S912XET256W1MAL

MC9S12XEP100 Reference Manual Covers MC9S12XE Family HCS12X Microcontrollers MC9S12XEP100RMV1 Rev. 1.25 02/2013 freescale.com To provide the most up-to-date information, the document revision on the World Wide Web is the most current. A printed copy may be an earlier revision. To verif, refer to: freescale.com This document contains information for the complete S12XE-Family and thus includes a set of separate FTM module sections to cover the whole family. A full list of family members and options is included in the appendices. This document contains information for all constituent modules, with the exception of the S12X CPU. For S12X CPU information please refer to CPU12XV2 in the CPU12/CPU12X Reference Manual. Revision History. Refer to module section revision history tables for more information. Date Revision Description 1.18 Updated NVM timing parameter section for brownout case Specified time delay from RESET to start of CPU code execution Added NVM patch Part IDs Enhanced ECT GPIO / timer function transitioning description Dec, 2008 1.19 Updated 208MAPBGA thermal parameters Revised TIM flag clearing procedure Corrected CRG register address Added maskset identifier suffix for ATMC fab Fixed typos Aug, 2009 1.20 Added 208MAPBGA disclaimer Added VREAPI to PT5. Added LVR Note to electricals. Updates to TIM/ECT/XGATE/SCI/MSCAN (see embedded rev. history) Apr, 2010 1.21 FTM section (see FTM revision history) PIM section (see PIM revision history) May, 2010 1.22 ECT and TIM sections (see ECT, TIM revision history tables) BDM Alternate clock source defined in device overview Sep, 2010 1.23 Added S12XEG256 option. Updated MSCAN section Aug, 2012 1.24 Added bandgap voltage to electricals Added new maskset and Part ID numbers Minor updates to MSCAN,SCI and S12XINT sections Removed BGA disclaimer Feb, 2013 1.25 Updated MSCAN section Formatting updates and minor corrections in PWM, CRG, BDM, DBG sections Updated Ordering Information Sep, 2008 Chapter 1 Device Overview MC9S12XE-Family. . . . . . . . . . . . . . . . . . . . . 27 Chapter 2 Port Integration Module (S12XEP100PIMV1) . . . . . . . . . . . . . . 89 Chapter 3 Memory Mapping Control (S12XMMCV4) . . . . . . . . . . . . . . . . 187 Chapter 4 Memory Protection Unit (S12XMPUV1) . . . . . . . . . . . . . . . . . 227 Chapter 5 External Bus Interface (S12XEBIV4) . . . . . . . . . . . . . . . . . . . . 241 Chapter 6 Interrupt (S12XINTV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 Chapter 7 Background Debug Module (S12XBDMV2) . . . . . . . . . . . . . . 279 Chapter 8 S12X Debug (S12XDBGV3) Module . . . . . . . . . . . . . . . . . . . . 305 Chapter 9 Security (S12XE9SECV2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 Chapter 10 XGATE (S12XGATEV3). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) . . . . . . 469 Chapter 12 Pierce Oscillator (S12XOSCLCPV2) . . . . . . . . . . . . . . . . . . . . 499 Chapter 13 Analog-to-Digital Converter (ADC12B16CV1) . . . . . . . . . . . . 503 Chapter 14 Enhanced Capture Timer (ECT16B8CV3). . . . . . . . . . . . . . . . 527 Chapter 15 Inter-Integrated Circuit (IICV3) Block Description. . . . . . . . . 579 Chapter 16 Scalable Controller Area Network (S12MSCANV3) . . . . . . . . 605 Chapter 17 Periodic Interrupt Timer (S12PIT24B8CV2) . . . . . . . . . . . . . . 659 Chapter 18 Periodic Interrupt Timer (S12PIT24B4CV2) . . . . . . . . . . . . . . 677 Chapter 19 Pulse-Width Modulator (S12PWM8B8CV1) . . . . . . . . . . . . . . 691 Chapter 20 Serial Communication Interface (S12SCIV5) . . . . . . . . . . . . . 723 Chapter 21 Serial Peripheral Interface (S12SPIV5) . . . . . . . . . . . . . . . . . . 761 Chapter 22 Timer Module (TIM16B8CV2) Block Description . . . . . . . . . . 787 Chapter 23 Voltage Regulator (S12VREGL3V3V1) . . . . . . . . . . . . . . . . . . 815 Chapter 24 128 KByte Flash Module (S12XFTM128K2V1) . . . . . . . . . . . . 832 Chapter 25 256 KByte Flash Module (S12XFTM256K2V1) . . . . . . . . . . . . 891 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 3 Chapter 26 384 KByte Flash Module (S12XFTM384K2V1) . . . . . . . . . . . . 953 Chapter 27 512 KByte Flash Module (S12XFTM512K3V1) . . . . . . . . . . . 1016 Chapter 28 768 KByte Flash Module (S12XFTM768K4V2) . . . . . . . . . . . 1077 Chapter 29 1024 KByte Flash Module (S12XFTM1024K5V2) . . . . . . . . . 1140 Appendix A Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 Appendix B Package Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1258 Appendix C PCB Layout Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1260 Appendix D Derivative Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268 Appendix E Detailed Register Address Map. . . . . . . . . . . . . . . . . . . . . . . 1271 Appendix F Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1322 MC9S12XE-Family Reference Manual Rev. 1.25 4 Freescale Semiconductor Blank Page MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 5 Blank Page MC9S12XE-Family Reference Manual Rev. 1.25 6 Freescale Semiconductor Chapter 1 Device Overview MC9S12XE-Family 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 1.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 1.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 1.1.4 Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 1.1.5 Address Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 1.1.6 Detailed Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 1.1.7 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 1.2.1 Device Pinout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 1.2.2 Pin Assignment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 1.2.3 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 1.2.4 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 System Clock Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.4.1 Chip Configuration Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 1.4.2 Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 1.4.3 Freeze Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 1.4.4 System States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.2 Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 1.6.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 ADC0 Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.7.1 External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 1.7.2 ADC0 Channel[17] Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 ADC1 External Trigger Input Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 MPU Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 VREG Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 1.10.1 Temperature Sensor Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 BDM Clock Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 S12XEPIM Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Oscillator Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Chapter 2 Port Integration Module (S12XEPIMV1) 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 7 2.2 2.3 2.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 2.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 2.3.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 2.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 2.3.3 Port A Data Register (PORTA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.4 Port B Data Register (PORTB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 2.3.5 Port A Data Direction Register (DDRA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.6 Port B Data Direction Register (DDRB) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 2.3.7 Port C Data Register (PORTC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 2.3.8 Port D Data Register (PORTD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.9 Port C Data Direction Register (DDRC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 2.3.10 Port D Data Direction Register (DDRD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 2.3.11 Port E Data Register (PORTE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 2.3.12 Port E Data Direction Register (DDRE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 2.3.13 S12X_EBI ports, BKGD pin Pull-up Control Register (PUCR) . . . . . . . . . . . . . . . . . . 114 2.3.14 S12X_EBI ports Reduced Drive Register (RDRIV) . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 2.3.15 ECLK Control Register (ECLKCTL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 2.3.16 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 2.3.17 IRQ Control Register (IRQCR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.18 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 2.3.19 Port K Data Register (PORTK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.20 Port K Data Direction Register (DDRK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 2.3.21 Port T Data Register (PTT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 2.3.22 Port T Input Register (PTIT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.3.23 Port T Data Direction Register (DDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 2.3.24 Port T Reduced Drive Register (RDRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.3.25 Port T Pull Device Enable Register (PERT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 2.3.26 Port T Polarity Select Register (PPST) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.27 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.28 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 2.3.29 Port S Data Register (PTS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 2.3.30 Port S Input Register (PTIS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.3.31 Port S Data Direction Register (DDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 2.3.32 Port S Reduced Drive Register (RDRS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 2.3.33 Port S Pull Device Enable Register (PERS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.3.34 Port S Polarity Select Register (PPSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 2.3.35 Port S Wired-Or Mode Register (WOMS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.3.36 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 2.3.37 Port M Data Register (PTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 2.3.38 Port M Input Register (PTIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 2.3.39 Port M Data Direction Register (DDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 2.3.40 Port M Reduced Drive Register (RDRM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 2.3.41 Port M Pull Device Enable Register (PERM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 MC9S12XE-Family Reference Manual Rev. 1.25 8 Freescale Semiconductor 2.3.42 2.3.43 2.3.44 2.3.45 2.3.46 2.3.47 2.3.48 2.3.49 2.3.50 2.3.51 2.3.52 2.3.53 2.3.54 2.3.55 2.3.56 2.3.57 2.3.58 2.3.59 2.3.60 2.3.61 2.3.62 2.3.63 2.3.64 2.3.65 2.3.66 2.3.67 2.3.68 2.3.69 2.3.70 2.3.71 2.3.72 2.3.73 2.3.74 2.3.75 2.3.76 2.3.77 2.3.78 2.3.79 2.3.80 2.3.81 2.3.82 2.3.83 2.3.84 2.3.85 2.3.86 Port M Polarity Select Register (PPSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Port M Wired-Or Mode Register (WOMM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Module Routing Register (MODRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Port P Data Register (PTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Port P Input Register (PTIP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Port P Data Direction Register (DDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 Port P Reduced Drive Register (RDRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Port P Pull Device Enable Register (PERP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Port P Polarity Select Register (PPSP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Port P Interrupt Enable Register (PIEP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Port P Interrupt Flag Register (PIFP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Port H Data Register (PTH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Port H Input Register (PTIH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Port H Data Direction Register (DDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Port H Reduced Drive Register (RDRH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Port H Pull Device Enable Register (PERH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Port H Polarity Select Register (PPSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 Port H Interrupt Enable Register (PIEH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Port H Interrupt Flag Register (PIFH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 Port J Data Register (PTJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Port J Input Register (PTIJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Port J Data Direction Register (DDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Port J Reduced Drive Register (RDRJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Port J Pull Device Enable Register (PERJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Port J Polarity Select Register (PPSJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Port J Interrupt Enable Register (PIEJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Port J Interrupt Flag Register (PIFJ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Port AD0 Data Register 0 (PT0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Port AD0 Data Register 1 (PT1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Port AD0 Data Direction Register 0 (DDR0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Port AD0 Data Direction Register 1 (DDR1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Port AD0 Reduced Drive Register 0 (RDR0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Port AD0 Reduced Drive Register 1 (RDR1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Port AD0 Pull Up Enable Register 0 (PER0AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Port AD0 Pull Up Enable Register 1 (PER1AD0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Port AD1 Data Register 0 (PT0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Port AD1 Data Register 1 (PT1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 Port AD1 Data Direction Register 0 (DDR0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160 Port AD1 Data Direction Register 1 (DDR1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161 Port AD1 Reduced Drive Register 0 (RDR0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Port AD1 Reduced Drive Register 1 (RDR1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Port AD1 Pull Up Enable Register 0 (PER0AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Port AD1 Pull Up Enable Register 1 (PER1AD1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Port R Data Register (PTR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 Port R Input Register (PTIR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 9 2.4 2.5 2.3.87 Port R Data Direction Register (DDRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.3.88 Port R Reduced Drive Register (RDRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 2.3.89 Port R Pull Device Enable Register (PERR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 2.3.90 Port R Polarity Select Register (PPSR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 2.3.91 PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 2.3.92 Port R Routing Register (PTRRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 2.3.93 Port L Data Register (PTL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 2.3.94 Port L Input Register (PTIL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2.3.95 Port L Data Direction Register (DDRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 2.3.96 Port L Reduced Drive Register (RDRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 2.3.97 Port L Pull Device Enable Register (PERL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 2.3.98 Port L Polarity Select Register (PPSL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.3.99 Port L Wired-Or Mode Register (WOML) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 2.3.100Port L Routing Register (PTLRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 2.3.101Port F Data Register (PTF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 2.3.102Port F Input Register (PTIF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 2.3.103Port F Data Direction Register (DDRF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 2.3.104Port F Reduced Drive Register (RDRF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 2.3.105Port F Pull Device Enable Register (PERF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 2.3.106Port F Polarity Select Register (PPSF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 2.3.107PIM Reserved Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 2.3.108Port F Routing Register (PTFRR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 2.4.3 Pins and Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 2.4.4 Pin interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 2.5.1 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186 Chapter 3 Memory Mapping Control (S12XMMCV4) 3.1 3.2 3.3 3.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 3.1.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 3.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 3.1.3 S12X Memory Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 3.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 3.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 3.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 3.4.1 MCU Operating Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 3.4.2 Memory Map Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 MC9S12XE-Family Reference Manual Rev. 1.25 10 Freescale Semiconductor 3.5 3.4.3 Chip Access Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 3.4.4 Chip Bus Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 3.5.1 CALL and RTC Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 3.5.2 Port Replacement Registers (PRRs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 3.5.3 On-Chip ROM Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 Chapter 4 Memory Protection Unit (S12XMPUV1) 4.1 4.2 4.3 4.4 4.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.1 Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 4.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 4.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 4.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 4.4.1 Protection Descriptors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 4.4.2 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 4.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 Chapter 5 External Bus Interface (S12XEBIV4) 5.1 5.2 5.3 5.4 5.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 5.1.1 Glossary or Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 5.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 5.4.1 Operating Modes and External Bus Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 5.4.2 Internal Visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 5.4.3 Accesses to Port Replacement Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 5.4.4 Stretched External Bus Accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253 5.4.5 Data Select and Data Direction Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 5.4.6 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 5.5.1 Normal Expanded Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 5.5.2 Emulation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 11 Chapter 6 Interrupt (S12XINTV2) 6.1 6.2 6.3 6.4 6.5 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 6.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 6.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 6.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 6.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 6.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 6.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 6.4.1 S12X Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 6.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 6.4.3 XGATE Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 6.4.4 Priority Decoders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 6.4.5 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 6.4.6 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275 6.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276 Chapter 7 Background Debug Module (S12XBDMV2) 7.1 7.2 7.3 7.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 7.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 7.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 7.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 7.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 7.3.3 Family ID Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 7.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 7.4.2 Enabling and Activating BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 7.4.3 BDM Hardware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 7.4.4 Standard BDM Firmware Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290 7.4.5 BDM Command Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 7.4.6 BDM Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 7.4.7 Serial Interface Hardware Handshake Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 7.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 7.4.9 SYNC — Request Timed Reference Pulse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301 MC9S12XE-Family Reference Manual Rev. 1.25 12 Freescale Semiconductor 7.4.10 Instruction Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302 7.4.11 Serial Communication Time Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Chapter 8 S12X Debug (S12XDBGV3) Module 8.1 8.2 8.3 8.4 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 8.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 8.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 8.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 8.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326 8.4.1 S12XDBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 8.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 8.4.3 Trigger Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331 8.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332 8.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 8.4.6 Tagging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 8.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342 Chapter 9 Security (S12XE9SECV2) 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 9.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347 9.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 9.1.3 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 9.1.4 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 9.1.5 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350 9.1.6 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 9.1.7 Complete Memory Erase (Special Modes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 Chapter 10 XGATE (S12XGATEV3) 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 10.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 10.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 10.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355 10.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 10.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 13 10.4 10.5 10.6 10.7 10.8 10.9 10.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373 10.4.1 XGATE RISC Core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.2 Programmer’s Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374 10.4.3 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375 10.4.4 Semaphores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376 10.4.5 Software Error Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.5.1 Incoming Interrupt Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.5.2 Outgoing Interrupt Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.6.1 Debug Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 10.6.2 Leaving Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381 Instruction Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382 10.8.1 Addressing Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382 10.8.2 Instruction Summary and Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385 10.8.3 Cycle Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387 10.8.4 Thread Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 10.8.5 Instruction Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 10.8.6 Instruction Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461 Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 10.9.