MC9S12ZVM-Family
Reference Manual
HCS12
Microcontrollers
Rev. 1.5
22 SEP 2014
MC9S12ZVMRMV1
freescale.com
The document revision on the Internet is the most current. To verify this is the latest revision, refer to:
freescale.com.
This document contains information for all modules except the CPU. For CPU information please refer to
the CPU S12Z Reference Manual. This revision history table summarizes changes to this document. The
individual module sections contain revision history tables with more detailed information.
Table 0-1. Revision History
Date
Revision
Description
12 Dec 2013
1.2
Replaced generic 8-channel TIM section with specific 4-channel TIM section
Textual enhancements and corrections throughout
Updated electrical parameter section and added parameters for temperataures up to 175°C
- Added Table A-5
- Merged Table A-8 and A-9 into Table A-9. Values updated. .
- Table A-15. Parameter #2. max changed from 800uA to 1050uA
- Table A-15. Inserted new C class parameter ISUPS at 85C. typ. 80uA
- Appendices B,D and E. Updated parameter values based on characterization results.
- Appendix C. Added parameter values for range above T=150°C
- Table F-3. Merged rows 2a and 2b. Merged rows 6a and 6b.
- Appendix G. Merged tables G-1 and G-2.
- Tables H-1 and H-2 values updated.
20 JAN 2014
1.3
Updated Stop mode description for BDC enabled case
Removed false reference to modified clock monitor assert frequency
Updated electricals for 175°C Grade0
- Removed temperature range disclaimer from electrical parameter spec.footer
- Added sentence above table A-3
- Table D-1. LINPHY parameters 12a and 12b replaced by 12a, 12b and 12c- Table D-2. LINPHY wake up pulse over whole temperature range
- Table E-1. FET gate charge spec. updated
22 MAY2014
1.4
Updated family derivative table for S12ZVML32, S12ZVM32 and S12ZVM16 devices
Added 64KB, 32KB and 16KB derivative information to flash module chapter
Added pin routing options for S12ZVM32 and S12ZVM16 devices
Added HV Phy information for the S12ZVM32 and S12ZVM16 derivatives
Updated Part ID assignment table and ordering information for S12ZVM32 and S12ZVM16
Corrected PLL VCO maximum frequency specification
Changed VLVLSA maximum from 7V to 6.9V
Added electrical parameter for HD division ratio through the phase multiplexer
Corrected preferred VRL reference from VRL_1 to VRL_0
Included NVM timing parameters for the S12ZVM32 and S12ZVM16 devices
Added GDU S12ZVM32 and S12ZVM16 specific differences and electrical specifications
Added references to fWSTAT
Added VDDX short circuit fall back current and temperature/input dependency specs.
22 SEP 2014
1.5
Removed incorrect references to PACLK in TIM chapter
Improved clarity of routing options in PIM chapter.
Updated S12ZVM- Family derivative table.
Added 48LQFP thermal package parameters
Extended LINPHY specification range minimum to 5V
Updated BKGD pin I/O specification
Specified ADC accuracy for a range of VDDA and VREF.
Freescale Semiconductor reserves the right to make changes without further notice to any products herein. Freescale Semiconductor makes no warranty,
representation or guarantee regarding the suitability of its products for any particular purpose, nor does Freescale Semiconductor assume any liability arising out of
the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation consequential or incidental damages. “Typical”
parameters that may be provided in Freescale Semiconductor data sheets and/or specifications can and do vary in different applications and actual performance may
vary over time. All operating parameters, including “Typicals”, must be validated for each customer application by customer’s technical experts. Freescale
Semiconductor does not convey any license under its patent rights nor the rights of others. Freescale Semiconductor products are not designed, intended, or
authorized for use as components in systems intended for surgical implant into the body, or other applications intended to support or sustain life, or for any other
application in which the failure of the Freescale Semiconductor product could create a situation where personal injury or death may occur. Should Buyer purchase or
use Freescale Semiconductor products for any such unintended or unauthorized application, Buyer shall indemnify and hold Freescale Semiconductor and its officers,
employees, subsidiaries, affiliates, and distributors harmless against all claims, costs, damages, and expenses, and reasonable attorney fees arising out of, directly
or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such claim alleges that Freescale Semiconductor was
negligent regarding the design or manufacture of the part.
