semiconductor Table 70. 0x01F0–0x01FF Clock and Power Management (CPMU) Map 2 of 2 Address Name 0x01F0 Reserved Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 0 0 0 0 0 LVDS LVIE LVIF R W 0x01F1 CPMU LVCTL R W R 0x01F6 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Reserved W R 0x01F7 Reserved W 0x01F8 0x01F9 CPMU IRCTRIMH CPMU IRCTRIML R TCTRIM[3:0] R IRCTRIM[7:0] W R 0x01FA IRCTRIM[9:8] W CPMUOSC OSCE OSCBW 0 0 OSCPINS_E N OSCFILT[4:0] W R 0x01FB 0 0 0 0 0 CPMUPROT PROT W R 0x01FC 0 0 0 0 0 0 0 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Bit 2 Bit 1 Bit 0 Reserved W Table 71. 0x01FD–0x1FF Reserved Address Name 0x01FD0x01FF Reserved R W Table 72. 0x0200–0x03FF Die-To-Die Initiator Blocking and Non-Blocking Access Window Address Name 0x02000x02FF Blocking Access Window 0x03000x03FF Non-Blocking Access Window Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 R W R W Table 73 shows the detailed module maps of the MM912_634 analog die. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 47 Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 Offset Name ISR (hi) R Interrupt Source Register W ISR (lo) R Interrupt Source Register W IVR R Interrupt Vector Register W VCR R Voltage Control Register W VSR R Voltage Status Register W LXR R Lx Status Register W LXCR R Lx Control Register W WDR R Watchdog Register W WDSR R Watchdog Service Register W WCR R Wake Up Control Register W TCR R Timing Control Register W WSR R Wake Up Source Register W RSR R Reset Status Register W MCR R Mode Control Register W LINR R 7 6 5 4 3 2 1 0 0 0 HOT LSOT HSOT LINOT SCI RX TX ERR TOV CH3 CH2 CH1 CH0 VSI 0 0 0 0 0x00 0x01 IRQ 0x02 0 0x04 VROVIE HTIE HVIE LVIE LBIE 0 0 0 VROVC HTC HVC LVC LBC 0 0 L5 L4 L3 L2 L1 L0 0 0 L5DS L4DS L3DS L2DS L1DS L0DS 0 0 0 0x05 0x08 0x09 WDOFF WDWO 0x10 WDTO 0x11 WDSR 0x12 CSSEL L5WE 0x13 L4WE L3WE L2WE FWM L1WE L0WE CST FWU LINWU L5WU L4WU L3WU L2WU L1WU L0WU 0 0 WDR EXR WUR LVRX LVR POR 0 0 0 0 0 0 0x14 0x15 0x16 MODE 0x18 LINOTC RX LINOTIE LIN Register W PTBC1 R 0 0x20 Port B Configuration Register 1 W PTBC2 R Port B Config Register 2 W 0x21 TX 0 LVSD LINEN LINSR 0 PUEB2 PUEB1 PUEB0 0 0 0 DDRB2 PWMCS PWMEN DDRB1 DDRB0 SERMOD MM912_634 48 Analog Integrated Circuit Device Data Freescale Semiconductor Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 (continued) Offset Name PTB R Port B Data Register W HSCR R High-side Control Register W HSSR R High-side Status Register W LSCR R 7 6 5 4 3 0 0 0 0 0 0x22 0x28 2 1 0 PTB2 PTB1 PTB0 HSOTIE HSHVSDE PWMCS2 PWMCS1 PWMHS2 PWMHS1 HS2 HS1 HSOTC 0 0 0 HS2CL HS1CL HS2OL HS1OL PWMCS2 PWMCS1 PWMLS2 PWMLS1 LS2 LS1 LS2CL LS1CL LS2OL LS1OL 0x29 0x30 0 LSOTIE Low-side Control Register W LSSR R Low-side Status Register W LSCEN R Low-Side Control Enable Register W HSR R LSOTC 0 0 0 0 0 0 0 0x31 0x32 LSCEN 0x38 HOTC 0 0 0 0 0 HOTIE Hall Supply Register W CSR R 0x3C HSUPON 0 0 0 CSE Current Sense Register W SCIBD (hi) R 0x40 SCI Baud Rate Register W SCIBD (lo) R SCI Baud Rate Register W SCIC1 R 0x41 0x42 CCD 0 LBKDIE RXEDGIE SBR7 SBR6 W SCIC2 R SCI Control Register 2 W SCIS1 R SCI Status Register 1 W SCIS2 R 0x43 SBR12 SBR11 SBR10 SBR9 SBR8 SBR5 SBR4 SBR3 SBR2 SBR1 SBR0 RSRC M ILT PE PT 0 LOOPS SCI Control Register 1 CSGS 0 TIE TCIE RIE ILIE TE RE RWU SBK TDRE TC RDRF IDLE OR NF FE PF LBKDIF RXEDGIF RXINV RWUID BRK13 LBKDE 0x44 0x45 SCI Status Register 2 W SCIC3 R SCI Control Register 3 W SCID R SCI Data Register W PWMCTL R PWM Control Register W 0 RAF R8 0x46 T8 TXDIR TXINV ORIE NEIE FEIE PEIE R7 R6 R5 R4 R3 R2 R1 R0 T7 T6 T5 T4 T3 T2 T1 T0 CAE1 CAE0 PCLK1 PCLK0 PPOL1 PPOL0 PWME1 PWME0 0x47 0x60 MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 49 Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 (continued) Offset Name PWMPRCLK 7 R 6 5 4 2 1 0 PCKB2 PCKB1 PCKB0 PCKA2 PCKA1 PCKA0 Bit 7 6 5 4 3 2 1 Bit 0 Bit 7 6 5 4 3 2 1 Bit 0 0 0x61 3 0 PWM Presc. Clk Select Reg W PWMSCLA R PWM Scale A Register W PWMSCLB R PWM Scale B Register W PWMCNT0 R Bit 7 6 5 4 3 2 1 Bit 0 PWM Ch Counter Reg 0 W 0 0 0 0 0 0 0 0 PWMCNT1 R Bit 7 6 5 4 3 2 1 Bit 0 PWM Ch Counter Reg 1 W 0 0 0 0 0 0 0 0 PWMPER0 R Bit 7 6 5 4 3 2 1 Bit 0 PWM Ch Period Register 0 W PWMPER1 R Bit 7 6 5 4 3 2 1 Bit 0 PWM Ch Period Register 1 W PWMDTY0 R Bit 7 6 5 4 3 2 1 Bit 0 PWM Ch Duty Register 0 W PWMDTY1 R Bit 7 6 5 4 3 2 1 Bit 0 PWM Ch Duty Register 1 W ACR R SCIE CCE OCE ADCRST PS2 PS1 PS0 SCF 2p5CLF 0 0 CCNT3 CCNT2 CCNT1 CCNT0 CH15 CH14 CH12 CH11 CH10 CH9 CH8 CH7 CH6 CH5 CH4 CH3 CH2 CH1 CH0 CC15 CC14 0 CC12 CC11 CC10 CC9 CC8 CC7 CC6 CC5 CC4 CC3 CC2 CC1 CC0 adr0 9 adr0 8 adr0 7 adr0 6 adr0 5 adr0 4 adr0 3 adr0 2 adr0 1 adr0 0 0 0 0 0 0 0 0x62 0x63 0x64 0x65 0x66 0x67 0x68 0x69 0x80 ADC Config Register W ASR R ADC Status Register W ACCR (hi) R 0 0x81 0x82 ADC Conversion Ctrl Reg W ACCR (lo) R ADC Conversion Ctrl Reg W ACCSR (hi) R ADC Conv Complete Reg W ACCSR (lo) R ADC Conv Complete Reg W ADR0 (hi) R ADC Data Result Register 0 W ADR0 (lo) R ADC Data Result Register 0 W 0x83 0 0x84 0x85 0x86 0x87 MM912_634 50 Analog Integrated Circuit Device Data Freescale Semiconductor Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 (continued) Offset Name ADR1 (hi) R ADC Data Result Register 1 W ADR1 (lo) R ADC Data Result Register 1 W ADR2 (hi) R ADC Data Result Register 2 W ADR2 (lo) R ADC Data Result Register 2 W ADR3 (hi) R ADC Data Result Register 3 W ADR3 (lo) R ADC Data Result Register 3 W ADR4 (hi) R ADC Data Result Register 4 W ADR4 (lo) R ADC Data Result Register 4 W ADR5 (hi) R ADC Data Result Register 5 W ADR5 (lo) R ADC Data Result Register 5 W ADR6 (hi) R ADC Data Result Register 6 W ADR6 (lo) R ADC Data Result Register 6 W ADR7 (hi) R ADC Data Result Register 7 W ADR7 (lo) R ADC Data Result Register 7 W ADR8 (hi) R ADC Data Result Register 8 W ADR8 (lo) R ADC Data Result Register 8 W ADR9 (hi) R ADC Data Result Register 9 W 7 6 5 4 3 2 1 0 adr1 9 adr1 8 adr1 7 adr1 6 adr1 5 adr1 4 adr1 3 adr1 2 adr1 1 adr1 0 0 0 0 0 0 0 adr2 9 adr2 8 adr2 7 adr2 6 adr2 5 adr2 4 adr2 3 adr2 2 adr2 1 adr2 0 0 0 0 0 0 0 adr3 9 adr3 8 adr3 7 adr3 6 adr3 5 adr3 4 adr3 3 adr3 2 adr3 1 adr3 0 0 0 0 0 0 0 adr4 9 adr4 8 adr4 7 adr4 6 adr4 5 adr4 4 adr4 3 adr4 2 adr4 1 adr4 0 0 0 0 0 0 0 adr5 9 adr5 8 adr5 7 adr5 6 adr5 5 adr5 4 adr5 3 adr5 2 adr5 1 adr5 0 0 0 0 0 0 0 adr6 9 adr6 8 adr6 7 adr6 6 adr6 5 adr6 4 adr6 3 adr6 2 adr6 1 adr6 0 0 0 0 0 0 0 adr7 9 adr7 8 adr7 7 adr7 6 adr7 5 adr7 4 adr7 3 adr7 2 adr7 1 adr7 0 0 0 0 0 0 0 adr8 9 adr8 8 adr8 7 adr8 6 adr8 5 adr8 4 adr8 3 adr8 2 adr8 1 adr8 0 0 0 0 0 0 0 adr9 9 adr9 8 adr9 7 adr9 6 adr9 5 adr9 4 adr9 3 adr9 2 0x88 0x89 0x8A 0x8B 0x8C 0x8D 0x8E 0x8F 0x90 0x91 0x92 0x93 0x94 0x95 0x96 0x97 0x98 MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 51 Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 (continued) Offset Name ADR9 (lo) R ADC Data Result Register 9 W ADR10 (hi) R ADC Data Result Reg 10 W ADR10 (lo) R ADC Data Result Reg 10 W ADR11 (hi) R ADC Data Result Reg 11 W ADR11 (lo) R ADC Data Result Reg 11 W ADR12 (hi) R ADC Data Result Reg 12 W ADR12 (lo) R ADC Data Result Reg 12 W ADR14 (hi) R ADC Data Result Reg 14 W ADR14 (lo) R ADC Data Result Reg 14 W ADR15 (hi) R ADC Data Result Reg 15 W ADR15 (lo) R ADC Data Result Reg 15 W TIOS R TIM InCap/OutComp Select W CFORC R Timer Compare Force Reg W OC3M R Output Comp 3 Mask Reg W OC3D R Output Comp 3 Data Reg W TCNT (hi) R Timer Count Register W TCNT (lo) R Timer Count Register W 7 6 5 4 3 2 1 0 adr9 1 adr9 0 0 0 0 0 0 0 adr10 9 adr10 8 adr10 7 adr10 6 adr10 5 adr10 4 adr10 3 adr10 2 adr10 1 adr10 0 0 0 0 0 0 0 adr11 9 adr11 8 adr11 7 adr11 6 adr11 5 adr11 4 adr11 3 adr11 2 adr11 1 adr11 0 0 0 0 0 0 0 adr12 9 adr12 8 adr12 7 adr12 6 adr12 5 adr12 4 adr12 3 adr12 2 adr12 1 adr12 0 0 0 0 0 0 0 adr14 9 adr14 8 adr14 7 adr14 6 adr14 5 adr14 4 adr14 3 adr14 2 adr14 1 adr14 0 0 0 0 0 0 0 adr15 9 adr15 8 adr15 7 adr15 6 adr15 5 adr15 4 adr15 3 adr15 2 adr15 1 adr15 0 0 0 0 0 0 0 0 0 0 0 IOS3 IOS2 IOS1 IOS0 0 0 0 0 FOC3 FOC2 FOC1 FOC0 OC3M3 OC3M2 OC3M1 OC3M0 OC3D3 OC3D2 OC3D1 OC3D0 0x99 0x9A 0x9B 0x9C 0x9D 0x9E 0x9F 0xA2 0xA3 0xA4 0xA5 0xC0 0 0 0 0 0xC1 0 0 0 0 0xC2 0 0 0 0 0xC3 0xC4 0xC5 tcnt 15 tcnt 14 tcnt 13 tcnt 12 tcnt 11 tcnt 10 tcnt 9 tcnt 8 tcnt 7 tcnt 6 tcnt 5 tcnt 4 tcnt 3 tcnt 2 tcnt 1 tcnt 0 MM912_634 52 Analog Integrated Circuit Device Data Freescale Semiconductor Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 (continued) Offset Name TSCR1 7 R 0xC6 6 5 0 0 TEN Timer System Control Reg 1 W TTOV R Timer Toggle Overflow Reg W TCTL1 R Timer Control Register 1 W TCTL2 R Timer Control Register 2 W TIE R Timer Interrupt Enable Reg W TSCR2 R 0 4 0xC9 0 0 W TFLG1 R Main Timer Interrupt Flag 1 W TFLG2 R 0 0 0 0 TOV3 TOV2 TOV1 TOV0 OL3 OM2 OL2 OM1 OL1 OM0 OL0 EDG3B EDG3A EDG2B EDG2A EDG1B EDG1A EDG0B EDG0A 0 0 0 0 C3I C2I C1I C0I TCRE PR2 PR1 PR0 C3F C2F C1F C0F 0 0 0 0 0 0 0 0xCC 0xCD 0 OM3 TOI Timer System Control Reg 2 1 0 0xCA 0xCB 2 TFFCA 0xC7 0xC8 3 0 0 0 0 0 0 0 tc0 15 tc0 14 tc0 13 tc0 12 tc0 11 tc0 10 tc0 9 tc0 8 tc0 7 tc0 6 tc0 5 tc0 4 tc0 3 tc0 2 tc0 1 tc0 0 tc1 15 tc1 14 tc1 13 tc1 12 tc1 11 tc1 10 tc1 9 tc1 8 tc1 7 tc1 6 tc1 5 tc1 4 tc1 3 tc1 2 tc1 1 tc1 0 tc2 15 tc2 14 tc2 13 tc2 12 tc2 11 tc2 10 tc2 9 tc2 8 tc2 7 tc2 6 tc2 5 tc2 4 tc2 3 tc2 2 tc2 1 tc2 0 tc3 15 tc3 14 tc3 13 tc3 12 tc3 11 tc3 10 tc3 9 tc3 8 tc3 7 tc3 6 tc3 5 tc3 4 tc3 3 tc3 2 tc3 1 tc3 0 LINTRE LINTR WDCTRE CTR0_4 CTR0_3 WDCTR2 WDCTR1 WDCTR0 TOF Main Timer Interrupt Flag 2 W TC0 (hi) R TIM InCap/OutComp Reg 0 W TC0 (lo) R TIM InCap/OutComp Reg 0 W TC1 (hi) R TIM InCap/OutComp Reg 1 W TC1 (lo) R TIM InCap/OutComp Reg 1 W TC2 (hi) R TIM InCap/OutComp Reg 2 W TC2 (lo) R TIM InCap/OutComp Reg 2 W TC3 (hi) R TIM InCap/OutComp Reg 3 W TC3 (lo) R TIM InCap/OutComp Reg 3 W CTR0 R Trimming Reg 0 W 0xCE 0xCF 0xD0 0xD1 0xD2 0xD3 0xD4 0xD5 0xF0 MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 53 Table 73. Analog die Registers(64) - 0x0200–0x02FF D2D Blocking Access (D2DI) 2 of 3/ 0x0300–0x03FF D2D Non Blocking Access (D2DI) 3 of 3 (continued) Offset Name CTR1 R Trimming Reg 1 W CTR2 R Trimming Reg 2 W CTR3 R Trimming Reg 3 W SRR R Silicon Revision Register W 0xF1 0xF2 0xF3 7 6 5 4 3 2 1 0 BGTRE CTR1_6 BGTRIMU P BGTRIMD N IREFTRE IREFTR2 IREFTR1 IREFTR0 CTR2_E CTR2_1 CTR2_0 SLPBGTR E SLPBG_L OCK SLPBGTR SLPBGTR SLPBGTR 2 1 0 OFFCTR1 OFFCTR0 CTR3_E 0 0 OFFCTRE OFFCTR2 0 0 CTR3_2 CTR3_1 FMREV CTR3_0 MMREV 0xF4 Note: 64. Registers not shown are reserved and must not be accessed. MCU ANALOG 5.3MM912_634 - Analog Die Overview 5.3.1Introduction The MM912_634 analog die implements all system base functionality to operate the integrated microcontroller, and delivers application specific actuator control as well as input capturing. 5.3.2 System Registers 5.3.2.1 Silicon Revision Register (SRR) Table 74. Silicon Revision Register (SRR) Offset(64) 0xF4 R Access: User read 7 6 5 4 0 0 0 0 3 2 FMREV 1 0 MMREV W Note: 65. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 75. SRR - Register Field Descriptions Field 3-2 FMREV 1-0 MMREV Description MM912_634 analog die Silicon Revision Register - These bits represent the revision of Silicon of the analog die. They are incremented for every full mask or metal mask issued of the device. One number is set for one revision of the silicon of the analog die. (66) Note: 66. Refer to MM912_634ER - MM912_634, Silicon Analog Mask (M91W) / Digital Mask (N53A) Errata. MM912_634 54 Analog Integrated Circuit Device Data Freescale Semiconductor 5.3.3 Analog Die Options The following section describes the differences between analog die options 1 and 2. Table 76. Analog Die Options Feature Option 1 Option 2 Current Sense Module YES NO Wake Up Inputs (Lx) L0…L5 L0.L3 NOTE This document describes the features and functions of option 1 (all modules available and tested). Beyond this chapter, there is no additional note or differentiation between the different implementations. 5.3.3.1 Current Sense Module For device options with the current sense module not available, the following considerations are to be made. 5.3.3.1.1 Pinout Considerations Table 77. ISENSE - Pin Considerations Pin PIN name for option 1 New PIN name 40 ISENSEL NC 41 ISENSEH NC Comment ISENSE feature not bonded and/or not tested. Connect PINs 40 and 41 (NC) to GND. 5.3.3.1.2 Register Considerations The Current Sense Register must remain in default (0x00) state. Offset Name CSR 7 R 0x3C 6 5 4 0 0 0 CSE Current Sense Register 3 2 CCD 1 0 CSGS W The Conversion Control Register - Bit 9 must always be written 0. ACCR (hi) R 0x82 0 CH15 ADC Conversion Ctrl Reg CH14 CH12 CH11 CH10 CH9 CH8 W The Conversion Complete Register - Bit 9 must be ignored. ACCSR (hi) R ADC Conv Complete Reg W CC15 CC14 0 CC12 CC11 CC10 CC9 CC8 adr9 9 adr9 8 adr9 7 adr9 6 adr9 5 adr9 4 adr9 3 adr9 2 adr9 1 adr9 0 0 0 0 0 0 0 0x84 The ADC Data Result Reg 9 must be ignored. ADR9 (hi) R ADC Data Result Register 9 W ADR9 (lo) R ADC Data Result Register 9 W 0x98 0x99 MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 55 5.3.3.1.3 • • Functional Considerations The complete Current Sense Module is not available. The ADC Channel 9 is not available. 5.3.3.2 Wake-up Inputs (Lx) For device options with reduced number of wake-up inputs (Lx), the following considerations are to be made. 5.3.3.2.1 Pinout Considerations Table 78. Lx - Pin Considerations Pin PIN Name for Option 1 New PIN name Comment 31…36 Lx NC One or more Lx wake-up inputs are not available based on the analog die option. Not available Lx inputs are not bonded and/or not tested. Connect not available Lx pins (NC) to GND. RLx is not required on those pins. 5.3.3.2.2 Register Considerations The Lx - Bit for the not available Lx input in the Lx Status Register must be ignored. Offset Name LXR R Lx Status Register W 7 6 5 4 3 2 1 0 0 0 L5 L4 L3 L2 L1 L0 L5DS L4DS L3DS L2DS L1DS L0DS 0x08 The Lx Control register for the not available Lx input must be written 0. LXCR R Lx Control Register W 0 0 0x09 A not available Lx input can not be selected as Wake-up Source and must have its LxWE bit set to 0. WCR R Wake Up Control Register W 0x12 CSSEL L5WE L4WE L3WE L2WE L1WE L0WE L4WU L3WU L2WU L1WU L0WU The Wake-up Source Register for not available Lx inputs must be ignored. WSR R Wake Up Source Register W FWU LINWU L5WU 0x14 The Conversion Control Register for the not available Lx analog input (3…8) must always be written 0. ACCR (hi) R 0x82 ADC Conversion Ctrl Reg W ACCR (lo) R ADC Conversion Ctrl Reg W 0x83 0 CH15 CH14 CH7 CH6 CH5 CH12 CH11 CH10 CH9 CH8 CH4 CH3 CH2 CH1 CH0 The Conversion Complete Register for the not available Lx analog input (3.8) must be ignored. MM912_634 56 Analog Integrated Circuit Device Data Freescale Semiconductor ACCSR (hi) R ADC Conv Complete Reg W ACCSR (lo) R ADC Conv Complete Reg W CC15 CC14 0 CC12 CC11 CC10 CC9 CC8 CC7 CC6 CC5 CC4 CC3 CC2 CC1 CC0 0x84 0x85 The ADC Data Result Register for the not available Lx analog input (3.8) must be ignored. 0x8C-0 x97 5.3.3.2.3 ADRx (hi) R ADC Data Result Register x W ADRx (lo) R ADC Data Result Register x W adrx 9 adrx 8 adrx 7 adrx 6 adrx 5 adrx 4 adrx 3 adrx 2 adrx 1 adrx 0 0 0 0 0 0 0 Functional Considerations For the not available Lx inputs, the following functions are limited: • No Wake-up feature / Cyclic Sense • No Digital Input • No Analog Input and conversion via ADC 5.4 Modes of Operation MCU ANALOG The MM912_634 analog die offers three main operating modes: Normal (Run), Stop, and Sleep. In Normal mode, the device is active and is operating under normal application conditions. In Stop mode, the voltage regulator operates with limited current capability, the external load is expected to be reduced while in Stop mode. In Sleep mode both voltage regulators are turned off (VDD = VDDX = 0 V). Wake-up from Stop mode is indicated by an interrupt signal. Wake-up from Sleep mode changes the MM912_634 analog die into reset mode while the voltage regulator is turned back on. The selection of the different modes is controlled by the Mode Control Register (MCR). Figure 16 describes how transitions are done between the different operating modes. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 57 Power Down Power Up (POR = 1) Power Down (VSUPVLVR and VDDX>VLVRX the MM912_634 analog die enters in Normal mode. To avoid short-circuit conditions being present for a long time, a tVTO timeout is implemented. Once VDD < VLVR or VDDX < VLVRX with VS1 > (VLVI + VLVI_H) for more than tVTO, the MM912_634 analog die transits directly to Sleep mode. The Reset Status Register (RSR) indicates the source of the reset by individual flags. • POR - Power On Reset • LVR - Low Voltage Reset VDD • LVRX - Low Voltage Reset VDDX • WDR - Watchdog Reset • EXR - External Reset • WUR - Wake-up Sleep Reset See also Section 5.8, “Resets". MM912_634 58 Analog Integrated Circuit Device Data Freescale Semiconductor 5.4.3 Normal Mode In Normal mode, all MM912_634 analog die user functions are active and can be controlled by the D2D Interface. Both regulators (VDD and VDDX) are active and operate with full current capability. Once entered in Normal mode, the Watchdog operates as a simple non-window watchdog with an initial timeout (tIWDTO) to be reset via the D2D Interface. After the initial reset, the watchdog operates in standard window mode. See Window Watchdog for details. 5.4.4 Stop Mode The Stop mode allows reduced current consumption with fast startup time. In this mode, both voltage regulators (VDD and VDDX) are active, with limited current drive capability. In this condition, the MCU is supposed to operate in Low Power mode (STOP). NOTE To avoid any pending analog die interrupts prevent the MCU from entering MCU stop resulting in unexpected system behavior, the analog die IRQ sources should be disabled and the corresponding flags be cleared before entering stop. The device can enter in Stop mode by configuring the Mode Control Register (MCR) via the D2D Interface. The MCU has to enter a Low Power mode immediately afterwards executing the STOP instruction. The Wake-up Source Register (WSR) has to be read after a wake-up condition in order to execute a new STOP mode command. Two base clock cycles (fBASE) delay are required between WSR read and MCR write. While in Stop mode, the MM912_634 analog die wakes up on the following sources: • Lx - Wake-up (maskable with selectable cyclic sense) • Forced Wake-up (configurable timeout) • LIN Wake-up • D2D Wake-up (special command) After Wake-up from the sources listed above, the device transits to Normal mode. Reset wakes up the device directly to Reset mode. See Section 5.9, “Wake-up / Cyclic Sense" for details. 5.4.5 Sleep Mode The Sleep mode allows very low current consumption. In this mode, both voltage regulators (VDD and VDDX) are inactive. The device can enter into Sleep mode by configuring the Mode Control Register (MCR) via the D2D- Interface. During Sleep mode, all unused internal blocks are deactivated to allow the lowest possible consumption. Power consumption decreases further if the Cyclic Sense or Forced Wake-up feature are disabled. While in Sleep mode, the MM912_634 analog die wakes up on the following sources: • Lx - Wake-up (maskable with selectable cyclic sense) • Forced Wake-up (configurable timeout) • LIN Wake-up After Wake-up from the sources listed above or a reset condition, the device transits to Reset mode. See Section 5.9, “Wake-up / Cyclic Sense" for details. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 59 5.4.6 Analog Die Functionality by Operation Mode Table 79. Operation Mode Overview Function Reset Normal Stop Sleep VDD/VDDX full full stop OFF HSUP full OFF OFF LSx full OFF OFF (64) Cyclic Sense(64) HSx full ADC full OFF OFF D2D full functional OFF full Wake-up(64) Wake-up(64) PTBx full OFF OFF LIN full Wake-up(64) Wake-up(64) Watchdog full(68) OFF OFF VSENSE full OFF OFF CSENSE full OFF OFF Cyclic Sense not active Cyclic Sense(64) Cyclic Sense(64) Lx Cyclic Sense OFF Note: 67. If configured. 68. Special init through non window watchdog. 5.4.7 Register Definition 5.4.7.1 Mode Control Register (MCR) Table 80. Mode Control Register (MCR) Offset(69) 0x16 R Access: User read/write 7 6 5 4 3 2 0 0 0 0 0 0 1 0 MODE W Reset 0 0 0 0 0 0 0 0 Note: 69. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 81. MCR - Register Field Descriptions Field 1-0 MODE Description Mode Select - These bits issue a transition from to the selected Operating mode. 00 - Normal mode. Only with effect in Stop mode. Issues Wake-up and transitions to Normal mode. 01 - Stop mode. Initiates transition to Stop mode.(70) 10 - Sleep mode. Initiates transition to Sleep mode. 11 - Normal mode. Note: 70. The Wake-up Source Register (WSR) has to be read after a wake-up condition in order to execute a new STOP mode command. Two base clock cycles (fBASE) delay are required between WSR read and MCR write. MM912_634 60 Analog Integrated Circuit Device Data Freescale Semiconductor 5.5 Power Supply MCU ANALOG The MM912_634 analog die supplies VDD (2.5 V), VDDX (5.0 V), and HSUP, based on the supply voltage applied to the VS1 pin. VDD is cascaded of the VDDX regulator. To separate the high-side outputs from the main power supply, the VS2 pin does only power the high-side drivers. Both supply pins have to be externally protected against reverse battery conditions. To supply external Hall Effect Sensors, the HSUP pin supplies a switchable regulated supply. See Section 5.11, “Hall Sensor Supply Output - HSUP". A reverse battery protected input (VSENSE) is implemented to measure the Battery Voltage directly. A serial resistor (RVSENSE) is required on this pin. See Section 5.23, “Supply Voltage Sense - VSENSE". In addition, the VS1 supply can be routed to the ADC (VS1SENSE) to measure the VS1 pin voltage directly. See Section 5.24, “Internal Supply Voltage Sense - VS1SENSE". To have an independent ADC verification, the internal sleep mode bandgap voltage can be routed to the ADC (BANDGAP). As this node is independent from the ADC reference, any out of range result would indicate malfunctioning ADC or Bandgap reference. See Section 5.25, “Internal Bandgap Reference Voltage Sense - BANDGAP". To stabilize the internal ADC reference voltage for higher precision measurements, the current limited ADC2p5 pin needs to be connected to an external filter capacitor (CADC2p5). It is not recommended to connect additional loads to this pin. See Section 5.20, “Analog Digital Converter - ADC". VSENSE VS1 VS2 The following safety features are implemented: • LBI - Low Battery Interrupt, internally measured at VSENSE • LVI - Low Voltage Interrupt, internally measured at VS1 • HVI - High Voltage Interrupt, internally measured at VS2 • VROVI - Voltage Regulator Overvoltage Interrupt internally measured at VDD and VDDX • LVR - Low Voltage Reset, internally measured at VDD • LVRX - Low Voltage Reset, internally measured at VDDX • HTI - High Temperature Interrupt measured between the VDD and VDDX regulators • Overtemperature Shutdown measured between the VDD and VDDX regulators LBI HVI HS1 HS2 ÷ HS1 & HS2 LVI ADC bg1p25sleep HSUP HSUP (18 V) Regulator VDDX (5.0 V) Regulator CHSUP VDDXINTERNAL VDDX LVRX VROV CVDDX ADC2p5 ADC 2.5 V Reference VDD (2.5 V) Regulator CADC VDD VDDINTERNAL LVR CVDD Figure 17. MM912_634 Power Supply 5.5.1 Voltage Regulators VDD (2.5 V) & VDDX (5.0 V) To supply the MCU die and minor additional loads two cascaded voltage regulators have been implemented, VDDX (5.0 V) and VDD (2.5 V). External capacitors (CVDD) and (CVDDX) are required for proper regulation. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 61 5.5.2 Power Up Behavior / Power Down Behavior - I64 MCU_POR MCU_LVR MCU_LVR MCU_POR To guarantee safe power up and down behavior, special dependencies are implemented to prevent unwanted MCU execution. Figure 18 shows a standard power up and power down sequence. RESET_A Normal Operating Range (not to scale) VLBI / VLVI VROVX 5.0 V VLVRX / VLVR_MCU VROV VLVR VPOR_A VPOR_MCU 4 1 5 2 3 6 VSUP VDDX VDD Figure 18. Power Up / Down Sequence To avoid any abnormal device behavior, it is essential to have the MCU Power on Reset (POR) block complete its start-up sequence before the analog die reset signal (RESET_A) is asserted. Since the RESET_A circuitry is supplied by VDDX, the voltage on the 2.5 V supply (VDD) needs to remain below the POR threshold whenever VDDX is too low to guarantee RESET_A can be properly asserted (3;6). This is achieved with the following implementation. Power Up: • The VDD regulator is enabled after VDDX reaches the VLVRX threshold (1). • Once VDD reaches VLVR, the RESET_A is released (2). • The MCU is also protected by the MCU_LVR. Power Down: • Once VDDX has reached the VLVRX threshold (4), the VDD regulator is disabled and the regulator output is actively pulled down to discharge any VDD capacitance (5). RESET_A is activated as well. • The active discharge guarantees VDD to be below POR level before VDDX discharges below critical level for the reset circuity. NOTE The behavior explained previously is essential for the 9S12I64 MCU die used, as this MCU does have an internal regulator stage, but the LVR function only active in normal mode 9S12I64. The shutdown behavior should be considered when sizing the external capacitors CVDD and CVDDX for extended low voltage operation. MM912_634 62 Analog Integrated Circuit Device Data Freescale Semiconductor 5.5.3 Register Definition 5.5.3.1 Voltage Control Register (VCR) Table 82. Voltage Control Register (VCR) Offset(69) Access: User read/write 0x04 R 7 6 5 0 0 0 4 3 2 1 0 VROVIE HTIE HVIE LVIE LBIE 0 0 0 0 0 W Reset 0 0 0 Note: 71. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 83. VCR - Register Field Descriptions Field 4 VROVIE Description Voltage Regulator Overvoltage Interrupt Enable — Enables the interrupt for the Regulator Overvoltage Condition. 0 - Voltage Regulator Overvoltage Interrupt is disabled 1 - Voltage Regulator Overvoltage Interrupt is enabled 3 HTIE High Temperature Interrupt Enable — Enables the interrupt for the Voltage Regulator (VDD/VDDX) Temperature Warning. 0 - High Temperature Interrupt is disabled 1 - High Temperature Interrupt is enabled 2 HVIE High Voltage Interrupt Enable — Enables the interrupt for the VS2 - High Voltage Warning. 0 - High Voltage Interrupt is disabled 1 - High Voltage Interrupt is enabled 1 LVIE Low Voltage Interrupt Enable — Enables the interrupt for the VS1 - Low Voltage Warning. 0 - Low Voltage Interrupt is disabled 1 - Low Voltage Interrupt is enabled 0 LBIE Low Battery Interrupt Enable — Enables the interrupt for the VSENSE - Low Battery Voltage Warning. 0 - Low Battery Interrupt is disabled 1 - Low Battery Interrupt is enabled 5.5.3.2 Voltage Status Register (VSR) Table 84. Voltage Status Register (VSR) Offset(72) 0x05 R Access: User read 7 6 5 4 3 2 1 0 0 0 0 VROVC HTC HVC LVC LBC 0 0 0 0 0 0 0 0 W Reset Note: 72. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 63 Table 85. VSR - Register Field Descriptions Field Description 4 VROVC Voltage Regulator Overvoltage Condition - This status bit indicates an overvoltage warning is present for at least one of the main voltage regulators (VDD or VDDX). Reading the register clears the VROVI flag if present. See Section 5.7, “Interrupts" for details. Note: This feature requires the trimming of Section 5.26.1.2.3, “Trimming Register 2 (CTR2)" to be done to be effective. Untrimmed devices may issue the VROVC condition including the LS turn off at normal operation. 0 - No Voltage Regulator Overvoltage Condition present. 1 - Voltage Regulator Overvoltage Condition present. 3 HTC High Temperature Condition - This status bit indicates a high temperature warning is present for the Voltage regulators (VDD/VDDX). Reading the register clears the HTI flag if present. See Section 5.7, “Interrupts" for details. 0 - No High Temperature Condition present. 1 - High Temperature Condition present. 2 HVC High Voltage Condition - This status bit indicates a high voltage warning for VS2 is present. Reading the register clears the HVI flag if present. See Section 5.7, “Interrupts" for details. 0 - No High Voltage Condition present. 1 - High Voltage Condition present. 1 LVC Low Voltage Condition - This status bit indicates a low voltage warning for VS1 is present. Reading the register clears the LVI flag if present. See Section 5.7, “Interrupts" for details. 0 - No Low Voltage Condition present. 1 - Low Voltage Condition present. 0 LBC Low Battery Condition - This status bit indicates a low voltage warning for VSENSE is present. Reading the register clears the LBI flag if present. See Section 5.7, “Interrupts" for details. 0 - No Low Battery Condition present. 1 - Low Battery Condition present. MCU ANALOG 5.6Die to Die Interface - Target The D2D Interface is the bus interface to the Microcontroller. Access to the MM912_634 analog die is controlled by the D2D Interface module. This section describes the functionality of the die-to-die target block (D2D). 5.6.1 Overview The D2D is the target for a data transfer from the target to the initiator (MCU). The initiator provides a set of configuration registers and two memory mapped 256 Byte address windows. When writing to a window, a transaction is initiated sending a write command, followed by an 8-bit address, and the data byte or word is received from the initiator. When reading from a window, a transaction is received with the read command, followed by an 8-bit address. The target then responds with the data. The basic idea is that a peripheral located on the MM912_634 analog die, can be addressed like an on-chip peripheral. Features: • software transparent register access to peripherals on the MM912_634 analog die • 256 Byte address window • supports blocking read or write, as well as non-blocking write transactions • 4-bit physical bus width • automatic synchronization of the target when initiator starts driving the interface clock • generates transaction and error status as well as EOT acknowledge • providing single interrupt interface to D2D Initiator MM912_634 64 Analog Integrated Circuit Device Data Freescale Semiconductor 5.6.2 Low Power Mode Operation The D2D module is disabled in SLEEP mode. In Stop mode, the D2DINT signal is used to wake-up a powered down MCU. As the MCU could wake-up without the MM912_634 analog die, a special command is recognized as a wake-up event during Stop mode. See . 5.6.2.1 Normal Mode / Stop Mode While in Normal or Stop mode, D2DCLK acts as input only with pull present. D2D[3:0] operates as an input/output with pull-down always present. D2DINT acts as output only. NOTE The maximum allowed clock speed of the interface is limited to fD2D. 5.6.2.2 Sleep Mode While in Sleep mode, all Interface data pins are pulled down to DGND to reduce power consumption. 5.7 Interrupts MCU ANALOG Interrupts are used to signal a microcontroller which a peripheral needs to be serviced. While in Stop mode, the interrupt signal is used to signal Wake-up events. The interrupts are signaled by an active high level of the D2DINT pin, which remains high until the interrupt is acknowledged via the D2D-Interface. Interrupts are only asserted while in Normal mode. 5.7.1 Interrupt Source Identification Once an Interrupt is signalized, there are two options to identify the corresponding source(s). 5.7.1.1 Interrupt Source Mirror All Interrupt sources in MM912_634 analog die are mirrored to a special Interrupt Source Register (ISR). This register is read only and indicates all currently pending Interrupts. Reading this register does not acknowledge any interrupt. An additional D2D access is necessary to serve the specific module. NOTE The VSI - Voltage Status Interrupt combines the five status flags for the Low Battery Interrupt, Low Voltage Interrupt, High Voltage Interrupt, Voltage Regulator Overvoltage Interrupt, and the Voltage Regulator High Temperature Interrupt. The specific source can be identified by reading the Voltage Status Register - VSR. 5.7.1.1.1 Interrupt Source Register (ISR) Table 86. Interrupt Source Register (ISR) Offset(69) 0x00 (0x00 and 0x01 for 8Bit access) R Access: User read 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 0 0 HOT LSOT HSOT LINOT SCI RX TX ERR TOV CH3 CH2 CH1 CH0 VSI W Note: 73. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 87. ISR - Register Field Descriptions Field Description 0 - VSI VSI - Voltage Status Interrupt combining the following sources: • Low Battery Interrupt • Low Voltage Interrupt • High Voltage Interrupt • Voltage Regulator Overvoltage Interrupt • Voltage Regulator High Temperature Interrupt 1 - CH0 CH0 - TIM Channel 0 Interrupt MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 65 Table 87. ISR - Register Field Descriptions (continued) Field Description 2 - CH1 CH1 - TIM Channel 1 Interrupt 3 - CH2 CH2 - TIM Channel 2 Interrupt 4 - CH3 CH3 - TIM Channel 3 Interrupt 5 - TOV TOV - Timer Overflow Interrupt 6 - ERR ERR - SCI Error Interrupt 7 - TX TX - SCI Transmit Interrupt 8 - RX RX - SCI Receive Interrupt 9 - SCI SCI - ADC Sequence Complete Interrupt 10 - LINOT LINOT - LIN Driver Overtemperature Interrupt 11 - HSOT HSOT - High-side Overtemperature Interrupt 12 - LSOT LSOT - Low-side Overtemperature Interrupt 13 - HOT HOT - HSUP Overtemperature Interrupt 5.7.1.2 Interrupt Vector Emulation by Priority To allow a vector based interrupt handling by the MCU, the number of the highest prioritized interrupt pending is returned in the Interrupt Vector Register. To allow an offset based vector table, the result is pre-shifted (multiple of 2). Reading this register does not acknowledge an interrupt. An additional D2D access is necessary to serve the specific module. 5.7.1.2.1 Interrupt Vector Register (IVR) Table 88. Interrupt Vector Register (IVR) Offset(74) 0x02 R Access: User read 7 6 0 0 5 4 3 2 1 0 IRQ W Note: 74. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 89. IVR - Register Field Descriptions Field 5:0 IRQ Description Represents the highest prioritized interrupt pending. See Table 90. If no interrupt is pending, the result is 0. The following table is listing all MM912_634 analog die interrupt sources with the corresponding priority. Table 90. Interrupt Source Priority Interrupt Source IRQ Priority no interrupt pending or wake-up from Stop mode 0x00 1 (highest) LVI - Low Voltage Interrupt 0x02 2 HTI - Voltage Regulator High Temperature Interrupt 0x04 3 LBI - Low Battery Interrupt 0x06 4 CH0 - TIM Channel 0 Interrupt 0x08 5 MM912_634 66 Analog Integrated Circuit Device Data Freescale Semiconductor Table 90. Interrupt Source Priority (continued) Interrupt Source IRQ Priority CH1 - TIM Channel 1 Interrupt 0x0A 6 CH2 - TIM Channel 2 Interrupt 0x0C 7 CH3 - TIM Channel 3 Interrupt 0x0E 8 TOV - Timer Overflow Interrupt 0x10 9 ERR - SCI Error Interrupt 0x12 10 TX - SCI Transmit Interrupt 0x14 11 RX - SCI Receive Interrupt 0x16 12 SCI - ADC Sequence Complete Interrupt 0x18 13 LINOT - LIN Driver Overtemperature Interrupt 0x1A 14 HSOT - High-side Overtemperature Interrupt 0x1C 15 LSOT - Low-side Overtemperature Interrupt 0x1E 16 HOT - HSUP Overtemperature Interrupt 0x20 17 HVI - High Voltage Interrupt 0x22 18 VROVI - Voltage Regulator Overvoltage Interrupt 0x24 19 (lowest) 5.7.2 5.7.2.1 Interrupt Sources Voltage Status Interrupt (VSI) The Voltage Status Interrupt - VSI combines the five interrupt sources of the Voltage Status Register. It is only available in the Interrupt Source Register (ISR). Acknowledge the interrupt by reading the Voltage Status Register - VSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.5, “Power Supply" for details on the Voltage Status Register including masking information. 5.7.2.2 Low Voltage Interrupt (LVI) Acknowledge the interrupt by reading the Voltage Status Register - VSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.5, “Power Supply" for details on the Voltage Status Register including masking information. 5.7.2.3 Voltage Regulator High Temperature Interrupt (HTI) Acknowledge the interrupt by reading the Voltage Status Register - VSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.5, “Power Supply" for details on the Voltage Status Register including masking information. 5.7.2.4 Low Battery Interrupt (LBI) Acknowledge the interrupt by reading the Voltage Status Register - VSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.5, “Power Supply" for details on the Voltage Status Register including masking information. 5.7.2.5 TIM Channel 0 Interrupt (CH0) See Section 5.19, “Basic Timer Module - TIM (TIM16B4C)". 5.7.2.6 TIM Channel 1 Interrupt (CH1) See Section 5.19, “Basic Timer Module - TIM (TIM16B4C)". 5.7.2.7 TIM Channel 2 Interrupt (CH2) See Section 5.19, “Basic Timer Module - TIM (TIM16B4C)". 5.7.2.8 TIM Channel 3 Interrupt (CH3) See Section 5.19, “Basic Timer Module - TIM (TIM16B4C)". MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 67 5.7.2.9 TIM Timer Overflow Interrupt (TOV) See Section 5.19, “Basic Timer Module - TIM (TIM16B4C)". 5.7.2.10 SCI Error Interrupt (ERR) See Section 5.16, “Serial Communication Interface (S08SCIV4)". 5.7.2.11 SCI Transmit Interrupt (TX) See Section 5.16, “Serial Communication Interface (S08SCIV4)". 5.7.2.12 SCI Receive Interrupt (RX) See Section 5.16, “Serial Communication Interface (S08SCIV4)". 5.7.2.13 LIN Driver Overtemperature Interrupt (LINOT) Acknowledge the interrupt by reading the LIN Register - LINR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.15, “LIN Physical Layer Interface - LIN" for details on the LIN Register including masking information. 5.7.2.14 High-side Overtemperature Interrupt (HSOT) Acknowledge the interrupt by reading the High-side Status Register - HSSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.12, “High-side Drivers - HS" for details on the High-side Status Register including masking information. 5.7.2.15 Low-side Overtemperature Interrupt (LSOT) Acknowledge the interrupt by reading the Low-side Status Register - LSSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.13, “Low-side Drivers - LSx" for details on the Low-side Status Register including masking information. 5.7.2.16 HSUP Overtemperature Interrupt (HOT) Acknowledge the interrupt by reading the Hall Supply Register - HSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.11, “Hall Sensor Supply Output - HSUP" for details on the Hall Supply Register including masking information. 5.7.2.17 High Voltage Interrupt (HVI) Acknowledge the interrupt by reading the Voltage Status Register - VSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.5, “Power Supply" for details on the Voltage Status Register including masking information. 5.7.2.18 Voltage Regulator Overvoltage Interrupt (VROVI) Acknowledge the interrupt by reading the Voltage Status Register - VSR. To issue a new interrupt, the condition has to vanish and occur again. See Section 5.5, “Power Supply" for details on the Voltage Status Register including masking information. MCU ANALOG 5.8Resets To protect the system during critical events, the MM912_634 analog die drives the RESET_A pin low during the presence of the reset condition. In addition, the RESET_A pin is monitored for external reset events. To match the MCU, the RESET_A pin is based on the VDDX voltage level. After an internal reset condition has gone, the RESET_A stays low for an additional time tRST before being released. Entering reset mode causes all MM912_634 analog die registers to be initialized to their RESET default. The only registers with valid information are the Reset Status Register (RSR) and the Wake-up Source Register (WUS). 5.8.1 Reset Sources In the MM912_634 six reset sources exist. 5.8.1.1 POR - Analog Die Power On Reset To indicate the device power supply (VS1) was below VPOR or the MM912_634 analog die was powered up, the POR condition is set. See Section 5.4, “Modes of Operation". MM912_634 68 Analog Integrated Circuit Device Data Freescale Semiconductor 5.8.1.2 LVR - Low Voltage Reset - VDD With the VDD voltage regulator output voltage falling below VLVR, the Low Voltage Reset condition becomes present. As the VDD Regulator is shutdown once a LVRX condition is detected, The actual cause could be also a low voltage condition at the VDDX regulator. See Section 5.5, “Power Supply". 5.8.1.3 LVRX - Low Voltage Reset - VDDX With the VDDX voltage regulator output voltage falling below VLVRX, the Low Voltage Reset condition becomes present. See Section 5.5, “Power Supply". 5.8.1.4 WUR - Wake-up Reset While in Sleep mode, any active wake-up event causes a MM912_634 analog die transition from Sleep to Reset Mode. To determine the wake-up source, refer to Section 5.9, “Wake-up / Cyclic Sense". 5.8.1.5 EXR - External Reset Any low level voltage at the RESET_A pin with a duration > tRSTDF issues an External Reset event. This reset source is also active in Stop mode. 5.8.1.6 WDR - Watchdog Reset Any incorrect serving if the MM912_634 analog die Watchdog results in a Watchdog Reset. Refer to the Section 5.10, “Window Watchdog" for details. 5.8.2 Register Definition 5.8.2.1 Reset Status Register (RSR) Table 91. Reset Status Register (RSR) Offset(74) 0x15 R Access: User read 7 6 5 4 3 2 1 0 0 0 WDR EXR WUR LVRX LVR POR W Note: 75. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 92. RSR - Register Field Descriptions Field Description 5 - WDR Watchdog Reset - Reset caused by an incorrect serving of the watchdog. 4 - EXR External Reset - Reset caused by the RESET_A pin driven low externally for > tRSTDF. 3 - WUR Wake-up Reset - Reset caused by a wake-up from Sleep mode. To determine the wake-up source, refer to Wake-up / Cyclic Sense. 2 - LVRX Low Voltage Reset VDDX - Reset caused by a low voltage condition monitored at the VDDX output. 1 - LVR Low Voltage Reset VDD - Reset caused by a low voltage condition monitored at the VDD output.(76) 0 - POR Power On Reset - Supply Voltage was below VPOR. Note: 76. As the VDD Regulator is shutdown once a LVRX condition is detected, The actual cause could be also a low voltage condition at the VDDX regulator. Reading the Reset Status register clears the information inside. Writing has no effect. LVR and LVRX are masked when POR or WUR are set. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 69 MCU ANALOG 5.9Wake-up / Cyclic Sense To wake-up the MM912_634 analog die from Stop or Sleep mode, several wake-up sources are implemented. As described in , a wake-up from Stop mode results in an interrupt (D2DINT) to the MCU combined with a transition to Normal mode. A wake-up from Sleep mode results in a transition to Reset mode. In any case, the source of the wake-up can be identified by reading the Wake-up Source Register (WSR). The Wake-up Source Register (WSR) has to be read after a wake-up condition to execute a new STOP mode command. Two base clock cycles (fBASE) delay are required between the WSR read and MCR write. In general, there are the following seven main wake-up sources: • Wake-up by a state change of one of the Lx inputs • Wake-up by a state change of one of the Lx inputs during a cyclic sense • Wake-up due to a forced wake-up • Wake-up by the LIN module • Wake-up by D2D interface (Stop mode only) • Wake-up due to internal / external Reset (Stop mode only) • Wake-up due to loss of supply voltage (Sleep mode only) VSUP HS1 HS2 D2DINT Wake-up Module D2DCLK D2D3 D2D2 Cyclic Sense / Forced Wake-up Timer Forced Wake-up D2D Wake Up L0 L1 L2 D2D1 L3 D2D0 Cyclic Wake-up Lx – Wake-up LIN Wake-up L4 L5 LIN LIN Bus Figure 19. Wake-up Sources 5.9.1 5.9.1.1 Wake-up Sources Lx - Wake-up (Cyclic Sense Disabled) Any state digital change on a Wake-up Enabled Lx input issues a wake-up. In order to select and activate a Wake-up Input (Lx), the Wake-up Control Register (WCR) must be configured with appropriate LxWE inputs enabled or disabled before entering low power mode. The Lx - Wake-up may be combined with the Forced Wake-up. Note: Selecting a Lx Input for wake-up disables a selected analog input once entering low power mode. 5.9.1.2 Lx - Cyclic Sense Wake-up To reduce external power consumption during low power mode a cyclic wake-up has been implemented. Configuring the Timing Control Register (TCR) a specific cycle time can be selected to implement a periodic switching of the HS1 or HS2 output with the corresponding detection of an Lx state change. Any configuration of the HSx in the High-side Control Register (HSCR) is ignored when entering low power mode. The Lx - Cyclic Sense Wake-up may be combined with the Forced Wake-up. In case both (forced and Lx change) events are present at the same time, the Forced Wake-up is indicated as Wake-up source. NOTE Once Cyclic Sense is configured (CSSEL!=0), the state change is only recognized from one cyclic sense event to the next. The additional accuracy of the cyclic sense cycle by the WD clock trimming is only active during STOP mode. There is no trimmed clock available during SLEEP mode. 5.9.1.3 Forced Wake-up Configuring the Forced Wake-up Multiplier (FWM) in the Timing Control Register (TCR) enables the forced wake-up based on the selected Cyclic Sense Timing (CST). Forced Wake-up can be combined with all other wake-up sources considering the timing dependencies. MM912_634 70 Analog Integrated Circuit Device Data Freescale Semiconductor 5.9.1.4 LIN - Wake-up While in Low-Power mode the MM912_634 analog die monitors the activity on the LIN bus. A dominant pulse longer than tPROPWL followed by a dominant to recessive transition causes a LIN Wake-up. This behavior protects the system from a short-to-ground bus condition. 5.9.1.5 D2D - Wake-up (Stop Mode only) Receiving a Normal mode request via the D2D interface (MODE=0, Mode Control Register (MCR)) results in a wake-up from stop mode. As this condition is controlled by the MCU, no wake-up status bit does indicate this wake-up source. 5.9.1.6 Wake-up Due to Internal / External Reset (STOP Mode Only) While in Stop mode, a Reset due to a VDD low voltage condition or an external Reset applied on the RESET_A pin results in a Wake-up with immediate transition to Reset mode. In this case, the LVR or EXR bits in the Reset Status Register indicates the source of the event. 