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 10.9.2 Code Example (Transmit "Hello World!" on SCI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463 10.9.3 Stack Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466 Chapter 11 S12XE Clocks and Reset Generator (S12XECRGV1) 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469 11.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 11.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 11.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.2.1 VDDPLL, VSSPLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.2.2 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471 11.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472 11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473 11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 11.4.1 Functional Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486 11.4.2 Operation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491 11.4.3 Low Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492 11.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494 11.5.1 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495 11.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497 MC9S12XE-Family Reference Manual Rev. 1.25 14 Freescale Semiconductor 11.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498 Chapter 12 Pierce Oscillator (S12XOSCLCPV2) 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 12.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 12.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499 12.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.2.1 VDDPLL and VSSPLL — Operating and Ground Voltage Pins . . . . . . . . . . . . . . . . . . . . 500 12.2.2 EXTAL and XTAL — Input and Output Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500 12.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.1 Gain Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.2 Clock Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.3 Wait Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 12.4.4 Stop Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 Chapter 13 Analog-to-Digital Converter (ADC12B16CV1) 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 13.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 13.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 13.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505 13.2 Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.2.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506 13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508 13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 13.4.1 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523 13.4.2 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524 13.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 13.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525 Chapter 14 Enhanced Capture Timer (ECT16B8CV3) 14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 14.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527 14.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 14.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 14.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 14.2.1 IOC7 — Input Capture and Output Compare Channel 7 . . . . . . . . . . . . . . . . . . . . . . . . 529 14.2.2 IOC6 — Input Capture and Output Compare Channel 6 . . . . . . . . . . . . . . . . . . . . . . . . 529 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 15 14.2.3 IOC5 — Input Capture and Output Compare Channel 5 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.4 IOC4 — Input Capture and Output Compare Channel 4 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.5 IOC3 — Input Capture and Output Compare Channel 3 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.6 IOC2 — Input Capture and Output Compare Channel 2 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.7 IOC1 — Input Capture and Output Compare Channel 1 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.2.8 IOC0 — Input Capture and Output Compare Channel 0 . . . . . . . . . . . . . . . . . . . . . . . . 530 14.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530 14.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530 14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530 14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 14.4.1 Enhanced Capture Timer Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573 14.4.2 Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 14.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577 Chapter 15 Inter-Integrated Circuit (IICV3) Block Description 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 15.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579 15.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.2.1 IIC_SCL — Serial Clock Line Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.2.2 IIC_SDA — Serial Data Line Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580 15.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 15.3.1 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593 15.4.1 I-Bus Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 593 15.4.2 Operation in Run Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.4.3 Operation in Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.4.4 Operation in Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 15.7 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 15.7.1 IIC Programming Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 Chapter 16 Freescale’s Scalable Controller Area Network (S12MSCANV3) 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605 16.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 16.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 16.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607 16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 16.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 MC9S12XE-Family Reference Manual Rev. 1.25 16 Freescale Semiconductor 16.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 16.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 16.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 16.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 16.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 16.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 644 16.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 16.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 16.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 16.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 16.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 16.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 16.5.2 Bus-Off Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658 Chapter 17 Periodic Interrupt Timer (S12PIT24B8CV2) 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 17.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 17.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660 17.3 Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661 17.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671 17.4.1 Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672 17.4.2 Interrupt Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 17.4.3 Hardware Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673 17.5 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.5.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.5.2 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.5.3 Flag Clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 17.6 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 Chapter 18 Periodic Interrupt Timer (S12PIT24B4CV2) 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 18.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 17 18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678 18.3 Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678 18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.4.1 Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 18.4.2 Interrupt Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.4.3 Hardware Trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5.2 Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.5.3 Flag Clearing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 18.6 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690 Chapter 19 Pulse-Width Modulator (S12PWM8B8CV1) 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691 19.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.2.1 PWM7 — PWM Channel 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 19.2.2 PWM6 — PWM Channel 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.3 PWM5 — PWM Channel 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.4 PWM4 — PWM Channel 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.5 PWM3 — PWM Channel 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.6 PWM3 — PWM Channel 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.7 PWM3 — PWM Channel 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.2.8 PWM3 — PWM Channel 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693 19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694 19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 19.4.1 PWM Clock Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 19.4.2 PWM Channel Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 712 19.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 720 19.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721 Chapter 20 Serial Communication Interface (S12SCIV5) 20.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 20.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 20.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 20.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 20.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725 20.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 MC9S12XE-Family Reference Manual Rev. 1.25 18 Freescale Semiconductor 20.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.3.1 Module Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726 20.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 727 20.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739 20.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 20.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 20.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741 20.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742 20.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 743 20.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748 20.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756 20.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 20.5.3 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758 20.5.4 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 20.5.5 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 760 Chapter 21 Serial Peripheral Interface (S12SPIV5) 21.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 21.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 21.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763 21.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764 21.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765 21.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773 21.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774 21.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775 21.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776 21.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 781 21.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782 21.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783 21.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 19 Chapter 22 Timer Module (TIM16B8CV2) Block Description 22.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 22.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788 22.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788 22.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789 22.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791 22.2.1 IOC7 — Input Capture and Output Compare Channel 7 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.2 IOC6 — Input Capture and Output Compare Channel 6 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.3 IOC5 — Input Capture and Output Compare Channel 5 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.4 IOC4 — Input Capture and Output Compare Channel 4 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.5 IOC3 — Input Capture and Output Compare Channel 3 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.6 IOC2 — Input Capture and Output Compare Channel 2 Pin . . . . . . . . . . . . . . . . . . . . 791 22.2.7 IOC1 — Input Capture and Output Compare Channel 1 Pin . . . . . . . . . . . . . . . . . . . . 792 22.2.8 IOC0 — Input Capture and Output Compare Channel 0 Pin . . . . . . . . . . . . . . . . . . . . 792 22.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 22.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 22.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 22.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 809 22.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810 22.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811 22.4.4 Pulse Accumulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 22.4.5 Event Counter Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 22.4.6 Gated Time Accumulation Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 22.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 22.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813 22.6.1 Channel [7:0] Interrupt (C[7:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 22.6.2 Pulse Accumulator Input Interrupt (PAOVI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 22.6.3 Pulse Accumulator Overflow Interrupt (PAOVF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 22.6.4 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 Chapter 23 Voltage Regulator (S12VREGL3V3V1) 23.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 23.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 23.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815 23.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816 23.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.1 VDDR — Regulator Power Input Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.2 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.3 VDD, VSS — Regulator Output1 (Core Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . 818 23.2.4 VDDF — Regulator Output2 (NVM Logic) Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.2.5 VDDPLL, VSSPLL — Regulator Output3 (PLL) Pins . . . . . . . . . . . . . . . . . . . . . . . . . 819 MC9S12XE-Family Reference Manual Rev. 1.25 20 Freescale Semiconductor 23.2.6 VDDX — Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.2.7 VREGEN — Optional Regulator Enable Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.2.8 VREG_API — Optional Autonomous Periodical Interrupt Output Pin . . . . . . . . . . . . . . 819 23.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 23.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820 23.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820 23.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.2 Regulator Core (REG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.3 Low-Voltage Detect (LVD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 23.4.4 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.5 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.6 HTD - High Temperature Detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.7 Regulator Control (CTRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.8 Autonomous Periodical Interrupt (API) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 23.4.9 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 23.4.10Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 23.4.11Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 Chapter 24 128 KByte Flash Module (S12XFTM128K2V1) 24.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832 24.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832 24.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833 24.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834 24.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835 24.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 24.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 24.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 841 24.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 24.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 24.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867 24.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887 24.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 24.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 24.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888 24.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 24.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 890 24.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 890 24.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 Chapter 25 256 KByte Flash Module (S12XFTM256K2V1) 25.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 21 25.2 25.3 25.4 25.5 25.6 25.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892 25.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893 25.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 25.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 25.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922 25.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922 25.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 927 25.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 25.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 25.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 949 25.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 950 25.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 951 25.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 951 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951 Chapter 26 384 KByte Flash Module (S12XFTM384K2V1) 26.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953 26.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954 26.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 955 26.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956 26.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 957 26.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958 26.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 958 26.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 26.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 984 26.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 984 26.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 989 26.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1011 26.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 26.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 26.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 26.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 26.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1014 26.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1014 26.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 Chapter 27 512 KByte Flash Module (S12XFTM512K3V1) 27.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016 MC9S12XE-Family Reference Manual Rev. 1.25 22 Freescale Semiconductor 27.2 27.3 27.4 27.5 27.6 27.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1016 27.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1017 27.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1019 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020 27.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1020 27.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 27.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046 27.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051 27.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1072 27.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 27.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 27.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1074 27.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1075 27.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1075 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1075 Chapter 28 768 KByte Flash Module (S12XFTM768K4V2) 28.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077 28.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078 28.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079 28.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080 28.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081 28.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082 28.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082 28.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1087 28.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108 28.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108 28.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113 28.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135 28.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136 28.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136 28.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1136 28.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137 28.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1138 28.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1138 28.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1138 Chapter 29 1024 KByte Flash Module (S12XFTM1024K5V2) 29.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140 MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 23 29.2 29.3 29.4 29.5 29.6 29.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1140 29.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141 29.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1142 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144 29.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144 29.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1150 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171 29.4.1 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1171 29.4.2 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1176 29.4.3 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197 29.4.4 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 29.4.5 Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198 29.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199 29.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . 1200 29.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . 1200 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1200 Appendix A Electrical Characteristics A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 A.1.1 Parameter Classification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 A.1.2 Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201 A.1.3 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1202 A.1.4 Current Injection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1203 A.1.5 Absolute Maximum Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1203 A.1.6 ESD Protection and Latch-up Immunity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1204 A.1.7 Operating Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1206 A.1.8 Power Dissipation and Thermal Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1207 A.1.9 I/O Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1209 A.1.10 Supply Currents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214 A.2 ATD Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219 A.2.1 ATD Operating Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219 A.2.2 Factors Influencing Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219 A.2.3 ATD Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1221 A.3 NVM, Flash and Emulated EEPROM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1224 A.3.1 Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1224 A.3.2 NVM Reliability Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1231 A.4 Voltage Regulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1234 A.5 Output Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.5.1 Resistive Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.5.2 Capacitive Loads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.5.3 Chip Power-up and Voltage Drops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1235 A.6 Reset, Oscillator and PLL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236 MC9S12XE-Family Reference Manual Rev. 1.25 24 Freescale Semiconductor A.6.1 Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1236 A.6.2 Oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1238 A.6.3 Phase Locked Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1239 A.7 External Interface Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241 A.7.1 MSCAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241 A.7.2 SPI Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241 A.7.3 External Bus Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1247 Appendix B Package Information B.1 B.2 B.3 B.4 208 MAPBGA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259 144-Pin LQFP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259 112-Pin LQFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1261 80-Pin QFP Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1262 Appendix C PCB Layout Guidelines Appendix D Derivative Differences D.1 Memory Sizes and Package Options S12XE - Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268 D.2 Pinout explanations: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1270 Appendix E Detailed Register Address Map Appendix F Ordering Information MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 25 MC9S12XE-Family Reference Manual Rev. 1.25 26 Freescale Semiconductor Chapter 1 Device Overview MC9S12XE-Family 1.1 Introduction The MC9S12XE-Family of micro controllers is a further development of the S12XD-Family including new features for enhanced system integrity and greater functionality. These new features include a Memory Protection Unit (MPU) and Error Correction Code (ECC) on the Flash memory together with enhanced EEPROM functionality (EEE), an enhanced XGATE, an Internally filtered, frequency modulated Phase Locked Loop (IPLL) and an enhanced ATD. The E-Family extends the S12X product range up to 1MB of Flash memory with increased I/O capability in the 208-pin version of the flagship MC9S12XE100. The MC9S12XE-Family delivers 32-bit performance with all the advantages and efficiencies of a 16 bit MCU. It retains the low cost, power consumption, EMC and code-size efficiency advantages currently enjoyed by users of Freescale’s existing 16-Bit MC9S12 and S12X MCU families. There is a high level of compatibility between the S12XE and S12XD families. The MC9S12XE-Family features an enhanced version of the performance-boosting XGATE co-processor which is programmable in “C” language and runs at twice the bus frequency of the S12X with an instruction set optimized for data movement, logic and bit manipulation instructions and which can service any peripheral module on the device. The new enhanced version has improved interrupt handling capability and is fully compatible with the existing XGATE module. The MC9S12XE-Family is composed of standard on-chip peripherals including up to 64Kbytes of RAM, eight asynchronous serial communications interfaces (SCI), three serial peripheral interfaces (SPI), an 8channel IC/OC enhanced capture timer (ECT), two 16-channel, 12-bit analog-to-digital converters, an 8channel pulse-width modulator (PWM), five CAN 2.0 A, B software compatible modules (MSCAN12), two inter-IC bus blocks (IIC), an 8-channel 24-bit periodic interrupt timer (PIT) and an 8-channel 16-bit standard timer module (TIM). The MC9S12XE-Family uses 16-bit wide accesses without wait states for all peripherals and memories. The non-multiplexed expanded bus interface available on the 144/208-Pin versions allows an easy interface to external memories. In addition to the I/O ports available in each module, up to 26 further I/O ports are available with interrupt capability allowing Wake-Up from STOP or WAIT modes. The MC9S12XE-Family is available in 208Pin MAPBGA, 144-Pin LQFP, 112-Pin LQFP or 80-Pin QFP options. 1.1.1 Features Features of the MC9S12XE-Family are listed here. Please see Table D-2.for memory options and Table D2. for the peripheral features that are available on the different family members. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 27 Chapter 1 Device Overview MC9S12XE-Family • • • • • • • • • • 16-Bit CPU12X — Upward compatible with MC9S12 instruction set with the exception of five Fuzzy instructions (MEM, WAV, WAVR, REV, REVW) which have been removed — Enhanced indexed addressing — Access to large data segments independent of PPAGE INT (interrupt module) — Eight levels of nested interrupts — Flexible assignment of interrupt sources to each interrupt level. — External non-maskable high priority interrupt (XIRQ) — Internal non-maskable high priority Memory Protection Unit interrupt — Up to 24 pins on ports J, H and P configurable as rising or falling edge sensitive interrupts EBI (external bus interface)(available in 208-Pin and 144-Pin packages only) — Up to four chip select outputs to select 16K, 1M, 2M and up to 4MByte address spaces — Each chip select output can be configured to complete transaction on either the time-out of one of the two wait state generators or the deassertion of EWAIT signal MMC (module mapping control) DBG (debug module) — Monitoring of CPU and/or XGATE busses with tag-type or force-type breakpoint requests — 64 x 64-bit circular trace buffer captures change-of-flow or memory access information BDM (background debug mode) MPU (memory protection unit) — 8 address regions definable per active program task — Address range granularity as low as 8-bytes — No write / No execute Protection Attributes — Non-maskable interrupt on access violation XGATE — Programmable, high performance I/O coprocessor module — Transfers data to or from all peripherals and RAM without CPU intervention or CPU wait states — Performs logical, shifts, arithmetic, and bit operations on data — Can interrupt the HCS12X CPU signalling transfer completion — Triggers from any hardware module as well as from the CPU possible — Two interrupt levels to service high priority tasks — Hardware support for stack pointer initialisation OSC_LCP (oscillator) — Low power loop control Pierce oscillator utilizing a 4MHz to 16MHz crystal — Good noise immunity — Full-swing Pierce option utilizing a 2MHz to 40MHz crystal — Transconductance sized for optimum start-up margin for typical crystals IPLL (Internally filtered, frequency modulated phase-locked-loop clock generation) MC9S12XE-Family Reference Manual Rev. 1.25 28 Freescale Semiconductor Chapter 1 Device Overview MC9S12XE-Family • • • • • • • — No external components required — Configurable option to spread spectrum for reduced EMC radiation (frequency modulation) CRG (clock and reset generation) — COP watchdog — Real time interrupt — Clock monitor — Fast wake up from STOP in self clock mode Memory Options — 128K, 256k, 384K, 512K, 768K and 1M byte Flash — 2K, 4K byte emulated EEPROM — 12K, 16K, 24K, 32K, 48K and 64K Byte RAM Flash General Features — 64 data bits plus 8 syndrome ECC (Error Correction Code) bits allow single bit failure correction and double fault detection — Erase sector size 1024 bytes — Automated program and erase algorithm D-Flash Features — Up to 32 Kbytes of D-Flash memory with 256 byte sectors for user access. — Dedicated commands to control access to the D-Flash memory over EEE operation. — Single bit fault correction and double bit fault detection within a word during read operations. — Automated program and erase algorithm with verify and generation of ECC parity bits. — Fast sector erase and word program operation. — Ability to program up to four words in a burst sequence Emulated EEPROM Features — Automatic EEE file handling using an internal Memory Controller. — Automatic transfer of valid EEE data from D-Flash memory to buffer RAM on reset. — Ability to monitor the number of outstanding EEE related buffer RAM words left to be programmed into D-Flash memory. — Ability to disable EEE operation and allow priority access to the D-Flash memory. — Ability to cancel all pending EEE operations and allow priority access to the D-Flash memory. Two 16-channel, 12-bit Analog-to-Digital Converters — 8/10/12 Bit resolution — 3µs, 10-bit single conversion time — Left/right, signed/unsigned result data — External and internal conversion trigger capability — Internal oscillator for conversion in Stop modes — Wake from low power modes on analog comparison > or ... Access #0 Access #1 Access #2 1 2 3 ... MC9S12XE-Family Reference Manual Rev. 1.25 252 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) Table 5-18. Interleaved Read-Write-Read Accesses (1 Cycle) (continued) ECLK phase ... ADDR[22:20] / ACC[2:0] ... ADDR[19:16] / IQSTAT[3:0] ... ADDR[15:0] / IVD[15:0] ... DATA[15:0] (internal read) ... high low addr 0 iqstat -1 high low addr 1 iqstat 0 acc 0 ... acc 2 ... addr 2 iqstat 1 ... x ... z ... (write) data 1 z ... 0 1 ... ivd 0 z z DATA[15:0] (external read) ... ? z data 0 RW ... 1 1 0 5.4.3 low acc 1 ? ? high (write) data 1 1 Accesses to Port Replacement Registers All read and write accesses to PRR addresses take two bus clock cycles independent of the operating mode. If writing to these addresses in emulation modes, the access is directed to both, the internal register and the external resource while reads will be treated external. The XEBI control registers also belong to this category. 5.4.4 Stretched External Bus Accesses In order to allow fast internal bus cycles to coexist in a system with slower external resources, the XEBI supports stretched external bus accesses (wait states) for each external address range related to one of the 4 chip select lines individually. This feature is available in normal expanded mode and emulation expanded mode for accesses to all external addresses except emulation memory and PRR. In these cases the fixed access times are 1 or 2 cycles, respectively. Stretched accesses are controlled by: 1. EXSTR1[2:0] and EXSTR0[2:0] bits in the EBICTL1 register configuring a fixed amount of stretch cycles individually for each CSx line in MMCCTL0 2. Activation of the external wait feature for each CSx line MMCCTL0 register 3. Assertion of the external EWAIT signal when at least one CSx line is configured for EWAIT The EXSTRx[2:0] control bits can be programmed for generation of a fixed number of 1 to 8 stretch cycles. If the external wait feature is enabled, the minimum number of additional stretch cycles is 2. An arbitrary amount of stretch cycles can be added using the EWAIT input. EWAIT needs to be asserted at least for a minimal specified time window within an external access cycle for the internal logic to detect it and add a cycle (refer to electrical characteristics). Holding it for additional cycles will cause the external bus access to be stretched accordingly. Write accesses are stretched by holding the initiator in its current state for additional cycles as programmed and controlled by external wait after the data have been driven out on the external bus. This results in an extension of time the bus signals and the related control signals are valid externally. Read data are not captured by the system in normal expanded mode until the specified setup time before the RE rising edge. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 253 Chapter 5 External Bus Interface (S12XEBIV4) Read data are not captured in emulation expanded mode until the specified setup time before the falling edge of ECLK. In emulation expanded mode, accesses to the internal flash or the emulation memory (determined by EROMON and ROMON bits; see S12X_MMC section for details) always take 1 cycle and stretching is not supported. In case the internal flash is taken out of the map in user applications, accesses are stretched as programmed and controlled by external wait. 5.4.5 Data Select and Data Direction Signals The S12X_EBI supports byte and word accesses at any valid external address. The big endian system of the MCU is extended to the external bus; however, word accesses are restricted to even aligned addresses. The only exception is the visibility of misaligned word accesses to addresses in the internal RAM as this module exclusively supports these kind of accesses in a single cycle. With the above restriction, a fixed relationship is implied between the address parity and the dedicated bus halves where the data are accessed: DATA[15:8] is related to even addresses and DATA[7:0] is related to odd addresses. In expanded modes the data access type is externally determined by a set of control signals, i.e., data select and data direction signals, as described below. The data select signals are not available if using the external bus interface with an 8-bit data bus. 5.4.5.1 Normal Expanded Mode In normal expanded mode, the external signals RE, WE, UDS, LDS indicate the access type (read/write), data size and alignment of an external bus access (Table 5-19). Table 5-19. Access in Normal Expanded Mode DATA[15:8] Access DATA[7:0] RE WE UDS LDS I/O data(addr) I/O data(addr) Word write of data on DATA[15:0] at an even and even+1 address 1 0 0 0 Out data(even) Out Byte write of data on DATA[7:0] at an odd address 1 0 1 0 Byte write of data on DATA[15:8] at an even address 1 0 0 1 In Word read of data on DATA[15:0] at an even and even+1 address 0 1 0 0 In Byte read of data on DATA[7:0] at an odd address 0 1 1 0 x data(odd) Out data(odd) In x data(even) In data(odd) In x In data(odd) Out data(even) Byte read of data on DATA[15:8] at an even address 0 1 0 1 In data(even) In x Indicates No Access 1 1 1 1 In x In x Unimplemented 1 1 1 0 In x In x 1 1 0 1 In x In x 5.4.5.2 Emulation Modes and Special Test Mode In emulation modes and special test mode, the external signals LSTRB, RW, and ADDR0 indicate the access type (read/write), data size and alignment of an external bus access. Misaligned accesses to the MC9S12XE-Family Reference Manual Rev. 1.25 254 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) internal RAM and misaligned XGATE PRR accesses in emulation modes are the only type of access that are able to produce LSTRB = ADDR0 = 1. This is summarized in Table 5-20. Table 5-20. Access in Emulation Modes and Special Test Mode DATA[15:8] Access DATA[7:0] RW LSTRB ADDR0 I/O data(addr) I/O data(addr) Word write of data on DATA[15:0] at an even and even+1 address 0 0 0 Out data(even) Out data(odd) Byte write of data on DATA[7:0] at an odd address 0 0 1 In x Out data(odd) data(odd) In Byte write of data on DATA[15:8] at an even address 0 1 0 Out Word write at an odd and odd+1 internal RAM address (misaligned — only in emulation modes) 0 1 1 Out data(odd+1) Out x Word read of data on DATA[15:0] at an even and even+1 address 1 0 0 In data(even) In data(even+1) Byte read of data on DATA[7:0] at an odd address 1 0 1 In x In data(odd) Byte read of data on DATA[15:8] at an even address 1 1 0 In data(even) In x Word read at an odd and odd+1 internal RAM address (misaligned - only in emulation modes) 1 1 1 In data(odd+1) In data(odd) data(odd) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 255 Chapter 5 External Bus Interface (S12XEBIV4) 5.4.6 Low-Power Options The XEBI does not support any user-controlled options for reducing power consumption. 5.4.6.1 Run Mode The XEBI does not support any options for reducing power in run mode. Power consumption is reduced in single-chip modes due to the absence of the external bus interface. Operation in expanded modes results in a higher power consumption, however any unnecessary toggling of external bus signals is reduced to the lowest indispensable activity by holding the previous states between external accesses. 5.4.6.2 Wait Mode The XEBI does not support any options for reducing power in wait mode. 5.4.6.3 Stop Mode The XEBI will cease to function in stop mode. 5.5 Initialization/Application Information This section describes the external bus interface usage and timing. Typical customer operating modes are normal expanded mode and emulation modes, specifically to be used in emulator applications. Taking the availability of the external wait feature into account the use cases are divided into four scenarios: • Normal expanded mode — External wait feature disabled – External wait feature enabled • Emulation modes – Emulation single-chip mode (without wait states) – Emulation expanded mode (with optional access stretching) Normal single-chip mode and special single-chip mode do not have an external bus. Special test mode is used for factory test only. Therefore, these modes are omitted here. All timing diagrams referred to throughout this section are available in the Electrical Characteristics appendix of the SoC section. 5.5.1 Normal Expanded Mode This mode allows interfacing to external memories or peripherals which are available in the commercial market. In these applications the normal bus operation requires a minimum of 1 cycle stretch for each external access. MC9S12XE-Family Reference Manual Rev. 1.25 256 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) 5.5.1.1 Example 1a: External Wait Feature Disabled The first example of bus timing of an external read and write access with the external wait feature disabled is shown in • Figure ‘Example 1a: Normal Expanded Mode — Read Followed by Write’ The associated supply voltage dependent timing are numbers given in • Table ‘Example 1a: Normal Expanded Mode Timing VDD5 = 5.0 V (EWAIT disabled)’ • Table ‘Example 1a: Normal Expanded Mode Timing VDD5 = 3.0 V (EWAIT disabled)’ Systems designed this way rely on the internal programmable access stretching. These systems have predictable external memory access times. The additional stretch time can be programmed up to 8 cycles to provide longer access times. 5.5.1.2 Example 1b: External Wait Feature Enabled The external wait operation is shown in this example. It can be used to exceed the amount of stretch cycles over the programmed number in EXSTR[2:0]. The feature must be enabled by configuring at least one CSx line for EWAIT. If the EWAIT signal is not asserted, the number of stretch cycles is forced to a minimum of 2 cycles. If EWAIT is asserted within the predefined time window during the access it will be strobed active and another stretch cycle is added. If strobed inactive, the next cycle will be the last cycle before the access is finished. EWAIT can be held asserted as long as desired to stretch the access. An access with 1 cycle stretch by EWAIT assertion is shown in • Figure ‘Example 1b: Normal Expanded Mode — Stretched Read Access’ • Figure ‘Example 1b: Normal Expanded Mode — Stretched Write Access’ The associated timing numbers for both operations are given in • Table ‘Example 1b: Normal Expanded Mode Timing VDD5 = 5.0 V (EWAIT enabled)’ • Table ‘Example 1b: Normal Expanded Mode Timing VDD5 = 3.0 V (EWAIT enabled)’ It is recommended to use the free-running clock (ECLK) at the fastest rate (bus clock rate) to synchronize the EWAIT input signal. 5.5.2 Emulation Modes In emulation mode applications, the development systems use a custom PRU device to rebuild the singlechip or expanded bus functions which are lost due to the use of the external bus with an emulator. Accesses to a set of registers controlling the related ports in normal modes (refer to SoC section) are directed to the external bus in emulation modes which are substituted by PRR as part of the PRU. Accesses to these registers take a constant time of 2 cycles. Depending on the setting of ROMON and EROMON (refer to S12X_MMC section), the program code can be executed from internal memory or an optional external emulation memory (EMULMEM). No wait MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 257 Chapter 5 External Bus Interface (S12XEBIV4) state operation (stretching) of the external bus access is done in emulation modes when accessing internal memory or emulation memory addresses. In both modes observation of the internal operation is supported through the external bus (internal visibility). 5.5.2.1 Example 2a: Emulation Single-Chip Mode This mode is used for emulation systems in which the target application is operating in normal single-chip mode. Figure 5-5 shows the PRU connection with the available external bus signals in an emulator application. S12X_EBI Emulator ADDR[22:0]/IVD[15:0] DATA[15:0] EMULMEM PRU PRR Ports LSTRB RW ADDR[22:20]/ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] ECLK ECLKX2 Figure 5-5. Application in Emulation Single-Chip Mode The timing diagram for this operation is shown in: • Figure ‘Example 2a: Emulation Single-Chip Mode — Read Followed by Write’ The associated timing numbers are given in: • Table ‘Example 2a: Emulation Single-Chip Mode Timing (EWAIT disabled)’ Timing considerations: • Signals muxed with address lines ADDRx, i.e., IVDx, IQSTATx and ACCx, have the same timing. • LSTRB has the same timing as RW. MC9S12XE-Family Reference Manual Rev. 1.25 258 Freescale Semiconductor Chapter 5 External Bus Interface (S12XEBIV4) • • ECLKX2 rising edges have the same timing as ECLK edges. The timing for accesses to PRU registers, which take 2 cycles to complete, is the same as the timing for an external non-PRR access with 1 cycle of stretch as shown in example 2b. 5.5.2.2 Example 2b: Emulation Expanded Mode This mode is used for emulation systems in which the target application is operating in normal expanded mode. If the external bus is used with a PRU, the external device rebuilds the data select and data direction signals UDS, LDS, RE, and WE from the ADDR0, LSTRB, and RW signals. Figure 5-6 shows the PRU connection with the available external bus signals in an emulator application. S12X_EBI Emulator ADDR[22:0]/IVD[15:0] DATA[15:0] EMULMEM PRU PRR LSTRB RW Ports UDS LDS RE WE ADDR[22:20]/ACC[2:0] ADDR[19:16]/ IQSTAT[3:0] CS[3:0] EWAIT ECLK ECLKX2 Figure 5-6. Application in Emulation Expanded Mode The timings of accesses with 1 stretch cycle are shown in • Figure ‘Example 2b: Emulation Expanded Mode — Read with 1 Stretch Cycle’ • Figure ‘Example 2b: Emulation Expanded Mode — Write with 1 Stretch Cycle’ The associated timing numbers are given in MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 259 Chapter 5 External Bus Interface (S12XEBIV4) • Table ‘Example 2b: Emulation Expanded Mode Timing VDD5 = 5.0 V (EWAIT disabled)’ (this also includes examples for alternative settings of 2 and 3 additional stretch cycles) Timing considerations: • If no stretch cycle is added, the timing is the same as in Emulation Single-Chip Mode. MC9S12XE-Family Reference Manual Rev. 1.25 260 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) Table 6-1. Revision History Revision Number Revision Date Sections Affected V02.00 01 Jul 2005 6.1.2/6-262 V02.04 11 Jan 2007 6.3.2.2/6-267 6.3.2.4/6-268 V02.05 20 Mar 2007 6.4.6/6-274 V02.07 13 Dec 2011 6.5.3.1/6-276 6.1 Description of Changes Initial V2 release, added new features: - XGATE threads can be interrupted. - SYS instruction vector. - Access violation interrupt vectors. - Added Notes for devices without XGATE module. - Fixed priority definition for software exceptions. - Re-worded for difference of Wake-up feature between STOP and WAIT modes. Introduction The XINT module decodes the priority of all system exception requests and provides the applicable vector for processing the exception to either the CPU or the XGATE module. The XINT module supports: • I bit and X bit maskable interrupt requests • One non-maskable unimplemented op-code trap • One non-maskable software interrupt (SWI) or background debug mode request • One non-maskable system call interrupt (SYS) • Three non-maskable access violation interrupts • One spurious interrupt vector request • Three system reset vector requests Each of the I bit maskable interrupt requests can be assigned to one of seven priority levels supporting a flexible priority scheme. For interrupt requests that are configured to be handled by the CPU, the priority scheme can be used to implement nested interrupt capability where interrupts from a lower level are automatically blocked if a higher level interrupt is being processed. Interrupt requests configured to be handled by the XGATE module can be nested one level deep. NOTE The HPRIO register and functionality of the original S12 interrupt module is no longer supported. It is superseded by the 7-level interrupt request priority scheme. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 261 Chapter 6 Interrupt (S12XINTV2) 6.1.1 Glossary The following terms and abbreviations are used in the document. Table 6-2. Terminology Term CCR Condition Code Register (in the S12X CPU) DMA Direct Memory Access INT Interrupt IPL Interrupt Processing Level ISR Interrupt Service Routine MCU XGATE IRQ XIRQ 6.1.2 • • • • • • • • • • • • • • Meaning Micro-Controller Unit refers to the XGATE co-processor; XGATE is an optional feature refers to the interrupt request associated with the IRQ pin refers to the interrupt request associated with the XIRQ pin Features Interrupt vector base register (IVBR) One spurious interrupt vector (at address vector base1 + 0x0010). One non-maskable system call interrupt vector request (at address vector base + 0x0012). Three non-maskable access violation interrupt vector requests (at address vector base + 0x0014− 0x0018). 2–109 I bit maskable interrupt vector requests (at addresses vector base + 0x001A–0x00F2). Each I bit maskable interrupt request has a configurable priority level and can be configured to be handled by either the CPU or the XGATE module2. I bit maskable interrupts can be nested, depending on their priority levels. One X bit maskable interrupt vector request (at address vector base + 0x00F4). One non-maskable software interrupt request (SWI) or background debug mode vector request (at address vector base + 0x00F6). One non-maskable unimplemented op-code trap (TRAP) vector (at address vector base + 0x00F8). Three system reset vectors (at addresses 0xFFFA–0xFFFE). Determines the highest priority XGATE and interrupt vector requests, drives the vector to the XGATE module or to the bus on CPU request, respectively. Wakes up the system from stop or wait mode when an appropriate interrupt request occurs or whenever XIRQ is asserted, even if X interrupt is masked. XGATE can wake up and execute code, even with the CPU remaining in stop or wait mode. 1. The vector base is a 16-bit address which is accumulated from the contents of the interrupt vector base register (IVBR, used as upper byte) and 0x00 (used as lower byte). 2. The IRQ interrupt can only be handled by the CPU MC9S12XE-Family Reference Manual Rev. 1.25 262 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.1.3 • • • • Modes of Operation Run mode This is the basic mode of operation. Wait mode In wait mode, the XINT module is frozen. It is however capable of either waking up the CPU if an interrupt occurs or waking up the XGATE if an XGATE request occurs. Please refer to Section 6.5.3, “Wake Up from Stop or Wait Mode” for details. Stop Mode In stop mode, the XINT module is frozen. It is however capable of either waking up the CPU if an interrupt occurs or waking up the XGATE if an XGATE request occurs. Please refer to Section 6.5.3, “Wake Up from Stop or Wait Mode” for details. Freeze mode (BDM active) In freeze mode (BDM active), the interrupt vector base register is overridden internally. Please refer to Section 6.3.2.1, “Interrupt Vector Base Register (IVBR)” for details. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 263 Chapter 6 Interrupt (S12XINTV2) 6.1.4 Block Diagram Figure 6-1 shows a block diagram of the XINT module. Peripheral Interrupt Requests Wake Up CPU Non I Bit Maskable Channels Interrupt Requests Priority Decoder IRQ Channel PRIOLVL2 PRIOLVL1 PRIOLVL0 RQST IVBR New IPL To CPU Vector Address Current IPL One Set Per Channel (Up to 108 Channels) INT_XGPRIO XGATE Requests Priority Decoder Wake up XGATE Vector ID XGATE Interrupts To XGATE Module RQST XGATE Request Route, PRIOLVLn Priority Level = bits from the channel configuration in the associated configuration register INT_XGPRIO = XGATE Interrupt Priority IVBR = Interrupt Vector Base IPL = Interrupt Processing Level Figure 6-1. XINT Block Diagram 6.2 External Signal Description The XINT module has no external signals. MC9S12XE-Family Reference Manual Rev. 1.25 264 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.3 Memory Map and Register Definition This section provides a detailed description of all registers accessible in the XINT module. 6.3.1 Module Memory Map Table 6-3 gives an overview over all XINT module registers. Table 6-3. XINT Memory Map Address Use Access 0x0120 RESERVED — 0x0121 Interrupt Vector Base Register (IVBR) R/W 0x0122–0x0125 RESERVED — 0x0126 XGATE Interrupt Priority Configuration Register (INT_XGPRIO) R/W 0x0127 Interrupt Request Configuration Address Register (INT_CFADDR) R/W 0x0128 Interrupt Request Configuration Data Register 0 (INT_CFDATA0) R/W 0x0129 Interrupt Request Configuration Data Register 1 (INT_CFDATA1) R/W 0x012A Interrupt Request Configuration Data Register 2 (INT_CFDATA2 R/W 0x012B Interrupt Request Configuration Data Register 3 (INT_CFDATA3) R/W 0x012C Interrupt Request Configuration Data Register 4 (INT_CFDATA4) R/W 0x012D Interrupt Request Configuration Data Register 5 (INT_CFDATA5) R/W 0x012E Interrupt Request Configuration Data Register 6 (INT_CFDATA6) R/W 0x012F Interrupt Request Configuration Data Register 7 (INT_CFDATA7) R/W MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 265 Chapter 6 Interrupt (S12XINTV2) 6.3.2 Register Descriptions This section describes in address order all the XINT module registers and their individual bits. Address Register Name 0x0121 IVBR Bit 7 6 5 R INT_XGPRIO R 3 2 0 0 0 0 0 INT_CFADDR R R W 0x0129 INT_CFDATA1 R W 0x012A INT_CFDATA2 R W 0x012B INT_CFDATA3 R W 0x012C INT_CFDATA4 R W 0x012D INT_CFDATA5 R W 0x012E INT_CFDATA6 R W 0x012F INT_CFDATA7 R W 0 INT_CFADDR[7:4] W 0x0128 INT_CFDATA0 Bit 0 XILVL[2:0] W 0x0127 1 IVB_ADDR[7:0]7 W 0x0126 4 RQST RQST RQST RQST RQST RQST RQST RQST 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] PRIOLVL[2:0] = Unimplemented or Reserved Figure 6-2. XINT Register Summary MC9S12XE-Family Reference Manual Rev. 1.25 266 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.3.2.1 Interrupt Vector Base Register (IVBR) Address: 0x0121 7 6 5 R 3 2 1 0 1 1 1 IVB_ADDR[7:0] W Reset 4 1 1 1 1 1 Figure 6-3. Interrupt Vector Base Register (IVBR) Read: Anytime Write: Anytime Table 6-4. IVBR Field Descriptions Field Description 7–0 Interrupt Vector Base Address Bits — These bits represent the upper byte of all vector addresses. Out of IVB_ADDR[7:0] reset these bits are set to 0xFF (i.e., vectors are located at 0xFF10–0xFFFE) to ensure compatibility to previous S12 microcontrollers. Note: A system reset will initialize the interrupt vector base register with “0xFF” before it is used to determine the reset vector address. Therefore, changing the IVBR has no effect on the location of the three reset vectors (0xFFFA–0xFFFE). Note: If the BDM is active (i.e., the CPU is in the process of executing BDM firmware code), the contents of IVBR are ignored and the upper byte of the vector address is fixed as “0xFF”. 6.3.2.2 XGATE Interrupt Priority Configuration Register (INT_XGPRIO) Address: 0x0126 R 7 6 5 4 3 0 0 0 0 0 0 0 0 0 2 0 0 XILVL[2:0] W Reset 1 0 0 1 = Unimplemented or Reserved Figure 6-4. XGATE Interrupt Priority Configuration Register (INT_XGPRIO) Read: Anytime Write: Anytime Table 6-5. INT_XGPRIO Field Descriptions Field Description 2–0 XILVL[2:0] XGATE Interrupt Priority Level — The XILVL[2:0] bits configure the shared interrupt level of the XGATE interrupts coming from the XGATE module. Out of reset the priority is set to the lowest active level (“1”). Note: If the XGATE module is not available on the device, write accesses to this register are ignored and read accesses to this register will return all 0. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 267 Chapter 6 Interrupt (S12XINTV2) Table 6-6. XGATE Interrupt Priority Levels Priority low high 6.3.2.3 XILVL2 XILVL1 XILVL0 Meaning 0 0 0 Interrupt request is disabled 0 0 1 Priority level 1 0 1 0 Priority level 2 0 1 1 Priority level 3 1 0 0 Priority level 4 1 0 1 Priority level 5 1 1 0 Priority level 6 1 1 1 Priority level 7 Interrupt Request Configuration Address Register (INT_CFADDR) Address: 0x0127 7 R 5 4 INT_CFADDR[7:4] W Reset 6 0 0 0 1 3 2 1 0 0 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 6-5. Interrupt Configuration Address Register (INT_CFADDR) Read: Anytime Write: Anytime Table 6-7. INT_CFADDR Field Descriptions Field Description 7–4 Interrupt Request Configuration Data Register Select Bits — These bits determine which of the 128 INT_CFADDR[7:4] configuration data registers are accessible in the 8 register window at INT_CFDATA0–7. The hexadecimal value written to this register corresponds to the upper nibble of the lower byte of the address of the interrupt vector, i.e., writing 0xE0 to this register selects the configuration data register block for the 8 interrupt vector requests starting with vector at address (vector base + 0x00E0) to be accessible as INT_CFDATA0–7. Note: Writing all 0s selects non-existing configuration registers. In this case write accesses to INT_CFDATA0–7 will be ignored and read accesses will return all 0. 6.3.2.4 Interrupt Request Configuration Data Registers (INT_CFDATA0–7) The eight register window visible at addresses INT_CFDATA0–7 contains the configuration data for the block of eight interrupt requests (out of 128) selected by the interrupt configuration address register (INT_CFADDR) in ascending order. INT_CFDATA0 represents the interrupt configuration data register of the vector with the lowest address in this block, while INT_CFDATA7 represents the interrupt configuration data register of the vector with the highest address, respectively. MC9S12XE-Family Reference Manual Rev. 1.25 268 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) Address: 0x0128 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-6. Interrupt Request Configuration Data Register 0 (INT_CFDATA0) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x0129 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-7. Interrupt Request Configuration Data Register 1 (INT_CFDATA1) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012A 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-8. Interrupt Request Configuration Data Register 2 (INT_CFDATA2) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012B 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-9. Interrupt Request Configuration Data Register 3 (INT_CFDATA3) 1. Please refer to the notes following the PRIOLVL[2:0] description below. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 269 Chapter 6 Interrupt (S12XINTV2) Address: 0x012C 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-10. Interrupt Request Configuration Data Register 4 (INT_CFDATA4) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012D 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-11. Interrupt Request Configuration Data Register 5 (INT_CFDATA5) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012E 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-12. Interrupt Request Configuration Data Register 6 (INT_CFDATA6) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Address: 0x012F 7 R W Reset RQST 0 6 5 4 3 0 0 0 0 0 0 0 0 2 1 0 PRIOLVL[2:0] 0 0 1(1) = Unimplemented or Reserved Figure 6-13. Interrupt Request Configuration Data Register 7 (INT_CFDATA7) 1. Please refer to the notes following the PRIOLVL[2:0] description below. Read: Anytime Write: Anytime MC9S12XE-Family Reference Manual Rev. 1.25 270 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) Table 6-8. INT_CFDATA0–7 Field Descriptions Field Description 7 RQST XGATE Request Enable — This bit determines if the associated interrupt request is handled by the CPU or by the XGATE module. 0 Interrupt request is handled by the CPU 1 Interrupt request is handled by the XGATE module Note: The IRQ interrupt cannot be handled by the XGATE module. For this reason, the configuration register for vector (vector base + 0x00F2) = IRQ vector address) does not contain a RQST bit. Writing a 1 to the location of the RQST bit in this register will be ignored and a read access will return 0. Note: If the XGATE module is not available on the device, writing a 1 to the location of the RQST bit in this register will be ignored and a read access will return 0. 2–0 Interrupt Request Priority Level Bits — The PRIOLVL[2:0] bits configure the interrupt request priority level of PRIOLVL[2:0] the associated interrupt request. Out of reset all interrupt requests are enabled at the lowest active level (“1”) to provide backwards compatibility with previous S12 interrupt controllers. Please also refer to Table 6-9 for available interrupt request priority levels. Note: Write accesses to configuration data registers of unused interrupt channels will be ignored and read accesses will return all 0. For information about what interrupt channels are used in a specific MCU, please refer to the Device Reference Manual of that MCU. Note: When vectors (vector base + 0x00F0–0x00FE) are selected by writing 0xF0 to INT_CFADDR, writes to INT_CFDATA2–7 (0x00F4–0x00FE) will be ignored and read accesses will return all 0s. The corresponding vectors do not have configuration data registers associated with them. Note: When vectors (vector base + 0x0010–0x001E) are selected by writing 0x10 to INT_CFADDR, writes to INT_CFDATA1–INT_CFDATA4 (0x0012–0x0018) will be ignored and read accesses will return all 0s. The corresponding vectors do not have configuration data registers associated with them. Note: Write accesses to the configuration register for the spurious interrupt vector request (vector base + 0x0010) will be ignored and read accesses will return 0x07 (request is handled by the CPU, PRIOLVL = 7). Table 6-9. Interrupt Priority Levels Priority low high 6.4 PRIOLVL2 PRIOLVL1 PRIOLVL0 Meaning 0 0 0 Interrupt request is disabled 0 0 1 Priority level 1 0 1 0 Priority level 2 0 1 1 Priority level 3 1 0 0 Priority level 4 1 0 1 Priority level 5 1 1 0 Priority level 6 1 1 1 Priority level 7 Functional Description The XINT module processes all exception requests to be serviced by the CPU module. These exceptions include interrupt vector requests and reset vector requests. Each of these exception types and their overall priority level is discussed in the subsections below. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 271 Chapter 6 Interrupt (S12XINTV2) 6.4.1 S12X Exception Requests The CPU handles both reset requests and interrupt requests. The XINT module contains registers to configure the priority level of each I bit maskable interrupt request which can be used to implement an interrupt priority scheme. This also includes the possibility to nest interrupt requests. A priority decoder is used to evaluate the priority of a pending interrupt request. 6.4.2 Interrupt Prioritization After system reset all interrupt requests with a vector address lower than or equal to (vector base + 0x00F2) are enabled, are set up to be handled by the CPU and have a pre-configured priority level of 1. Exceptions to this rule are the non-maskable interrupt requests and the spurious interrupt vector request at (vector base + 0x0010) which cannot be disabled, are always handled by the CPU and have a fixed priority levels. A priority level of 0 effectively disables the associated I bit maskable interrupt request. If more than one interrupt request is configured to the same interrupt priority level the interrupt request with the higher vector address wins the prioritization. The following conditions must be met for an I bit maskable interrupt request to be processed. 1. The local interrupt enabled bit in the peripheral module must be set. 2. The setup in the configuration register associated with the interrupt request channel must meet the following conditions: a) The XGATE request enable bit must be 0 to have the CPU handle the interrupt request. b) The priority level must be set to non zero. c) The priority level must be greater than the current interrupt processing level in the condition code register (CCR) of the CPU (PRIOLVL[2:0] > IPL[2:0]). 3. The I bit in the condition code register (CCR) of the CPU must be cleared. 4. There is no access violation interrupt request pending. 5. There is no SYS, SWI, BDM, TRAP, or XIRQ request pending. NOTE All non I bit maskable interrupt requests always have higher priority than I bit maskable interrupt requests. If an I bit maskable interrupt request is interrupted by a non I bit maskable interrupt request, the currently active interrupt processing level (IPL) remains unaffected. It is possible to nest non I bit maskable interrupt requests, e.g., by nesting SWI or TRAP calls. 6.4.2.1 Interrupt Priority Stack The current interrupt processing level (IPL) is stored in the condition code register (CCR) of the CPU. This way the current IPL is automatically pushed to the stack by the standard interrupt stacking procedure. The new IPL is copied to the CCR from the priority level of the highest priority active interrupt request channel which is configured to be handled by the CPU. The copying takes place when the interrupt vector is fetched. The previous IPL is automatically restored by executing the RTI instruction. MC9S12XE-Family Reference Manual Rev. 1.25 272 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.4.3 XGATE Requests If the XGATE module is implemented on the device, the XINT module is also used to process all exception requests to be serviced by the XGATE module. The overall priority level of those exceptions is discussed in the subsections below. 6.4.3.1 XGATE Request Prioritization An interrupt request channel is configured to be handled by the XGATE module, if the RQST bit of the associated configuration register is set to 1 (please refer to Section 6.3.2.4, “Interrupt Request Configuration Data Registers (INT_CFDATA0–7)”). The priority level configuration (PRIOLVL) for this channel becomes the XGATE priority which will be used to determine the highest priority XGATE request to be serviced next by the XGATE module. Additionally, XGATE interrupts may be raised by the XGATE module by setting one or more of the XGATE channel interrupt flags (by using the SIF instruction). This will result in an CPU interrupt with vector address vector base + (2 * channel ID number), where the channel ID number corresponds to the highest set channel interrupt flag, if the XGIE and channel RQST bits are set. The shared interrupt priority for the XGATE interrupt requests is taken from the XGATE interrupt priority configuration register (please refer to Section 6.3.2.2, “XGATE Interrupt Priority Configuration Register (INT_XGPRIO)”). If more than one XGATE interrupt request channel becomes active at the same time, the channel with the highest vector address wins the prioritization. 6.4.4 Priority Decoders The XINT module contains priority decoders to determine the priority for all interrupt requests pending for the respective target. There are two priority decoders, one for each interrupt request target, CPU or XGATE. The function of both priority decoders is basically the same with one exception: the priority decoder for the XGATE module does not take the current XGATE thread processing level into account. Instead, XGATE requests are handed to the XGATE module including a 1-bit priority identifier. The XGATE module uses this additional information to decide if the new request can interrupt a currently running thread. The 1-bit priority identifier corresponds to the most significant bit of the priority level configuration of the requesting channel. This means that XGATE requests with priority levels 4, 5, 6 or 7 can interrupt running XGATE threads with priority levels 1, 2 and 3. A CPU interrupt vector is not supplied until the CPU requests it. Therefore, it is possible that a higher priority interrupt request could override the original exception which caused the CPU to request the vector. In this case, the CPU will receive the highest priority vector and the system will process this exception instead of the original request. If the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the CPU will default to that of the spurious interrupt vector. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 273 Chapter 6 Interrupt (S12XINTV2) NOTE Care must be taken to ensure that all exception requests remain active until the system begins execution of the applicable service routine; otherwise, the exception request may not get processed at all or the result may be a spurious interrupt request (vector at address (vector base + 0x0010)). 6.4.5 Reset Exception Requests The XINT module supports three system reset exception request types (for details please refer to the Clock and Reset Generator module (CRG)): 1. Pin reset, power-on reset, low-voltage reset, or illegal address reset 2. Clock monitor reset request 3. COP watchdog reset request 6.4.6 Exception Priority The priority (from highest to lowest) and address of all exception vectors issued by the XINT module upon request by the CPU is shown in Table 6-10. Generally, all non-maskable interrupts have higher priorities than maskable interrupts. Please note that between the three software interrupts (Unimplemented op-code trap request, SWI/BGND request, SYS request) there is no real priority defined because they cannot occur simultaneously (the S12XCPU executes one instruction at a time). Table 6-10. Exception Vector Map and Priority Vector Address(1) Source 0xFFFE Pin reset, power-on reset, low-voltage reset, illegal address reset 0xFFFC Clock monitor reset 0xFFFA COP watchdog reset (Vector base + 0x00F8) Unimplemented op-code trap (Vector base + 0x00F6) Software interrupt instruction (SWI) or BDM vector request (Vector base + 0x0012) System call interrupt instruction (SYS) (Vector base + 0x0018) (reserved for future use) (Vector base + 0x0016) XGATE Access violation interrupt request(2) (Vector base + 0x0014) CPU Access violation interrupt request(3) (Vector base + 0x00F4) XIRQ interrupt request (Vector base + 0x00F2) IRQ interrupt request (Vector base + 0x00F0–0x001A) Device specific I bit maskable interrupt sources (priority determined by the associated configuration registers, in descending order) (Vector base + 0x0010) Spurious interrupt 1. 16 bits vector address based 2. only implemented if device features both a Memory Protection Unit (MPU) and an XGATE co-processor 3. only implemented if device features a Memory Protection Unit (MPU) MC9S12XE-Family Reference Manual Rev. 1.25 274 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.5 6.5.1 Initialization/Application Information Initialization After system reset, software should: • Initialize the interrupt vector base register if the interrupt vector table is not located at the default location (0xFF10–0xFFF9). • Initialize the interrupt processing level configuration data registers (INT_CFADDR, INT_CFDATA0–7) for all interrupt vector requests with the desired priority levels and the request target (CPU or XGATE module). It might be a good idea to disable unused interrupt requests. • If the XGATE module is used, setup the XGATE interrupt priority register (INT_XGPRIO) and configure the XGATE module (please refer the XGATE Block Guide for details). • Enable I maskable interrupts by clearing the I bit in the CCR. • Enable the X maskable interrupt by clearing the X bit in the CCR (if required). 