Chapter 1
Device Overview MC9S12ZVM-Family
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.2.1 MC9S12ZVM-Family Member Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
1.2.2 Functional Differences Between N06E and 0N95G Masksets . . . . . . . . . . . . . . . . . . . . 19
1.2.3 Functional Differences Between 1N95G and 0N95G Masksets . . . . . . . . . . . . . . . . . . . 20
Chip-Level Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Module Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.4.1 S12Z Central Processor Unit (CPU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
1.4.2 Embedded Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1.4.3 Clocks, Reset & Power Management Unit (CPMU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
1.4.4 Main External Oscillator (XOSCLCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.5 Timer (TIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.6 Pulse width Modulator with Fault protection (PMF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.4.7 Programmable Trigger Unit (PTU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.8 LIN physical layer transceiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.9 Serial Communication Interface Module (SCI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.10 Multi-Scalable Controller Area Network (MSCAN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
1.4.11 Serial Peripheral Interface Module (SPI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.12 Analog-to-Digital Converter Module (ADC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.13 Supply Voltage Sensor (BATS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.14 On-Chip Voltage Regulator system (VREG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.4.15 Gate Drive Unit (GDU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.4.16 Current Sense . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.4.17 High Voltage Physical Interface (S12ZVM32, S12ZVM16) . . . . . . . . . . . . . . . . . . . . . . 27
Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Device Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
1.6.1 Flash Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
1.6.2 Part ID Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Signal Description and Device Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.7.1 Pin Assignment Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
1.7.2 Detailed External Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
1.7.3 Power Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
1.7.4 Package and Pinouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Internal Signal Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
1.8.1 ADC Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
1.8.2 Motor Control Loop Signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.3 Device Level PMF Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.4 BDC Clock Source Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.5 LINPHY Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.6 HVPHY Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
1.8.7 FTMRZ Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1.8.8 CPMU Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
3
1.10
1.11
1.12
1.13
1.9.1 Chip Configuration Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1.9.2 Debugging Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
1.9.3 Low Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.10.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.10.2 Securing the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
1.10.3 Operation of the Secured Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
1.10.4 Unsecuring the Microcontroller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
1.10.5 Reprogramming the Security Bits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
1.10.6 Complete Memory Erase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Resets and Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
1.11.1 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
1.11.2 Interrupt Vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
1.11.3 Effects of Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Module device level dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.12.1 CPMU COP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.12.2 CPMU High Temperature Trimming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
1.12.3 Flash IFR Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
1.13.1 ADC Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
1.13.2 SCI Baud Rate Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
1.13.3 Motor Control Application Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
1.13.4 BDCM Complementary Mode Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
1.13.5 BLDC Six-Step Commutation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
1.13.6 PMSM Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
1.13.7 Power Domain Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Chapter 2
Port Integration Module (S12ZVMPIMV2)
2.1
2.2
2.3
2.4
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
2.1.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
2.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
2.3.1 Register Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
2.3.2 PIM Registers 0x0200-0x020F . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
2.3.3 PIM Generic Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
2.3.4 PIM Generic Register Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
2.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
2.4.2 Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
2.4.3 Pin I/O Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
2.4.4 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
2.4.5 Pin interrupts and Key-Wakeup (KWU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
2.4.6 Over-Current Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
MC9S12ZVM Family Reference Manual Rev. 1.5
4
Freescale Semiconductor
2.5
Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
2.5.1 Port Data and Data Direction Register writes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
2.5.2 Over-Current Protection on EVDD1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Chapter 3
Memory Mapping Control (S12ZMMCV1)
3.1
3.2
3.3
3.4
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
3.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
3.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
3.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
3.3.1 Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
3.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
3.4.1 Global Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
3.4.2 Illegal Accesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
3.4.3 Uncorrectable ECC Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Chapter 4
Interrupt (S12ZINTV0)
4.1
4.2
4.3
4.4
4.5
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
4.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
4.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
4.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
4.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
4.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
4.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.4.1 S12Z Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.4.2 Interrupt Prioritization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
4.4.3 Priority Decoder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
4.4.4 Reset Exception Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
4.4.5 Exception Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.4.6 Interrupt Vector Table Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.5.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
4.5.2 Interrupt Nesting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
4.5.3 Wake Up from Stop or Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
5
Chapter 5
Background Debug Controller (S12ZBDCV2)
5.1
5.2
5.3
5.4
5.5
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
5.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
5.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
5.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
5.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
5.4.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
5.4.2 Enabling BDC And Entering Active BDM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
5.4.3 Clock Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
5.4.4 BDC Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
5.4.5 BDC Access Of Internal Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
5.4.6 BDC Serial Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
5.4.7 Serial Interface Hardware Handshake (ACK Pulse) Protocol . . . . . . . . . . . . . . . . . . . . 175
5.4.8 Hardware Handshake Abort Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
5.4.9 Hardware Handshake Disabled (ACK Pulse Disabled) . . . . . . . . . . . . . . . . . . . . . . . . . 178
5.4.10 Single Stepping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
5.4.11 Serial Communication Timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
5.5.1 Clock Frequency Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Chapter 6
S12Z Debug (S12ZDBGV2) Module
6.1
6.2
6.3
6.4
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
6.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
6.1.2 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
6.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
6.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
6.1.5 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
6.2.1 External Event Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
6.2.2 Profiling Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
6.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
6.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
6.4.1 DBG Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
6.4.2 Comparator Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
6.4.3 Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
MC9S12ZVM Family Reference Manual Rev. 1.5
6
Freescale Semiconductor
6.5
6.4.4 State Sequence Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
6.4.5 Trace Buffer Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
6.4.6 Code Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
6.4.7 Breakpoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