5.9.1.7 Wake-up Due to Loss of Supply Voltage (SLEEP Mode Only) While in Sleep mode, a supply voltage VS1 < VPOR results in a transition to Power On mode. 5.9.2 Register Definition 5.9.2.1 Wake-up Control Register (WCR) Table 93. Wake-up Control Register (WCR) Offset(76) 0x12 Access: User read/write 7 6 5 4 3 2 1 0 L5WE L4WE L3WE L2WE L1WE L0WE 1 1 1 1 1 1 R CSSEL W Reset 0 0 Note: 77. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 94. WCR - Register Field Descriptions Field Description 7-6 CSSEL Cyclic Sense Select - Configures the HSx output for the cyclic sense event. Note, with no LxWE selected - only the selected HSx output is switched periodically, no Lx state change would be detected. For all configurations, the Forced Wake-up can be activated in parallel in Section 5.9.2.2, “Timing Control Register (TCR)" 00 - Cyclic Sense Off 01 - Cyclic Sense with periodic HS1on 10 - Cyclic Sense with periodic HS2 on 11 - Cyclic Sense with periodic HS1 and HS2 on. 5 - L5WE Wake-up Input 5 Enabled - L5 Wake-up Select Bit. 0 - L5 Wake-up Disabled 1 - L5 Wake-up Enabled 4 - L4WE Wake-up Input 4 Enabled - L4 Wake-up Select Bit. 0 - L4 Wake-up Disabled 1 - L4 Wake-up Enabled 3 - L3WE Wake-up Input 3 Enabled - L3 Wake-up Select Bit. 0 - L3Wake-up Disabled 1 - L3 Wake-up Enabled 2- L2WE Wake-up Input 2 Enabled - L2 Wake-up Select Bit. 0 - L2 Wake-up Disabled 1 - L2 Wake-up Enabled MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 71 Table 94. WCR - Register Field Descriptions (continued) Field Description 1 - L1WE Wake-up Input 1 Enabled - L1 Wake-up Select Bit. 0 - L1 Wake-up Disabled 1 - L1 Wake-up Enabled 0 - L0WE Wake-up Input 0 Enabled - L0 Wake-up Select Bit. 0 - L0 Wake-up Disabled 1 - L0 Wake-up Enabled 5.9.2.2 Timing Control Register (TCR) Table 95. Timing Control Register (TCR) Offset(78) 0x13 Access: User read/write 7 6 5 4 3 2 1 0 0 0 R FWM CST W Reset 0 0 0 0 0 0 Note: 78. Offset related to 0x0200 for blocking access and 0x300 for non blocking access within the global address space. Table 96. TCR - Register Field Descriptions Field Description 7-4 FWM Forced Wake-up Multiplicator - Configures the multiplicator for the forced wake-up. The selected multiplicator (FWM!=0) forces a wake-up every FWM x CST ms. With this implementation, Forced and Cyclic wake-up can be performed in parallel with the cyclic sense period GO Opcode (hex) Data Description 18 none (Previous enable tagging and go to user program.) This command is deprecated and should not be used.  Opcode is executed as a GO command. Note: 187. If enabled, ACK occurs when data is ready for transmission for all BDM READ commands and occurs after the write is complete for all BDM WRITE commands. 188. When the firmware command READ_NEXT or WRITE_NEXT is used to access the BDM address space the BDM resources are accessed rather than user code. Writing BDM firmware is not possible. 189. System stop disables the ACK function and ignored commands do not have an ACK-pulse (e.g., CPU in stop mode). The GO_UNTIL command does not get an Acknowledge if CPU executes the stop instruction before the “UNTIL” condition (BDM active again) is reached (see Section 5.31.4.7, “Serial Interface Hardware Handshake Protocol" last note). 5.31.4.5 BDM Command Structure Hardware and firmware BDM commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word, depending on the command. All the read commands return 16 bits of data despite the byte or word implication in the command name.{Satatement} 8-bit reads return 16-bits of data, only one byte of which contains valid data. If reading an even address, the valid data appears in the MSB. If reading an odd address, the valid data appears in the LSB. 16-bit misaligned reads and writes are generally not allowed. If attempted by BDM hardware command, the BDM ignores the least significant bit of the address and assumes an even address from the remaining bits. For hardware data read commands, the external host must wait at least 150 bus clock cycles after sending the address before attempting to obtain the read data. This is to be certain valid data is available in the BDM shift register, ready to be shifted out. For hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay which can be incurred as the BDM waits for a free cycle before stealing a cycle. For BDM firmware read commands, the external host should wait at least 48 bus clock cycles after sending the command opcode and before attempting to obtain the read data. The 48 cycle wait allows enough time for the requested data to be made available in the BDM shift register, ready to be shifted out. For BDM firmware write commands, the external host must wait 36 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The external host should wait for at least for 76 bus clock cycles after a TRACE1 or GO command before starting any new serial command. This is to allow the CPU to exit gracefully from the standard BDM firmware lookup table and resume execution of the user code. Disturbing the BDM shift register prematurely may adversely affect the exit from the standard BDM firmware lookup table. NOTE If the bus rate of the target processor is unknown or could be changing, it is recommended the ACK (acknowledge function) is used to indicate when an operation is complete. When using ACK, the delay times are automated. Figure 56 represents the BDM command structure. The command blocks illustrate a series of eight bit times starting with a falling edge. The bar across the top of the blocks indicates the BKGD line idles in the high state. The time for an 8-bit command is 8  16 target clock cycles.(190) Note: 190. Target clock cycles are cycles measured using the target MCU’s serial clock rate. See Section 5.31.4.6, “BDM Serial Interface" and Section 5.31.3.2.1, “BDM Status Register (BDMSTS)" for information on how serial clock rate is selected. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 185 Hardware Read 8 Bits AT ~16 TC/Bit 16 Bits AT ~16 TC/Bit Command Address 150-BC Delay 16 Bits AT ~16 TC/Bit Next Command Data 150-BC Delay Hardware Write Command Address Data Next Command 48-BC DELAY Firmware Read Data Command Next Command 36-BC DELAY Firmware Write Command Data Next Command 76-BC Delay GO, TRACE Command Next Command BC = Bus Clock Cycles TC = Target Clock Cycles Figure 56. BDM Command Structure 5.31.4.6 BDM Serial Interface The BDM communicates with external devices serially via the BKGD pin. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the BDM. This clock is referred to as the target clock in the following explanation. The BDM serial interface uses a clocking scheme in which the external host generates a falling edge on the BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per bit. The interface times out if 512 clock cycles occur between falling edges from the host. The BKGD pin is a pseudo open-drain pin and has an weak on-chip active pull-up which is enabled at all times. It is assumed there is an external pull-up and so drivers connected to BKGD do not typically drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host for transmit cases and the target for receive cases. The timing for host-to-target is shown in Figure 57 and of target-to-host in Figure 58 and Figure 59. All four cases begin when the host drives the BKGD pin low to generate a falling edge. Since the host and target are operating from separate clocks, it can take the target system up to one full clock cycle to recognize this edge. The target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove BKGD low to start the bit up to one target clock cycle earlier. Synchronization between the host and target is established in this manner at the start of every bit time. Figure 57 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic requires the pin be driven high no later than eight target clock cycles after the falling edge for a logic 1 transmission. Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. MM912_634 186 Analog Integrated Circuit Device Data Freescale Semiconductor BDM Clock (Target MCU) Host Transmit 1 Host Transmit 0 Perceived Start of Bit Time Target Senses Bit Earliest Start of Next Bit 10 Cycles Synchronization Uncertainty Figure 57. BDM Host-to-Target Serial Bit Timing The receive cases are more complicated. Figure 58 shows the host receiving a logic 1 from the target system. Since the host is asynchronous to the target, there is up to one clock-cycle delay from the host-generated falling edge on BKGD to the perceived start of the bit time in the target. The host holds the BKGD pin low long enough for the target to recognize it (at least two target clock cycles). The host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock cycles after it started the bit time. BDM Clock (Target MCU) Host Drive to BKGD Pin High-Impedance Target System Speedup Pulse High-Impedance Perceived Start of Bit Time High-Impedance R-C Rise BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 58. BDM Target-to-Host Serial Bit Timing (Logic 1) Figure 59 shows the host receiving a logic 0 from the target. Since the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on BKGD to the start of the bit time as perceived by the target. The host initiates the bit time but the target finishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target clock cycles then briefly drives it high to speed up the rising edge. The host samples the bit level about 10 target clock cycles after starting the bit time. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 187 BDM Clock (Target MCU) Host Drive to BKGD Pin High-Impedance Speedup Pulse Target System Drive and Speedup Pulse Perceived Start of Bit Time BKGD Pin 10 Cycles 10 Cycles Earliest Start of Next Bit Host Samples BKGD Pin Figure 59. BDM Target-to-Host Serial Bit Timing (Logic 0) 5.31.4.7 Serial Interface Hardware Handshake Protocol BDM commands require CPU execution is ultimately treated at the MCU bus rate. Since the BDM clock source can be modified, it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the CPU. The alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. This sub-section describes the hardware handshake protocol. The hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. This protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the BKGD pin. This pulse is generated by the target MCU when a command, issued by the host, has been successfully executed (see Figure 60). This pulse is referred to as the ACK pulse. After the ACK pulse has finished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (BACKGROUND, GO, GO_UNTIL or TRACE1). The ACK pulse is not issued earlier than 32 serial clock cycles after the BDM command was issued. The end of the BDM command is assumed to be the 16th tick of the last bit. This minimum delay assures enough time for the host to perceive the ACK pulse. Note also, there is no upper limit for the delay between the command and the related ACK pulse, since the command execution depends upon the CPU bus, which in some cases could be very slow due to long accesses taking place.This protocol allows a great flexibility for the POD designers, since it does not rely on any accurate time measurement or short response time to any event in the serial communication. BDM Clock (Target MCU) Target Transmits ACK Pulse High-Impedance 32 Cycles 16 Cycles High-Impedance Speedup Pulse Minimum Delay From the BDM Command BKGD Pin Earliest Start of Next Bit 16th Tick of the Last Command Bit Figure 60. Target Acknowledge Pulse (ACK) NOTE If the ACK pulse was issued by the target, the host assumes the previous command was executed. If the CPU enters stop prior to executing a hardware command, the ACK pulse is not issued meaning the BDM command was not executed. After entering stop mode, the BDM command is no longer pending. MM912_634 188 Analog Integrated Circuit Device Data Freescale Semiconductor Figure 61 shows the ACK handshake protocol in a command level timing diagram. The READ_BYTE instruction is used as an example. First, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. The target BDM decodes the instruction. A bus cycle is grabbed (free or stolen) by the BDM and it executes the READ_BYTE operation. Having retrieved the data, the BDM issues an ACK pulse to the host controller, indicating the addressed byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the byte retrieval process. Note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. Target BKGD Pin READ_BYTE Host Byte Address Host (2) Bytes are Retrieved New BDM Command Host Target Target BDM Issues the ACK Pulse (out of scale) BDM Decodes the Command BDM Executes the READ_BYTE Command Figure 61. Handshake Protocol at the Command Level Differently from the normal bit transfer (where the host initiates the transmission), the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative edge on the BKGD pin. The hardware handshake protocol in Figure 60 specifies the timing when the BKGD pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical conflict on the BKGD pin. NOTE The only place the BKGD pin can have an electrical conflict is when one side is driving low and the other side is issuing a speedup pulse (high). Other “highs” are pulled rather than driven. However, at low rates the time of the speedup pulse can become lengthy and so the potential conflict time becomes longer as well. The ACK handshake protocol does not support nested ACK pulses. If a BDM command is not acknowledge by an ACK pulse, the host needs to abort the pending command first in order to be able to issue a new BDM command. When the CPU enters stop while the host issues a hardware command (e.g., WRITE_BYTE), the target discards the incoming command due to the stop being detected. Therefore, the command is not acknowledged by the target, which means the ACK pulse is not issued in this case. After a certain time the host (not aware of stop) should decide to abort any possible pending ACK pulse in order to be sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command, and its corresponding ACK, can be aborted. NOTE The ACK pulse does not provide a timeout. This means for the GO_UNTIL command, it cannot be distinguished if a stop has been executed (command discarded and ACK not issued) or if the “UNTIL” condition (BDM active) is just not reached yet. Hence in any case where the ACK pulse of a command is not issued the possible pending command should be aborted before issuing a new command. See the handshake abort procedure described in Section 5.31.4.8, “Hardware Handshake Abort Procedure". 5.31.4.8 Hardware Handshake Abort Procedure The abort procedure is based on the SYNC command. In order to abort a command, which had not issued the corresponding ACK pulse, the host controller should generate a low pulse in the BKGD pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse.By detecting this long low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 5.31.4.9, “SYNC — Request Timed Reference Pulse", and assumes the pending command and therefore the related ACK pulse, are being aborted. Therefore, after the SYNC protocol has been completed the host is free to issue new BDM commands. For BDM firmware READ or WRITE commands it can not be guaranteed the pending command is aborted when issuing a SYNC before the corresponding ACK pulse. There is a short latency time from the time the READ or WRITE access begins until it is finished and the corresponding ACK pulse is issued. The latency time depends on the firmware READ or WRITE command is issued and on the selected bus clock rate. When the SYNC command starts during this latency time the READ or WRITE command is not aborted, but the corresponding ACK pulse is aborted. A pending GO, TRACE1 or GO_UNTIL command can not be aborted. Only the corresponding ACK pulse can be aborted by the SYNC command. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 189 Although it is not recommended, the host could abort a pending BDM command by issuing a low pulse in the BKGD pin shorter than 128 serial clock cycles, which is not interpreted as the SYNC command. The ACK is actually aborted when a negative edge is perceived by the target in the BKGD pin. The short abort pulse should have at least 4 clock cycles keeping the BKGD pin low, in order to allow the negative edge to be detected by the target.In this case, the target does not execute the SYNC protocol but the pending command is aborted along with the ACK pulse. The potential problem with this abort procedure is when there is a conflict between the ACK pulse and the short abort pulse. In this case, the target may not perceive the abort pulse. The worst case is when the pending command is a read command (i.e., READ_BYTE). If the abort pulse is not perceived by the target the host attempts to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. In this case, host and target runs out of synchronism. However, if the command to be aborted is not a read command the short abort pulse could be used. After a command is aborted the target assumes the next negative edge, after the abort pulse, is the first bit of a new BDM command. NOTE The details about the short abort pulse are being provided only as a reference for the reader to better understand the BDM internal behavior. It is not recommended this procedure be used in a real application. Since the host knows the target serial clock frequency, the SYNC command (used to abort a command) does not need to consider the lower possible target frequency. In this case, the host could issue a SYNC very close to the 128 serial clock cycles length. Providing a small overhead on the pulse length in order to assure the SYNC pulse is not misinterpreted by the target. See Section 5.31.4.9, “SYNC — Request Timed Reference Pulse". Figure 62 shows a SYNC command being issued after a READ_BYTE, which aborts the READ_BYTE command. Note that, after the command is aborted a new command could be issued by the host computer. READ_BYTE CMD is Aborted by the SYNC Request (Out of Scale) BKGD Pin READ_BYTE Memory Address Host SYNC Response From the Target (Out of Scale) READ_STATUS Target Host BDM Decode and Starts to Execute the READ_BYTE Command New BDM Command Target Host Target New BDM Command Figure 62. ACK Abort Procedure at the Command Level NOTE Figure 62 does not represent the signals in a true timing scale Figure 63 shows a conflict between the ACK pulse and the SYNC request pulse. This conflict could occur if a POD device is connected to the target BKGD pin and the target is already in debug active mode. Consider that the target CPU is executing a pending BDM command at the exact moment the POD is being connected to the BKGD pin. In this case, an ACK pulse is issued along with the SYNC command. In this case, there is an electrical conflict between the ACK speedup pulse and the SYNC pulse. Since this is not a probable situation, the protocol does not prevent this conflict from happening. At Least 128 Cycles BDM Clock (Target MCU) Target MCU Drives to BKGD Pin Host Drives SYNC To BKGD Pin ACK Pulse High-Impedance Host and Target Drive to BKGD Pin Electrical Conflict Speedup Pulse Host SYNC Request Pulse BKGD Pin 16 Cycles Figure 63. ACK Pulse and SYNC Request Conflict MM912_634 190 Analog Integrated Circuit Device Data Freescale Semiconductor NOTE This information is being provided so the MCU integrator is aware such a conflict could occur. The hardware handshake protocol is enabled by the ACK_ENABLE and disabled by the ACK_DISABLE BDM commands. This provides backwards compatibility with the existing POD devices which are not able to execute the hardware handshake protocol. It also allows for new POD devices, supporting the hardware handshake protocol, to freely communicate with the target device. If desired, without the need for waiting for the ACK pulse. The commands are described as follows: • ACK_ENABLE — enables the hardware handshake protocol. The target issues the ACK pulse when a CPU command is executed by the CPU. The ACK_ENABLE command itself also has the ACK pulse as a response. • ACK_DISABLE — disables the ACK pulse protocol. In this case, the host needs to use the worst case delay time at the appropriate places in the protocol. The default state of the BDM after reset is hardware handshake protocol disabled. All the read commands ACK (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the BKGD serial pin. All the write commands ACK (if enabled) after the data has been received by the BDM through the BKGD serial pin and when the data bus cycle is complete. See Section 5.31.4.3, “BDM Hardware Commands" and Section 5.31.4.4, “Standard BDM Firmware Commands" for more information on the BDM commands. The ACK_ENABLE sends an ACK pulse when the command has been completed. This feature could be used by the host to evaluate if the target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command, the host knows the target supports the hardware handshake protocol. If the target does not support the hardware handshake protocol the ACK pulse is not issued. In this case, the ACK_ENABLE command is ignored by the target since it is not recognized as a valid command. The BACKGROUND command issues an ACK pulse when the CPU changes from normal to background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO command issues an ACK pulse when the CPU exits from background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO_UNTIL command is equivalent to a GO command with exception that the ACK pulse, in this case, is issued when the CPU enters into background mode. This command is an alternative to the GO command and should be used when the host wants to trace if a breakpoint match occurs and causes the CPU to enter active background mode. Note that the ACK is issued whenever the CPU enters BDM, which could be caused by a breakpoint match or by a BGND instruction being executed. The ACK pulse related to this command could be aborted using the SYNC command. The TRACE1 command has the related ACK pulse issued when the CPU enters background active mode after one instruction of the application program is executed. The ACK pulse related to this command could be aborted using the SYNC command. 5.31.4.9 SYNC — Request Timed Reference Pulse The SYNC command is unlike other BDM commands because the host does not necessarily know the correct communication speed to use for BDM communications until after it has analyzed the response to the SYNC command. To issue a SYNC command, the host should perform the following steps: 1. Drive the BKGD pin low for at least 128 cycles at the lowest possible BDM serial communication frequency 2. Drive BKGD high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. Remove all drive to the BKGD pin so it reverts to high impedance. 4. Listen to the BKGD pin for the sync response pulse. Upon detecting the SYNC request from the host, the target performs the following steps: 1. Discards any incomplete command received or bit retrieved. 2. Waits for BKGD to return to a logic one. 3. Delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. Drives BKGD low for 128 cycles at the current BDM serial communication frequency. 