6.5.2 Interrupt Nesting The interrupt request priority level scheme makes it possible to implement priority based interrupt request nesting for the I bit maskable interrupt requests handled by the CPU. • I bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority, so that there can be up to seven nested I bit maskable interrupt requests at a time (refer to Figure 614 for an example using up to three nested interrupt requests). I bit maskable interrupt requests cannot be interrupted by other I bit maskable interrupt requests per default. In order to make an interrupt service routine (ISR) interruptible, the ISR must explicitly clear the I bit in the CCR (CLI). After clearing the I bit, I bit maskable interrupt requests with higher priority can interrupt the current ISR. An ISR of an interruptible I bit maskable interrupt request could basically look like this: • Service interrupt, e.g., clear interrupt flags, copy data, etc. • Clear I bit in the CCR by executing the instruction CLI (thus allowing interrupt requests with higher priority) • Process data • Return from interrupt by executing the instruction RTI MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 275 Chapter 6 Interrupt (S12XINTV2) 0 Stacked IPL IPL in CCR 0 0 4 0 0 0 4 7 4 3 1 0 7 6 RTI L7 5 4 RTI Processing Levels 3 L3 (Pending) 2 L4 RTI 1 L1 (Pending) 0 RTI Reset Figure 6-14. Interrupt Processing Example 6.5.3 6.5.3.1 Wake Up from Stop or Wait Mode CPU Wake Up from Stop or Wait Mode Only I bit maskable interrupt requests which are configured to be handled by the CPU are capable of waking the MCU from wait mode. Since bus and core clocks are disabled in stop mode, only interrupt requests that can be generated without these clocks can wake the MCU from stop mode. These are listed in the device overview interrupt vector table. Only I bit maskable interrupt requests which are configured to be handled by the CPU are capable of waking the MCU from stop mode. To determine whether an I bit maskable interrupt is qualified to wake up the CPU or not, the same settings as in normal run mode are applied during stop or wait mode: • If the I bit in the CCR is set, all I bit maskable interrupts are masked from waking up the MCU. • An I bit maskable interrupt is ignored if it is configured to a priority level below or equal to the current IPL in CCR. • I bit maskable interrupt requests which are configured to be handled by the XGATE module are not capable of waking up the CPU. The X bit maskable interrupt request can wake up the MCU from stop or wait mode at anytime, even if the X bit in CCR is set. If the X bit maskable interrupt request is used to wake-up the MCU with the X bit in the CCR set, the associated ISR is not called. The CPU then resumes program execution with the instruction following the WAI or STOP instruction. This features works following the same rules like any interrupt request, i.e. care must be taken that the X interrupt request used for wake-up remains active at least until the system begins execution of the instruction following the WAI or STOP instruction; otherwise, wake-up may not occur. MC9S12XE-Family Reference Manual Rev. 1.25 276 Freescale Semiconductor Chapter 6 Interrupt (S12XINTV2) 6.5.3.2 XGATE Wake Up from Stop or Wait Mode Interrupt request channels which are configured to be handled by the XGATE module are capable of waking up the XGATE module. Interrupt request channels handled by the XGATE module do not affect the state of the CPU. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 277 Chapter 6 Interrupt (S12XINTV2) MC9S12XE-Family Reference Manual Rev. 1.25 278 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Table 7-1. Revision History Revision Number Revision Date V02.00 07 Mar 2006 - First version of S12XBDMV2 V02.01 14 May 2008 - Introduced standardized Revision History Table V02.02 12 Sep 2012 - Minor formatting corrections 7.1 Sections Affected Description of Changes Introduction This section describes the functionality of the background debug module (BDM) sub-block of the HCS12X core platform. The background debug module (BDM) sub-block is a single-wire, background debug system implemented in on-chip hardware for minimal CPU intervention. All interfacing with the BDM is done via the BKGD pin. The BDM has enhanced capability for maintaining synchronization between the target and host while allowing more flexibility in clock rates. This includes a sync signal to determine the communication rate and a handshake signal to indicate when an operation is complete. The system is backwards compatible to the BDM of the S12 family with the following exceptions: • TAGGO command no longer supported by BDM • External instruction tagging feature now part of DBG module • BDM register map and register content extended/modified • Global page access functionality • Enabled but not active out of reset in emulation modes (if modes available) • CLKSW bit set out of reset in emulation modes (if modes available). • Family ID readable from firmware ROM at global address 0x7FFF0F (value for HCS12X devices is 0xC1) 7.1.1 Features The BDM includes these distinctive features: • Single-wire communication with host development system • Enhanced capability for allowing more flexibility in clock rates • SYNC command to determine communication rate • GO_UNTIL command MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 279 Chapter 7 Background Debug Module (S12XBDMV2) • • • • • • • • • • • • • Hardware handshake protocol to increase the performance of the serial communication Active out of reset in special single chip mode Nine hardware commands using free cycles, if available, for minimal CPU intervention Hardware commands not requiring active BDM 14 firmware commands execute from the standard BDM firmware lookup table Software control of BDM operation during wait mode Software selectable clocks Global page access functionality Enabled but not active out of reset in emulation modes (if modes available) CLKSW bit set out of reset in emulation modes (if modes available). When secured, hardware commands are allowed to access the register space in special single chip mode, if the non-volatile memory erase test fail. Family ID readable from firmware ROM at global address 0x7FFF0F (value for HCS12X devices is 0xC1) BDM hardware commands are operational until system stop mode is entered (all bus masters are in stop mode) 7.1.2 Modes of Operation BDM is available in all operating modes but must be enabled before firmware commands are executed. Some systems may have a control bit that allows suspending thefunction during background debug mode. 7.1.2.1 Regular Run Modes All of these operations refer to the part in run mode and not being secured. The BDM does not provide controls to conserve power during run mode. • Normal modes General operation of the BDM is available and operates the same in all normal modes. • Special single chip mode In special single chip mode, background operation is enabled and active out of reset. This allows programming a system with blank memory. • Emulation modes (if modes available) In emulation mode, background operation is enabled but not active out of reset. This allows debugging and programming a system in this mode more easily. 7.1.2.2 Secure Mode Operation If the device is in secure mode, the operation of the BDM is reduced to a small subset of its regular run mode operation. Secure operation prevents BDM and CPU accesses to non-volatile memory (Flash and/or EEPROM) other than allowing erasure. For more information please see Section 7.4.1, “Security”. MC9S12XE-Family Reference Manual Rev. 1.25 280 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) 7.1.2.3 Low-Power Modes The BDM can be used until all bus masters (e.g., CPU or XGATE or others depending on which masters are available on the SOC) are in stop mode. When CPU is in a low power mode (wait or stop mode) all BDM firmware commands as well as the hardware BACKGROUND command can not be used respectively are ignored. In this case the CPU can not enter BDM active mode, and only hardware read and write commands are available. Also the CPU can not enter a low power mode during BDM active mode. If all bus masters are in stop mode, the BDM clocks are stopped as well. When BDM clocks are disabled and one of the bus masters exits from stop mode the BDM clocks will restart and BDM will have a soft reset (clearing the instruction register, any command in progress and disable the ACK function). The BDM is now ready to receive a new command. 7.1.3 Block Diagram A block diagram of the BDM is shown in Figure 7-1. Host System Serial Interface BKGD Data 16-Bit Shift Register Control Register Block Address TRACE BDMACT Instruction Code and Execution Bus Interface and Control Logic Data Control Clocks ENBDM SDV UNSEC CLKSW Standard BDM Firmware LOOKUP TABLE Secured BDM Firmware LOOKUP TABLE BDMSTS Register Figure 7-1. BDM Block Diagram 7.2 External Signal Description A single-wire interface pin called the background debug interface (BKGD) pin is used to communicate with the BDM system. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the background debug mode. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 281 Chapter 7 Background Debug Module (S12XBDMV2) 7.3 Memory Map and Register Definition 7.3.1 Module Memory Map Table 7-2 shows the BDM memory map when BDM is active. Table 7-2. BDM Memory Map 7.3.2 Global Address Module Size (Bytes) 0x7FFF00–0x7FFF0B BDM registers 12 0x7FFF0C–0x7FFF0E BDM firmware ROM 3 0x7FFF0F Family ID (part of BDM firmware ROM) 1 0x7FFF10–0x7FFFFF BDM firmware ROM 240 Register Descriptions A summary of the registers associated with the BDM is shown in Figure 7-2. Registers are accessed by host-driven communications to the BDM hardware using READ_BD and WRITE_BD commands. Global Address Register Name 0x7FFF00 Reserved R Bit 7 6 5 4 3 2 1 Bit 0 X X X X X X 0 0 BDMACT 0 SDV TRACE UNSEC 0 X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 W 0x7FFF01 BDMSTS R W 0x7FFF02 Reserved R ENBDM CLKSW W 0x7FFF03 Reserved R W 0x7FFF04 Reserved R W 0x7FFF05 Reserved R W 0x7FFF06 BDMCCRL R W = Unimplemented, Reserved X = Indeterminate = Implemented (do not alter) 0 = Always read zero Figure 7-2. BDM Register Summary MC9S12XE-Family Reference Manual Rev. 1.25 282 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Global Address Register Name 0x7FFF07 Bit 7 6 5 4 3 0 0 0 0 0 BGAE BGP6 BGP5 BGP4 0 0 0 0 0 0 0 BDMCCRH R 2 1 Bit 0 CCR10 CCR9 CCR8 BGP3 BGP2 BGP1 BGP0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W 0x7FFF08 BDMGPR R W 0x7FFF09 Reserved R W 0x7FFF0A Reserved R W 0x7FFF0B Reserved R W = Unimplemented, Reserved = Indeterminate X = Implemented (do not alter) = Always read zero 0 Figure 7-2. BDM Register Summary (continued) 7.3.2.1 BDM Status Register (BDMSTS) Register Global Address 0x7FFF01 7 R W ENBDM 6 5 4 3 BDMACT 0 SDV TRACE 1 0 0 0 2 1 0 UNSEC 0 0 0(3) 0 1(2) 0 0 0 0 0 CLKSW Reset Special Single-Chip Mode Emulation Modes 0(1) 1 0 0 0 0 0 0 0 0 (if modes available) All Other Modes 0 = Unimplemented, Reserved = Implemented (do not alter) 0 = Always read zero 1. ENBDM is read as 1 by a debugging environment in special single chip mode when the device is not secured or secured but fully erased (non-volatile memory). This is because the ENBDM bit is set by the standard firmware before a BDM command can be fully transmitted and executed. 2. CLKSW is read as 1 by a debugging environment in emulation modes when the device is not secured and read as 0 when secured if emulation modes available. 3. UNSEC is read as 1 by a debugging environment in special single chip mode when the device is secured and fully erased, else it is 0 and can only be read if not secure (see also bit description). Figure 7-3. BDM Status Register (BDMSTS) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 283 Chapter 7 Background Debug Module (S12XBDMV2) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured, but subject to the following: — ENBDM should only be set via a BDM hardware command if the BDM firmware commands are needed. (This does not apply in special single chip and emulation modes). — BDMACT can only be set by BDM hardware upon entry into BDM. It can only be cleared by the standard BDM firmware lookup table upon exit from BDM active mode. — CLKSW can only be written via BDM hardware WRITE_BD commands. — All other bits, while writable via BDM hardware or standard BDM firmware write commands, should only be altered by the BDM hardware or standard firmware lookup table as part of BDM command execution. Table 7-3. BDMSTS Field Descriptions Field Description 7 ENBDM Enable BDM — This bit controls whether the BDM is enabled or disabled. When enabled, BDM can be made active to allow firmware commands to be executed. When disabled, BDM cannot be made active but BDM hardware commands are still allowed. 0 BDM disabled 1 BDM enabled Note: ENBDM is set by the firmware out of reset in special single chip mode. In emulation modes (if modes available) the ENBDM bit is set by BDM hardware out of reset. In special single chip mode with the device secured, this bit will not be set by the firmware until after the non-volatile memory erase verify tests are complete. In emulation modes (if modes available) with the device secured, the BDM operations are blocked. 6 BDMACT BDM Active Status — This bit becomes set upon entering BDM. The standard BDM firmware lookup table is then enabled and put into the memory map. BDMACT is cleared by a carefully timed store instruction in the standard BDM firmware as part of the exit sequence to return to user code and remove the BDM memory from the map. 0 BDM not active 1 BDM active 4 SDV Shift Data Valid — This bit is set and cleared by the BDM hardware. It is set after data has been transmitted as part of a firmware or hardware read command or after data has been received as part of a firmware or hardware write command. It is cleared when the next BDM command has been received or BDM is exited. SDV is used by the standard BDM firmware to control program flow execution. 0 Data phase of command not complete 1 Data phase of command is complete 3 TRACE TRACE1 BDM Firmware Command is Being Executed — This bit gets set when a BDM TRACE1 firmware command is first recognized. It will stay set until BDM firmware is exited by one of the following BDM commands: GO or GO_UNTIL. 0 TRACE1 command is not being executed 1 TRACE1 command is being executed MC9S12XE-Family Reference Manual Rev. 1.25 284 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Table 7-3. BDMSTS Field Descriptions (continued) Field Description 2 CLKSW Clock Switch — The CLKSW bit controls which clock the BDM operates with. It is only writable from a hardware BDM command. A minimum delay of 150 cycles at the clock speed that is active during the data portion of the command send to change the clock source should occur before the next command can be send. The delay should be obtained no matter which bit is modified to effectively change the clock source (either PLLSEL bit or CLKSW bit). This guarantees that the start of the next BDM command uses the new clock for timing subsequent BDM communications. Table 7-4 shows the resulting BDM clock source based on the CLKSW and the PLLSEL (PLL select in the CRG module, the bit is part of the CLKSEL register) bits. Note: The BDM alternate clock source can only be selected when CLKSW = 0 and PLLSEL = 1. The BDM serial interface is now fully synchronized to the alternate clock source, when enabled. This eliminates frequency restriction on the alternate clock which was required on previous versions. Refer to the device specification to determine which clock connects to the alternate clock source input. Note: If the acknowledge function is turned on, changing the CLKSW bit will cause the ACK to be at the new rate for the write command which changes it. Note: In emulation modes (if modes available), the CLKSW bit will be set out of RESET. 1 UNSEC Unsecure — If the device is secured this bit is only writable in special single chip mode from the BDM secure firmware. It is in a zero state as secure mode is entered so that the secure BDM firmware lookup table is enabled and put into the memory map overlapping the standard BDM firmware lookup table. The secure BDM firmware lookup table verifies that the non-volatile memories (e.g. on-chip EEPROM and/or Flash EEPROM) are erased. This being the case, the UNSEC bit is set and the BDM program jumps to the start of the standard BDM firmware lookup table and the secure BDM firmware lookup table is turned off. If the erase test fails, the UNSEC bit will not be asserted. 0 System is in a secured mode. 1 System is in a unsecured mode. Note: When UNSEC is set, security is off and the user can change the state of the secure bits in the on-chip Flash EEPROM. Note that if the user does not change the state of the bits to “unsecured” mode, the system will be secured again when it is next taken out of reset.After reset this bit has no meaning or effect when the security byte in the Flash EEPROM is configured for unsecure mode. Table 7-4. BDM Clock Sources PLLSEL CLKSW BDMCLK 0 0 Bus clock dependent on oscillator 0 1 Bus clock dependent on oscillator 1 0 Alternate clock (refer to the device specification to determine the alternate clock source) 1 1 Bus clock dependent on the PLL MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 285 Chapter 7 Background Debug Module (S12XBDMV2) 7.3.2.2 BDM CCR LOW Holding Register (BDMCCRL) Register Global Address 0x7FFF06 7 6 5 4 3 2 1 0 CCR7 CCR6 CCR5 CCR4 CCR3 CCR2 CCR1 CCR0 Special Single-Chip Mode 1 1 0 0 1 0 0 0 All Other Modes 0 0 0 0 0 0 0 0 R W Reset Figure 7-4. BDM CCR LOW Holding Register (BDMCCRL) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured NOTE When BDM is made active, the CPU stores the content of its CCRL register in the BDMCCRL register. However, out of special single-chip reset, the BDMCCRL is set to 0xD8 and not 0xD0 which is the reset value of the CCRL register in this CPU mode. Out of reset in all other modes the BDMCCRL register is read zero. When entering background debug mode, the BDM CCR LOW holding register is used to save the low byte of the condition code register of the user’s program. It is also used for temporary storage in the standard BDM firmware mode. The BDM CCR LOW holding register can be written to modify the CCR value. 7.3.2.3 BDM CCR HIGH Holding Register (BDMCCRH) Register Global Address 0x7FFF07 R 7 6 5 4 3 0 0 0 0 0 0 0 0 0 0 W Reset 2 1 0 CCR10 CCR9 CCR8 0 0 0 = Unimplemented or Reserved Figure 7-5. BDM CCR HIGH Holding Register (BDMCCRH) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured When entering background debug mode, the BDM CCR HIGH holding register is used to save the high byte of the condition code register of the user’s program. The BDM CCR HIGH holding register can be written to modify the CCR value. MC9S12XE-Family Reference Manual Rev. 1.25 286 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) 7.3.2.4 BDM Global Page Index Register (BDMGPR) Register Global Address 0x7FFF08 R W Reset 7 6 5 4 3 2 1 0 BGAE BGP6 BGP5 BGP4 BGP3 BGP2 BGP1 BGP0 0 0 0 0 0 0 0 0 Figure 7-6. BDM Global Page Register (BDMGPR) Read: All modes through BDM operation when not secured Write: All modes through BDM operation when not secured Table 7-5. BDMGPR Field Descriptions Field Description 7 BGAE BDM Global Page Access Enable Bit — BGAE enables global page access for BDM hardware and firmware read/write instructions The BDM hardware commands used to access the BDM registers (READ_BD_ and WRITE_BD_) can not be used for global accesses even if the BGAE bit is set. 0 BDM Global Access disabled 1 BDM Global Access enabled 6–0 BGP[6:0] BDM Global Page Index Bits 6–0 — These bits define the extended address bits from 22 to 16. For more detailed information regarding the global page window scheme, please refer to the S12X_MMC Block Guide. 7.3.3 Family ID Assignment The family ID is a 8-bit value located in the firmware ROM (at global address: 0x7FFF0F). The read-only value is a unique family ID which is 0xC1 for S12X devices. 7.4 Functional Description The BDM receives and executes commands from a host via a single wire serial interface. There are two types of BDM commands: hardware and firmware commands. Hardware commands are used to read and write target system memory locations and to enter active background debug mode, see Section 7.4.3, “BDM Hardware Commands”. Target system memory includes all memory that is accessible by the CPU. Firmware commands are used to read and write CPU resources and to exit from active background debug mode, see Section 7.4.4, “Standard BDM Firmware Commands”. The CPU resources referred to are the accumulator (D), X index register (X), Y index register (Y), stack pointer (SP), and program counter (PC). Hardware commands can be executed at any time and in any mode excluding a few exceptions as highlighted (see Section 7.4.3, “BDM Hardware Commands”) and in secure mode (see Section 7.4.1, “Security”). Firmware commands can only be executed when the system is not secure and is in active background debug mode (BDM). MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 287 Chapter 7 Background Debug Module (S12XBDMV2) 7.4.1 Security If the user resets into special single chip mode with the system secured, a secured mode BDM firmware lookup table is brought into the map overlapping a portion of the standard BDM firmware lookup table. The secure BDM firmware verifies that the on-chip non-volatile memory (e.g. EEPROM and Flash EEPROM) is erased. This being the case, the UNSEC and ENBDM bit will get set. The BDM program jumps to the start of the standard BDM firmware and the secured mode BDM firmware is turned off and all BDM commands are allowed. If the non-volatile memory does not verify as erased, the BDM firmware sets the ENBDM bit, without asserting UNSEC, and the firmware enters a loop. This causes the BDM hardware commands to become enabled, but does not enable the firmware commands. This allows the BDM hardware to be used to erase the non-volatile memory. BDM operation is not possible in any other mode than special single chip mode when the device is secured. The device can be unsecured via BDM serial interface in special single chip mode only. More information regarding security is provided in the security section of the device documentation. 7.4.2 Enabling and Activating BDM The system must be in active BDM to execute standard BDM firmware commands. BDM can be activated only after being enabled. BDM is enabled by setting the ENBDM bit in the BDM status (BDMSTS) register. The ENBDM bit is set by writing to the BDM status (BDMSTS) register, via the single-wire interface, using a hardware command such as WRITE_BD_BYTE. After being enabled, BDM is activated by one of the following1: • Hardware BACKGROUND command • CPU BGND instruction • External instruction tagging mechanism2 • Breakpoint force or tag mechanism2 When BDM is activated, the CPU finishes executing the current instruction and then begins executing the firmware in the standard BDM firmware lookup table. When BDM is activated by a breakpoint, the type of breakpoint used determines if BDM becomes active before or after execution of the next instruction. NOTE If an attempt is made to activate BDM before being enabled, the CPU resumes normal instruction execution after a brief delay. If BDM is not enabled, any hardware BACKGROUND commands issued are ignored by the BDM and the CPU is not delayed. In active BDM, the BDM registers and standard BDM firmware lookup table are mapped to addresses 0x7FFF00 to 0x7FFFFF. BDM registers are mapped to addresses 0x7FFF00 to 0x7FFF0B. The BDM uses these registers which are readable anytime by the BDM. However, these registers are not readable by user programs. 1. BDM is enabled and active immediately out of special single-chip reset. 