6.5.1 Avoiding Unintended Breakpoint Re-triggering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
6.5.2 Debugging Through Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
6.5.3 Breakpoints from other S12Z sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
6.5.4 Code Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Chapter 7
ECC Generation Module (SRAM_ECCV1)
7.1
7.2
7.3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
7.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
7.2.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
7.2.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
7.3.1 Aligned 2 and 4 Byte Memory Write Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
7.3.2 Other Memory Write Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
7.3.3 Memory Read Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
7.3.4 Memory Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
7.3.5 Interrupt Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
7.3.6 ECC Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
7.3.7 ECC Debug Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Chapter 8
S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1
8.2
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
8.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
8.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
8.1.3 S12CPMU_UHV_V6 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.2.1 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.2.2 EXTAL and XTAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.2.3 VSUP — Regulator Power Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.2.4 VDDA, VSSA — Regulator Reference Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.2.5 VDDX, VSSX— Pad Supply Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
8.2.6 BCTL— Base Control Pin for external PNP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
8.2.7 VSS1,2 — Core Ground Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
8.2.8 VDD— Core Logic Supply Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
8.2.9 VDDF— NVM Logic Supply Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
8.2.10 API_EXTCLK — API external clock output pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
8.2.11 TEMPSENSE — Internal Temperature Sensor Output Voltage . . . . . . . . . . . . . . . . . . 254
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
7
8.3
8.4
8.5
8.6
8.7
Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
8.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
8.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
8.4.1 Phase Locked Loop with Internal Filter (PLL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
8.4.2 Startup from Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
8.4.3 Stop Mode using PLLCLK as source of the Bus Clock . . . . . . . . . . . . . . . . . . . . . . . . 297
8.4.4 Full Stop Mode using Oscillator Clock as source of the Bus Clock . . . . . . . . . . . . . . . 298
8.4.5 External Oscillator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
8.4.6 System Clock Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
8.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
8.5.2 Description of Reset Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
8.5.3 Oscillator Clock Monitor Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
8.5.4 PLL Clock Monitor Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
8.5.5 Computer Operating Properly Watchdog (COP) Reset . . . . . . . . . . . . . . . . . . . . . . . . . 303
8.5.6 Power-On Reset (POR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
8.5.7 Low-Voltage Reset (LVR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
8.6.1 Description of Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
8.7.1 General Initialization Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
8.7.2 Application information for COP and API usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
8.7.3 Application Information for PLL and Oscillator Startup . . . . . . . . . . . . . . . . . . . . . . . . 307
Chapter 9
Analog-to-Digital Converter (ADC12B_LBA_V1)
9.1
9.2
9.3
9.4
9.5
9.6
9.7
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
9.2.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
9.2.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
9.3.1 Detailed Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
9.4.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
9.4.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320
Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
9.5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
9.5.2 Analog Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
9.5.3 Digital Sub-Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
9.7.1 ADC Conversion Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
9.7.2 ADC Sequence Abort Done Interrupt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
MC9S12ZVM Family Reference Manual Rev. 1.5
8
Freescale Semiconductor
9.8
9.7.3 ADC Error and Conversion Flow Control Issue Interrupt . . . . . . . . . . . . . . . . . . . . . . . 368
Use Cases and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
9.8.1 List Usage — CSL single buffer mode and RVL single buffer mode . . . . . . . . . . . . . . 369
9.8.2 List Usage — CSL single buffer mode and RVL double buffer mode . . . . . . . . . . . . . 369
9.8.3 List Usage — CSL double buffer mode and RVL double buffer mode . . . . . . . . . . . . . 370
9.8.4 List Usage — CSL double buffer mode and RVL single buffer mode . . . . . . . . . . . . . 370
9.8.5 List Usage — CSL double buffer mode and RVL double buffer mode . . . . . . . . . . . . . 371
9.8.6 RVL swapping in RVL double buffer mode and related registers ADCIMDRI and
ADCEOLRI 371
9.8.7 Conversion flow control application information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
9.8.8 Continuous Conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
9.8.9 Triggered Conversion — Single CSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
9.8.10 Fully Timing Controlled Conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
Chapter 10
Supply Voltage Sensor - (BATSV3)
10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
10.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
10.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
10.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
10.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
10.2.1 VSUP — Voltage Supply Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
10.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
10.3.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
10.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
10.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
10.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
10.4.2 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
Chapter 11
Timer Module (TIM16B4CV3) Block Description
11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
11.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
11.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
11.1.3 Block Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
11.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
11.2.1 IOC3 - IOC0 — Input Capture and Output Compare Channel 3-0 . . . . . . . . . . . . . . . . 391
11.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
11.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
11.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
11.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
11.4.1 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
11.4.2 Input Capture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
11.4.3 Output Compare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
9
11.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
11.6 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
11.6.1 Channel [3:0] Interrupt (C[3:0]F) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
11.6.2 Timer Overflow Interrupt (TOF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
Chapter 12
Freescale’s Scalable Controller Area Network (S12MSCANV3)
12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
12.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
12.1.2 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
12.1.3 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
12.1.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
12.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
12.2.1 RXCAN — CAN Receiver Input Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
12.2.2 TXCAN — CAN Transmitter Output Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
12.2.3 CAN System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
12.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
12.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
12.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
12.3.3 Programmer’s Model of Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
12.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
12.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
12.4.2 Message Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
12.4.3 Identifier Acceptance Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
12.4.4 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
12.4.5 Low-Power Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455
12.4.6 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
12.4.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
12.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
12.5.1 MSCAN initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
12.5.2 Bus-Off Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Chapter 13
Programmable Trigger Unit (PTUV2)
13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
13.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
13.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
13.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
13.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
13.2.1 PTUT0 — PTU Trigger 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
13.2.2 PTUT1 — PTU Trigger 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
13.2.3 PTURE — PTUE Reload Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
13.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
13.3.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
MC9S12ZVM Family Reference Manual Rev. 1.5
10
Freescale Semiconductor
13.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