5. Drives a one-cycle high speedup pulse to force a fast rise time on BKGD. 6. Removes all drive to the BKGD pin so it reverts to high impedance. The host measures the low time of this 128 cycle SYNC response pulse and determines the correct speed for subsequent BDM communications. Typically, the host can determine the correct communication speed within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. As soon as the SYNC request is detected by the target, any partially received command or bit retrieved is discarded. This is referred to as a soft-reset, equivalent to a time-out in the serial communication. After the SYNC response, the target considers the next negative edge (issued by the host) as the start of a new BDM command or the start of new SYNC request. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 191 Another use of the SYNC command pulse is to abort a pending ACK pulse. The behavior is exactly the same as in a regular SYNC command. Note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. In this case, the command may not have been understood by the target and so an ACK response pulse is not issued. 5.31.4.10 Instruction Tracing When a TRACE1 command is issued to the BDM in active BDM, the CPU exits the standard BDM firmware and executes a single instruction in the user code. Once this has occurred, the CPU is forced to return to the standard BDM firmware and the BDM is active and ready to receive a new command. If the TRACE1 command is issued again, the next user instruction is executed. This facilitates stepping or tracing through the user code one instruction at a time. If an interrupt is pending when a TRACE1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. Once back in standard BDM firmware execution, the program counter points to the first instruction in the interrupt service routine. Be aware when tracing through the user code, the execution of the user code is done step by step but peripherals are free running. Hence possible timing relations between CPU code execution and occurrence of events of other peripherals no longer exist. Do not trace the CPU instruction BGND used for soft breakpoints. Tracing over the BGND instruction results in a return address pointing to BDM firmware address space. When tracing through user code which contains stop instructions the following happens when the stop instruction is traced: The CPU enters stop mode and the TRACE1 command can not be finished before leaving the low power mode. This is the case because BDM active mode can not be entered after CPU executed the stop instruction. However all BDM hardware commands except the BACKGROUND command are operational after tracing a stop instruction and still being in stop mode. If system stop mode is entered (all bus masters are in stop mode) no BDM command is operational. As soon as stop mode is exited the CPU enters BDM active mode and the saved PC value points to the entry of the corresponding interrupt service routine. In case the handshake feature is enabled the corresponding ACK pulse of the TRACE1 command is discarded when tracing a stop instruction. Hence there is no ACK pulse when BDM active mode is entered as part of the TRACE1 command after CPU exited from stop mode. All valid commands sent during CPU being in stop mode or after CPU exited from stop mode has an ACK pulse. The handshake feature becomes disabled only when system stop mode has been reached. Hence after a system stop mode the handshake feature must be enabled again by sending the ACK_ENABLE command. 5.31.4.11 Serial Communication Timeout The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If BKGD is kept low for more than 128 target clock cycles, the target understands a SYNC command was issued. In this case, the target keeps waiting for a rising edge on BKGD in order to answer the SYNC request pulse. If the rising edge is not detected, the target keeps waiting forever without any timeout limit. Consider now the case where the host returns BKGD to logic one before 128 cycles. This is interpreted as a valid bit transmission, and not as a SYNC request. The target keeps waiting for another falling edge marking the start of a new bit. If, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a timeout occurs and the current command is discarded without affecting memory or the operating mode of the MCU. This is referred to as a soft-reset. If a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset occurs causing the command to be disregarded. The data is not available for retrieval after the timeout has occurred. This is the expected behavior if the handshake protocol is not enabled. In order to allow the data to be retrieved even with a large clock frequency mismatch (between BDM and CPU) when the hardware handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. Therefore, the host could wait for more then 512 serial clock cycles and still be able to retrieve the data from an issued read command. However, once the handshake pulse (ACK pulse) is issued, the timeout feature is re-activated, meaning the target times out after 512 clock cycles. Therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ACK pulse had been issued. After this period, the read command is discarded and the data is no longer available for retrieval. Any negative edge in the BKGD pin after the timeout period is considered to be a new command or a SYNC request. Note that whenever a partially issued command, or partially retrieved data, has occurred the timeout in the serial communication is active. This means if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset occurs causing the partially received command or data retrieved to be disregarded. The next negative edge in the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDM command, or the start of a SYNC request pulse. MM912_634 192 Analog Integrated Circuit Device Data Freescale Semiconductor 5.32 S12S Debug Module (S12SDBGV2) 5.32.1 Introduction The S12SDBG module provides an on-chip trace buffer with flexible triggering capability to allow non-intrusive debug of application software. The S12SDBG module is optimized for S12SCPU debugging. Typically the S12SDBG module is used in conjunction with the S12SBDM module, whereby the user configures the S12SDBG module for a debugging session over the BDM interface. Once configured the S12SDBG module is armed and the device leaves BDM returning control to the user program, which is then monitored by the S12SDBG module. Alternatively the S12SDBG module can be configured over a serial interface using SWI routines. 5.32.1.1 Glossary Of Terms COF: Change Of Flow. Change in the program flow due to a conditional branch, indexed jump or interrupt. BDM: Background Debug Mode S12SBDM: Background Debug Module DUG: Device User Guide, describing the features of the device into which the DBG is integrated. WORD: 16 bit data entity Data Line: 20 bit data entity CPU: S12SCPU module DBG: S12SDBG module POR: Power On Reset Tag: Tags can be attached to CPU opcodes as they enter the instruction pipe. If the tagged opcode reaches the execution stage a tag hit occurs. 5.32.1.2 Overview The comparators monitor the bus activity of the CPU module. A match can initiate a state sequencer transition. On a transition to the Final State, bus tracing is triggered and/or a breakpoint can be generated. Independent of comparator matches a transition to Final State with associated tracing and breakpoint can be triggered immediately by writing to the TRIG control bit. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. Tracing is disabled when the MCU system is secured. 5.32.1.3 • • • • • Features Three comparators (A, B and C) — Comparators A compares the full address bus and full 16-bit data bus — Comparator A features a data bus mask register — Comparators B and C compare the full address bus only — Each comparator features selection of read or write access cycles — Comparator B allows selection of byte or word access cycles — Comparator matches can initiate state sequencer transitions Three comparator modes — Simple address/data comparator match mode — Inside address range mode, Addmin  Address Addmax — Outside address range match mode, Address Addminor Address  Addmax Two types of matches — Tagged — This matches just before a specific instruction begins execution — Force — This is valid on the first instruction boundary after a match occurs Two types of breakpoints — CPU breakpoint entering BDM on breakpoint (BDM) — CPU breakpoint executing SWI on breakpoint (SWI) Trigger mode independent of comparators — TRIG Immediate software trigger MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 193 • Four trace modes — Normal: change of flow (COF) PC information is stored (see Section 5.32.4.5.2.1, “Normal Mode") for change of flow definition. — Loop1: same as Normal but inhibits consecutive duplicate source address entries — Detail: address and data for all cycles except free cycles and opcode fetches are stored — Compressed Pure PC: all program counter addresses are stored 4-stage state sequencer for trace buffer control — Tracing session trigger linked to Final State of state sequencer — Begin and End alignment of tracing to trigger • 5.32.1.4 Modes of Operation The DBG module can be used in all MCU functional modes. During BDM hardware accesses and whilst the BDM module is active, CPU monitoring is disabled. When the CPU enters active BDM Mode through a BACKGROUND command, the DBG module, if already armed, remains armed. The DBG module tracing is disabled if the MCU is secure, however, breakpoints can still be generated Table 276. Mode Dependent Restriction Summary BDM Enable BDM Active MCU Secure Comparator Matches Enabled Breakpoints Possible Tagging Possible Tracing Possible x x 1 Yes Yes Yes No 0 0 0 Yes Only SWI Yes Yes 0 1 0 1 0 0 Yes Yes Yes Yes 1 1 0 No No No No 5.32.1.5 Active BDM not possible when not enabled Block Diagram TAGS TAGHITS BREAKPOINT REQUESTS TO CPU COMPARATOR A COMPARATOR B COMPARATOR C COMPARATOR MATCH CONTROL CPU BUS BUS INTERFACE SECURE MATCH0 MATCH1 TAG & MATCH CONTROL LOGIC TRANSITION STATE STATE SEQUENCER STATE MATCH2 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 64. Debug Module Block Diagram 5.32.2 External Signal Description There are no external signals associated with this module. MM912_634 194 Analog Integrated Circuit Device Data Freescale Semiconductor 5.32.3 5.32.3.1 Memory Map and Registers Module Memory Map A summary of the registers associated with the DBG sub-block is shown in Figure 277. Detailed descriptions of the registers and bits are given in the subsections which follow. Table 277. Quick Reference to DBG Registers Address Name 0x0020 DBGC1 Bit 7 R 5 4 3 0 0 BDM DBGBRK 0 0 0 0 0 ARM W R 0x0021 6 2 1 Bit 0 0 COMRV TRIG TBF(191) 0 SSF2 SSF1 SSF0 DBGSR W R 0x0022 0 DBGTCR 0 TSOURCE TRCMOD TALIGN W R 0x0023 0 0 0 0 0 0 DBGC2 ABCM W R 0x0024 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 TBF 0 0 0 SC3 SC2 SC1 SC0 DBGTBH W R 0x0025 DBGTBL W R 0x0026 CNT DBGCNT W R 0x0027 0 0 DBGSCRX W R 0x0027 0 0 0 0 0 MC2 MC1 MC0 SZE SZ TAG BRK RW RWE NDB COMPE SZE SZ TAG BRK RW RWE 0 0 TAG BRK RW RWE 0 0 0 0 DBGMFR W R 0x0028 DBGACTL W R 0x0028 DBGBCTL 0 COMPE W R 0x0028 DBGCCTL 0 COMPE W R 0x0029 0 0 DBGXAH Bit 17 Bit 16 W R 0x002A DBGXAM Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 W R 0x002B DBGXAL W MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 195 Table 277. Quick Reference to DBG Registers (continued) Address Name 0x002C DBGADH Bit 7 6 5 4 3 2 1 Bit 0 Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 Bit 15 14 13 12 11 10 9 Bit 8 Bit 7 6 5 4 3 2 1 Bit 0 R W R 0x002D DBGADL W R 0x002E DBGADHM W R 0x002F DBGADLM W Note: 191. 192. 193. 194. This bit is visible at DBGCNT[7] and DBGSR[7] This represents the contents if the Comparator A control register is blended into this address. This represents the contents if the Comparator B control register is blended into this address. This represents the contents if the Comparator C control register is blended into this address. 5.32.3.2 Register Descriptions This section consists of the DBG control and trace buffer register descriptions in address order. Each comparator has a bank of registers visible through an 8-byte window between 0x0028 and 0x002F in the DBG module register address map. When ARM is set in DBGC1, the only bits in the DBG module registers which can be written are ARM, TRIG, and COMRV[1:0] 5.32.3.2.1 Debug Control Register 1 (DBGC1) Table 278. Debug Control Register (DBGC1) Address: 0x0020 7 R 6 5 0 0 ARM W Reset 4 3 BDM DBGBRK 0 0 2 1 0 0 COMRV TRIG 0 0 0 0 0 0 = Unimplemented or Reserved Read: Anytime Write: Bits 7, 1, 0 anytime  Bit 6 can be written anytime but always reads back as 0.  Bits 4:3 anytime DBG is not armed. NOTE When disarming the DBG by clearing ARM with software, the contents of bits[4:3] are not affected by the write, since up until the write operation, ARM = 1 preventing these bits from being written. These bits must be cleared using a second write if required. MM912_634 196 Analog Integrated Circuit Device Data Freescale Semiconductor Table 279. DBGC1 Field Descriptions Field Description 7 ARM Arm Bit — The ARM bit controls whether the DBG module is armed. This bit can be set and cleared by user software and is automatically cleared on completion of a debug session, or if a breakpoint is generated with tracing not enabled. On setting this bit the state sequencer enters State1. 0 Debugger disarmed 1 Debugger armed 6 TRIG Immediate Trigger Request Bit — This bit when written to 1 requests an immediate trigger independent of state sequencer status. When tracing is complete a forced breakpoint may be generated depending upon DBGBRK and BDM bit settings. This bit always reads back a 0. Writing a 0 to this bit has no effect. If the DBGTCR_TSOURCE bit is clear no tracing is carried out. If tracing has already commenced using BEGIN trigger alignment, it continues until the end of the tracing session as defined by the TALIGN bit, thus TRIG has no affect. In secure mode tracing is disabled and writing to this bit cannot initiate a tracing session. The session is ended by setting TRIG and ARM simultaneously. 0 Do not trigger until the state sequencer enters the Final State. 1 Trigger immediately 4 BDM Background Debug Mode Enable — This bit determines if a breakpoint causes the system to enter Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDM is not enabled by the ENBDM bit in the BDM module, then breakpoints default to SWI. 0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint. 1 Breakpoint to BDM, if BDM enabled. Otherwise breakpoint to SWI 3 DBGBRK S12SDBG Breakpoint Enable Bit — The DBGBRK bit controls whether the debugger is request a breakpoint on reaching the state sequencer Final State. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If tracing is not enabled, the breakpoint is generated immediately. 0 No Breakpoint generated 1 Breakpoint generated 1–0 COMRV Comparator Register Visibility Bits — These bits determine which bank of comparator register is visible in the 8-byte window of the S12SDBG module address map, located between 0x0028 to 0x002F. Furthermore these bits determine which register is visible at the address 0x0027. See Table 280. Table 280. COMRV Encoding COMRV Visible Comparator Visible Register at 0x0027 00 Comparator A DBGSCR1 01 Comparator B DBGSCR2 10 Comparator C DBGSCR3 11 None DBGMFR 5.32.3.2.2 Debug Status Register (DBGSR) Table 281. Debug Status Register (DBGSR) Address: 0x0021 R 7 6 5 4 3 2 1 0 TBF 0 0 0 0 SSF2 SSF1 SSF0 — 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset POR = Unimplemented or Reserved Read: Anytime Write: Never MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 197 Table 282. DBGSR Field Descriptions Field Description 7 TBF Trace Buffer Full — The TBF bit indicates the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines is valid data, regardless of the value of DBGCNT bits. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit This bit is also visible at DBGCNT[7] 2–0 SSF[2:0] State Sequencer Flag Bits — The SSF bits indicate in which state the State Sequencer is currently in. During a debug session on each transition to a new state these bits are updated. If the debug session is ended by software clearing the ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a debug session is ended by an internal event, then the state sequencer returns to state0 and these bits are cleared to indicate state0 was entered during the session. On arming the module the state sequencer enters state1 and these bits are forced to SSF[2:0] = 001. See Table 283. Table 283. SSF[2:0] — State Sequence Flag Bit Encoding SSF[2:0] Current State 000 State0 (disarmed) 001 State1 010 State2 011 State3 100 Final State 101,110,111 Reserved 5.32.3.2.3 Debug Trace Control Register (DBGTCR) Table 284. Debug Trace Control Register (DBGTCR) Address: 0x0022 7 R 6 0 5 4 0 0 3 2 1 0 0 TSOURCE TRCMOD TALIGN W Reset 0 0 0 0 0 0 0 0 Read: Anytime Write: Bit 6 only when DBG is neither secure nor armed.Bits 3,2,0 anytime the module is disarmed. Table 285. DBGTCR Field Descriptions Field Description 6 TSOURCE Trace Source Control Bit — The TSOURCE bit enables a tracing session given a trigger condition. If the MCU system is secured, this bit cannot be set and tracing is inhibited.  This bit must be set to read the trace buffer. 0 Debug session without tracing requested 1 Debug session with tracing requested 3–2 TRCMOD Trace Mode Bits — See Section 5.32.4.5.2, “Trace Modes" for detailed Trace Mode descriptions. In Normal Mode, change of flow information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. In Compressed Pure PC mode the program counter value for each instruction executed is stored. See Table 286. 0 TALIGN Trigger Align Bit — This bit controls whether the trigger is aligned to the beginning or end of a tracing session. 0 Trigger at end of stored data 1 Trigger before storing data MM912_634 198 Analog Integrated Circuit Device Data Freescale Semiconductor Table 286. TRCMOD Trace Mode Bit Encoding TRCMOD Description 00 Normal 01 Loop1 10 Detail 11 Compressed Pure PC 5.32.3.2.4 Debug Control Register2 (DBGC2) Table 287. Debug Control Register2 (DBGC2) Address: 0x0023 R 7 6 5 4 3 2 0 0 0 0 0 0 1 0 ABCM W Reset 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Read: Anytime Write: Anytime the module is disarmed. This register configures the comparators for range matching. Table 288. DBGC2 Field Descriptions Field Description 1–0 ABCM[1:0] A and B Comparator Match Control — These bits determine the A and B comparator match mapping as described in Table 289. Table 289. ABCM Encoding ABCM Description 00 Match0 mapped to comparator A match: Match1 mapped to comparator B match. 01 Match 0 mapped to comparator A/B inside range: Match1 disabled. 10 Match 0 mapped to comparator A/B outside range: Match1 disabled. 11 Reserved(195) Note: 195. Currently defaults to Comparator A, Comparator B disabled MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 199 5.32.3.2.5 Debug Trace Buffer Register (DBGTBH:DBGTBL) Table 290. Debug Trace Buffer Register (DBGTB) Address: 0x0024, 0x0025 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 POR X X X X X X X X X X X X X X X X Other Resets — — — — — — — — — — — — — — — — R W Read: Only when unlocked AND unsecured AND not armed AND TSOURCE set. Write: Aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. Table 291. DBGTB Field Descriptions Field Description 15–0 Bit[15:0] Trace Buffer Data Bits — The Trace Buffer Register is a window through which the 20-bit wide data lines of the Trace Buffer may be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to the next address to be read. When the ARM bit is set the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module is disarmed. The DBGTB register can be read only as an aligned word, any byte reads or misaligned access of these registers return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. Similarly reads while the debugger is armed or with the TSOURCE bit clear, return 0 and do not affect the trace buffer pointer. The POR state is undefined. Other resets do not affect the trace buffer contents. 5.32.3.2.6 Debug Count Register (DBGCNT) Table 292. Debug Count Register (DBGCNT) Address: 0x0026 R 7 6 TBF 0 — 0 — 0 5 4 3 2 1 0 — 0 — 0 — 0 CNT W Reset POR — 0 — 0 — 0 = Unimplemented or Reserved Read: Anytime Write: Never Table 293. DBGCNT Field Descriptions Field Description 7 TBF Trace Buffer Full — The TBF bit indicates the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines is valid data, regardless of the value of DBGCNT bits. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit This bit is also visible at DBGSR[7] 5–0 CNT[5:0] Count Value — The CNT bits indicate the number of valid data 20-bit data lines stored in the Trace Buffer. Table 294 shows the correlation between the CNT bits and the number of valid data lines in the Trace Buffer. When the CNT rolls over to zero, the TBF bit in DBGSR is set and incrementing of CNT continues in end-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by power-on-reset initialization but is not cleared by other system resets. Thus should a reset occur during a debug session, the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. The DBGCNT register is not decremented when reading from the trace buffer. MM912_634 200 Analog Integrated Circuit Device Data Freescale Semiconductor Table 294. CNT Decoding Table TBF CNT[5:0] Description 0 000000 No data valid 0 000001 000010 000100 000110 … 111111 1 line valid 2 lines valid 4 lines valid 6 lines valid … 63 lines valid 1 000000 64 lines valid; if using Begin trigger alignment, ARM bit is cleared and the tracing session ends. 1 000001 … … 111110 64 lines valid, oldest data has been overwritten by most recent data 5.32.3.2.7 Debug State Control Registers There is a dedicated control register for each of the state sequencer states 1 to 3 which determines if transitions from this state are allowed, depending upon comparator matches or tag hits, and defines the next state for the state sequencer following a match. The three debug state control registers are located at the same address in the register address map (0x0027). Each register can be accessed using the COMRV bits in DBGC1 to blend in the required register. The COMRV = 11 value blends in the match flag register (DBGMFR). Table 295. State Control Register Access Encoding COMRV Visible State Control Register 00 DBGSCR1 01 DBGSCR2 10 DBGSCR3 11 DBGMFR 5.32.3.2.7.1 Debug State Control Register 1 (DBGSCR1) Table 296. Debug State Control Register 1 (DBGSCR1) Address: 0x0027 R 7 6 5 4 0 0 0 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 W Reset 0 0 0 0 = Unimplemented or Reserved Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 00. The state control register 1 selects the targeted next state whilst in State1. The matches refer to the match channels of the comparator match control logic as depicted in Figure 64 and described in Section 5.32.3.2.8.1, “Debug Comparator Control Register (DBGXCTL)". Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 201 Table 297. DBGSCR1 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State1, based upon the match event. Table 298. State1 Sequencer Next State Selection SC[3:0] Description (Unspecified matches have no effect) 0000 Any match to Final State 0001 Match1 to State3 0010 Match2 to State2 0011 Match1 to State2 0100 Match0 to State2....... Match1 to State3 0101 Match1 to State3.........Match0 to Final State 0110 Match0 to State2....... Match2 to State3 0111 Either Match0 or Match1 to State2 1000 Reserved 1001 Match0 to State3 1010 Reserved 1011 Reserved 1100 Reserved 1101 Either Match0 or Match2 to Final State........Match1 to State2 1110 Reserved 1111 Reserved The priorities described in Table 331 dictate in the case of simultaneous matches, a match leading to final state has priority followed by the match on the lower channel number (0,1,2). Thus with SC[3:0]=1101 a simultaneous match0/match1 transitions to final state. 5.32.3.2.7.2 Debug State Control Register 2 (DBGSCR2) Table 299. Debug State Control Register 2 (DBGSCR2) Address: 0x0027 R 7 6 5 4 0 0 0 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 W Reset 0 0 0 0 = Unimplemented or Reserved Read: If COMRV[1:0] = 01 Write: If COMRV[1:0] = 01 and DBG is not armed. MM912_634 202 Analog Integrated Circuit Device Data Freescale Semiconductor This register is visible at 0x0027 only with COMRV[1:0] = 01. The state control register 2 selects the targeted next state whilst in State2. The matches refer to the match channels of the comparator match control logic as depicted in Figure 64 and described in Section 5.32.3.2.8.1, “Debug Comparator Control Register (DBGXCTL)". Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 300. DBGSCR2 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State2, based upon the match event. Table 301. State2 —Sequencer Next State Selection SC[3:0] Description (Unspecified matches have no effect) 0000 Match0 to State1....... Match2 to State3. 0001 Match1 to State3 0010 Match2 to State3 0011 Match1 to State3....... Match0 Final State 0100 Match1 to State1....... Match2 to State3. 0101 Match2 to Final State 0110 Match2 to State1..... Match0 to Final State 0111 Either Match0 or Match1 to Final State 1000 Reserved 1001 Reserved 1010 Reserved 1011 Reserved 1100 Either Match0 or Match1 to Final State........Match2 to State3 1101 Reserved 1110 Reserved 1111 Either Match0 or Match1 to Final State........Match2 to State1 The priorities described in Table 331 dictate in the case of simultaneous matches, a match leading to final state has priority followed by the match on the lower channel number (0,1,2) MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 203 5.32.3.2.7.3 Debug State Control Register 3 (DBGSCR3) Table 302. Debug State Control Register 3 (DBGSCR3) Address: 0x0027 R 7 6 5 4 0 0 0 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 W Reset 0 0 0 0 = Unimplemented or Reserved Read: If COMRV[1:0] = 10 Write: If COMRV[1:0] = 10 and DBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 10. The state control register three selects the targeted next state whilst in State3. The matches refer to the match channels of the comparator match control logic as depicted in Figure 64 and described in Section 5.32.3.2.8.1, “Debug Comparator Control Register (DBGXCTL)". Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 303. DBGSCR3 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State3, based upon the match event. Table 304. State3 — Sequencer Next State Selection SC[3:0] Description (Unspecified matches have no effect) 0000 Match0 to State1 0001 Match2 to State2........ Match1 to Final State 0010 Match0 to Final State....... Match1 to State1 0011 Match1 to Final State....... Match2 to State1 0100 Match1 to State2 0101 Match1 to Final State 0110 Match2 to State2........ Match0 to Final State 0111 Match0 to Final State 1000 Reserved 1001 Reserved 1010 Either Match1 or Match2 to State1....... Match0 to Final State 1011 Reserved 1100 Reserved 1101 Either Match1 or Match2 to Final State....... Match0 to State1 1110 Match0 to State2....... Match2 to Final State 1111 Reserved The priorities described in Table 331 dictate in the case of simultaneous matches, a match leading to final state has priority followed by the match on the lower channel number (0,1,2). MM912_634 204 Analog Integrated Circuit Device Data Freescale Semiconductor 5.32.3.2.7.4 Debug Match Flag Register (DBGMFR) Table 305. Debug Match Flag Register (DBGMFR) Address: 0x0027 R 7 6 5 4 3 2 1 0 0 0 0 0 0 MC2 MC1 MC0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Read: If COMRV[1:0] = 11 Write: Never DBGMFR is visible at 0x0027 only with COMRV[1:0] = 11. It features 3 flag bits each mapped directly to a channel. Should a match occur on the channel during the debug session, then the corresponding flag is set and remains set until the next time the module is armed by writing to the ARM bit. Thus the contents are retained after a debug session for evaluation purposes. These flags cannot be cleared by software, they are cleared only when arming the module. A set flag does not inhibit the setting of other flags. Once a flag is set, further comparator matches on the same channel in the same session have no affect on this flag. 5.32.3.2.8 Comparator Register Descriptions Each comparator has a bank of registers visible through an 8-byte window in the DBG module register address map. Comparator A consists of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). Comparator B consists of four register bytes (three address bus compare registers and a control register). Comparator C consists of four register bytes (three address bus compare registers and a control register). Each set of comparator registers can be accessed using the COMRV bits in the DBGC1 register. Unimplemented registers (e.g. Comparator B data bus and data bus masking) read as zero and cannot be written. The control register for comparator B differs from those of comparators A and C. Table 306. Comparator Register Layout 0x0028 CONTROL Read/Write Comparators A,B and C 0x0029 ADDRESS HIGH Read/Write Comparators A,B and C 0x002A ADDRESS MEDIUM Read/Write Comparators A,B and C 0x002B ADDRESS LOW Read/Write Comparators A,B and C 0x002C DATA HIGH COMPARATOR Read/Write Comparator A only 0x002D DATA LOW COMPARATOR Read/Write Comparator A only 0x002E DATA HIGH MASK Read/Write Comparator A only 0x002F DATA LOW MASK Read/Write Comparator A only 5.32.3.2.8.1 Debug Comparator Control Register (DBGXCTL) The contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the DBG module register address map. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 205 Table 307. Debug Comparator Control Register DBGACTL (Comparator A) Address: 0x0028 7 6 5 4 3 2 1 0 SZE SZ TAG BRK RW RWE NDB COMPE 0 0 0 0 0 0 0 0 1 0 R W Reset = Unimplemented or Reserved Table 308. Debug Comparator Control Register DBGBCTL (Comparator B) Address: 0x0028 7 6 5 4 3 2 SZE SZ TAG BRK RW RWE 0 0 0 0 0 0 0 0 1 0 R 0 COMPE W Reset = Unimplemented or Reserved Table 309. Debug Comparator Control Register DBGCCTL (Comparator C) Address: 0x0028 R 7 6 0 0 5 4 3 2 TAG BRK RW RWE 0 0 0 0 0 COMPE W Reset 0 0 0 0 = Unimplemented or Reserved Read: DBGACTL if COMRV[1:0] = 00 DBGBCTL if COMRV[1:0] = 01 DBGCCTL if COMRV[1:0] = 10 Write: DBGACTL if COMRV[1:0] = 00 and DBG not armed DBGBCTL if COMRV[1:0] = 01 and DBG not armed DBGCCTL if COMRV[1:0] = 10 and DBG not armed Table 310. DBGXCTL Field Descriptions Field Description 7 SZE (Comparators A and B) Size Comparator Enable Bit — The SZE bit controls whether access size comparison is enabled for the associated comparator. This bit is ignored if the TAG bit in the same register is set. 0 Word/Byte access size is not used in comparison 1 Word/Byte access size is used in comparison 6 SZ (Comparators A and B) Size Comparator Value Bit — The SZ bit selects either word or byte access size in comparison for the associated comparator. This bit is ignored if the SZE bit is cleared or if the TAG bit in the same register is set. 0 Word access size is compared 1 Byte access size is compared MM912_634 206 Analog Integrated Circuit Device Data Freescale Semiconductor Table 310. DBGXCTL Field Descriptions (continued) Field Description 5 TAG Tag Select — This bit controls whether the comparator match has immediate effect, causing an immediate state sequencer transition or tag the opcode at the matched address. Tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 Allow state sequencer transition immediately on match 1 On match, tag the opcode. If the opcode is about to be executed allow a state sequencer transition 4 BRK Break — This bit controls whether a comparator match terminates a debug session immediately, independent of state sequencer state. To generate an immediate breakpoint the module breakpoints must be enabled using the DBGC1 bit DBGBRK. 0 The debug session termination is dependent upon the state sequencer and trigger conditions. 1 A match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. 3 RW Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the associated comparator. The RW bit is not used if RWE = 0. This bit is ignored if the TAG bit in the same register is set. 0 Write cycle is matched1 Read cycle is matched 2 RWE Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the associated comparator.This bit is ignored if the TAG bit in the same register is set 0 Read/Write is not used in comparison 1 Read/Write is used in comparison 1 NDB (Comparator A) Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator register value or when the data bus differs from the register value. This bit is ignored if the TAG bit in the same register is set. This bit is only available for comparator A. 0 Match on data bus equivalence to comparator register contents 1 Match on data bus difference to comparator register contents 0 COMPE Determines if comparator is enabled 0 The comparator is not enabled 1 The comparator is enabled Table 311 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if the corresponding TAG bit is set since the match occurs based on the tagged opcode reaching the execution stage of the instruction queue. Table 311. Read or Write Comparison Logic Table RWE Bit RW Bit RW Signal Comment 0 x 0 RW not used in comparison 0 x 1 RW not used in comparison 1 0 0 Write data bus 1 0 1 No match 1 1 0 No match 1 1 1 Read data bus 5.32.3.2.8.2 Debug Comparator Address High Register (DBGXAH) Table 312. Debug Comparator Address High Register (DBGXAH) Address: 0x0029 R 7 6 5 4 3 2 0 0 0 0 0 0 1 0 Bit 17 Bit 16 0 0 W Reset 0 0 0 0 0 0 = Unimplemented or Reserved MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 207 The DBGC1_COMRV bits determine which comparator address registers are visible in the 8-byte window from 0x0028 to 0x002F as shown in Table 313. Table 313. Comparator Address Register Visibility COMRV Visible Comparator 00 DBGAAH, DBGAAM, DBGAAL 01 DBGBAH, DBGBAM, DBGBAL 10 DBGCAH, DBGCAM, DBGCAL 11 None Read: Anytime. See Table 313 for visible register encoding. Write: If DBG not armed. See Table 313 for visible register encoding. Table 314. DBGXAH Field Descriptions Field 1–0 Bit[17:16] Description Comparator Address High Compare Bits — The Comparator address high compare bits control whether the selected comparator compares the address bus bits [17:16] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 5.32.3.2.8.3 Debug Comparator Address Mid Register (DBGXAM) Table 315. Debug Comparator Address Mid Register (DBGXAM) Address: 0x002A 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 R W Reset Read: Anytime. See Table 313 for visible register encoding. Write: If DBG not armed. See Table 313 for visible register encoding. Table 316. DBGXAM Field Descriptions Field 7–0 Bit[15:8] Description Comparator Address Mid Compare Bits — The Comparator address mid compare bits control whether the selected comparator compares the address bus bits [15:8] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 5.32.3.2.8.4 Debug Comparator Address Low Register (DBGXAL) Table 317. Debug Comparator Address Low Register (DBGXAL) Address: 0x002B 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 R W Reset MM912_634 208 Analog Integrated Circuit Device Data Freescale Semiconductor Read: Anytime. See Table 313 for visible register encoding. Write: If DBG not armed. See Table 313 for visible register encoding. Table 318. DBGXAL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Address Low Compare Bits — The Comparator address low compare bits control whether the selected comparator compares the address bus bits [7:0] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 5.32.3.2.8.5 Debug Comparator Data High Register (DBGADH) Table 319. Debug Comparator Data High Register (DBGADH) Address: 0x002C 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 R W Reset Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 320. DBGADH Field Descriptions Field Description 7–0 Bits[15:8] Comparator Data High Compare Bits— The Comparator data high compare bits control whether the selected comparator compares the data bus bits [15:8] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparator A. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear. 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one 5.32.3.2.8.6 Debug Comparator Data Low Register (DBGADL) Table 321. Debug Comparator Data Low Register (DBGADL) Address: 0x002D 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 R W Reset Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 209 Table 322. DBGADL Field Descriptions Field Description 7–0 Bits[7:0] Comparator Data Low Compare Bits — The Comparator data low compare bits control whether the selected comparator compares the data bus bits [7:0] to a logic one or logic zero. The comparator data compare bits are only used in comparison if the corresponding data mask bit is logic 1. This register is available only for comparator A. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear 0 Compare corresponding data bit to a logic zero 1 Compare corresponding data bit to a logic one Debug Comparator Data High Mask Register (DBGADHM) Table 323. Debug Comparator Data High Mask Register (DBGADHM) Address: 0x002E 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 R W Reset Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 324. DBGADHM Field Descriptions Field Description 7–0 Bits[15:8] Comparator Data High Mask Bits — The Comparator data high mask bits control whether the selected comparator compares the data bus bits [15:8] to the corresponding comparator data compare bits. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear 0 Do not compare corresponding data bit Any value of corresponding data bit allows match. 1 Compare corresponding data bit 5.32.3.2.8.7 Debug Comparator Data Low Mask Register (DBGADLM) Table 325. Debug Comparator Data Low Mask Register (DBGADLM) Address: 0x002F 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 R W Reset Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and DBG not armed. Table 326. DBGADLM Field Descriptions Field Description 7–0 Bits[7:0] Comparator Data Low Mask Bits — The Comparator data low mask bits control whether the selected comparator compares the data bus bits [7:0] to the corresponding comparator data compare bits. Data bus comparisons are only performed if the TAG bit in DBGACTL is clear 0 Do not compare corresponding data bit. Any value of corresponding data bit allows match 1 Compare corresponding data bit MM912_634 210 Analog Integrated Circuit Device Data Freescale Semiconductor 5.32.4 Functional Description This section provides a complete functional description of the DBG module. If the part is in secure mode, the DBG module can generate breakpoints but tracing is not possible. 5.32.4.1 S12SDBG Operation Arming the DBG module by setting ARM in DBGC1 allows triggering the state sequencer, storing of data in the trace buffer and generation of breakpoints to the CPU. The DBG module is made up of four main blocks, the comparators, control logic, the state sequencer, and the trace buffer. The comparators monitor the bus activity of the CPU. All comparators can be configured to monitor address bus activity. Comparator A can also be configured to monitor data bus activity and mask out individual data bus bits during a compare. Comparators can be configured to use R/W and word/byte access qualification in the comparison. A match with a comparator register value can initiate a state sequencer transition to another state (see Figure 66). Either forced or tagged matches are possible. Using a forced match, a state sequencer transition can occur immediately on a successful match of system busses and comparator registers. Whilst tagging, at a comparator match, the instruction opcode is tagged and only if the instruction reaches the execution stage of the instruction queue can a state sequencer transition occur. In the case of a transition to Final State, bus tracing is triggered and/or a breakpoint can be generated. A state sequencer transition to final state (with associated breakpoint, if enabled) can be initiated by writing to the TRIG bit in the DBGC1 control register. The trace buffer is visible through a 2-byte window in the register address map and must be read out using standard 16-bit word reads. TAGS TAGHITS BREAKPOINT REQUESTS TO CPU COMPARATOR A COMPARATOR B COMPARATOR C COMPARATOR MATCH CONTROL CPU BUS BUS INTERFACE SECURE MATCH0 MATCH1 TAG & MATCH CONTROL LOGIC TRANSITION STATE STATE SEQUENCER STATE MATCH2 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 65. DBG Overview 5.32.4.2 Comparator Modes The DBG contains three comparators, A, B and C. Each comparator compares the system address bus with the address stored in DBGXAH, DBGXAM, and DBGXAL. Furthermore, comparator A also compares the data buses to the data stored in DBGADH, DBGADL and allows masking of individual data bus bits. All comparators are disabled in BDM and during BDM accesses. The comparator match control logic (see Figure 65) configures comparators to monitor the buses for an exact address or an address range, whereby either an access inside or outside the specified range generates a match condition. The comparator configuration is controlled by the control register contents and the range control by the DBGC2 contents. A match can initiate a transition to another state sequencer state (see Section 5.32.4.4, “State Sequence Control"). The comparator control register also allows the type of access to be included in the comparison through the use of the RWE, RW, SZE, and SZ bits. The RWE bit controls whether read or write comparison is enabled for the associated comparator and the RW bit selects either a read or write access for a valid match. Similarly the SZE and SZ bits allow the size of access (word or byte) to be considered in the compare. Only comparators A and B feature SZE and SZ. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 211 The TAG bit in each comparator control register is used to determine the match condition. By setting TAG, the comparator qualifies a match with the output of opcode tracking logic and a state sequencer transition occurs when the tagged instruction reaches the CPU execution stage. Whilst tagging the RW, RWE, SZE, and SZ bits and the comparator data registers are ignored; the comparator address register must be loaded with the exact opcode address. If the TAG bit is clear (forced type match) a comparator match is generated when the selected address appears on the system address bus. If the selected address is an opcode address, the match is generated when the opcode is fetched from the memory, which precedes the instruction execution by an indefinite number of cycles due to instruction pipelining. For a comparator match of an opcode at an odd address when TAG = 0, the corresponding even address must be contained in the comparator register. Thus for an opcode at odd address (n), the comparator register must contain address (n–1). Once a successful comparator match has occurred, the condition which caused the original match is not verified again on subsequent matches. Thus if a particular data value is verified at a given address, this address may not still contain this data value when a subsequent match occurs. Match[0, 1, 2] map directly to Comparators [A, B, C] respectively, except in range modes (see Section 5.32.3.2.4, “Debug Control Register2 (DBGC2)"). Comparator channel priority rules are described in the priority section (Section 5.32.4.3.4, “Channel Priorities"). 5.32.4.2.1 Single Address Comparator Match With range comparisons disabled, the match condition is an exact equivalence of address bus with the value stored in the comparator address registers. Further qualification of the type of access (R/W, word/byte) and data bus contents is possible, depending on comparator channel. 5.32.4.2.1.1 Comparator C Comparator C offers only address and direction (R/W) comparison. The exact address is compared, thus with the comparator address register loaded with address (n) a word access of address (n–1) also accesses (n) but does not cause a match. Table 327. Comparator C Access Considerations Condition For Valid Match Comp C Address RWE RW Examples Read and write accesses of ADDR[n] ADDR[n](196) 0 X LDAA ADDR[n] STAA #$BYTE ADDR[n] Write accesses of ADDR[n] ADDR[n] 1 0 STAA #$BYTE ADDR[n] Read accesses of ADDR[n] ADDR[n] 1 1 LDAA #$BYTE ADDR[n] Note: 196. A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address from the code. 5.32.4.2.1.2 Comparator B Comparator B offers address, direction (R/W) and access size (word/byte) comparison. If the SZE bit is set the access size (word or byte) is compared with the SZ bit value such that only the specified size of access causes a match. Thus if configured for a byte access of a particular address, a word access covering the same address does not lead to match. Assuming the access direction is not qualified (RWE=0), for simplicity, the size access considerations are shown in Table 328. Table 328. Comparator B Access Size Considerations Condition For Valid Match Comp B Address RWE SZE SZ8 Examples Word and byte accesses of ADDR[n] ADDR[n](197) 0 0 X MOVB #$BYTE ADDR[n] MOVW #$WORD ADDR[n] Word accesses of ADDR[n] only ADDR[n] 0 1 0 MOVW #$WORD ADDR[n] LDD ADDR[n] Note: 197. A word access of ADDR[n-1] also accesses ADDR[n] but does not generate a match. The comparator address register must contain the exact address from the code. Access direction can also be used to qualify a match for Comparator B in the same way as described for Comparator C in Table 327. MM912_634 212 Analog Integrated Circuit Device Data Freescale Semiconductor 5.32.4.2.1.3 Comparator A Comparator A offers address, direction (R/W), access size (word/byte) and data bus comparison. Table 329 lists access considerations with data bus comparison. On word accesses the data byte of the lower address is mapped to DBGADH. Access direction can also be used to qualify a match for Comparator A in the same way as described for Comparator C in Table 327. Table 329. Comparator A Matches When Accessing ADDR[n] SZE SZ DBGADHM, DBGADLM 0 X $0000 Byte Word No data bus comparison 0 X $FF00 Byte, data (ADDR[n])=DH Word, data (ADDR[n])=DH, data(ADDR[n+1])=X Match data (ADDR[n]) 0 X $00FF Word, data (ADDR[n])=X, data(ADDR[n+1])=DL Match data(ADDR[n+1]) 0 X $00FF Byte, data (ADDR[n])=X, data(ADDR[n+1])=DL Possible unintended match 0 X $FFFF Word, data (ADDR[n])=DH, data(ADDR[n+1])=DL Match data (ADDR[n], ADDR[n+1]) 0 X $FFFF Byte, data (ADDR[n])=DH, data(ADDR[n+1])=DL Possible unintended match 1 0 $0000 Word No data bus comparison 1 0 $00FF Word, data (ADDR[n])=X, data(ADDR[n+1])=DL Match only data at ADDR[n+1] 1 0 $FF00 Word, data (ADDR[n])=DH, data(ADDR[n+1])=X Match only data at ADDR[n] 1 0 $FFFF Word, data (ADDR[n])=DH, data(ADDR[n+1])=DL Match data at ADDR[n] & ADDR[n+1] 1 1 $0000 Byte No data bus comparison 1 1 $FF00 Byte, data (ADDR[n])=DH Match data at ADDR[n] 5.32.4.2.1.4 Access DH=DBGADH, DL=DBGADL Comment Comparator A Data Bus Comparison NDB Dependency Comparator A features an NDB control bit, which allows data bus comparators to be configured to either trigger on equivalence or trigger on difference. This allows monitoring of a difference in the contents of an address location from an expected value. When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by clearing the corresponding mask bit (DBGADHM/DBGADLM) so it is ignored in the comparison. A match occurs when all data bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is based on the address bus only, the data bus is ignored. When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored and prevents a match because no difference can be detected. In this case address bus equivalence does not cause a match. Table 330. NDB and MASK Bit Dependency NDB DBGADHM[n] /DBGADLM[n] Comment 0 0 Do not compare data bus bit. 0 1 Compare data bus bit. Match on equivalence. 