2. This method is provided by the S12X_DBG module. MC9S12XE-Family Reference Manual Rev. 1.25 288 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) 7.4.3 BDM Hardware Commands Hardware commands are used to read and write target system memory locations and to enter active background debug mode. Target system memory includes all memory that is accessible by the CPU on the SOC which can be on-chip RAM, non-volatile memory (e.g. EEPROM, Flash EEPROM), I/O and control registers, and all external memory. Hardware commands are executed with minimal or no CPU intervention and do not require the system to be in active BDM for execution, although, they can still be executed in this mode. When executing a hardware command, the BDM sub-block waits for a free bus cycle so that the background access does not disturb the running application program. If a free cycle is not found within 128 clock cycles, the CPU is momentarily frozen so that the BDM can steal a cycle. When the BDM finds a free cycle, the operation does not intrude on normal CPU operation provided that it can be completed in a single cycle. However, if an operation requires multiple cycles the CPU is frozen until the operation is complete, even though the BDM found a free cycle. The BDM hardware commands are listed in Table 7-6. The READ_BD and WRITE_BD commands allow access to the BDM register locations. These locations are not normally in the system memory map but share addresses with the application in memory. To distinguish between physical memory locations that share the same address, BDM memory resources are enabled just for the READ_BD and WRITE_BD access cycle. This allows the BDM to access BDM locations unobtrusively, even if the addresses conflict with the application memory map. Table 7-6. Hardware Commands Opcode (hex) Data BACKGROUND 90 None Enter background mode if firmware is enabled. If enabled, an ACK will be issued when the part enters active background mode. ACK_ENABLE D5 None Enable Handshake. Issues an ACK pulse after the command is executed. ACK_DISABLE D6 None Disable Handshake. This command does not issue an ACK pulse. READ_BD_BYTE E4 16-bit address Read from memory with standard BDM firmware lookup table in map. 16-bit data out Odd address data on low byte; even address data on high byte. READ_BD_WORD EC 16-bit address Read from memory with standard BDM firmware lookup table in map. 16-bit data out Must be aligned access. READ_BYTE E0 16-bit address Read from memory with standard BDM firmware lookup table out of map. 16-bit data out Odd address data on low byte; even address data on high byte. READ_WORD E8 16-bit address Read from memory with standard BDM firmware lookup table out of map. 16-bit data out Must be aligned access. WRITE_BD_BYTE C4 16-bit address Write to memory with standard BDM firmware lookup table in map. 16-bit data in Odd address data on low byte; even address data on high byte. WRITE_BD_WORD CC 16-bit address Write to memory with standard BDM firmware lookup table in map. 16-bit data in Must be aligned access. WRITE_BYTE C0 16-bit address Write to memory with standard BDM firmware lookup table out of map. 16-bit data in Odd address data on low byte; even address data on high byte. Command Description MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 289 Chapter 7 Background Debug Module (S12XBDMV2) Table 7-6. Hardware Commands (continued) Command WRITE_WORD Opcode (hex) C8 Data Description 16-bit address Write to memory with standard BDM firmware lookup table out of map. 16-bit data in Must be aligned access. NOTE: If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 7.4.4 Standard BDM Firmware Commands Firmware commands are used to access and manipulate CPU resources. The system must be in active BDM to execute standard BDM firmware commands, see Section 7.4.2, “Enabling and Activating BDM”. Normal instruction execution is suspended while the CPU executes the firmware located in the standard BDM firmware lookup table. The hardware command BACKGROUND is the usual way to activate BDM. As the system enters active BDM, the standard BDM firmware lookup table and BDM registers become visible in the on-chip memory map at 0x7FFF00–0x7FFFFF, and the CPU begins executing the standard BDM firmware. The standard BDM firmware watches for serial commands and executes them as they are received. The firmware commands are shown in Table 7-7. MC9S12XE-Family Reference Manual Rev. 1.25 290 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Table 7-7. Firmware Commands Command(1) Opcode (hex) Data Description READ_NEXT(2) 62 16-bit data out Increment X index register by 2 (X = X + 2), then read word X points to. READ_PC 63 16-bit data out Read program counter. READ_D 64 16-bit data out Read D accumulator. READ_X 65 16-bit data out Read X index register. READ_Y 66 16-bit data out Read Y index register. READ_SP 67 16-bit data out Read stack pointer. WRITE_NEXT 42 16-bit data in Increment X index register by 2 (X = X + 2), then write word to location pointed to by X. WRITE_PC 43 16-bit data in Write program counter. WRITE_D 44 16-bit data in Write D accumulator. WRITE_X 45 16-bit data in Write X index register. WRITE_Y 46 16-bit data in Write Y index register. WRITE_SP 47 16-bit data in Write stack pointer. GO 08 none Go to user program. If enabled, ACK will occur when leaving active background mode. GO_UNTIL(3) 0C none Go to user program. If enabled, ACK will occur upon returning to active background mode. TRACE1 10 none Execute one user instruction then return to active BDM. If enabled, ACK will occur upon returning to active background mode. TAGGO -> GO 18 none (Previous enable tagging and go to user program.) This command will be deprecated and should not be used anymore. Opcode will be executed as a GO command. 1. If enabled, ACK will occur when data is ready for transmission for all BDM READ commands and will occur after the write is complete for all BDM WRITE commands. 2. When the firmware command READ_NEXT or WRITE_NEXT is used to access the BDM address space the BDM resources are accessed rather than user code. Writing BDM firmware is not possible. 3. System stop disables the ACK function and ignored commands will not have an ACK-pulse (e.g., CPU in stop or wait mode). The GO_UNTIL command will not get an Acknowledge if CPU executes the wait or stop instruction before the “UNTIL” condition (BDM active again) is reached (see Section 7.4.7, “Serial Interface Hardware Handshake Protocol” last Note). 7.4.5 BDM Command Structure Hardware and firmware BDM commands start with an 8-bit opcode followed by a 16-bit address and/or a 16-bit data word depending on the command. All the read commands return 16 bits of data despite the byte or word implication in the command name. 8-bit reads return 16-bits of data, of which, only one byte will contain valid data. If reading an even address, the valid data will appear in the MSB. If reading an odd address, the valid data will appear in the LSB. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 291 Chapter 7 Background Debug Module (S12XBDMV2) 16-bit misaligned reads and writes are generally not allowed. If attempted by BDM hardware command, the BDM will ignore the least significant bit of the address and will assume an even address from the remaining bits. For devices with external bus: The following cycle count information is only valid when the external wait function is not used (see wait bit of EBI sub-block). During an external wait the BDM can not steal a cycle. Hence be careful with the external wait function if the BDM serial interface is much faster than the bus, because of the BDM softreset after time-out (see Section 7.4.11, “Serial Communication Time Out”). For hardware data read commands, the external host must wait at least 150 bus clock cycles after sending the address before attempting to obtain the read data. This is to be certain that valid data is available in the BDM shift register, ready to be shifted out. For hardware write commands, the external host must wait 150 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The 150 bus clock cycle delay in both cases includes the maximum 128 cycle delay that can be incurred as the BDM waits for a free cycle before stealing a cycle. For firmware read commands, the external host should wait at least 48 bus clock cycles after sending the command opcode and before attempting to obtain the read data. This includes the potential of extra cycles when the access is external and stretched (+1 to maximum +7 cycles) or to registers of the PRU (port replacement unit) in emulation modes (if modes available). The 48 cycle wait allows enough time for the requested data to be made available in the BDM shift register, ready to be shifted out. NOTE This timing has increased from previous BDM modules due to the new capability in which the BDM serial interface can potentially run faster than the bus. On previous BDM modules this extra time could be hidden within the serial time. For firmware write commands, the external host must wait 36 bus clock cycles after sending the data to be written before attempting to send a new command. This is to avoid disturbing the BDM shift register before the write has been completed. The external host should wait at least for 76 bus clock cycles after a TRACE1 or GO command before starting any new serial command. This is to allow the CPU to exit gracefully from the standard BDM firmware lookup table and resume execution of the user code. Disturbing the BDM shift register prematurely may adversely affect the exit from the standard BDM firmware lookup table. NOTE If the bus rate of the target processor is unknown or could be changing or the external wait function is used, it is recommended that the ACK (acknowledge function) is used to indicate when an operation is complete. When using ACK, the delay times are automated. Figure 7-7 represents the BDM command structure. The command blocks illustrate a series of eight bit times starting with a falling edge. The bar across the top of the blocks indicates that the BKGD line idles in the high state. The time for an 8-bit command is 8 × 16 target clock cycles.1 MC9S12XE-Family Reference Manual Rev. 1.25 292 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) Hardware Read 8 Bits AT ~16 TC/Bit 16 Bits AT ~16 TC/Bit Command Address 150-BC Delay 16 Bits AT ~16 TC/Bit Data Next Command 150-BC Delay Hardware Write Command Address Next Command Data 48-BC DELAY Firmware Read Command Next Command Data 36-BC DELAY Firmware Write Command Data Next Command 76-BC Delay GO, TRACE Command Next Command BC = Bus Clock Cycles TC = Target Clock Cycles Figure 7-7. BDM Command Structure 7.4.6 BDM Serial Interface The BDM communicates with external devices serially via the BKGD pin. During reset, this pin is a mode select input which selects between normal and special modes of operation. After reset, this pin becomes the dedicated serial interface pin for the BDM. The BDM serial interface is timed using the clock selected by the CLKSW bit in the status register see Section 7.3.2.1, “BDM Status Register (BDMSTS)”. This clock will be referred to as the target clock in the following explanation. The BDM serial interface uses a clocking scheme in which the external host generates a falling edge on the BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per bit. The interface times out if 512 clock cycles occur between falling edges from the host. The BKGD pin is a pseudo open-drain pin and has an weak on-chip active pull-up that is enabled at all times. It is assumed that there is an external pull-up and that drivers connected to BKGD do not typically drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide brief driven-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host for transmit cases and the target for receive cases. The timing for host-to-target is shown in Figure 7-8 and that of target-to-host in Figure 7-9 and Figure 7-10. All four cases begin when the host drives the BKGD pin low to generate a falling edge. Since the host and target are operating from separate clocks, it can take the target system up to one full clock 1. Target clock cycles are cycles measured using the target MCU’s serial clock rate. See Section 7.4.6, “BDM Serial Interface” and Section 7.3.2.1, “BDM Status Register (BDMSTS)” for information on how serial clock rate is selected. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 293 Chapter 7 Background Debug Module (S12XBDMV2) cycle to recognize this edge. The target measures delays from this perceived start of the bit time while the host measures delays from the point it actually drove BKGD low to start the bit up to one target clock cycle earlier. Synchronization between the host and target is established in this manner at the start of every bit time. Figure 7-8 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic requires the pin be driven high no later that eight target clock cycles after the falling edge for a logic 1 transmission. Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven signals. BDM Clock (Target MCU) Host Transmit 1 Host Transmit 0 Perceived Start of Bit Time Target Senses Bit 10 Cycles Synchronization Uncertainty Earliest Start of Next Bit Figure 7-8. BDM Host-to-Target Serial Bit Timing The receive cases are more complicated. Figure 7-9 shows the host receiving a logic 1 from the target system. Since the host is asynchronous to the target, there is up to one clock-cycle delay from the hostgenerated falling edge on BKGD to the perceived start of the bit time in the target. The host holds the BKGD pin low long enough for the target to recognize it (at least two target clock cycles). The host must release the low drive before the target drives a brief high speedup pulse seven target clock cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock cycles after it started the bit time. MC9S12XE-Family Reference Manual Rev. 1.25 294 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) BDM Clock (Target MCU) Host Drive to BKGD Pin Target System Speedup Pulse High-Impedance High-Impedance High-Impedance Perceived Start of Bit Time R-C Rise BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 7-9. BDM Target-to-Host Serial Bit Timing (Logic 1) MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 295 Chapter 7 Background Debug Module (S12XBDMV2) Figure 7-10 shows the host receiving a logic 0 from the target. Since the host is asynchronous to the target, there is up to a one clock-cycle delay from the host-generated falling edge on BKGD to the start of the bit time as perceived by the target. The host initiates the bit time but the target finishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target clock cycles then briefly drives it high to speed up the rising edge. The host samples the bit level about 10 target clock cycles after starting the bit time. BDM Clock (Target MCU) Host Drive to BKGD Pin High-Impedance Speedup Pulse Target System Drive and Speedup Pulse Perceived Start of Bit Time BKGD Pin 10 Cycles 10 Cycles Host Samples BKGD Pin Earliest Start of Next Bit Figure 7-10. BDM Target-to-Host Serial Bit Timing (Logic 0) 7.4.7 Serial Interface Hardware Handshake Protocol BDM commands that require CPU execution are ultimately treated at the MCU bus rate. Since the BDM clock source can be asynchronously related to the bus frequency, when CLKSW = 0, it is very helpful to provide a handshake protocol in which the host could determine when an issued command is executed by the CPU. The alternative is to always wait the amount of time equal to the appropriate number of cycles at the slowest possible rate the clock could be running. This sub-section will describe the hardware handshake protocol. The hardware handshake protocol signals to the host controller when an issued command was successfully executed by the target. This protocol is implemented by a 16 serial clock cycle low pulse followed by a brief speedup pulse in the BKGD pin. This pulse is generated by the target MCU when a command, issued by the host, has been successfully executed (see Figure 7-11). This pulse is referred to as the ACK pulse. After the ACK pulse has finished: the host can start the bit retrieval if the last issued command was a read command, or start a new command if the last command was a write command or a control command (BACKGROUND, GO, GO_UNTIL or TRACE1). The ACK pulse is not issued earlier than 32 serial clock cycles after the BDM command was issued. The end of the BDM command is assumed to be the 16th tick of the last bit. This minimum delay assures enough time for the host to perceive the ACK pulse. Note also that, there is no upper limit for the delay between the command and the related ACK pulse, since the command execution depends upon the CPU bus frequency, which in some cases could be very slow MC9S12XE-Family Reference Manual Rev. 1.25 296 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) compared to the serial communication rate. This protocol allows a great flexibility for the POD designers, since it does not rely on any accurate time measurement or short response time to any event in the serial communication. BDM Clock (Target MCU) 16 Cycles Target Transmits ACK Pulse High-Impedance High-Impedance 32 Cycles Speedup Pulse Minimum Delay From the BDM Command BKGD Pin Earliest Start of Next Bit 16th Tick of the Last Command Bit Figure 7-11. Target Acknowledge Pulse (ACK) NOTE If the ACK pulse was issued by the target, the host assumes the previous command was executed. If the CPU enters wait or stop prior to executing a hardware command, the ACK pulse will not be issued meaning that the BDM command was not executed. After entering wait or stop mode, the BDM command is no longer pending. Figure 7-12 shows the ACK handshake protocol in a command level timing diagram. The READ_BYTE instruction is used as an example. First, the 8-bit instruction opcode is sent by the host, followed by the address of the memory location to be read. The target BDM decodes the instruction. A bus cycle is grabbed (free or stolen) by the BDM and it executes the READ_BYTE operation. Having retrieved the data, the BDM issues an ACK pulse to the host controller, indicating that the addressed byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the byte retrieval process. Note that data is sent in the form of a word and the host needs to determine which is the appropriate byte based on whether the address was odd or even. Target BKGD Pin READ_BYTE Host Byte Address Host (2) Bytes are Retrieved New BDM Command Host Target Target BDM Issues the ACK Pulse (out of scale) BDM Decodes the Command BDM Executes the READ_BYTE Command Figure 7-12. Handshake Protocol at Command Level MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 297 Chapter 7 Background Debug Module (S12XBDMV2) Differently from the normal bit transfer (where the host initiates the transmission), the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative edge in the BKGD pin. The hardware handshake protocol in Figure 7-11 specifies the timing when the BKGD pin is being driven, so the host should follow this timing constraint in order to avoid the risk of an electrical conflict in the BKGD pin. NOTE The only place the BKGD pin can have an electrical conflict is when one side is driving low and the other side is issuing a speedup pulse (high). Other “highs” are pulled rather than driven. However, at low rates the time of the speedup pulse can become lengthy and so the potential conflict time becomes longer as well. The ACK handshake protocol does not support nested ACK pulses. If a BDM command is not acknowledge by an ACK pulse, the host needs to abort the pending command first in order to be able to issue a new BDM command. When the CPU enters wait or stop while the host issues a hardware command (e.g., WRITE_BYTE), the target discards the incoming command due to the wait or stop being detected. Therefore, the command is not acknowledged by the target, which means that the ACK pulse will not be issued in this case. After a certain time the host (not aware of stop or wait) should decide to abort any possible pending ACK pulse in order to be sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command, and its corresponding ACK, can be aborted. NOTE The ACK pulse does not provide a time out. This means for the GO_UNTIL command that it can not be distinguished if a stop or wait has been executed (command discarded and ACK not issued) or if the “UNTIL” condition (BDM active) is just not reached yet. Hence in any case where the ACK pulse of a command is not issued the possible pending command should be aborted before issuing a new command. See the handshake abort procedure described in Section 7.4.8, “Hardware Handshake Abort Procedure”. 7.4.8 Hardware Handshake Abort Procedure The abort procedure is based on the SYNC command. In order to abort a command, which had not issued the corresponding ACK pulse, the host controller should generate a low pulse in the BKGD pin by driving it low for at least 128 serial clock cycles and then driving it high for one serial clock cycle, providing a speedup pulse. By detecting this long low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 7.4.9, “SYNC — Request Timed Reference Pulse”, and assumes that the pending command and therefore the related ACK pulse, are being aborted. Therefore, after the SYNC protocol has been completed the host is free to issue new BDM commands. For Firmware READ or WRITE commands it can not be guaranteed that the pending command is aborted when issuing a SYNC before the corresponding ACK pulse. There is a short latency time from the time the READ or WRITE access begins until it is finished and the corresponding ACK pulse is issued. The latency time depends on the firmware READ or WRITE command that is issued and if the serial interface is running on a different clock rate than the bus. When the SYNC command starts during this latency time the READ or WRITE command will not be aborted, but the corresponding ACK pulse will be aborted. A pending GO, TRACE1 or MC9S12XE-Family Reference Manual Rev. 1.25 298 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) GO_UNTIL command can not be aborted. Only the corresponding ACK pulse can be aborted by the SYNC command. Although it is not recommended, the host could abort a pending BDM command by issuing a low pulse in the BKGD pin shorter than 128 serial clock cycles, which will not be interpreted as the SYNC command. The ACK is actually aborted when a negative edge is perceived by the target in the BKGD pin. The short abort pulse should have at least 4 clock cycles keeping the BKGD pin low, in order to allow the negative edge to be detected by the target. In this case, the target will not execute the SYNC protocol but the pending command will be aborted along with the ACK pulse. The potential problem with this abort procedure is when there is a conflict between the ACK pulse and the short abort pulse. In this case, the target may not perceive the abort pulse. The worst case is when the pending command is a read command (i.e., READ_BYTE). If the abort pulse is not perceived by the target the host will attempt to send a new command after the abort pulse was issued, while the target expects the host to retrieve the accessed memory byte. In this case, host and target will run out of synchronism. However, if the command to be aborted is not a read command the short abort pulse could be used. After a command is aborted the target assumes the next negative edge, after the abort pulse, is the first bit of a new BDM command. NOTE The details about the short abort pulse are being provided only as a reference for the reader to better understand the BDM internal behavior. It is not recommended that this procedure be used in a real application. Since the host knows the target serial clock frequency, the SYNC command (used to abort a command) does not need to consider the lower possible target frequency. In this case, the host could issue a SYNC very close to the 128 serial clock cycles length. Providing a small overhead on the pulse length in order to assure the SYNC pulse will not be misinterpreted by the target. See Section 7.4.9, “SYNC — Request Timed Reference Pulse”. Figure 7-13 shows a SYNC command being issued after a READ_BYTE, which aborts the READ_BYTE command. Note that, after the command is aborted a new command could be issued by the host computer. READ_BYTE CMD is Aborted by the SYNC Request (Out of Scale) BKGD Pin READ_BYTE Host Memory Address Target BDM Decode and Starts to Execute the READ_BYTE Command SYNC Response From the Target (Out of Scale) READ_STATUS Host Target New BDM Command Host Target New BDM Command Figure 7-13. ACK Abort Procedure at the Command Level NOTE Figure 7-13 does not represent the signals in a true timing scale Figure 7-14 shows a conflict between the ACK pulse and the SYNC request pulse. This conflict could occur if a POD device is connected to the target BKGD pin and the target is already in debug active mode. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 299 Chapter 7 Background Debug Module (S12XBDMV2) Consider that the target CPU is executing a pending BDM command at the exact moment the POD is being connected to the BKGD pin. In this case, an ACK pulse is issued along with the SYNC command. In this case, there is an electrical conflict between the ACK speedup pulse and the SYNC pulse. Since this is not a probable situation, the protocol does not prevent this conflict from happening. At Least 128 Cycles BDM Clock (Target MCU) ACK Pulse Target MCU Drives to BKGD Pin Host Drives SYNC To BKGD Pin High-Impedance Host and Target Drive to BKGD Pin Electrical Conflict Speedup Pulse Host SYNC Request Pulse BKGD Pin 16 Cycles Figure 7-14. ACK Pulse and SYNC Request Conflict NOTE This information is being provided so that the MCU integrator will be aware that such a conflict could eventually occur. The hardware handshake protocol is enabled by the ACK_ENABLE and disabled by the ACK_DISABLE BDM commands. This provides backwards compatibility with the existing POD devices which are not able to execute the hardware handshake protocol. It also allows for new POD devices, that support the hardware handshake protocol, to freely communicate with the target device. If desired, without the need for waiting for the ACK pulse. The commands are described as follows: • ACK_ENABLE — enables the hardware handshake protocol. The target will issue the ACK pulse when a CPU command is executed by the CPU. The ACK_ENABLE command itself also has the ACK pulse as a response. • ACK_DISABLE — disables the ACK pulse protocol. In this case, the host needs to use the worst case delay time at the appropriate places in the protocol. The default state of the BDM after reset is hardware handshake protocol disabled. All the read commands will ACK (if enabled) when the data bus cycle has completed and the data is then ready for reading out by the BKGD serial pin. All the write commands will ACK (if enabled) after the data has been received by the BDM through the BKGD serial pin and when the data bus cycle is complete. See Section 7.4.3, “BDM Hardware Commands” and Section 7.4.4, “Standard BDM Firmware Commands” for more information on the BDM commands. MC9S12XE-Family Reference Manual Rev. 1.25 300 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) The ACK_ENABLE sends an ACK pulse when the command has been completed. This feature could be used by the host to evaluate if the target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command, the host knows that the target supports the hardware handshake protocol. If the target does not support the hardware handshake protocol the ACK pulse is not issued. In this case, the ACK_ENABLE command is ignored by the target since it is not recognized as a valid command. The BACKGROUND command will issue an ACK pulse when the CPU changes from normal to background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO command will issue an ACK pulse when the CPU exits from background mode. The ACK pulse related to this command could be aborted using the SYNC command. The GO_UNTIL command is equivalent to a GO command with exception that the ACK pulse, in this case, is issued when the CPU enters into background mode. This command is an alternative to the GO command and should be used when the host wants to trace if a breakpoint match occurs and causes the CPU to enter active background mode. Note that the ACK is issued whenever the CPU enters BDM, which could be caused by a breakpoint match or by a BGND instruction being executed. The ACK pulse related to this command could be aborted using the SYNC command. The TRACE1 command has the related ACK pulse issued when the CPU enters background active mode after one instruction of the application program is executed. The ACK pulse related to this command could be aborted using the SYNC command. 7.4.9 SYNC — Request Timed Reference Pulse The SYNC command is unlike other BDM commands because the host does not necessarily know the correct communication speed to use for BDM communications until after it has analyzed the response to the SYNC command. To issue a SYNC command, the host should perform the following steps: 1. Drive the BKGD pin low for at least 128 cycles at the lowest possible BDM serial communication frequency (the lowest serial communication frequency is determined by the crystal oscillator or the clock chosen by CLKSW.) 2. Drive BKGD high for a brief speedup pulse to get a fast rise time (this speedup pulse is typically one cycle of the host clock.) 3. Remove all drive to the BKGD pin so it reverts to high impedance. 4. Listen to the BKGD pin for the sync response pulse. Upon detecting the SYNC request from the host, the target performs the following steps: 1. Discards any incomplete command received or bit retrieved. 2. Waits for BKGD to return to a logic one. 3. Delays 16 cycles to allow the host to stop driving the high speedup pulse. 4. Drives BKGD low for 128 cycles at the current BDM serial communication frequency. 5. Drives a one-cycle high speedup pulse to force a fast rise time on BKGD. 6. Removes all drive to the BKGD pin so it reverts to high impedance. The host measures the low time of this 128 cycle SYNC response pulse and determines the correct speed for subsequent BDM communications. Typically, the host can determine the correct communication speed MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 301 Chapter 7 Background Debug Module (S12XBDMV2) within a few percent of the actual target speed and the communication protocol can easily tolerate speed errors of several percent. As soon as the SYNC request is detected by the target, any partially received command or bit retrieved is discarded. This is referred to as a soft-reset, equivalent to a time-out in the serial communication. After the SYNC response, the target will consider the next negative edge (issued by the host) as the start of a new BDM command or the start of new SYNC request. Another use of the SYNC command pulse is to abort a pending ACK pulse. The behavior is exactly the same as in a regular SYNC command. Note that one of the possible causes for a command to not be acknowledged by the target is a host-target synchronization problem. In this case, the command may not have been understood by the target and so an ACK response pulse will not be issued. 7.4.10 Instruction Tracing When a TRACE1 command is issued to the BDM in active BDM, the CPU exits the standard BDM firmware and executes a single instruction in the user code. Once this has occurred, the CPU is forced to return to the standard BDM firmware and the BDM is active and ready to receive a new command. If the TRACE1 command is issued again, the next user instruction will be executed. This facilitates stepping or tracing through the user code one instruction at a time. If an interrupt is pending when a TRACE1 command is issued, the interrupt stacking operation occurs but no user instruction is executed. Once back in standard BDM firmware execution, the program counter points to the first instruction in the interrupt service routine. Be aware when tracing through the user code that the execution of the user code is done step by step but all peripherals are free running. Hence possible timing relations between CPU code execution and occurrence of events of other peripherals no longer exist. Do not trace the CPU instruction BGND used for soft breakpoints. Tracing the BGND instruction will result in a return address pointing to BDM firmware address space. When tracing through user code which contains stop or wait instructions the following will happen when the stop or wait instruction is traced: The CPU enters stop or wait mode and the TRACE1 command can not be finished before leaving the low power mode. This is the case because BDM active mode can not be entered after CPU executed the stop instruction. However all BDM hardware commands except the BACKGROUND command are operational after tracing a stop or wait instruction and still being in stop or wait mode. If system stop mode is entered (all bus masters are in stop mode) no BDM command is operational. As soon as stop or wait mode is exited the CPU enters BDM active mode and the saved PC value points to the entry of the corresponding interrupt service routine. In case the handshake feature is enabled the corresponding ACK pulse of the TRACE1 command will be discarded when tracing a stop or wait instruction. Hence there is no ACK pulse when BDM active mode is entered as part of the TRACE1 command after CPU exited from stop or wait mode. All valid commands sent during CPU being in stop or wait mode or after CPU exited from stop or wait mode will have an ACK pulse. The handshake feature becomes disabled only when system stop mode has been reached. Hence MC9S12XE-Family Reference Manual Rev. 1.25 302 Freescale Semiconductor Chapter 7 Background Debug Module (S12XBDMV2) after a system stop mode the handshake feature must be enabled again by sending the ACK_ENABLE command. 7.4.11 Serial Communication Time Out The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command was issued. In this case, the target will keep waiting for a rising edge on BKGD in order to answer the SYNC request pulse. If the rising edge is not detected, the target will keep waiting forever without any time-out limit. Consider now the case where the host returns BKGD to logic one before 128 cycles. This is interpreted as a valid bit transmission, and not as a SYNC request. The target will keep waiting for another falling edge marking the start of a new bit. If, however, a new falling edge is not detected by the target within 512 clock cycles since the last falling edge, a time-out occurs and the current command is discarded without affecting memory or the operating mode of the MCU. This is referred to as a soft-reset. If a read command is issued but the data is not retrieved within 512 serial clock cycles, a soft-reset will occur causing the command to be disregarded. The data is not available for retrieval after the time-out has occurred. This is the expected behavior if the handshake protocol is not enabled. However, consider the behavior where the BDM is running in a frequency much greater than the CPU frequency. In this case, the command could time out before the data is ready to be retrieved. In order to allow the data to be retrieved even with a large clock frequency mismatch (between BDM and CPU) when the hardware handshake protocol is enabled, the time out between a read command and the data retrieval is disabled. Therefore, the host could wait for more then 512 serial clock cycles and still be able to retrieve the data from an issued read command. However, once the handshake pulse (ACK pulse) is issued, the time-out feature is reactivated, meaning that the target will time out after 512 clock cycles. Therefore, the host needs to retrieve the data within a 512 serial clock cycles time frame after the ACK pulse had been issued. After that period, the read command is discarded and the data is no longer available for retrieval. Any negative edge in the BKGD pin after the time-out period is considered to be a new command or a SYNC request. Note that whenever a partially issued command, or partially retrieved data, has occurred the time out in the serial communication is active. This means that if a time frame higher than 512 serial clock cycles is observed between two consecutive negative edges and the command being issued or data being retrieved is not complete, a soft-reset will occur causing the partially received command or data retrieved to be disregarded. The next negative edge in the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDM command, or the start of a SYNC request pulse. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 303 Chapter 7 Background Debug Module (S12XBDMV2) MC9S12XE-Family Reference Manual Rev. 1.25 304 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-1. Revision History Revision Number Revision Date Sections Affected V03.20 14 Sep 2007 8.3.2.7/8-317 - Clarified reserved State Sequencer encodings. V03.21 23 Oct 2007 8.4.2.2/8-329 8.4.2.4/8-330 - Added single databyte comparison limitation information - Added statement about interrupt vector fetches whilst tagging. V03.22 12 Nov 2007 8.4.5.2/8-334 8.4.5.5/8-341 - Removed LOOP1 tracing restriction NOTE. - Added pin reset effect NOTE. V03.23 13 Nov 2007 General V03.24 04 Jan 2008 8.4.5.3/8-336 V03.25 14 May 2008 General - Updated Revision History Table format. Corrected other paragraph formats. V03.26 12 Sep 2012 General - Added missing full stops. Removed redundant quotation marks. 8.1 Description of Changes - Text readability improved, typo removed. - Corrected bit name. Introduction The S12XDBG module provides an on-chip trace buffer with flexible triggering capability to allow nonintrusive debug of application software. The S12XDBG module is optimized for the S12X 16-bit architecture and allows debugging of CPU12Xand XGATE module operations. Typically the S12XDBG module is used in conjunction with the S12XBDM module, whereby the user configures the S12XDBG module for a debugging session over the BDM interface. Once configured the S12XDBG module is armed and the device leaves BDM Mode returning control to the user program, which is then monitored by the S12XDBG module. Alternatively the S12XDBG module can be configured over a serial interface using SWI routines. 8.1.1 Glossary Table 8-2. Glossary Of Terms Term Definition COF Change Of Flow. Change in the program flow due to a conditional branch, indexed jump or interrupt BDM Background Debug Mode DUG Device User Guide, describing the features of the device into which the DBG is integrated WORD 16-bit data entity MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 305 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-2. Glossary Of Terms (continued) Term Definition Data Line 64-bit data entity CPU CPU12X module Tag Tags can be attached to XGATE or CPU opcodes as they enter the instruction pipe. If the tagged opcode reaches the execution stage a tag hit occurs. 8.1.2 Overview The comparators monitor the bus activity of the CPU12X and XGATE. When a match occurs the control logic can trigger the state sequencer to a new state. On a transition to the Final State, bus tracing is triggered and/or a breakpoint can be generated. Independent of comparator matches a transition to Final State with associated tracing and breakpoint can be triggered by the external TAGHI and TAGLO signals, or by an XGATE module S/W breakpoint request or by writing to the TRIG control bit. The trace buffer is visible through a 2-byte window in the register address map and can be read out using standard 16-bit word reads. Tracing is disabled when the MCU system is secured. 8.1.3 • • • • • Features Four comparators (A, B, C, and D) — Comparators A and C compare the full address bus and full 16-bit data bus — Comparators A and C feature a data bus mask register — Comparators B and D compare the full address bus only — Each comparator can be configured to monitor CPU12X or XGATE buses — Each comparator features selection of read or write access cycles — Comparators B and D allow selection of byte or word access cycles — Comparisons can be used as triggers for the state sequencer Three comparator modes — Simple address/data comparator match mode — Inside address range mode, Addmin ≤ Address ≤ Addmax — Outside address range match mode, Address < Addmin or Address > Addmax Two types of triggers — Tagged — This triggers just before a specific instruction begins execution — Force — This triggers on the first instruction boundary after a match occurs. The following types of breakpoints — CPU12X breakpoint entering BDM on breakpoint (BDM) — CPU12X breakpoint executing SWI on breakpoint (SWI) — XGATE breakpoint External CPU12X instruction tagging trigger independent of comparators MC9S12XE-Family Reference Manual Rev. 1.25 306 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module • • • XGATE S/W breakpoint request trigger independent of comparators TRIG Immediate software trigger independent of comparators Four trace modes — Normal: change of flow (COF) PC information is stored (see Section 8.4.5.2.1) for change of flow definition. — Loop1: same as Normal but inhibits consecutive duplicate source address entries — Detail: address and data for all cycles except free cycles and opcode fetches are stored — Pure PC: All program counter addresses are stored. 4-stage state sequencer for trace buffer control — Tracing session trigger linked to Final State of state sequencer — Begin, End, and Mid alignment of tracing to trigger • 8.1.4 Modes of Operation The S12XDBG module can be used in all MCU functional modes. During BDM hardware accesses and whilst the BDM module is active, CPU12X monitoring is disabled. Thus breakpoints, comparators, and CPU12X bus tracing are disabled but XGATE bus monitoring accessing the S12XDBG registers, including comparator registers, is still possible. While in active BDM or during hardware BDM accesses, XGATE activity can still be compared, traced and can be used to generate a breakpoint to the XGATE module. When the CPU12X enters active BDM Mode through a BACKGROUND command, with the S12XDBG module armed, the S12XDBG remains armed. The S12XDBG module tracing is disabled if the MCU is secure. However, breakpoints can still be generated if the MCU is secure. Table 8-3. Mode Dependent Restriction Summary BDM Enable BDM Active MCU Secure Comparator Matches Enabled Breakpoints Possible Tagging Possible Tracing Possible x x 1 Yes Yes Yes No 0 0 0 Yes Only SWI Yes Yes 0 1 0 1 0 0 Yes Yes Yes Yes 1 1 0 XGATE only XGATE only XGATE only XGATE only Active BDM not possible when not enabled MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 307 Chapter 8 S12X Debug (S12XDBGV3) Module 8.1.5 Block Diagram TAGS TAGHITS EXTERNAL TAGHI / TAGLO BREAKPOINT REQUESTS XGATE S/W BREAKPOINT REQUEST CPU12X & XGATE XGATE BUS COMPARATOR A COMPARATOR B COMPARATOR C COMPARATOR D MATCH0 COMPARATOR MATCH CONTROL CPU12X BUS BUS INTERFACE SECURE MATCH1 TAG & TRIGGER CONTROL LOGIC TRIGGER STATE STATE SEQUENCER STATE MATCH2 MATCH3 TRACE CONTROL TRIGGER TRACE BUFFER READ TRACE DATA (DBG READ DATA BUS) Figure 8-1. Debug Module Block Diagram 8.2 External Signal Description The S12XDBG sub-module features two external tag input signals. See Device User Guide (DUG) for the mapping of these signals to device pins. These tag pins may be used for the external tagging in emulation modes only. Table 8-4. External System Pins Associated With S12XDBG Pin Name Pin Functions TAGHI (See DUG) TAGHI When instruction tagging is on, tags the high half of the instruction word being read into the instruction queue. TAGLO (See DUG) TAGLO When instruction tagging is on, tags the low half of the instruction word being read into the instruction queue. TAGLO (See DUG) Unconditional Tagging Enable In emulation modes, a low assertion on this pin in the 7th or 8th cycle after the end of reset enables the Unconditional Tagging function. 8.3 8.3.1 Description Memory Map and Registers Module Memory Map A summary of the registers associated with the S12XDBG sub-block is shown in Table 8-2. Detailed descriptions of the registers and bits are given in the subsections that follow. MC9S12XE-Family Reference Manual Rev. 1.25 308 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Address Name Bit 7 6 0 TRIG 5 4 XGSBPE BDM 0 0 3 2 1 Bit 0 0x0020 DBGC1 R W 0x0021 DBGSR R W 0x0022 DBGTCR R W 0x0023 DBGC2 R W 0 0 0 0 0x0024 DBGTBH R W Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0x0025 DBGTBL R W Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0x0026 DBGCNT R W 0 0x0027 DBGSCRX 0 0 0 0 SC3 SC2 SC1 SC0 0x0027 DBGMFR R W R W 0 0 0 0 MC3 MC2 MC1 MC0 NDB TAG BRK RW RWE SRC COMPE SZ TAG BRK RW RWE SRC COMPE Bit 22 21 20 19 18 17 Bit 16 0x00281 0x00282 DBGXCTL R (COMPA/C) W DBGXCTL R (COMPB/D) W ARM TBF EXTF TSOURCE 0 SZE 0 DBGBRK 0 TRANGE COMRV SSF2 SSF1 SSF0 TRCMOD TALIGN CDCM ABCM CNT 0x0029 DBGXAH R W 0x002A DBGXAM R W Bit 15 14 13 12 11 10 9 Bit 8 0x002B DBGXAL R W Bit 7 6 5 4 3 2 1 Bit 0 0x002C DBGXDH R W Bit 15 14 13 12 11 10 9 Bit 8 0x002D DBGXDL R W Bit 7 6 5 4 3 2 1 Bit 0 0x002E DBGXDHM R W Bit 15 14 13 12 11 10 9 Bit 8 1 Bit 0 R Bit 7 6 5 4 3 2 W 1 This represents the contents if the Comparator A or C control register is blended into this address. 2 This represents the contents if the Comparator B or D control register is blended into this address 0x002F DBGXDLM Figure 8-2. Quick Reference to S12XDBG Registers MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 309 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2 Register Descriptions This section consists of the S12XDBG control and trace buffer register descriptions in address order. Each comparator has a bank of registers that are visible through an 8-byte window between 0x0028 and 0x002F in the S12XDBG module register address map. When ARM is set in DBGC1, the only bits in the S12XDBG module registers that can be written are ARM, TRIG, and COMRV[1:0]. 8.3.2.1 Debug Control Register 1 (DBGC1) Address: 0x0020 7 R W Reset 6 ARM 0 0 TRIG 0 5 4 XGSBPE BDM 0 0 3 2 1 DBGBRK 0 0 COMRV 0 0 0 Figure 8-3. Debug Control Register (DBGC1) Read: Anytime Write: Bits 7, 1, 0 anytime Bit 6 can be written anytime but always reads back as 0. Bits 5:2 anytime S12XDBG is not armed. NOTE If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm from an internal trigger event, then the ARM bit is cleared due to the hardware disarm. NOTE When disarming the S12XDBG by clearing ARM with software, the contents of bits[5:2] are not affected by the write, since up until the write operation, ARM = 1 preventing these bits from being written. These bits must be cleared using a second write if required. Table 8-5. DBGC1 Field Descriptions Field Description 7 ARM Arm Bit — The ARM bit controls whether the S12XDBG module is armed. This bit can be set and cleared by user software and is automatically cleared on completion of a tracing session, or if a breakpoint is generated with tracing not enabled. On setting this bit the state sequencer enters State1. 0 Debugger disarmed 1 Debugger armed 6 TRIG Immediate Trigger Request Bit — This bit when written to 1 requests an immediate trigger independent of comparator or external tag signal status. When tracing is complete a forced breakpoint may be generated depending upon DBGBRK and BDM bit settings. This bit always reads back a 0. Writing a 0 to this bit has no effect. If TSOURCE are clear no tracing is carried out. If tracing has already commenced using BEGIN- or MID trigger alignment, it continues until the end of the tracing session as defined by the TALIGN bit settings, thus TRIG has no affect. In secure mode tracing is disabled and writing to this bit has no effect. 0 Do not trigger until the state sequencer enters the Final State. 1 Trigger immediately . MC9S12XE-Family Reference Manual Rev. 1.25 310 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-5. DBGC1 Field Descriptions (continued) Field 5 XGSBPE Description XGATE S/W Breakpoint Enable — The XGSBPE bit controls whether an XGATE S/W breakpoint request is passed to the CPU12X. The XGATE S/W breakpoint request is handled by the S12XDBG module, which can request an CPU12X breakpoint depending on the state of this bit. 0 XGATE S/W breakpoint request is disabled 1 XGATE S/W breakpoint request is enabled 4 BDM Background Debug Mode Enable — This bit determines if an S12X breakpoint causes the system to enter Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDM is not enabled by the ENBDM bit in the BDM module, then breakpoints default to SWI. 0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint. 1 Breakpoint to BDM, if BDM enabled. Otherwise breakpoint to SWI 3–2 DBGBRK S12XDBG Breakpoint Enable Bits — The DBGBRK bits control whether the debugger will request a breakpoint to either CPU12X or XGATE or both upon reaching the state sequencer Final State. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If tracing is not enabled, the breakpoint is generated immediately. Please refer to Section 8.4.7 for further details. XGATE software breakpoints are independent of the DBGBRK bits. XGATE software breakpoints force a breakpoint to the CPU12X independent of the DBGBRK bit field configuration. See Table 8-6. 