13.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
13.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
13.4.2 Memory based trigger event list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
13.4.3 Reload mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
13.4.4 Async reload event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
13.4.5 Interrupts and error handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
13.4.6 Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
Chapter 14
Pulse Width Modulator with Fault Protection (PMF15B6CV3)
14.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
14.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
14.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
14.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494
14.2 Signal Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
14.2.1 PWM0–PWM5 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
14.2.2 FAULT0–FAULT5 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
14.2.3 IS0–IS2 Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
14.2.4 Global Load OK Signal — glb_ldok . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
14.2.5 Commutation Event Signal — async_event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
14.2.6 Commutation Event Edge Select Signal — async_event_edge_sel[1:0] . . . . . . . . . . . 496
14.2.7 PWM Reload Event Signals — pmf_reloada,b,c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
14.2.8 PWM Reload-Is-Asynchronous Signal — pmf_reload_is_async . . . . . . . . . . . . . . . . . 496
14.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
14.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
14.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
14.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
14.4.1 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529
14.4.2 Prescaler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530
14.4.3 PWM Generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530
14.4.4 Independent or Complementary Channel Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 534
14.4.5 Deadtime Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
14.4.6 Top/Bottom Correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537
14.4.7 Asymmetric PWM Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
14.4.8 Variable Edge Placement PWM Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544
14.4.9 Double Switching PWM Output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545
14.4.10Output Polarity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547
14.4.11Software Output Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547
14.4.12PWM Generator Loading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550
14.4.13Fault Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
14.5 Resets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557
14.6 Clocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 557
14.7 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
14.8 Initialization and Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
11
14.8.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
14.8.2 BLDC 6-Step Commutation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
Chapter 15
Serial Communication Interface (S12SCIV6)
15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
15.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563
15.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564
15.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
15.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
15.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
15.2.1 TXD — Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
15.2.2 RXD — Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
15.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
15.3.1 Module Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
15.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567
15.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
15.4.1 Infrared Interface Submodule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581
15.4.2 LIN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581
15.4.3 Data Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 582
15.4.4 Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 583
15.4.5 Transmitter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 584
15.4.6 Receiver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 589
15.4.7 Single-Wire Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
15.4.8 Loop Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
15.5 Initialization/Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
15.5.1 Reset Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
15.5.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
15.5.3 Interrupt Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599
15.5.4 Recovery from Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
15.5.5 Recovery from Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
Chapter 16
Serial Peripheral Interface (S12SPIV5)
16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
16.1.1 Glossary of Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
16.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
16.1.3 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
16.1.4 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604
16.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
16.2.1 MOSI — Master Out/Slave In Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
16.2.2 MISO — Master In/Slave Out Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
16.2.3 SS — Slave Select Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
16.2.4 SCK — Serial Clock Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
MC9S12ZVM Family Reference Manual Rev. 1.5
12
Freescale Semiconductor
16.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
16.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
16.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
16.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
16.4.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616
16.4.2 Slave Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617
16.4.3 Transmission Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618
16.4.4 SPI Baud Rate Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
16.4.5 Special Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624
16.4.6 Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
16.4.7 Low Power Mode Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626
Chapter 17
Gate Drive Unit (GDUV4/V5)
17.1 Differences GDUV4 vs GDUV5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
17.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
17.2.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
17.2.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630
17.2.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632
17.3 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
17.3.1 HD — High-Side Drain Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
17.3.2 VBS[2:0] — Bootstrap Capacitor Connection Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
17.3.3 HG[2:0] — High-Side Gate Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
17.3.4 HS[2:0] — High-Side Source Pins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
17.3.5 VLS[2:0] — Voltage Supply for Low-Side Pre-Drivers . . . . . . . . . . . . . . . . . . . . . . . . 633
17.4 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
17.4.1 Register Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
17.4.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636
17.5 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
17.5.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
17.5.2 Low-Side FET Pre-Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
17.5.3 High-Side FET Pre-Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655
17.5.4 Charge Pump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658
17.5.5 Desaturation Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659
17.5.6 Phase Comparators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660
17.5.7 Fault Protection Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661
17.5.8 Current Sense Amplifier and Overcurrent Comparator . . . . . . . . . . . . . . . . . . . . . . . . . 665
17.5.9 GDU DC Link Voltage Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665
17.5.10Boost Converter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666
17.5.11Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667
17.6 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
17.6.1 FET Pre-Driver Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668
17.6.2 Calculation of Bootstrap Capacitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 669
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
13
Chapter 18
LIN/HV Physical Layer (S12LINPHYV3)
18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671
18.1.1 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672
18.1.2 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672
18.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673
18.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.2.1 LIN — LIN Bus Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.2.2 LGND — LIN Ground Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.2.3 VLINSUP — Positive Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.2.4 LPTxD — LIN Transmit Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.2.5 LPRxD — LIN Receive Pin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.3 Memory Map and Register Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
18.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677
18.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684
18.4.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684
18.4.2 Slew Rate and LIN Mode Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684
18.4.3 Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685
18.4.4 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688
18.5 Application Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691
18.5.1 Module Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691
18.5.2 Interrupt handling in Interrupt Service Routine (ISR) . . . . . . . . . . . . . . . . . . . . . . . . . . 691
Chapter 19
Flash Module (S12ZFTMRZ)
19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693
19.1.1 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694
19.1.2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 695