1 0 Do not compare data bus bit. 1 1 Compare data bus bit. Match on difference. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 213 5.32.4.2.2 Range Comparisons Using the AB comparator pair for a range comparison, the data bus can also be used for qualification by using the comparator A data registers. Furthermore the DBGACTL RW and RWE bits can be used to qualify the range comparison on either a read or a write access. The corresponding DBGBCTL bits are ignored. The SZE and SZ control bits are ignored in range mode. The comparator A TAG bit is used to tag range comparisons. The comparator B TAG bit is ignored in range modes. In order for a range comparison using comparators A and B, both COMPEA and COMPEB must be set; to disable range comparisons both must be cleared. The comparator A BRK bit is used to for the AB range, the comparator B BRK bit is ignored in range mode. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. 5.32.4.2.2.1 Inside Range (CompA_Addr  Address  CompB_Addr) In the Inside Range comparator mode, comparator pair A and B can be configured for range comparisons. This configuration depends upon the control register (DBGC2). The match condition requires a valid match for both comparators happens on the same bus cycle. A match condition on only one comparator is not valid. An aligned word access which straddles the range boundary is valid only if the aligned address is inside the range. 5.32.4.2.2.2 Outside Range (address < CompA_Addr or Address > CompB_Addr) In the Outside Range comparator mode, comparator pair A and B can be configured for range comparisons. A single match condition on either of the comparators is recognized as valid. An aligned word access which straddles the range boundary is valid only if the aligned address is outside the range. Outside range mode in combination with tagging can be used to detect if the opcode fetches are from an unexpected range. In forced match mode the outside range match would typically be activated at any interrupt vector fetch or register access. This can be avoided by setting the upper range limit to $3FFFF or lower range limit to $00000 respectively. 5.32.4.3 Match Modes (Forced or Tagged) Match modes are used as qualifiers for a state sequencer change of state. The Comparator control register TAG bits select the match mode. The modes are described in the following sections. 5.32.4.3.1 Forced Match When configured for forced matching, a comparator channel match can immediately initiate a transition to the next state sequencer state whereby the corresponding flags in DBGSR are set. The state control register for the current state determines the next state. Forced matches are typically generated 2-3 bus cycles after the final matching address bus cycle, independent of comparator RWE/RW settings. Furthermore since opcode fetches occur several cycles before the opcode execution a forced match of an opcode address typically precedes a tagged match at the same address. 5.32.4.3.2 Tagged Match If a CPU taghit occurs a transition to another state sequencer state is initiated and the corresponding DBGSR flags are set. For a comparator related taghit to occur, the DBG must first attach tags to instructions as they are fetched from memory. When the tagged instruction reaches the execution stage of the instruction queue a taghit is generated by the CPU. This can initiate a state sequencer transition. 5.32.4.3.3 Immediate Trigger Independent of comparator matches it is possible to initiate a tracing session and/or breakpoint by writing to the TRIG bit in DBGC1. If configured for begin aligned tracing, this triggers the state sequencer into the Final State, if configured for end alignment, setting the TRIG bit disarms the module, ending the session and issues a forced breakpoint request to the CPU. It is possible to set both TRIG and ARM simultaneously to generate an immediate trigger, independent of the current state of ARM. 5.32.4.3.4 Channel Priorities In case of simultaneous matches the priority is resolved according to Table 331. The lower priority is suppressed. It is thus possible to miss a lower priority match if it occurs simultaneously with a higher priority. The priorities described in Table 331 dictate in the case of simultaneous matches, the match pointing to final state has highest priority followed by the lower channel number (0,1,2). MM912_634 214 Analog Integrated Circuit Device Data Freescale Semiconductor Table 331. Channel Priorities Priority Source Action Highest TRIG Enter Final State Channel pointing to Final State Transition to next state as defined by state control registers Match0 (force or tag hit) Transition to next state as defined by state control registers Match1 (force or tag hit) Transition to next state as defined by state control registers Match2 (force or tag hit) Transition to next state as defined by state control registers Lowest 5.32.4.4 State Sequence Control ARM = 0 State 0 (Disarmed) ARM = 1 State1 State2 ARM = 0 Session Complete (Disarm) Final State State3 ARM = 0 Figure 66. State Sequencer Diagram The state sequencer allows a defined sequence of events to provide a trigger point for tracing of data in the trace buffer. Once the DBG module has been armed by setting the ARM bit in the DBGC1 register, then state1 of the state sequencer is entered. Further transitions between the states are then controlled by the state control registers and channel matches. From Final State the only permitted transition is back to the disarmed state0. Transition between any of the states 1 to 3 is not restricted. Each transition updates the SSF[2:0] flags in DBGSR accordingly to indicate the current state. Alternatively writing to the TRIG bit in DBGSC1, provides an immediate trigger independent of comparator matches. Independent of the state sequencer, each comparator channel can be individually configured to generate an immediate breakpoint when a match occurs through the use of the BRK bits in the DBGxCTL registers. Thus it is possible to generate an immediate breakpoint on selected channels, whilst a state sequencer transition can be initiated by a match on other channels. If a debug session is ended by a match on a channel the state sequencer transitions through Final State for a clock cycle to state0. This is independent of tracing and breakpoint activity, thus with tracing and breakpoints disabled, the state sequencer enters state0 and the debug module is disarmed. 5.32.4.4.1 Final State On entering Final State a trigger may be issued to the trace buffer according to the trace alignment control as defined by the TALIGN bit (see Section 5.32.3.2.3, “Debug Trace Control Register (DBGTCR)"). If the TSOURCE bit in DBGTCR is clear then the trace buffer is disabled and the transition to Final State can only generate a breakpoint request. In this case or upon completion of a tracing session when tracing is enabled, the ARM bit in the DBGC1 register is cleared, returning the module to the disarmed state0. If tracing is enabled a breakpoint request can occur at the end of the tracing session. If neither tracing nor breakpoints are enabled then when the final state is reached it returns automatically to state0 and the debug module is disarmed. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 215 5.32.4.5 Trace Buffer Operation The trace buffer is a 64 lines deep by 20-bits wide RAM array. The DBG module stores trace information in the RAM array in a circular buffer format. The system accesses the RAM array through a register window (DBGTBH:DBGTBL) using 16-bit wide word accesses. After each complete 20-bit trace buffer line is read, an internal pointer into the RAM increments so the next read receives fresh information. Data is stored in the format shown in Table 332 and Table 336. After each store the counter register DBGCNT is incremented. Tracing of CPU activity is disabled when the BDM is active. Reading the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not incremented. 5.32.4.5.1 Trace Trigger Alignment Using the TALIGN bit (see Section 5.32.3.2.3, “Debug Trace Control Register (DBGTCR)") it is possible to align the trigger with the end or the beginning of a tracing session. If end alignment is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is entered; the transition to Final State signals the end of the tracing session. Tracing with Begin-Trigger starts at the opcode of the trigger. Using end alignment or when the tracing is initiated by writing to the TRIG bit whilst configured for begin alignment, tracing starts in the second cycle after the DBGC1 write cycle. 5.32.4.5.1.1 Storing with Begin Trigger Alignment Storing with begin alignment, data is not stored in the Trace Buffer until the Final State is entered. Once the trigger condition is met the DBG module remains armed until 64 lines are stored in the Trace Buffer. If the trigger is at the address of the change-of-flow instruction the change of flow associated with the trigger is stored in the Trace Buffer. Using begin alignment together with tagging, if the tagged instruction is about to be executed then the trace is started. Upon completion of the tracing session the breakpoint is generated, thus the breakpoint does not occur at the tagged instruction boundary. 5.32.4.5.1.2 Storing with End Trigger Alignment Storing with end alignment, data is stored in the Trace Buffer until the Final State is entered, at which point the DBG module becomes disarmed and no more data is stored. If the trigger is at the address of a change of flow instruction, the trigger event is not stored in the Trace Buffer. If all trace buffer lines have been used before a trigger event occurs then the trace continues at the first line, overwriting the oldest entries. 5.32.4.5.2 Trace Modes Four trace modes are available. The mode is selected using the TRCMOD bits in the DBGTCR register. Tracing is enabled using the TSOURCE bit in the DBGTCR register. The modes are described in the following subsections. 5.32.4.5.2.1 Normal Mode In Normal Mode, change of flow (COF) program counter (PC) addresses are stored. COF addresses are defined as follows: • Source address of taken conditional branches (long, short, bit-conditional, and loop primitives) • Destination address of indexed JMP, JSR, and CALL instruction • Destination address of RTI, RTS, and RTC instructions • Vector address of interrupts, except for BDM vectors LBRA, BRA, BSR, BGND as well as non-indexed JMP, JSR, and CALL instructions are not classified as change of flow and are not stored in the trace buffer. Stored information includes the full 18-bit address bus and information bits, which contains a source/destination bit to indicate whether the stored address was a source address or destination address. NOTE When a COF instruction with destination address is executed, the destination address is stored to the trace buffer on instruction completion, indicating the COF has taken place. If an interrupt occurs simultaneously then the next instruction carried out is actually from the interrupt service routine. The instruction at the destination address of the original program flow gets executed after the interrupt service routine. In the following example an IRQ interrupt occurs during execution of the indexed JMP at address MARK1. The BRN at the destination (SUB_1) is not executed until after the IRQ service routine but the destination address is entered into the trace buffer to indicate the indexed JMP COF has taken place. MM912_634 216 Analog Integrated Circuit Device Data Freescale Semiconductor MARK1 MARK2 LDX JMP NOP #SUB_1 0,X SUB_1 BRN * ADDR1 NOP DBNE A,PART5 IRQ_ISR MARK1 IRQ_ISR SUB_1 ADDR1 LDAB STAB RTI #$F0 VAR_C1 ; JMP Destination address TRACE BUFFER ENTRY 1 ; RTI Destination address TRACE BUFFER ENTRY 3 ; ; Source address TRACE BUFFER ENTRY 4 ; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2 ; The execution flow taking into account the IRQ is as follows LDX JMP LDAB STAB RTI BRN NOP DBNE 5.32.4.5.2.2 ; IRQ interrupt occurs during execution of this ; #SUB_1 0,X #$F0 VAR_C1 ; ; ; * A,PART5 ; ; Loop1 Mode Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it however allows the filtering out of redundant information. The intent of Loop1 Mode is to prevent the Trace Buffer from being filled entirely with duplicate information from a looping construct such as delays using the DBNE instruction or polling loops using BRSET/BRCLR instructions. Immediately after address information is placed in the Trace Buffer, the DBG module writes this value into a background register. This prevents consecutive duplicate address entries in the Trace Buffer resulting from repeated branches. Loop1 Mode only inhibits consecutive duplicate source address entries which would typically be stored in most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector addresses, since repeated entries of these would most likely indicate a bug in the user’s code which the DBG module is designed to help find. 5.32.4.5.2.3 Detail Mode In Detail Mode, address and data for all memory and register accesses is stored in the trace buffer. This mode is intended to supply additional information on indexed, indirect addressing modes where storing only the destination address would not provide all information required for a user to determine where the code is in error. This mode also features information bit storage to the trace buffer, for each address byte storage. The information bits indicate the size of access (word or byte) and the type of access (read or write). When tracing in Detail Mode, all cycles are traced except those when the CPU is either in a free or opcode fetch cycle. 5.32.4.5.2.4 Compressed Pure PC Mode In Compressed Pure PC Mode, the PC addresses of all executed opcodes, including illegal opcodes are stored. A compressed storage format is used to increase the effective depth of the trace buffer. This is achieved by storing the lower order bits each time and using 2 information bits to indicate if a 64 byte boundary has been crossed, in which case the full PC is stored. Each Trace Buffer row consists of 2 information bits and 18 PC address bits NOTE: When tracing is terminated using forced breakpoints, latency in breakpoint generation means opcodes following the opcode causing the breakpoint can be stored to the trace buffer. The number of opcodes is dependent on program flow. This can be avoided by using tagged breakpoints. 5.32.4.5.3 Trace Buffer Organization (Normal, Loop1, Detail modes) ADRH, ADRM, ADRL denote address high, middle and low byte respectively. The numerical suffix refers to the tracing count. The information format for Loop1 and Normal modes is identical. In Detail mode, the address and data for each entry are stored on consecutive lines, thus the maximum number of entries is 32. In this case DBGCNT bits are incremented twice, once for the address line and once for the data line, on each trace buffer entry. In Detail mode CINF comprises of R/W and size access information (CRW and CSZ respectively). MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 217 Single byte data accesses in Detail Mode are always stored to the low byte of the trace buffer (DATAL) and the high byte is cleared. When tracing word accesses, the byte at the lower address is always stored to trace buffer byte1 and the byte at the higher address is stored to byte0. Table 332. Trace Buffer Organization (Normal,Loop1,Detail modes) Mode 4-bits 8-bits 8-bits Field 2 Field 1 Field 0 CINF1,ADRH1 ADRM1 ADRL1 0 DATAH1 DATAL1 CINF2,ADRH2 ADRM2 ADRL2 0 DATAH2 DATAL2 Entry 1 PCH1 PCM1 PCL1 Entry 2 PCH2 PCM2 PCL2 Entry Number Entry 1 Detail Mode Entry 2 Normal/Loop1 Modes 5.32.4.5.3.1 Information Bit Organization The format of the bits is dependent upon the active trace mode as described below. Field2 Bits in Detail Mode Table 333. Field2 Bits in Detail Mode Bit 3 Bit 2 Bit 1 Bit 0 CSZ CRW ADDR[17] ADDR[16] In Detail Mode the CSZ and CRW bits indicate the type of access being made by the CPU. Table 334. Field Descriptions Bit Description 3 CSZ Access Type Indicator — This bit indicates if the access was a byte or word size when tracing in Detail Mode 0 Word Access 1 Byte Access 2 CRW Read Write Indicator — This bit indicates if the corresponding stored address corresponds to a read or write access when tracing in Detail Mode. 0 Write Access 1 Read Access 1 ADDR[17] Address Bus bit 17 — Corresponds to system address bus bit 17. 0 ADDR[16] Address Bus bit 16 — Corresponds to system address bus bit 16. Field2 Bits in Normal and Loop1 Modes Figure 67. Information Bits PCH Bit 3 Bit 2 Bit 1 Bit 0 CSD CVA PC17 PC16 MM912_634 218 Analog Integrated Circuit Device Data Freescale Semiconductor Table 335. PCH Field Descriptions Bit Description 3 CSD Source Destination Indicator — In Normal and Loop1 mode this bit indicates if the corresponding stored address is a source or destination address. This bit has no meaning in Compressed Pure PC mode. 0 Source Address 1 Destination Address 2 CVA Vector Indicator — In Normal and Loop1 mode this bit indicates if the corresponding stored address is a vector address. Vector addresses are destination addresses, thus if CVA is set, then the corresponding CSD is also set. This bit has no meaning in Compressed Pure PC mode. 0 Non-Vector Destination Address 1 Vector Destination Address 1 PC17 Program Counter bit 17 — In Normal and Loop1 mode this bit corresponds to program counter bit 17. 0 PC16 Program Counter bit 16 — In Normal and Loop1 mode this bit corresponds to program counter bit 16. 5.32.4.5.4 Trace Buffer Organization (Compressed Pure PC mode) Table 336. Trace Buffer Organization Example (Compressed PurePC mode) Mode 2-bits 6-bits 6-bits 6-bits Field 3 Field 2 Field 1 Field 0 Line Number Compressed Pure PC Mode Line 1 00 PC1 (Initial 18-bit PC Base Address) Line 2 11 PC4 PC3 PC2 Line 3 01 0 0 PC5 Line 4 00 Line 5 10 Line 6 00 PC6 (New 18-bit PC Base Address) 0 PC8 PC7 PC9 (New 18-bit PC Base Address) NOTE Configured for end aligned triggering in compressed PurePC mode, then after rollover it is possible the oldest base address is overwritten. In this case all entries between the pointer and the next base address have lost their base address following rollover. For example in Table 337 if one line of rollover has occurred, Line 1, PC1, is overwritten with a new entry. Thus the entries on Lines 2 and 3 have lost their base address. For reconstruction of program flow the first base address following the pointer must be used, in the example, Line 4. The pointer points to the oldest entry, Line 2. 5.32.4.5.5 Field3 Bits in Compressed Pure PC Modes Table 337. Compressed Pure PC Mode Field 3 Information Bit Encoding INF1 INF0 TRACE BUFFER ROW CONTENT 0 0 Base PC address TB[17:0] contains a full PC[17:0] value 0 1 Trace Buffer[5:0] contain incremental PC relative to base address zero value 1 0 Trace Buffer[11:0] contain next 2 incremental PCs relative to base address zero value 1 1 Trace Buffer[17:0] contain next 3 incremental PCs relative to base address zero value Each time that PC[17:6] differs from the previous base PC[17:6], then a new base address is stored. The base address zero value is the lowest address in the 64 address range. The first line of the trace buffer always gets a base PC address, this applies also on rollover. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 219 5.32.4.5.6 Reading Data from Trace Buffer The data stored in the Trace Buffer can be read provided the DBG module is not armed, is configured for tracing (TSOURCE bit is set) and the system not secured. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by a single aligned word write to DBGTB when the module is disarmed. The Trace Buffer can only be read through the DBGTB register using aligned word reads, any byte or misaligned reads return 0 and do not cause the trace buffer pointer to increment to the next trace buffer address. The Trace Buffer data is read out first-in first-out. By reading CNT in DBGCNT the number of valid lines can be determined. DBGCNT does not decrement as data is read. Whilst reading an internal pointer is used to determine the next line to be read. After a tracing session, the pointer points to the oldest data entry, thus if no rollover has occurred, the pointer points to line0, otherwise it points to the line with the oldest entry. In compressed Pure PC mode on rollover the line with the oldest data entry may also contain newer data entries in fields 0 and 1. Thus if rollover is indicated by the TBF bit, the line status must be decoded using the INF bits in field3 of this line. If both INF bits are clear then the line contains only entries from before the last rollover.  If INF0=1 then field 0 contains post rollover data but fields 1 and 2 contain pre rollover data.  If INF1=1 then fields 0 and 1 contain post rollover data but field 2 contains pre rollover data. The pointer is initialized by each aligned write to DBGTBH to point to the oldest data again. This enables an interrupted trace buffer read sequence to be easily restarted from the oldest data entry. The least significant word of line is read out first. This corresponds to the fields 1 and 0 of Table 332. The next word read returns field 2 in the least significant bits [3:0] and “0” for bits [15:4]. Reading the Trace Buffer while the DBG module is armed returns invalid data and no shifting of the RAM pointer occurs. 