1–0 COMRV Comparator Register Visibility Bits — These bits determine which bank of comparator register is visible in the 8-byte window of the S12XDBG module address map, located between 0x0028 to 0x002F. Furthermore these bits determine which register is visible at the address 0x0027. See Table 8-7. Table 8-6. DBGBRK Encoding DBGBRK Resource Halted by Breakpoint 00 No breakpoint generated 01 XGATE breakpoint generated 10 CPU12X breakpoint generated 11 Breakpoints generated for CPU12X and XGATE Table 8-7. COMRV Encoding COMRV Visible Comparator Visible Register at 0x0027 00 Comparator A DBGSCR1 01 Comparator B DBGSCR2 10 Comparator C DBGSCR3 11 Comparator D DBGMFR MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 311 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.2 Debug Status Register (DBGSR) Address: 0x0021 R 7 6 5 4 3 2 1 0 TBF EXTF 0 0 0 SSF2 SSF1 SSF0 — 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W Reset POR = Unimplemented or Reserved Figure 8-4. Debug Status Register (DBGSR) Read: Anytime Write: Never Table 8-8. DBGSR Field Descriptions Field Description 7 TBF Trace Buffer Full — The TBF bit indicates that the trace buffer has stored 64 or more lines of data since it was last armed. If this bit is set, then all 64 lines will be valid data, regardless of the value of DBGCNT bits CNT[6:0]. The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset initialization. Other system generated resets have no affect on this bit. 6 EXTF External Tag Hit Flag — The EXTF bit indicates if a tag hit condition from an external TAGHI/TAGLO tag was met since arming. This bit is cleared when ARM in DBGC1 is written to a one. 0 External tag hit has not occurred 1 External tag hit has occurred 2–0 SSF[2:0] State Sequencer Flag Bits — The SSF bits indicate in which state the State Sequencer is currently in. During a debug session on each transition to a new state these bits are updated. If the debug session is ended by software clearing the ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a debug session is ended by an internal trigger, then the state sequencer returns to state0 and these bits are cleared to indicate that state0 was entered during the session. On arming the module the state sequencer enters state1 and these bits are forced to SSF[2:0] = 001. See Table 8-9. Table 8-9. SSF[2:0] — State Sequence Flag Bit Encoding SSF[2:0] Current State 000 State0 (disarmed) 001 State1 010 State2 011 State3 100 Final State 101,110,111 Reserved MC9S12XE-Family Reference Manual Rev. 1.25 312 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.3 Debug Trace Control Register (DBGTCR) Address: 0x0022 7 6 R TSOURCE W Reset 5 0 4 3 TRANGE 0 0 2 1 TRCMOD 0 0 0 TALIGN 0 0 0 Figure 8-5. Debug Trace Control Register (DBGTCR) Read: Anytime Write: Bits 7:6 only when S12XDBG is neither secure nor armed. Bits 5:0 anytime the module is disarmed. Table 8-10. DBGTCR Field Descriptions Field 7–6 TSOURCE Description Trace Source Control Bits — The TSOURCE bits select the data source for the tracing session. If the MCU system is secured, these bits cannot be set and tracing is inhibited. See Table 8-11. 5–4 TRANGE Trace Range Bits — The TRANGE bits allow filtering of trace information from a selected address range when tracing from the CPU12X in Detail Mode. The XGATE tracing range cannot be narrowed using these bits. To use a comparator for range filtering, the corresponding COMPE and SRC bits must remain cleared. If the COMPE bit is not clear then the comparator will also be used to generate state sequence triggers. If the corresponding SRC bit is set the comparator is mapped to the XGATE buses, the TRANGE bits have no effect on the valid address range, memory accesses within the whole memory map are traced. See Table 8-12. 3–2 TRCMOD Trace Mode Bits — See Section 8.4.5.2 for detailed Trace Mode descriptions. In Normal Mode, change of flow information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. See Table 8-13. 1–0 TALIGN Trigger Align Bits — These bits control whether the trigger is aligned to the beginning, end or the middle of a tracing session. See Table 8-14. Table 8-11. TSOURCE — Trace Source Bit Encoding TSOURCE Tracing Source 00 No tracing requested 01 CPU12X (1) 10 XGATE 1,(2) Both CPU12X and XGATE 11 1. No range limitations are allowed. Thus tracing operates as if TRANGE = 00. 2. No Detail Mode tracing supported. If TRCMOD = 10, no information is stored. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 313 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-12. TRANGE Trace Range Encoding TRANGE Tracing Range 00 Trace from all addresses (No filter) 01 Trace only in address range from $00000 to Comparator D 10 Trace only in address range from Comparator C to $7FFFFF 11 Trace only in range from Comparator C to Comparator D Table 8-13. TRCMOD Trace Mode Bit Encoding TRCMOD Description 00 Normal 01 Loop1 10 Detail 11 Pure PC Table 8-14. TALIGN Trace Alignment Encoding 8.3.2.4 TALIGN Description 00 Trigger at end of stored data 01 Trigger before storing data 10 Trace buffer entries before and after trigger 11 Reserved Debug Control Register2 (DBGC2) Address: 0x0023 R 7 6 5 4 0 0 0 0 0 0 0 3 0 1 CDCM W Reset 2 0 0 ABCM 0 0 0 = Unimplemented or Reserved Figure 8-6. Debug Control Register2 (DBGC2) Read: Anytime Write: Anytime the module is disarmed. This register configures the comparators for range matching. Table 8-15. DBGC2 Field Descriptions Field Description 3–2 CDCM[1:0] C and D Comparator Match Control — These bits determine the C and D comparator match mapping as described in Table 8-16. 1–0 ABCM[1:0] A and B Comparator Match Control — These bits determine the A and B comparator match mapping as described in Table 8-17. MC9S12XE-Family Reference Manual Rev. 1.25 314 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-16. CDCM Encoding CDCM Description 00 Match2 mapped to comparator C match....... Match3 mapped to comparator D match. 01 Match2 mapped to comparator C/D inside range....... Match3 disabled. 10 Match2 mapped to comparator C/D outside range....... Match3 disabled. 11 Reserved(1) 1. Currently defaults to Match2 mapped to comparator C : Match3 mapped to comparator D Table 8-17. ABCM Encoding ABCM Description 00 Match0 mapped to comparator A match....... Match1 mapped to comparator B match. 01 Match 0 mapped to comparator A/B inside range....... Match1 disabled. 10 Match 0 mapped to comparator A/B outside range....... Match1 disabled. 11 Reserved(1) 1. Currently defaults to Match0 mapped to comparator A : Match1 mapped to comparator B 8.3.2.5 Debug Trace Buffer Register (DBGTBH:DBGTBL) Address: 0x0024, 0x0025 15 R W 14 13 12 11 10 9 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 8 7 6 5 4 3 2 1 0 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 POR X X X X X X X X X X X X X X X X Other Resets — — — — — — — — — — — — — — — — Figure 8-7. Debug Trace Buffer Register (DBGTB) Read: Only when unlocked AND not secured AND not armed AND with a TSOURCE bit set. Write: Aligned word writes when disarmed unlock the trace buffer for reading but do not affect trace buffer contents. Table 8-18. DBGTB Field Descriptions Field Description 15–0 Bit[15:0] Trace Buffer Data Bits — The Trace Buffer Register is a window through which the 64-bit wide data lines of the Trace Buffer may be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to the next address to be read. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module is disarmed. The DBGTB register can be read only as an aligned word, any byte reads or misaligned access of these registers will return 0 and will not cause the trace buffer pointer to increment to the next trace buffer address. The same is true for word reads while the debugger is armed. The POR state is undefined Other resets do not affect the trace buffer contents. . MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 315 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.6 Debug Count Register (DBGCNT) Address: 0x0026 7 R 6 5 4 0 3 2 1 0 — 0 — 0 — 0 CNT W Reset POR 0 0 — 0 — 0 — 0 — 0 = Unimplemented or Reserved Figure 8-8. Debug Count Register (DBGCNT) Read: Anytime Write: Never Table 8-19. DBGCNT Field Descriptions Field Description 6–0 CNT[6:0] Count Value — The CNT bits [6:0] indicate the number of valid data 64-bit data lines stored in the Trace Buffer. Table 8-20 shows the correlation between the CNT bits and the number of valid data lines in the Trace Buffer. When the CNT rolls over to zero, the TBF bit in DBGSR is set and incrementing of CNT will continue in endtrigger or mid-trigger mode. The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by power-on-reset initialization but is not cleared by other system resets. Thus should a reset occur during a debug session, the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset occurred. The DBGCNT register is not decremented when reading from the trace buffer. Table 8-20. CNT Decoding Table TBF (DBGSR) CNT[6:0] Description 0 0000000 No data valid 0 0000001 32 bits of one line valid(1) 0 0000010 0000100 0000110 .. 1111100 1 line valid 2 lines valid 3 lines valid .. 62 lines valid 0 1111110 63 lines valid 1 0000000 64 lines valid; if using Begin trigger alignment, ARM bit will be cleared and the tracing session ends. 64 lines valid, 0000010 oldest data has been overwritten by most recent data .. .. 1111110 1. This applies to Normal/Loop1/PurePC Modes when tracing from either CPU12X or XGATE only. 1 MC9S12XE-Family Reference Manual Rev. 1.25 316 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.7 Debug State Control Registers There is a dedicated control register for each of the state sequencer states 1 to 3 that determines if transitions from that state are allowed, depending upon comparator matches or tag hits, and defines the next state for the state sequencer following a match. The three debug state control registers are located at the same address in the register address map (0x0027). Each register can be accessed using the COMRV bits in DBGC1 to blend in the required register. The COMRV = 11 value blends in the match flag register (DBGMFR). Table 8-21. State Control Register Access Encoding 8.3.2.7.1 COMRV Visible State Control Register 00 DBGSCR1 01 DBGSCR2 10 DBGSCR3 11 DBGMFR Debug State Control Register 1 (DBGSCR1) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 0 W Reset 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 8-9. Debug State Control Register 1 (DBGSCR1) Read: If COMRV[1:0] = 00 Write: If COMRV[1:0] = 00 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 00. The state control register 1 selects the targeted next state whilst in State1. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-22. DBGSCR1 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State1, based upon the match event. Table 8-23. State1 Sequencer Next State Selection SC[3:0] 0000 0001 0010 Description Any match triggers to state2 Any match triggers to state3 Any match triggers to Final State MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 317 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-23. State1 Sequencer Next State Selection (continued) SC[3:0] 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Match2 triggers to State2....... Other matches have no effect Match2 triggers to State3....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match0 triggers to State2....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State2....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State2....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers to Final State....... Other matches have no effect Match3 has no effect....... All other matches (M0,M1,M2) trigger to State2 Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.2 Debug State Control Register 2 (DBGSCR2) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 8-10. Debug State Control Register 2 (DBGSCR2) Read: If COMRV[1:0] = 01 Write: If COMRV[1:0] = 01 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 01. The state control register 2 selects the targeted next state whilst in State2. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-24. DBGSCR2 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State2, based upon the match event. Table 8-25. State2 —Sequencer Next State Selection SC[3:0] 0000 Description Any match triggers to state1 MC9S12XE-Family Reference Manual Rev. 1.25 318 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-25. State2 —Sequencer Next State Selection (continued) SC[3:0] 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state3 Any match triggers to Final State Match3 triggers to State1....... Other matches have no effect Match3 triggers to State3....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Match0 triggers to State1....... Match1 triggers to State3....... Other matches have no effect Match1 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match0 triggers to State1....... Match2 triggers to State3....... Other matches have no effect Match2 triggers to State3....... Match0 triggers Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State3....... Other matches have no effect Match3 triggers to State3....... Match1 triggers Final State....... Other matches have no effect Match2 triggers to State1..... Match3 trigger to Final State Match2 has no affect, all other matches (M0,M1,M3) trigger to Final State Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.3 Debug State Control Register 3 (DBGSCR3) Address: 0x0027 R 7 6 5 4 0 0 0 0 0 0 0 W Reset 0 3 2 1 0 SC3 SC2 SC1 SC0 0 0 0 0 = Unimplemented or Reserved Figure 8-11. Debug State Control Register 3 (DBGSCR3) Read: If COMRV[1:0] = 10 Write: If COMRV[1:0] = 10 and S12XDBG is not armed. This register is visible at 0x0027 only with COMRV[1:0] = 10. The state control register three selects the targeted next state whilst in State3. The matches refer to the match channels of the comparator match control logic as depicted in Figure 8-1 and described in Section 8.3.2.8.1. Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control register. Table 8-26. DBGSCR3 Field Descriptions Field 3–0 SC[3:0] Description These bits select the targeted next state whilst in State3, based upon the match event. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 319 Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-27. State3 — Sequencer Next State Selection SC[3:0] 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Description Any match triggers to state1 Any match triggers to state2 Any match triggers to Final State Match0 triggers to State1....... Other matches have no effect Match0 triggers to State2....... Other matches have no effect Match0 triggers to Final State.......Match1 triggers to State1...Other matches have no effect Match1 triggers to State1....... Other matches have no effect Match1 triggers to State2....... Other matches have no effect Match1 triggers to Final State....... Other matches have no effect Match2 triggers to State2....... Match0 triggers to Final State....... Other matches have no effect Match1 triggers to State1....... Match3 triggers to State2....... Other matches have no effect Match3 triggers to State2....... Match1 triggers to Final State....... Other matches have no effect Match2 triggers to Final State....... Other matches have no effect Match3 triggers to Final State....... Other matches have no effect Reserved. (No match triggers state sequencer transition) Reserved. (No match triggers state sequencer transition) The trigger priorities described in Table 8-42 dictate that in the case of simultaneous matches, the match on the lower channel number (0,1,2,3) has priority. The SC[3:0] encoding ensures that a match leading to final state has priority over all other matches. 8.3.2.7.4 Debug Match Flag Register (DBGMFR) Address: 0x0027 R 7 6 5 4 3 2 1 0 0 0 0 0 MC3 MC2 MC1 MC0 0 0 0 0 0 0 0 0 W Reset = Unimplemented or Reserved Figure 8-12. Debug Match Flag Register (DBGMFR) Read: If COMRV[1:0] = 11 Write: Never DBGMFR is visible at 0x0027 only with COMRV[1:0] = 11. It features four flag bits each mapped directly to a channel. Should a match occur on the channel during the debug session, then the corresponding flag is set and remains set until the next time the module is armed by writing to the ARM bit. Thus the contents are retained after a debug session for evaluation purposes. These flags cannot be cleared by software, they are cleared only when arming the module. A set flag does not inhibit the setting of other flags. Once a flag is set, further triggers on the same channel have no affect. MC9S12XE-Family Reference Manual Rev. 1.25 320 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.8 Comparator Register Descriptions Each comparator has a bank of registers that are visible through an 8-byte window in the S12XDBG module register address map. Comparators A and C consist of 8 register bytes (3 address bus compare registers, two data bus compare registers, two data bus mask registers and a control register). Comparators B and D consist of four register bytes (three address bus compare registers and a control register). Each set of comparator registers is accessible in the same 8-byte window of the register address map and can be accessed using the COMRV bits in the DBGC1 register. If the Comparators B or D are accessed through the 8-byte window, then only the address and control bytes are visible, the 4 bytes associated with data bus and data bus masking read as zero and cannot be written. Furthermore the control registers for comparators B and D differ from those of comparators A and C. Table 8-28. Comparator Register Layout 0x0028 CONTROL Read/Write Comparators A,B,C,D 0x0029 ADDRESS HIGH Read/Write Comparators A,B,C,D 0x002A ADDRESS MEDIUM Read/Write Comparators A,B,C,D 0x002B ADDRESS LOW Read/Write Comparators A,B,C,D 0x002C DATA HIGH COMPARATOR Read/Write Comparator A and C only 0x002D DATA LOW COMPARATOR Read/Write Comparator A and C only 0x002E DATA HIGH MASK Read/Write Comparator A and C only 0x002F DATA LOW MASK Read/Write Comparator A and C only 8.3.2.8.1 Debug Comparator Control Register (DBGXCTL) The contents of this register bits 7 and 6 differ depending upon which comparator registers are visible in the 8-byte window of the DBG module register address map. Address: 0x0028 7 R 0 W Reset 0 6 5 4 3 2 1 0 NDB TAG BRK RW RWE SRC COMPE 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-13. Debug Comparator Control Register (Comparators A and C) Address: 0x0028 R W Reset 7 6 5 4 3 2 1 0 SZE SZ TAG BRK RW RWE SRC COMPE 0 0 0 0 0 0 0 0 Figure 8-14. Debug Comparator Control Register (Comparators B and D) Read: Anytime. See Table 8-29 for visible register encoding. MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 321 Chapter 8 S12X Debug (S12XDBGV3) Module Write: If DBG not armed. See Table 8-29 for visible register encoding. The DBGC1_COMRV bits determine which comparator control, address, data and datamask registers are visible in the 8-byte window from 0x0028 to 0x002F as shown in Section Table 8-29. Table 8-29. Comparator Address Register Visibility COMRV Visible Comparator 00 DBGACTL, DBGAAH ,DBGAAM, DBGAAL, DBGADH, DBGADL, DBGADHM, DBGADLM 01 DBGBCTL, DBGBAH, DBGBAM, DBGBAL 10 DBGCCTL, DBGCAH, DBGCAM, DBGCAL, DBGCDH, DBGCDL, DBGCDHM, DBGCDLM 11 DBGDCTL, DBGDAH, DBGDAM, DBGDAL Table 8-30. DBGXCTL Field Descriptions Field Description 7 SZE (Comparators B and D) Size Comparator Enable Bit — The SZE bit controls whether access size comparison is enabled for the associated comparator. This bit is ignored if the TAG bit in the same register is set. 0 Word/Byte access size is not used in comparison 1 Word/Byte access size is used in comparison 6 NDB (Comparators A and C Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator register value or when the data bus differs from the register value. Furthermore data bus bits can be individually masked using the comparator data mask registers. This bit is only available for comparators A and C. This bit is ignored if the TAG bit in the same register is set. This bit position has an SZ functionality for comparators B and D. 0 Match on data bus equivalence to comparator register contents 1 Match on data bus difference to comparator register contents 6 SZ (Comparators B and D) Size Comparator Value Bit — The SZ bit selects either word or byte access size in comparison for the associated comparator. This bit is ignored if the SZE bit is cleared or if the TAG bit in the same register is set. This bit position has NDB functionality for comparators A and C 0 Word access size will be compared 1 Byte access size will be compared 5 TAG Tag Select — This bit controls whether the comparator match will cause a trigger or tag the opcode at the matched address. Tagged opcodes trigger only if they reach the execution stage of the instruction queue. 0 Trigger immediately on match 1 On match, tag the opcode. If the opcode is about to be executed a trigger is generated 4 BRK Break — This bit controls whether a channel match terminates a debug session immediately, independent of state sequencer state. To generate an immediate breakpoint the module breakpoints must be enabled using DBGBRK. 0 The debug session termination is dependent upon the state sequencer and trigger conditions. 1 A match on this channel terminates the debug session immediately; breakpoints if active are generated, tracing, if active, is terminated and the module disarmed. 3 RW Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the associated comparator . The RW bit is not used if RWE = 0. 0 Write cycle will be matched 1 Read cycle will be matched 2 RWE Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the associated comparator. This bit is not used for tagged operations. 0 Read/Write is not used in comparison 1 Read/Write is used in comparison MC9S12XE-Family Reference Manual Rev. 1.25 322 Freescale Semiconductor Chapter 8 S12X Debug (S12XDBGV3) Module Table 8-30. DBGXCTL Field Descriptions (continued) Field Description 1 SRC Determines mapping of comparator to CPU12X or XGATE 0 The comparator is mapped to CPU12X buses 1 The comparator is mapped to XGATE address and data buses 0 COMPE Determines if comparator is enabled 0 The comparator is not enabled 1 The comparator is enabled for state sequence triggers or tag generation Table 8-31 shows the effect for RWE and RW on the comparison conditions. These bits are not useful for tagged operations since the trigger occurs based on the tagged opcode reaching the execution stage of the instruction queue. Thus these bits are ignored if tagged triggering is selected. Table 8-31. Read or Write Comparison Logic Table 8.3.2.8.2 RWE Bit RW Bit RW Signal Comment 0 x 0 RW not used in comparison 0 x 1 RW not used in comparison 1 0 0 Write 1 0 1 No match 1 1 0 No match 1 1 1 Read Debug Comparator Address High Register (DBGXAH) Address: 0x0029 7 R 0 W Reset 0 6 5 4 3 2 1 0 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16 0 0 0 0 0 0 0 = Unimplemented or Reserved Figure 8-15. Debug Comparator Address High Register (DBGXAH) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-32. DBGXAH Field Descriptions Field Description 6–0 Bit[22:16] Comparator Address High Compare Bits — The Comparator address high compare bits control whether the selected comparator will compare the address bus bits [22:16] to a logic one or logic zero. This register byte is ignored for XGATE compares. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one MC9S12XE-Family Reference Manual Rev. 1.25 Freescale Semiconductor 323 Chapter 8 S12X Debug (S12XDBGV3) Module 8.3.2.8.3 Debug Comparator Address Mid Register (DBGXAM) Address: 0x002A R W Reset 7 6 5 4 3 2 1 0 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 0 0 0 0 0 0 0 0 Figure 8-16. Debug Comparator Address Mid Register (DBGXAM) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-33. DBGXAM Field Descriptions Field 7–0 Bit[15:8] Description Comparator Address Mid Compare Bits— The Comparator address mid compare bits control whether the selected comparator will compare the address bus bits [15:8] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one 8.3.2.8.4 Debug Comparator Address Low Register (DBGXAL) Address: 0x002B R W Reset 7 6 5 4 3 2 1 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 0 0 0 0 0 0 0 0 Figure 8-17. Debug Comparator Address Low Register (DBGXAL) Read: Anytime. See Table 8-29 for visible register encoding. Write: If DBG not armed. See Table 8-29 for visible register encoding. Table 8-34. DBGXAL Field Descriptions Field 7–0 Bits[7:0] Description Comparator Address Low Compare Bits — The Comparator address low compare bits control whether the selected comparator will compare the address bus bits [7:0] to a logic one or logic zero. 0 Compare corresponding address bit to a logic zero 1 Compare corresponding address bit to a logic one MC9S12XE-Family Reference Manual Rev. 1.25 324 Freescale Semiconductor