19.1.3 Block Diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 695
19.2 External Signal Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699
19.3 Memory Map and Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699
19.3.1 Module Memory Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 700
19.3.2 Register Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704
19.4 Functional Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724
19.4.1 Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724
19.4.2 IFR Version ID Word . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724
19.4.3 Flash Block Read Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724
19.4.4 Internal NVM resource . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725
19.4.5 Flash Command Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725
19.4.6 Allowed Simultaneous P-Flash and EEPROM Operations . . . . . . . . . . . . . . . . . . . . . . 730
19.4.7 Flash Command Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731
19.4.8 Interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 747
19.4.9 Wait Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748
MC9S12ZVM Family Reference Manual Rev. 1.5
14
Freescale Semiconductor
19.4.10Stop Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748
19.5 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748
19.5.1 Unsecuring the MCU using Backdoor Key Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 749
19.5.2 Unsecuring the MCU in Special Single Chip Mode using BDM . . . . . . . . . . . . . . . . . 749
19.5.3 Mode and Security Effects on Flash Command Availability . . . . . . . . . . . . . . . . . . . . . 750
19.6 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750
Appendix A
MCU Electrical Specifications
A.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 751
Appendix B
CPMU Electrical Specifications (VREG, OSC, IRC, PLL)
B.1 VREG Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
B.2 IRC and OSC Electrical Specifications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
B.3 Phase Locked Loop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
Appendix C
ADC Electrical Specifications
C.1 ADC Operating Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773
Appendix D
LIN/HV PHY Electrical Specifications
D.1 Static Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779
D.2 Dynamic Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780
Appendix E
GDU Electrical Specifications
E.1
E.2
GDU specifications for devices with PartID[31:15] =0x0017.. . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Preliminary GDU specifications for devices with PartID[31:15] =0x0015 . . . . . . . . . . . . . . . . . 785
Appendix F
NVM Electrical Parameters
F.1
F.2
F.3
NVM Timing Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789
NVM Reliability Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
NVM Factory Shipping Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794
Appendix G
BATS Electrical Specifications
G.1 Static Electrical Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795
G.2 Dynamic Electrical Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 796
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
15
Appendix H
SPI Electrical Specifications
H.1 Master Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797
Appendix I
MSCAN Electrical Specifications
Appendix J
Package Information
Appendix K
Ordering Information
Appendix L
Detailed Register Address Map
L.1
L.2
L.3
L.4
L.5
L.6
L.7
L.8
L.9
L.10
L.11
L.12
L.13
L.14
L.15
L.16
L.17
L.18
L.19
L.20
L.21
0x0000–0x0003 Part ID S12ZVMC, S12ZVML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813
0x0000–0x0003 Part ID S12ZVM32, S12ZVM16 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813
0x0010–0x001F S12ZINT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814
0x0070-0x00FF S12ZMMC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814
0x0100-0x017F S12ZDBG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815
0x0200-0x02FF PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819
0x0380-0x039F FTMRZ128K512 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823
0x03C0-0x03CF SRAM_ECC_32D7P. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824
0x0500-x053F PMF15B6C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825
0x0580-0x059F PTU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
0x05C0-0x05FF TIM0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831
0x0600-0x063F ADC0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833
0x0640-0x067F ADC1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835
0x06A0-0x06BF GDU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837
0x06C0-0x06DF CPMU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838
0x06F0-0x06F7 BATS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 840
0x0700-0x0707 SCI0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 841
0x0710-0x0717 SCI1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 842
0x0780-0x0787 SPI0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 842
0x0800–0x083F CAN0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 843
0x0980-0x0987 LINPHY0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 844
MC9S12ZVM Family Reference Manual Rev. 1.5
16
Freescale Semiconductor
Chapter 1
Device Overview MC9S12ZVM-Family
Table 1-1. Revision History
Version
Number
Revision
Date
Sections
Affected
1.6
03.Jan.2014
Section 1.2.2
• Removed false reference to modified clock monitor assert frequency
1.7
26.Feb.2014
Section 1.2.1
Table 1-4
Section 1.4.17
Figure 1-5
Section 1.8.6
Section 1.7.4
•
•
•
•
•
•
1.8
04.Sep.2014
Section 1.2.1
• Added S12ZVML31 information to derivative table
1.1
Description of Changes
Added S12ZVM32 and S12ZVM16 information to derivative table
Updated PartID Table
Added HVPHY feature for S12ZVM32 and S12ZVM16
Added HVPHY feature for S12ZVM32 and S12ZVM16
Added HVPHY feature for S12ZVM32 and S12ZVM16
Added 48LQFP-EP for S12ZVM32 and S12ZVM16
Introduction
The MC9S12ZVM-Family is an automotive 16-bit microcontroller family using the NVM + UHV
technology that offers the capability to integrate 40 V analog components. This family reuses many
features from the existing S12/S12X portfolio. The particular differentiating features of this family are the
enhanced S12Z core, the combination of dual-ADC synchronized with PWM generation and the
integration of “high-voltage” analog modules, including the voltage regulator (VREG), Gate Drive Unit
(GDU) and a Local Interconnect Network (LIN) physical layer. These features enable a fully integrated
single chip solution to drive up to 6 external power MOSFETs for BLDC or PMSM motor drive
applications.
The MC9S12ZVM-Family includes error correction code (ECC) on RAM and flash memory, EEPROM
for diagnostic or data storage, a fast analog-to-digital converter (ADC) and a frequency modulated phase
locked loop (IPLL) that improves the EMC performance. The MC9S12ZVM-Family delivers an
optimized solution with the integration of several key system components into a single device, optimizing
system architecture and achieving significant space savings. The MC9S12ZVM-Family delivers all the
advantages and efficiencies of a 16-bit MCU while retaining the low cost, power consumption, EMC, and
code-size efficiency advantages currently enjoyed by users of existing S12(X) families. The
MC9S12ZVM-Family is available in different pin-out options, using the 64-pin LQFP-EP and 48-pin
LQFP-EP packages to accommodate LIN, CAN and external PWM based application interfaces. In
addition to the I/O ports available in each module, further I/O ports are available with interrupt capability
allowing wake-up from stop or wait modes.
The MC9S12ZVM-Family is a general-purpose family of devices suitable for a range of applications,
including:
• 3-phase sensorless BLDC motor control for
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
17
Chapter 1 Device Overview MC9S12ZVM-Family
•
— Fuel pump
— Water pump
— Oil pump
— A/C compressor
— HVAC blower
— Engine cooling fan
— Electric vehicle battery cooling fan
Brush DC motor control requiring driving in 2 directions, along with PWM control for
— Reversible wiper
— Trunk opener
1.2
Features
This section describes the key features of the MC9S12ZVM-Family.
1.2.1
MC9S12ZVM-Family Member Comparison
Table 1-2 provides a summary of feature set differences within the MC9S12ZVM-Family. The
S12ZVML31, S12ZVM32 and S12ZVM16 devices feature GDU specification V5. The other devices in
the family feature GDU specification V4. The differences between GDU V4 and V5 is summarized in the
GDU chapter introduction. All other features are common to all MC9S12ZVM-Family members.
ZVML31, ZVM32 and ZVM16 specific information is preliminary until these devices are qualified.
Table 1-2. S12ZVM -Family Differences
ZVML31
ZVML31
(1)
(1)
32 KB
32 KB
32 KB
32 KB
32 KB
16 KB
16 KB
512
Bytes
512
Bytes
128
Bytes
128
Bytes
128
Bytes
128
Bytes
128
Bytes
128
Bytes
4 KB
4 KB
4 KB
4 KB
4 KB
4 KB
4 KB
2 KB
2 KB
64 pin
64 pin
64 pin
64 pin
64 pin
48 pin
64 pin
48 pin
64 pin
48 pin
1
–
1
–
1
1
1
–
–
–
–
CAN VREG
–
1
–
1
–
–
–
–
–
–
–
HVPHY
–
–
–
–
–
–
–
1
1
1
1
SCI(2)
2
2
2
2
2
2
2
2
2
2
2
SPI
1
1
1
1
1
1
0
1
0
1
0
ADC channels
4+5
4+5
4+5
4+5
4+5
4+5
1+3
4+5
1+3
4+5
1+3
PMF channels
6
6
6
6
6
6
6
6
6
6
6
TIM channels
4
4
4
4
4
4
3
4
3
4
3
Feature
ZVML12
ZVMC12
ZVML64
ZVMC64
ZVML32
128 KB
128 KB
64 KB
64 KB
EEPROM
512
Bytes
512
Bytes
512
Bytes
RAM
8 KB
8 KB
Package
64 pin
LINPHY
Flash
ZVM32(1) ZVM32(1) ZVM16(1) ZVM16(1)
MC9S12ZVM Family Reference Manual Rev. 1.5
18
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-2. S12ZVM -Family Differences
Feature
ZVML31
ZVML31
(1)
(1)
1
–
–
–
–
–
–
75
75
50
50
50
50
50
50
V4
V4
V4
V5
V5
V5
V5
V5
V5
Required
Required
Required
Required
Not
Required
Not
Required
Not
Required
Not
Required
Not
Required
Not
Required
Standard
Standard
Standard
Standard
Lite
Lite
Lite
Lite
Lite
Lite
ZVML12
ZVMC12
ZVML64
ZVMC64
ZVML32
MSCAN(3)
1
1
1
1
External FET
Nominal Gate
Charge (nC)
75
75
75
GDU version
V4
V4
GDU external
bootstrap
diode
Required
DBG version
Standard
ZVM32(1) ZVM32(1) ZVM16(1) ZVM16(1)
1. Information relating to these derivatives is preliminary.
2. Options featuring a single SCI include the SCI1 instantiation.
3. External CAN physical interface required.
1.2.2
Functional Differences Between N06E and 0N95G Masksets
NOTE
N95G also includes bug fixes that are not listed here because they do not
constitute specification changes. Please refer to the Mask Set Errata
documents for details.