5.32.4.5.7 Trace Buffer Reset State The Trace Buffer contents and DBGCNT bits are not initialized by a system reset. Thus should a system reset occur, the trace session information from immediately before the reset occurred can be read out and the number of valid lines in the trace buffer is indicated by DBGCNT. The internal pointer to the current trace buffer address is initialized by unlocking the trace buffer and points to the oldest valid data even if a reset occurred during the tracing session. To read the trace buffer after a reset, TSOURCE must be set, otherwise the trace buffer reads as all zeroes. Generally debugging occurrences of system resets is best handled using end trigger alignment since the reset may occur before the trace trigger, which in the begin trigger alignment case means no information would be stored in the trace buffer. The Trace Buffer contents and DBGCNT bits are undefined following a POR. NOTE An external pin RESET occurs simultaneous to a trace buffer entry can, in very seldom cases, lead to either this entry being corrupted or the first entry of the session being corrupted. In such cases the other contents of the trace buffer still contain valid tracing information. The case occurs when the reset assertion coincides with the trace buffer entry clock edge. 5.32.4.6 Tagging A tag follows program information as it advances through the instruction queue. When a tagged instruction reaches the head of the queue a tag hit occurs and can initiate a state sequencer transition. Each comparator control register features a TAG bit, which controls whether the comparator match causes a state sequencer transition immediately or tags the opcode at the matched address. If a comparator is enabled for tagged comparisons, the address stored in the comparator match address registers must be an opcode address. Using Begin trigger together with tagging, if the tagged instruction is about to be executed then the transition to the next state sequencer state occurs. If the transition is to the Final State, tracing is started. Only upon completion of the tracing session can a breakpoint be generated. Using End alignment, when the tagged instruction is about to be executed and the next transition is to Final State then a breakpoint is generated immediately, before the tagged instruction is carried out. R/W monitoring, access size (SZ) monitoring and data bus monitoring are not useful if tagging is selected, since the tag is attached to the opcode at the matched address and is not dependent on the data bus nor on the type of access. Thus these bits are ignored if tagging is selected. When configured for range comparisons and tagging, the ranges are accurate only to word boundaries. Tagging is disabled when the BDM becomes active. MM912_634 220 Analog Integrated Circuit Device Data Freescale Semiconductor 5.32.4.7 Breakpoints It is possible to generate breakpoints from channel transitions to final state or using software to write to the TRIG bit in the DBGC1 register. 5.32.4.7.1 Breakpoints From Comparator Channels Breakpoints can be generated when the state sequencer transitions to the Final State. If configured for tagging, then the breakpoint is generated when the tagged opcode reaches the execution stage of the instruction queue. If a tracing session is selected by the TSOURCE bit, breakpoints are requested when the tracing session has completed, thus if Begin aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 338). If no tracing session is selected, breakpoints are requested immediately. If the BRK bit is set, then the associated breakpoint is generated immediately independent of tracing trigger alignment. Table 338. Breakpoint Setup For CPU Breakpoints BRK TALIGN DBGBRK 0 0 0 Fill Trace Buffer until trigger then disarm (no breakpoints) 0 0 1 Fill Trace Buffer until trigger, then breakpoint request occurs 0 1 0 Start Trace Buffer at trigger (no breakpoints) 0 1 1 Start Trace Buffer at trigger. A breakpoint request occurs when Trace Buffer is full 1 x 1 Terminate tracing and generate breakpoint immediately on trigger 1 x 0 Terminate tracing immediately on trigger 5.32.4.7.2 Breakpoint Alignment Breakpoints Generated Via The TRIG Bit If a TRIG triggers occur, the Final State is entered whereby tracing trigger alignment is defined by the TALIGN bit. If a tracing session is selected by the TSOURCE bit, breakpoints are requested when the tracing session has completed, thus if Begin aligned triggering is selected, the breakpoint is requested only on completion of the subsequent trace (see Table 338). If no tracing session is selected, breakpoints are requested immediately. TRIG breakpoints are possible with a single write to DBGC1, setting ARM and TRIG simultaneously. 5.32.4.7.3 Breakpoint Priorities If a TRIG trigger occurs after Begin aligned tracing has already started, then the TRIG no longer has an effect. When the associated tracing session is complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent comparator channel match, it has no effect, since tracing has already started. If a forced SWI breakpoint coincides with a BGND in user code with BDM enabled, then the BDM is activated by the BGND and the breakpoint to SWI is suppressed. 5.32.4.7.3.1 DBG Breakpoint Priorities And BDM Interfacing Breakpoint operation is dependent on the state of the BDM module. If the BDM module is active, the CPU is executing out of BDM firmware, thus comparator matches and associated breakpoints are disabled. In addition, while executing a BDM TRACE command, tagging into BDM is disabled. If BDM is not active, the breakpoint gives priority to BDM requests over SWI requests if the breakpoint happens to coincide with a SWI instruction in user code. On returning from BDM, the SWI from user code gets executed. Table 339. Breakpoint Mapping Summary DBGBRK BDM Bit (DBGC1[4]) BDM Enabled BDM Active Breakpoint Mapping 0 X X X No Breakpoint 1 0 X 0 Breakpoint to SWI X X 1 1 No Breakpoint 1 1 0 X Breakpoint to SWI 1 1 1 0 Breakpoint to BDM MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 221 BDM cannot be entered from a breakpoint unless the ENABLE bit is set in the BDM. If entry to BDM via a BGND instruction is attempted and the ENABLE bit in the BDM is cleared, the CPU actually executes the BDM firmware code, checks the ENABLE and returns if ENABLE is not set. If not serviced by the monitor then the breakpoint is re-asserted when the BDM returns to normal CPU flow. If the comparator register contents coincide with the SWI/BDM vector address then an SWI in user code could coincide with a DBG breakpoint. The CPU ensures BDM requests have a higher priority than SWI requests. Returning from the BDM/SWI service routine care must be taken to avoid a repeated breakpoint at the same address. Should a tagged or forced breakpoint coincide with a BGND in user code, then the instruction which follows the BGND instruction is the first instruction executed when normal program execution resumes. NOTE When program control returns from a tagged breakpoint using an RTI or BDM GO command without program counter modification it returns to the instruction whose tag generated the breakpoint. To avoid a repeated breakpoint at the same location reconfigure the DBG module in the SWI routine, if configured for an SWI breakpoint, or over the BDM interface by executing a TRACE command before the GO to increment the program flow past the tagged instruction. 5.32.5 5.32.5.1 Application Information State Machine scenarios Defining the state control registers as SCR1,SCR2, SCR3 and M0,M1,M2 as matches on channels 0,1,2 respectively. SCR encoding supported by S12SDBGV1 are shown in black. SCR encoding supported only in S12SDBGV2 are shown in red. For backwards compatibility the new scenarios use a 4th bit in each SCR register. Thus the existing encoding for SCRx[2:0] is not changed. 5.32.5.2 Scenario 1 A trigger is generated if a given sequence of 3 code events is executed. SCR2=0010 SCR1=0011 State1 M1 State2 SCR3=0111 M2 State3 M0 Final State Figure 68. Scenario 1 Scenario 1 is possible with S12SDBGV1 SCR encoding 5.32.5.3 Scenario 2 A trigger is generated if a given sequence of 2 code events is executed. SCR2=0101 SCR1=0011 State1 M1 State2 M2 Final State Figure 69. Scenario 2a A trigger is generated if a given sequence of 2 code events is executed, whereby the first event is entry into a range (COMPA,COMPB configured for range mode). M1 is disabled in range modes. SCR2=0101 SCR1=0111 State1 M01 State2 M2 Final State Figure 70. Scenario 2b A trigger is generated if a given sequence of 2 code events is executed, whereby the second event is entry into a range (COMPA,COMPB configured for range mode) MM912_634 222 Analog Integrated Circuit Device Data Freescale Semiconductor SCR2=0011 SCR1=0010 M2 State1 M0 State2 Final State Figure 71. Scenario 2c All 3 scenarios 2a,2b,2c are possible with the S12SDBGV1 SCR encoding 5.32.5.4 Scenario 3 A trigger is generated immediately when one of up to 3 given events occurs SCR1=0000 M012 State1 Final State Figure 72. Scenario 3 Scenario 3 is possible with S12SDBGV1 SCR encoding 5.32.5.5 Scenario 4 Trigger if a sequence of 2 events is carried out in an incorrect order. Event A must be followed by event B and event B must be followed by event A. 2 consecutive occurrences of event A without an intermediate event B cause a trigger. Similarly 2 consecutive occurrences of event B without an intermediate event A cause a trigger. This is possible by using CompA and CompC to match on the same address as shown. M0 SCR1=0100 State1 M1 M2 State 3 SCR3=0001 SCR2=0011 State2 M0 M1 M1 Final State Figure 73. Scenario 4a This scenario is currently not possible using 2 comparators only. S12SDBGV2 makes it possible with 2 comparators, State 3 allowing a M0 to return to state 2, whilst a M2 leads to final state as shown. SCR1=0110 State1 M2 SCR3=1110 State 3 M0 M0 State2 M2 M2 SCR2=1100 M01 M1 disabled in range mode Final State Figure 74. Scenario 4b (with 2 comparators) The advantage of using only 2 channels is now range comparisons can be included (channel0) This however violates the S12SDBGV1 specification, which states a match leading to final state always has priority in case of a simultaneous match, whilst priority is also given to the lowest channel number. For S12SDBG the corresponding CPU priority decoder is removed to support this, such that on simultaneous taghits, taghits pointing to final state have highest priority. If no taghit points to final state then the lowest channel number has priority. Thus with the above encoding from State3, the CPU and DBG would break on a simultaneous M0/M2. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 223 5.32.5.6 Scenario 5 Trigger if following event A, event C precedes event B. i.e. the expected execution flow is A->B->C. SCR2=0110 SCR1=0011 M1 State1 M0 State2 Final State M2 Figure 75. Scenario 5 Scenario 5 is possible with the S12SDBGV1 SCR encoding 5.32.5.7 Scenario 6 Trigger if event A occurs twice in succession before any of 2 other events (BC) occurs. This scenario is not possible using the S12SDBGV1 SCR encoding. S12SDBGV2 includes additions shown in red. The change in SCR1 encoding also has the advantage that a State1->State3 transition using M0 is now possible. This is advantageous because range and data bus comparisons use channel0 only. SCR3=1010 SCR1=1001 M0 State1 M0 State3 Final State M12 Figure 76. Scenario 6 5.32.5.8 Scenario 7 Trigger when a series of 3 events is executed out of order. Specifying the event order as M1,M2,M0 to run in loops (120120120). Any deviation from this order should trigger. This scenario is not possible using the S12SDBGV1 SCR encoding because OR possibilities are very limited in the channel encoding. By adding OR forks as shown in red this scenario is possible. M01 SCR2=1100 SCR1=1101 State1 M1 State2 SCR3=1101 M2 State3 M12 Final State M0 M02 Figure 77. Scenario 7 On simultaneous matches the lowest channel number has priority so with this configuration the forking from State1 has the peculiar effect that a simultaneous match0/match1 transitions to final state, but a simultaneous match2/match1transitions to state2. 5.32.5.9 Scenario 8 Trigger when a routine/event at M2 follows either M1 or M0. SCR2=0101 SCR1=0111 State1 M01 State2 M2 Final State Figure 78. Scenario 8a Trigger when an event M2 is followed by either event M0 or event M1 MM912_634 224 Analog Integrated Circuit Device Data Freescale Semiconductor SCR2=0111 SCR1=0010 M2 State1 State2 M01 Final State Figure 79. Scenario 8b Scenario 8a and 8b are possible with the S12SDBGV1 and S12SDBGV2 SCR encoding. 5.32.5.10 Scenario 9 Trigger when a routine/event at A (M2) does not follow either B or C (M1 or M0) before they are executed again. This cannot be realized with theS12SDBGV1 SCR encoding due to OR limitations. By changing the SCR2 encoding as shown in red this scenario becomes possible. SCR2=1111 SCR1=0111 M01 State1 State2 M01 Final State M2 Figure 80. Scenario 9 5.32.5.11 Scenario 10 Trigger if an event M0 occurs following up to two successive M2 events without the resetting event M1. As shown up to 2 consecutive M2 events are allowed, whereby a reset to State1 is possible after either one or two M2 events. If an event M0 occurs following the second M2, before M1 resets to State1 then a trigger is generated. Configuring CompA and CompC the same, it is possible to generate a breakpoint on the third consecutive occurrence of event M0 without a reset M1. SCR1=0010 State1 M1 SCR2=0100 M2 SCR3=0010 M2 State2 State3 M0 Final State M1 Figure 81. Scenario 10a M0 SCR2=0011 SCR1=0010 State1 M2 State2 SCR3=0000 M1 State3 Final State M0 Figure 82. Scenario 10b Scenario 10b shows the case that after M2 then M1 must occur before M0. Starting from a particular point in code, event M2 must always be followed by M1 before M0. If after any M2, event M0 occurs before M1 then a trigger is generated. 5.33 5.33.1 Security (S12X9SECV2) Introduction This specification describes the function of the security mechanism in the S12I chip family (9SEC). NOTE No security feature is absolutely secure. However, Freescale’s strategy is to make reading or copying the FLASH and/or EEPROM difficult for unauthorized users. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 225 5.33.1.1 Features The user must be reminded part of the security must lie with the application code. An extreme example would be application code which dumps the contents of the internal memory. This would defeat the purpose of security. At the same time, the user may also wish to put a back door in the application program. An example of this is the user downloads a security key through the SCI, which allows access to a programming routine which updates parameters stored in another section of the Flash memory. The security features of the S12I chip family (in secure mode) are: • Protect the content of non-volatile memories (Flash, EEPROM) • Execution of NVM commands is restricted • Disable access to internal memory via background debug module (BDM) 5.33.1.2 Modes of Operation Table 340 gives an overview over availability of security relevant features in unsecure and secure modes. Figure 83 shows all modules affected by security in an MCU. Table 340. Feature Availability in Unsecure and Secure Modes on S12I Unsecure Mode NS SS NX ES Secure Mode EX ST NS SS NX ES EX ST Note: 198. Restricted NVM command set only. Refer to the NVM wrapper block guides for detailed information. 199. BDM hardware commands restricted to peripheral registers only. xbdm unsecure xmmc secreq flash security control security status mmc_secure xdbg xgate eeprom Figure 83. Chip Security Block Diagram The security mechanism relies on non-volatile bits contained in the FLASH module. The state of these bits is passed to the S12XMMC. Several of the MCU modules are involved in blocking certain operations which would reveal the contents of the protected FLASH and EEPROM. 5.34 Impact on MCU modules When the device is in secure mode, the following blocks are affected by security. 5.34.1 MMC There is a signal called “secure” from the FLASH or EEPROM which indicates if the security is enabled. There is also a signal from the xbdm, which is used in the process of unsecuring the chip. This signal is called “unsecure”. These two signals and the resulting state of “device security” are shown in Table 341. MM912_634 226 Analog Integrated Circuit Device Data Freescale Semiconductor Table 341. : Security Bits - System Control secreq bdm_unsecure mmc_secure 0 0 0 (unsecured) 0 1 0 (unsecured) 1 0 1 (secured) 1 1 0 (unsecured) In expanded modes, if the “mmc_secure_t2” signal is asserted, the ROMON and EEON bits are forced to zero. This operation is independent of how the part got to expanded mode (straight out of reset or by writing the mode register). When security is enabled and the part is brought up in special single chip mode, the secure BDM firmware is brought into the map along with the standard BDM firmware. The secure firmware has higher priority, but does not fill the whole space. It occupies $7F_FF80 to $7F_FFFF. One cycle after bdm_unsecure is asserted the secure firmware is disabled from the map. In secure mode aBDM access to a non register address is translated to a peripheral register address, and BDM registers are not accessible. No BDM global access is possible if the chip is secured. In secured expanded mode or emulation mode, FLASH and EEPROM are disabled by the MMC. 5.34.2 BDM When security is active and the blank check is performed and failed, only BDM hardware commands are available. If the blank check is succeeds, all BDM commands are available. The BDM status register contains a bit called UNSEC. This bit is only writable by the secure firmware in special single chip mode. Based on the state of this bit, the BDM generates a signal called “unsecure”. The bit and signal are always reset to 0 (= de-asserted = secure). If the user resets into special single chip mode with the part secured, an alternate BDM firmware (“SECURE firmware”), is placed in the map along with the standard BDM firmware. The secure firmware has higher priority than the standard firmware, but it is smaller (less bytes). The secure firmware covers the vector space, but does not reach the beginning of the BDM firmware space. When blank check is successfully performed, UNSEC is asserted. The BDM program jumps to the start of the standard BDM firmware program and the secure firmware is turned off. If the blank check fails, then the ENBDM bit in the BDMSTS register is set without asserting UNSEC, and the BDM firmware code enters a loop. This enables the BDM hardware commands. In secure mode the MMC restricts BDM accesses to the register space. With UNSEC asserted, security is off and the user can change the state of the secure bits in the FLASH. Note that if the user does not change the state of these bits to “unsecured”, the part is secured again when it is next taken out of reset. 5.34.3 DBG S12X_DBG disables the trace buffer, but breakpoints are still valid. 5.34.4 XGATE XGATE internal registers XGCCR, XGPC, and XGR1 - XGR7 can not be written and reads zero from IPBI. Single stepping in XGATE is not possible. XGATE code residing in the internal RAM cannot be protected: 1. start MCU in NSC, let it run for a while 2. reset into SSC, MASERS the NVM 3. reset into SSC, blank check of BDM secure firmware succeeds 4. MCU is temporarily unsecured 5. BDM can be used to read internal RAM (contents not affected by reset) MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 227 5.35 Secure firmware Code Overview The BDM contains a secure firmware code. This firmware code is invoked when the user comes out of reset in special single chip mode with security enabled. The function of the firmware code is straight forward: • Verify the FLASH is erased • Verify the EEPROM is erased • If both are erased, release security If either the FLASH or the EEPROM is not erased, then security is not released. The ENBDM bit is set and the code enters a loop. This allows BDM hardware commands, which may be used to erase the EEPROM and FLASH. Note that erasing the memories and erasing / reprogramming the security bits is NOT part of the firmware code. The user must perform these operations. The blank check of FLASH and EEPROM is done in the BDM firmware. As such it could be changed on future parts. The current scheme uses the NVM command state-machines (FTX, EETX) to perform the blank check. 5.35.0.1 Securing the Microcontroller Once the user has programmed the Flash and EEPROM, the chip can be secured by programming the security bits located in the options/security byte in the Flash memory array. These non-volatile bits keeps the device secured through reset and power-down. The options/security byte is located at address 0xFF0F (= global address 0x7F_FF0F) in the Flash memory array. This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for security (SEC[1:0]). On devices which have a memory page window, the Flash options/security byte is also available at address 0xBF0F by selecting page 0x3F with the PPAGE register. The contents of this byte are copied into the Flash security register (FSEC) during a reset sequence. Table 342. Flash Options/Security Byte 0xFF0F 7 6 5 4 3 2 1 0 KEYEN1 KEYEN0 NV5 NV4 NV3 NV2 SEC1 SEC0 The meaning of the bits KEYEN[1:0] is shown in Table 343. Refer to Section 5.35.0.2.5, “Unsecuring the MCU Using the Back door Key Access" for more information. Table 343. Back door Key Access Enable Bits KEYEN[1:0] Back door Key Access Enabled 00 0 (disabled) 01 0 (disabled) 10 1 (enabled) 11 0 (disabled) The meaning of the security bits SEC[1:0] is shown in Table 344. For security reasons, the state of device security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’. Table 344. Security Bits SEC[1:0] Security State 00 1 (secured) 01 1 (secured) 10 0 (unsecured) 11 1 (secured) NOTE Refer to the Flash block guide for actual security configuration (in section “Flash Module Security”). MM912_634 228 Analog Integrated Circuit Device Data Freescale Semiconductor 5.35.0.2 Operation of the Secured Microcontroller By securing the device, unauthorized access to the EEPROM and Flash memory contents can be prevented. However, it must be understood the security of the EEPROM and Flash memory contents also depends on the design of the application program. For example, if the application has the capability of downloading code through a serial port and then executing this code (e.g. an application containing bootloader code), then this capability could potentially be used to read the EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this example, the security of the application could be enhanced by requiring a challenge/response authentication before any code can be downloaded. Secured operation has the following effects on the microcontroller: 5.35.0.2.1 • • • 5.35.0.2.2 • • • • Normal Single Chip Mode (NS) Background debug module (BDM) operation is completely disabled. Execution of Flash and EEPROM commands is restricted. Refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. Special Single Chip Mode (SS) BDM firmware commands are disabled. BDM hardware commands are restricted to the register space. Execution of Flash and EEPROM commands is restricted. Refer to the NVM block guide for details. Tracing code execution using the DBG module is disabled. Special single chip mode means BDM is active after reset. The availability of BDM firmware commands depends on the security state of the device. The BDM secure firmware first performs a blank check of both the Flash memory and the EEPROM. If the blank check succeeds, security is temporarily turned off and the state of the security bits in the appropriate Flash memory location can be changed If the blank check fails, security remains active, only the BDM hardware commands is enabled, and the accessible memory space is restricted to the peripheral register area. This allows the BDM to be used to erase the EEPROM and Flash memory without giving access to their contents. After erasing both Flash memory and EEPROM, another reset into special single chip mode causes the blank check to succeed and the options/security byte can be programmed to “unsecured” state via BDM. While the BDM is executing the blank check, the BDM interface is completely blocked, which means all BDM commands are temporarily blocked. 