•
•
•
•
Device Level
— Changed BDC fast clock source from core clock to bus clock
— Added exposed pad electrical connection to die VSS.
— Device level current injection immunity improved
— GDU register address range changed
— Removed mapping of VRL to PAD7
— Added ADC reference voltages to IFR
— Increased over voltage detect thresholds to allow operating range up to 26.5V
GDU
— Added status flags for overvoltage on HD pin and low voltage on VLS
— Blanking time: start internal blanking time generator with HGx/LGx instead of PWM signal
— Added over current shutdown feature
— Added low pass filter to desaturation comparators
SCI V6 replaces V5
— Enhanced baud rate options
LINPHY
— Direct Power Injection (DPI) robustness improvements
— TX dominant timeout feature
— Internal pull-up adjusted to stay in 27KOhm to 40KOhm range
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
19
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
•
•
1.2.3
•
1.3
OSC, CPMU:
— Added full swing Pierce mode
— Added a configuration bit OMRE (Oscillator Monitor Reset Enable) that will enable the
Monitor Reset. By default, clock monitor reset disabled (OMRE=0).
PTU:
— Allow swapping the trigger list at every reload event with load_ok active
— Made the TG0LIST and TG1LIST writable if the associated TG0/TG1 is disabled
— Allow SW to clear the PTULDOK bit when the PTU is disabled
FTMRZ:
— Added wait state configuration option bits for bus accesses
— Removed interdependency of DFDF and SFDIF bits
— Changed FTMRZ behavior when forbidden simultaneous P-flash/D-flash operations occur
DBG:
— Added register access restrictions when DBG is disarmed but a profiling transmission is still
active
— Added a register bit to indicate that the profiling transmission is still active
BDC
— Improved handling of attempted internal accesses during STOP mode
Functional Differences Between 1N95G and 0N95G Masksets
GDU version changed from V2 to V4
— Added low side driver shutdown flexibility in overvoltage case
– Switched off if overvoltage condition and GOCA1=1
– Switched on if overvoltage condition and GOCA1=0
— Changed time constant of HD overvoltage monitor to improve noise filtering
Chip-Level Features
On-chip modules available within the family include the following features:
• S12Z CPU core
• 128, 64, 32 or 16KB on-chip flash with ECC
• 512 or128 byte EEPROM with ECC
• 8, 4 or 2 KB on-chip SRAM with ECC
• Phase locked loop (IPLL) frequency multiplier with internal filter
• 1 MHz internal RC oscillator with +/-1.3% accuracy over rated temperature range
• 4-20MHz amplitude controlled pierce oscillator
• Internal COP (watchdog) module
• 6-channel, 15-bit pulse width modulator with fault protection (PMF)
MC9S12ZVM Family Reference Manual Rev. 1.5
20
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
1.4
Low side and high side FET pre-drivers for each phase
— Gate drive pre-regulator
— LDO (Low Dropout Voltage Regulator) (typically 11V)
— High side gate supply generated using bootstrap circuit with external diode and capacitor
— Sustaining charge pump with two external capacitors and diodes
— High side drain (HD) monitoring on internal ADC channel using HD/5 voltage
Two parallel analog-to-digital converters (ADC) with 12-bit resolution and up to 9 channels
available on external pins
Programmable Trigger Unit (PTU) for synchronization of PMF and ADC
One serial peripheral interface (SPI) module
One serial communication interface (SCI) module with interface to internal LIN physical layer
transceiver (with RX connected to a timer channel for frequency calibration purposes, if desired)
Up to one additional SCI (not connected to LIN physical layer)
On-chip LIN physical layer transceiver fully compliant with the LIN 2.2 standard
(S12ZVML versions)
One High Voltage physical interface. (S12ZVM32, S12ZVM16 versions only)
4-channel timer module (TIM) with input capture/output compare
MSCAN (1 Mbit/s, CAN 2.0 A, B software compatible) module
On-chip voltage regulator (VREG) for regulation of input supply and all internal voltages
— Optional VREG ballast control output to supply an external CAN physical layer
Two current sense circuits for overcurrent detection or torque measurement
Autonomous periodic interrupt (API)
20mA high-current output for use as Hall sensor supply
Supply voltage sense with low battery warning
Chip temperature sensor
Module Features
The following sections provide more details of the integrated modules.
1.4.1
S12Z Central Processor Unit (CPU)
The S12Z CPU is a revolutionary high-speed core, with code size and execution efficiencies over the S12X
CPU. The S12Z CPU also provides a linear memory map eliminating the inconvenience and performance
impact of page swapping.
• Harvard Architecture - parallel data and code access
• 3 stage pipeline
• 32-Bit wide instruction and databus
• 32-Bit ALU
• 24-bit addressing, of 16MB linear address space
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
21
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
•
Instructions and Addressing modes optimized for C-Programming & Compiler
Optimized address path so it is able to run without Flash wait states
— MAC unit 32bit += 32bit*32bit
— Hardware divider
— Single cycle multi-bit shifts (Barrel shifter)
— Special instructions for fixed point math
Unimplemented opcode traps
Unprogrammed byte value (0xFF) defaults to SWI instruction
1.4.1.1
•
Background debug controller (BDC) with single-wire interface
— Non-intrusive memory access commands
— Supports in-circuit programming of on-chip nonvolatile memory
1.4.1.2
•
•
•
•
Debugger (DBG)
S12ZVML31, S12ZVM32, S12ZVM16 feature subset listed in Section 6.1
Enhanced DBG module including:
— Four comparators (A, B, C and D) each configurable to monitor PC addresses or addresses of
data accesses
— A and C compare full address bus and full 32-bit data bus with data bus mask register
— B and D compare full address bus only
— Three modes: simple address/data match, inside address range, or outside address range
— Tag-type or force-type hardware breakpoint requests
State sequencer control
64 x 64-bit circular trace buffer to capture change-of-flow addresses or address and data of every
access
— Begin, End and Mid alignment of tracing to trigger
Profiling mode for external visibility of internal program flow
1.4.2
Embedded Memory
1.4.2.1
•
•
Background Debug Controller (BDC)
Memory Access Integrity
Illegal address detection
ECC support on embedded NVM and system RAM
1.4.2.2
Flash
On-chip flash memory on the MC9S12ZVM-family on the features the following:
• Up to128 KB of program flash memory
MC9S12ZVM Family Reference Manual Rev. 1.5
22
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
— 32 data bits plus 7 syndrome ECC (error correction code) bits allow single bit fault correction
and double fault detection
— Erase sector size 512 bytes
— Automated program and erase algorithm
— User margin level setting for reads
— Protection scheme to prevent accidental program or erase
1.4.2.3
•
Up to 512 bytes EEPROM
— 16 data bits plus 6 syndrome ECC (error correction code) bits allow single bit error correction
and double fault detection
— Erase sector size 4 bytes
— Automated program and erase algorithm
— User margin level setting for reads
1.4.2.4
•
1.4.3
•
•
•
•
•
•
EEPROM
SRAM
Up to 8 KB of general-purpose RAM with ECC
— Single bit error correction and double bit error detection
Clocks, Reset & Power Management Unit (CPMU)
Real time interrupt (RTI)
Clock monitor, supervising the correct function of the oscillator (CM)
Computer operating properly (COP) watchdog
— Configurable as window COP for enhanced failure detection
— Can be initialized out of reset using option bits located in flash memory
System reset generation
Autonomous periodic interrupt (API) (combination with cyclic, watchdog)
Low Power Operation
— RUN mode is the main full perform
— ance operating mode with the entire device clocked.
— WAIT mode when the internal CPU clock is switched off, so the CPU does not execute
instructions.
— Pseudo STOP - system clocks are stopped but the oscillator the RTI, the COP, and API modules
can be enabled
— STOP - the oscillator is stopped in this mode, all clocks are switched off and all counters and
dividers remain frozen, with the exception of the COP and API which can optionally run from
ACLK.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
23
Chapter 1 Device Overview MC9S12ZVM-Family
1.4.3.1
•
Phase-locked-loop clock frequency multiplier
— No external components required
— Reference divider and multiplier allow large variety of clock rates
— Automatic bandwidth control mode for low-jitter operation
— Automatic frequency lock detector
— Configurable option to spread spectrum for reduced EMC radiation (frequency modulation)
— Reference clock sources:
– Internal 1 MHz RC oscillator (IRC)
– External 4-20 MHz crystal oscillator/resonator
1.4.3.2
•
1.4.4
•
1.4.5
•
•
1.4.6
•
•
•
•
•
•
Internal Phase-Locked Loop (IPLL)
Internal RC Oscillator (IRC)
Trimmable internal 1MHz reference clock.
— Trimmed accuracy over -40°C to 150°C junction temperature range: ±1.3%max.
Main External Oscillator (XOSCLCP)
Amplitude controlled Pierce oscillator using 4 MHz to 20 MHz crystal
— Current gain control on amplitude output
— Signal with low harmonic distortion
— Low power
— Good noise immunity
— Eliminates need for external current limiting resistor
— Trans conductance sized for optimum start-up margin for typical crystals
— Oscillator pins shared with GPIO functionality
Timer (TIM)
4 x 16-bit channels Timer module for input capture or output compare
16-bit free-running counter with 8-bit precision prescaler
Pulse width Modulator with Fault protection (PMF)
6 x 15-bit channel PWM resolution
Each pair of channels can be combined to generate a PWM signal (with independent control of
edges of PWM signal)
Dead time insertion available for each complementary pair
Center-aligned or edge-aligned outputs
Programmable clock select logic with a wide range of frequencies
Programmable fault detection
MC9S12ZVM Family Reference Manual Rev. 1.5
24
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.4.7
•
•
•
•
•
Programmable Trigger Unit (PTU)
Enables synchronization between PMF and ADC
2 trigger input sources and software trigger source
2 trigger outputs
One 16-bit delay register pre-trigger output
Operation in One-Shot or Continuous modes
1.4.8
•
•
•
•
•
•
•
•
•
•
LIN physical layer transceiver
Compliant with LIN Physical Layer 2.2 specification.
Compliant with the SAE J2602-2 LIN standard.
Standby mode with glitch-filtered wake-up.
Slew rate selection optimized for the baud rates: 10.4kBit/s, 20kBit/s and Fast Mode (up to
250kBit/s).
Switchable 34kΩ/330kΩ pull-ups (in shutdown mode, 330kΩ only)
Current limitation for LIN Bus pin falling edge.
Over-current protection.
LIN TxD-dominant timeout feature monitoring the LPTxD signal.
Automatic transmitter shutdown in case of an over-current or TxD-dominant timeout.
Fulfills the OEM “Hardware Requirements for LIN (CAN and FlexRay) Interfaces in Automotive
Applications” v1.3.