5.35.0.2.3 Executing from Internal Memory in Expanded Mode The user may choose to operate from internal memory while in expanded mode. To do this the user must start in single chip mode and write to the mode bits selecting expanded operation. In this mode internal visibility and IPIPE are blocked. If the users program tries to execute from outside the program memory space (internal space occupied by the FLASH), the FLASH and EEPROM is disabled. BDM operations is blocked. If the user begins operation in single chip mode with security on, the user is constrained to operate out of internal memory - even if the user changes to expanded mode. To accomplish this, the MMC needs to register the part started in single chip mode and was secured. The CPU provides the state of the two high-order bits of the Program Counter. All this information, plus the firmware size information is used to determine the part is executing in the proper space. If the program strays, the selects for FLASH and EEPROM are disabled by the MMC until the part goes through reset. 5.35.0.2.4 Unsecuring the Microcontroller Unsecuring the microcontroller can be done by three different methods: 1. Back door key access 2. Reprogramming the security bits 3. Complete memory erase (special modes) 5.35.0.2.5 Unsecuring the MCU Using the Back door Key Access In normal modes (single chip and expanded), security can be temporarily disabled using the back door key access method. This method requires that: • The back door key at 0xFF00–0xFF07 (= global addresses 0x7F_FF00–0x7F_FF07) has been programmed to a valid value. • The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’. • In single chip mode, the application program programmed into the microcontroller must be designed to have the capability to write to the back door key locations. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 229 The back door key values themselves would not normally be stored within the application data, which means the application program would have to be designed to receive the back door key values from an external source (e.g. through a serial port). The back door key access method allows debugging of a secured microcontroller without having to erase the Flash. This is particularly useful for failure analysis. NOTE No word of the back door key is allowed to have the value 0x0000 or 0xFFFF. 5.35.0.3 Reprogramming the Security Bits In normal single chip mode (NS), security can also be disabled by erasing and reprogramming the security bits within Flash options/security byte to the unsecured value. Because the erase operation erases the entire sector from 0xFE00–0xFFFF (0x7F_FE00–0x7F_FFFF), the back door key and the interrupt vectors are also erased; this method is not recommended for normal single chip mode. The application software can only erase and program the Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected (see Flash protection). Thus Flash protection is a useful means of preventing this method. The microcontroller enters the unsecured state after the next reset following the programming of the security bits to the unsecured value. This method requires: • The application software previously programmed into the microcontroller has been designed to have the capability to erase and program the Flash options/security byte, or security is first disabled using the back door key method, allowing BDM to be used to issue commands to erase and program the Flash options/security byte. • The Flash sector containing the Flash options/security byte is not protected. 5.35.0.4 Complete Memory Erase (Special Modes) The microcontroller can be unsecured in special modes by erasing the entire EEPROM and Flash memory contents. When a secure microcontroller is reset into special single chip mode (SS), the BDM firmware verifies whether the EEPROM and Flash memory are erased. If any EEPROM or Flash memory address is not erased, only BDM hardware commands are enabled. BDM hardware commands can then be used to write to the EEPROM and Flash registers to mass erase the EEPROM and all Flash memory blocks. When next reset into special single chip mode, the BDM firmware again verifies whether all EEPROM and Flash memory are erased, and this being the case, enables all BDM commands, allowing the Flash options/security byte to be programmed to the unsecured value. The security bits SEC[1:0] in the Flash security register indicates the unsecure state following the next reset. 5.36 Initialization of a Virgin Device “Virgin” cells in the Flash array reads all programmed and the MCU is secured as the SEC[1:0] bits would be loaded with ‘00’ from the Flash security byte. At wafer probe NVM BIST mode is used to test and initialize the Flash IFR block. Wafer probe leaves the Flash block erased so the MCU is secured. For blind-assembled products, the following sequence must be used to initialize the Flash array: • Reset the MCU into special mode. • Set FCLKDIV to provide a proper FCLK period. • Set FPROT register to the unprotected state. • Set the WRALL bit in the FTSTMOD register, if available. • Load the Flash Pulse Timer with the mass erase time by executing a LDPTMR command write sequence. • Execute MASERSI commands to mass erase the Flash main block and Flash IFR block. • Execute the LDPTMR and PGMI command write sequence to program all timing parameters into the Flash IFR block. • Reset the MCU into special single chip mode. After the reset the BDM secure firmware executes a blank check command. If the blank check succeeds the MCU is temporarily unsecured. • Execute the PGM command write sequence to program the security byte to the unsecured state. Blocking access to memories which can be secured during SCAN testing is necessary. While it would take a fair amount of sophistication on the part of a “thief”, our DFT people still consider this a major risk to security. It is therefore highly recommended accesses to the FLASH and EEPROM arrays be blocked at chip level during scan test. Blocking or not blocking security at the core level does not help. MM912_634 230 Analog Integrated Circuit Device Data Freescale Semiconductor 5.37 Impact of Security on Test When silicon comes out of processing, it is extremely unlikely the security bits are configured for unsecure. There needs to be “hooks” for running BIST (if present) or Burn-in by bypassing the security. If wafer level burn-in is to be used, security must have a bypass which can be connected to by the burn-in layer. In burn-in, security is bypassed, but when the burn-in layer is removed, the state of secreq determines whether the part is secured or not. This may require some sort of weak pull-up device. At some point during testing the internal FLASH and EEPROM needs to be unsecured. This test program should follow the same sequence as a user to unsecure the part: erase the memories, bring the part up in special mode, erase and program the security bits to the unsecured state. 5.38 5.38.1 S12 Clock, Reset and Power Management Unit (S12CPMU) Introduction This specification describes the function of the Clock, Reset and Power Management Unit. • The Pierce oscillator (OSCLCP) provides a robust, low-noise and low-power external clock source. It is designed for optimal start-up margin with typical crystal oscillators. • The Voltage regulator (IVREG) operates from the range 3.13 V to 5.5 V. It provides all the required chip internal voltages and voltage monitors. • The Phase Locked Loop (PLL) provides a highly accurate frequency multiplier with internal filter. • The Internal Reference Clock (IRC1M) provides a 1.0 MHz clock. 5.38.1.1 Features The Pierce Oscillator (OSCLCP) contains circuitry to dynamically control current gain in the output amplitude. This ensures a signal with low harmonic distortion, low power and good noise immunity. • Supports crystals or resonators from 4.0 to 16 MHz. • High noise immunity due to input hysteresis and spike filtering. • Low RF emissions with peak-to-peak swing limited dynamically • Transconductance (gm) sized for optimum start-up margin for typical crystals • Dynamic gain control eliminates the need for external current limiting resistor • Integrated resistor eliminates the need for external bias resistor. • Low power consumption: Operates from internal 1.8 V (nominal) supply, Amplitude control limits power The Voltage Regulator (IVREG) has the following features: • Input voltage range from 3.13 V to 5.5 V • Low-voltage detect (LVD) with low-voltage interrupt (LVI) • Power-on reset (POR) • Low-voltage reset (LVR) • during scan pattern execution option to go to RPM to support IDDq test. • external voltage reference used for HV-stress test and MIM screen, the external voltage on VDDA, divided by series resistors, are used as input to the regulating loop of the IVREG The Phase Locked Loop (PLL) has the following features: • highly accurate and phase locked frequency multiplier • Configurable internal filter for best stability and lock time. • Frequency modulation for defined jitter and reduced emission • Automatic frequency lock detector • Interrupt request on entry or exit from locked condition • Reference clock either external (crystal) or internal square wave (1.0 MHz IRC1M) based. • PLL stability is sufficient for LIN communication, even if using IRC1M as reference clock The Internal Reference Clock (IRC1M) has the following features: • Trimmable in frequency • Factory trimmed value for 1.0 MHz in Flash Memory, can be overwritten by application if required Other features of the S12CPMU include • Clock monitor to detect loss of crystal • Autonomous periodical interrupt (API) MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 231 • • Bus Clock Generator — Clock switch to select either PLLCLK or external crystal/resonator based Bus Clock — PLLCLK divider to adjust system speed System Reset generation from the following possible sources: — Power-on reset (POR) — Low-voltage reset (LVR) — Illegal address access — COP timeout — Loss of oscillation (clock monitor fail) — External pin RESET 5.38.1.2 Modes of Operation This subsection lists and briefly describes all operating modes supported by the S12CPMU. 5.38.1.2.1 Run Mode The voltage regulator is in Full Performance Mode (FPM). The Phase-locked Loop (PLL) is on. The Internal Reference Clock (IRC1M) is on. The API is available. • PLL Engaged Internal (PEI) — This is the default mode after System Reset and Power-on Reset. — The Bus Clock is based on the PLLCLK. — After reset the PLL is configured for 64 MHz VCOCLK operation Post divider is 0x03, so PLLCLK is VCOCLK divided by 4, that is 16 MHz and Bus Clock is 8.0 MHz. The PLL can be reconfigured for other bus frequencies. — The reference clock for the PLL (REFCLK) is based on internal reference clock IRC1M • PLL Engaged External (PEE) — The Bus Clock is based on the PLLCLK. — This mode can be entered from default mode PEI by performing the following steps: – Configure the PLL for desired bus frequency. – Program the reference divider (REFDIV[3:0] bits) to divide down oscillator frequency if necessary. – Enable the external oscillator (OSCE bit) • PLL Bypassed External (PBE) — The Bus Clock is based on the Oscillator Clock (OSCCLK). — This mode can be entered from default mode PEI by performing the following steps: – Enable the external oscillator (OSCE bit) – Wait for oscillator to start up (UPOSC=1) – Select the Oscillator Clock (OSCCLK) as Bus Clock (PLLSEL=0) — The PLLCLK is still on to filter possible spikes of the external oscillator clock 5.38.1.2.2 Stop Mode This mode is entered by executing the CPU STOP instruction. The voltage regulator is in Reduced Power mode (RPM) The API is available The Phase Locked Loop (PLL) is off The Internal Reference Clock (IRC1M) is off Core Clock, Bus Clock and BDM Clock are stopped MM912_634 232 Analog Integrated Circuit Device Data Freescale Semiconductor Depending on the setting of the PSTP and the OSCE bit, Stop mode can be differentiated between Full Stop mode (PSTP = 0 or OSCE=0) and Pseudo Stop mode (PSTP = 1 and OSCE=1). • Full Stop mode (pstp = 0 or osce=0) The external oscillator (OSCLCP) is disabled After wake-up from Full Stop mode the Core Clock and Bus Clock are running on PLLCLK (PLLSEL=1). After wake-up from Full Stop mode the COP and RTI are running on IRCCLK (COPOSCSEL=0, RTIOSCSEL=0) • Pseudo Stop Mode (PSTP = 1 and OSCE=1) The external oscillator (OSCLCP) continues to run. If the respective enable bits are set the COP and RTI continues to run. The clock configuration bits PLLSEL, COPOSCSEL, RTIOSCSEL are unchanged NOTE When starting up the external oscillator (either by programming OSCE bit to 1 or on exit from Full Stop Mode with OSCE bit already 1) the software must wait for a minimum time equivalent to the startup-time of the external oscillator tUPOSC before entering Pseudo Stop mode. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 233 5.38.1.3 S12IPIMV1 Block Diagram Illegal Address Access MMC VDD, VDDF (core supplies) Low Voltage Detect VDDA VDDR VSS ILAF LVIE Low Voltage Interrupt LVDS Low Voltage Detect VDDX VDDX VSSX Voltage Regulator 3.13 to 5.5V VDDA VSSA LVRF Power-On Detect PORF RESET UPOSC Loop EXTAL Controlled Pierce Oscillator XTAL (OSCLCP) 4MHz-16MHz REFDIV[3:0] OSCBW Reference Divider Internal Reference Clock (IRC1M) OSCE System Reset Oscillator status Interrupt OSCIE UPOSC=0 sets PLLSEL bit Adaptive Oscillator Filter IRCTRIM[9:0] Power-On Reset Reset Generator monitor fail Clock Monitor PSTP S12CPMU COP time out & OSCCLK OSCFILT[4:0] PLLSEL POSTDIV[4:0] Post Divider 1,2,…,32 divide by 4 ECLK2X (Core Clock) PLLCLK divide ECLK by 2 (Bus Clock) IRCCLK (to LCD) VCOFRQ[1:0] Phase locked Loop with internal Filter (PLL) REFCLK FBCLK BDM Clock divide by 8 VCOCLK Lock detect CAN_OSCCLK (to MSCAN) REFFRQ[1:0] LOCK LOCKIE Divide by 2*(SYNDIV+1) SYNDIV[5:0] Bus Clock RC ACLK Osc. Autonomous API_EXTCLK Periodic Interrupt (API) APICLK UPOSC APIE RTIE UPOSC=0 clears IRCCLK COPCLK COP OSCCLK COPOSCSEL PLL Lock Interrupt Watchdog PCE COP time out to Reset Generator CPMUCOP IRCCLK RTICLK OSCCLK RTIOSCSEL API Interrupt RTI Interrupt Real Time Interrupt (RTI) PRE CPMURTI Figure 84. Block diagram of S12CPMU Figure 85 shows a block diagram of the OSCLCP. MM912_634 234 Analog Integrated Circuit Device Data Freescale Semiconductor OSCCLK Peak Detector Gain Control VDD = 1.8 V VSS Rf EXTAL XTAL Figure 85. OSCLCP Block Diagram 5.38.2 Signal Description This section lists and describes the signals which connect off chip. 5.38.2.1 RESET RESET is an active-low bidirectional pin. As an input it initializes the MCU asynchronously to a known start-up state. As an open-drain output it indicates an MCU-internal reset has been triggered. 5.38.2.2 EXTAL and XTAL These pins provide the interface for a crystal to control the internal clock generator circuitry. EXTAL is the external clock input or the input to the crystal oscillator amplifier. XTAL is the output of the crystal oscillator amplifier. The MCU internal OSCCLK is derived from the EXTAL input frequency. If OSCE=0, the EXTAL pin is pulled down by an internal resistor of approximately 200 k and the XTAL pin is pulled down by an internal resistor of approximately 700 k. NOTE Freescale recommends an evaluation of the application board and chosen resonator or crystal by the resonator or crystal supplier. Loop controlled circuit is not suited for overtone resonators and crystals. 5.38.2.3 VDDR — Regulator Power Input Pin Pin VDDR is the power input of IVREG. All currents sourced into the regulator loads flow through this pin. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDR and VSS can smooth ripple on VDDR. 5.38.2.4 VSS — Ground Pin 5.38.2.5 VSS must be grounded.VDDA, VSSA — Regulator Reference Supply Pins Pins VDDA and VSSA are used to supply the analog parts of the regulator.  Internal precision reference circuits are supplied from these signals. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDA and VSSA can improve the quality of this supply. MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 235 5.38.2.6 VDDX, VSSX— Pad Supply Pins This supply domain is monitored by the Low Voltage Reset circuit. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between VDDX and VSSX can improve the quality of this supply. NOTE Depending on the device package following device supply pins are maybe combined into one supply pin: VDDR, VDDX and VDDA. Depending on the device package following device supply pins are maybe combined into one supply pin: VSS, VSSX and VSSA. Refer to the device Reference Manual for information if device supply pins are combined into one supply pin for certain packages and which supply pins are combined together. An off-chip decoupling capacitor (100 nF...220 nF, X7R ceramic) between the combined supply pin pair can improve the quality of this supply. 5.38.2.7 VDD — Internal Regulator Output Supply (Core Logic) Node VDD is a device internal supply output of the voltage regulator which provides the power supply for the core logic. This supply domain is monitored by the Low Voltage Reset circuit. 5.38.2.8 VDDF — Internal Regulator Output Supply (NVM Logic) Node VDDF is a device internal supply output of the voltage regulator which provides the power supply for the NVM logic. This supply domain is monitored by the Low Voltage Reset circuit 5.38.2.9 API_EXTCLK — API external clock output pin This pin provides the signal selected via APIES and is enabled with APIEA bit. See device specification to which pin it connects. 5.38.2.10 vddf_test, vdd_test, vddpll_test — supply testmode pins These pins allow to measure internal VDDF, VDD, VDDPLL. 5.38.2.11 cpmu_test_clk This signal is connected to a device pin and allows measuring internal clocks if cpmu_test_clk_en bit is set. 5.38.2.12 cpmu_test_xfc This signal is connected to a device pin and allows measuring the internal PLL filter node if cpmu_test_xfc_en bit is set. 5.38.2.13 REGFT[2:0] and REGT[2:0] With the ipt_trim_ld_en signal of the PTI, the trim values for VDD and VDDF of the VREG are loaded into CPMUTEST3 register which directly trims the VREG. 5.38.3 Memory Map and Registers This section provides a detailed description of all registers accessible in the S12CPMU. 5.38.3.1 Module Memory Map The S12CPMU registers are shown in Figure 345. Table 345. CPMU Register Summary Address Name 0x0034 CPMU SYNR 0x0035 CPMU REFDIV Bit 7 6 5 4 3 2 1 Bit 0 R VCOFRQ[1:0] SYNDIV[5:0] W R 0 0 REFFRQ[1:0] REFDIV[3:0] W = Unimplemented or Reserved MM912_634 236 Analog Integrated Circuit Device Data Freescale Semiconductor Table 345. CPMU Register Summary (continued) Address Name 0x0036 CPMU POSTDIV R Bit 7 6 5 0 0 0 4 2 1 Bit 0 POSTDIV[4:0] W R 0x0037 3 CPMUFLG LOCK RTIF PORF LVRF 0 0 LOCKIF UPOSC ILAF OSCIF W R 0x0038 CPMUINT RTIE 0 0 LOCKIE 0 OSCIE W R 0x0039 CPMUCLKS 0 PLLSEL PSTP 0 0 0 PRE PCE RTI OSCSEL COP OSCSEL 0 0 0 0 RTR2 RTR1 RTR0 CR2 CR1 CR0 0 fm_test0 test_sqw_os c0 pfd_force_up 0 pfd_force_d own0 W R 0x003A CPMUPLL FM1 FM0 RTR5 RTR4 RTR3 0 0 0 W R 0x003B CPMURTI RTDEC RTR6 WCOP RSBCK W R 0x003C CPMUCOP W 0x003D RESERVEDCP MUTEST0 R WRTMASK fmcs_reg_sel 0 cpmu_test_ gfe0 cpmu_test_xf fc_force_en c_en0 0 pfd_force_en 0 cpmu_test_ clk_en0 cpmu_test_cl k_sel[1]0 vcofrq20 W 0x003E RESERVEDCP MUTEST1 R cpmu_test_ clk_sel[0]0 osc_lcp_mo osc_lcp_ext nitor_disabl sqw_enable e0 0 W 0x003E RESERVEDCP MUFMCS 0x003F CPMU ARMCOP 0x02F0 R fmcs_cs[7:0] W R 0 0 0 0 0 0 0 0 W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 R 0 0 0 0 0 0 0 0 0 0 0 0 0 LVDS LVIE LVIF APIE APIF 0 0 APIR9 APIR8 RESERVED W 0x02F1 0x02F2 CPMU LVCTL CPMU APICTL R W R 0 0 APICLK APIES APIEA APIFE W R 0x02F3 CPMUAPITR APITR5 APITR4 APITR3 APITR2 APITR1 APITR0 APIR15 APIR14 APIR13 APIR12 APIR11 APIR10 W R 0x02F4 CPMUAPIRH W = Unimplemented or Reserved MM912_634 Analog Integrated Circuit Device Data Freescale Semiconductor 237 Table 345. CPMU Register Summary (continued) Address Name 0x02F5 CPMUAPIRL Bit 7 6 5 4 3 2 1 Bit 0 APIR7 APIR6 APIR5 APIR4 APIR3 APIR2 APIR1 APIR0 0 LVRT 0vdd_extern al_en 0 REGFT2 0 REGFT1 0 REGFT0 0 REGT2 0 REGT1 0 REGT0 0 0 0 0 0 0 0 0 R W 0x02F6 RESERVEDCP MUTEST3 R W R 0x02F7 RESERVED W CPMU IRCTRIMH 0x02F8 CPMU IRCTRIML 0x02F9 R 0 TCTRIM[4:0] R IRCTRIM[7:0] W R 0x02FA IRCTRIM[9:8] W CPMUOSC OSCE OSCBW 0 0 OSCPINS_E N OSCFILT[4:0] W R 0x02FB 0 0 0 0 0 CPMUPROT PROT W 0x02FC RESERVEDCP MUTEST2 R 0 0 0 LVRS 0 LVRFS 0 LVRXS 0 0 0RCEXA W = Unimplemented or Reserved 5.38.3.2 Register Descriptions This section describes all the S12CPMU registers and their individual bits. Address order is as listed in Table 345. 5.38.3.2.1 S12CPMU Synthesizer Register (CPMUSYNR) The CPMUSYNR register controls the multiplication factor of the PLL and selects the VCO frequency range. Table 346. S12CPMU Synthesizer Register (CPMUSYNR) 0x0034 7 6 5 4 3 2 1 0 1 1 1 R VCOFRQ[1:0] SYNDIV[5:0] W Reset 0 1 0 1 1 Read: Anytime Write: Anytime if PROT=0 (CPMUPROT register) and PLLSEL=1 (CPMUCLKS register). Else write has no effect. NOTE Writing to this register clears the LOCK and UPOSC status bits. If PLL has locked (LOCK=1) f VCO = 2  f REF   SYNDIV + 1  MM912_634 238 Analog Integrated Circuit Device Data Freescale Semiconductor NOTE fVCO must be within the specified VCO frequency lock range. Bus frequency fBUS must not exceed the specified maximum. The VCOFRQ[1:0] bits are used to configure the VCO gain for optimal stability and lock time. For correct PLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK frequency as shown in Table 347. Setting the VCOFRQ[1:0] bits incorrectly can result in a non functional PLL (no locking and/or insufficient stability). Table 347. VCO Clock Frequency Selection VCOCLK Frequency Ranges VCOFRQ[1:0] 32 MHz