1.4.9
•
•
•
•
•
•
•
•
Serial Communication Interface Module (SCI)
Full-duplex or single-wire operation
Standard mark/space non-return-to-zero (NRZ) format
Selectable IrDA 1.4 return-to-zero-inverted (RZI) format with programmable pulse widths
16-bit baud rate selection
Programmable character length
Programmable polarity for transmitter and receiver
Active edge receive wakeup
Break detect and transmit collision detect supporting LIN
1.4.10
•
•
•
•
Multi-Scalable Controller Area Network (MSCAN)
Implementation of the CAN protocol — Version 2.0A/B
Five receive buffers with FIFO storage scheme
Three transmit buffers with internal prioritization using a “local priority” concept
Flexible maskable identifier filter supports two full-size (32-bit) extended identifier filters, or four
16-bit filters, or either 8-bit filters
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
25
Chapter 1 Device Overview MC9S12ZVM-Family
•
Programmable wake-up functionality with integrated low-pass filter
1.4.11
•
•
•
•
•
•
Configurable 8- or 16-bit data size
Full-duplex or single-wire bidirectional
Double-buffered transmit and receive
Master or slave mode
MSB-first or LSB-first shifting
Serial clock phase and polarity options
1.4.12
•
•
•
•
Supply Voltage Sensor (BATS)
Monitoring of supply (VSUP) voltage
Internal ADC interface from an internal resistive divider
Generation of low or high voltage interrupts
1.4.14
•
Analog-to-Digital Converter Module (ADC)
Dual ADC
— 12-bit resolution
— Up to 9 external channels & 8 internal channels
— 2.5us for single 12-bit resolution conversion
— Left or right aligned result data
— Continuous conversion mode
Programmers model with list based command and result storage architecture
ADC directly writes results to RAM, preventing stall of further conversions
Internal signals monitored with the ADC module
— VRH, VRL, (VRL+VRH)/2, Vsup monitor, Vbg, TempSense, GDU phase, GDU DC-link
External pins can also be used as digital I/O
1.4.13
•
•
•
Serial Peripheral Interface Module (SPI)
On-Chip Voltage Regulator system (VREG)
Voltage regulator
— Linear voltage regulator directly supplied by VSUP
— Low-voltage detect on VSUP
— Power-on reset (POR)
— Low-voltage reset (LVR) for VDDX domain
— External ballast device support to reduce internal power dissipation
— Capable of supplying both the MCU internally plus external components
— Over-temperature interrupt
MC9S12ZVM Family Reference Manual Rev. 1.5
26
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
Internal voltage regulator
— Linear voltage regulator with bandgap reference
— Low-voltage detect on VDDA
— Power-on reset (POR) circuit
— Low-voltage reset for VDD domain
Package option for VREG ballast control output to supply external CANPHY
1.4.15
•
•
•
•
•
•
•
•
•
Low side and high side FET pre-drivers for each phase
Gate drive pre-regulator LDO (Low Dropout Voltage Regulator)
High side gate supply done via bootstrap circuit
External bootstrap diode replaced by internal circuit (GDUV5 only)
Sustaining charge pump with two external capacitors and diodes
Optional boost converter configuration with voltage feedback
FET-Predriver desaturation and error recognition
Monitoring of FET High Side drain (HD) voltage
Diagnostic failure management
1.4.16
•
Current Sense
2 channel, integrated op-amp functionality
1.4.17
•
•
•
•
•
•
•
•
Gate Drive Unit (GDU)
High Voltage Physical Interface (S12ZVM32, S12ZVM16)
Single pin high voltage interface signal operating in the VSUP voltage range
Internal interface mapped to internal timer channel.
Compliant with the ISO9141 (K-line) standard.
Standby mode with glitch-filtered wake-up.
Slew rate selection optimized for: 5.2 kHz, 10 kHz and Fast Mode (up to 125 kHz).
Switchable 34 kΩ/330 kΩ pullup resistors (in shutdown mode, 330 kΩ only).
Current limitation for LIN Bus pin falling edge.
Overcurrent protection.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
27
Chapter 1 Device Overview MC9S12ZVM-Family
Block Diagram
ADC0
AN0_[4:0]
12-bit
VRH
Analog-Digital Converter VRL
512 bytes EEPROM with ECC
Current Sense Circuits
VDD
VSS2
VDDF
VSS1
VDDX1/VDDX2
VSUP
BCTL
VDDC
BCTLC
Voltage Regulator
(Nominal 12V)
CAN VREG
BATS
Voltage Supply Monitor
S12ZCPU
Interrupt Module
PE0
PE1
PTE
BKGD
RESET
TEST
DBG
Debug Module
4 Comparators
Trace Buffer
AMPP1
AMPM1
AMP1
HD
CP
VCP
VLS_OUT
BST
VSSB
VBS[2:0]
HG[2:0]
HS[2:0]
VLS[2:0]
LG[2:0]
LS[2:0]
PMF
15-bit 6 channel
Pulse Width Modulator
PWM0
PWM1
PWM2
PWM3
PWM4
PWM5
IOC0_0
TIM
16-bit 4-Channel Timer IOC0_1
Clock Monitor
EXTAL
IOC0_2
COP Watchdog
Low Power Pierce
IOC0_3
Real Time Interrupt
Oscillator
XTAL
PTURE
Auton. Periodic Int. PTU
Programmable Trigger PTUT0
PLL with Frequency
PTUT1
Modulation option Internal RC Oscillator Unit
BDC
Background
Debug Controller
Reset Generation
and Test Entry
LINPHY0 (S12ZVML versions only)
OR
HV Physical Interface
LIN0
LGND
GDU
Gate Drive Unit
LIN0
LGND
PTAD / KWAD
AMPP0
AMPM0
AMP0
2K, 4K, 8KB RAM with ECC
PAD[8:5]
RXD1
SCI1
Asynchronous Serial IF TXD1
RXD0
SCI0
Asynchronous Serial IF TXD0
RXCAN0
CAN0
TXCAN0
msCAN 2.0B
MISO0
SPI0
MOSI0
SCK0
Synchronous Serial IF
SS0
HD
CP
VCP
VLS_OUT
BST
VSSB
VBS[2:0]
HG[2:0]
HS[2:0]
VLS[2:0]
LG[2:0]
LS[2:0]
PTP / KWP
32K, 64K, 128KB Flash with ECC
ADC1
AN1_[3:0]
12-bit
VRH
Analog-Digital Converter VRL
PAD[4:0]
PP0
PP1
PP2
PTT
5V Analog Supply
VDDA/VSSA
PT0
PT1
PT2
PT3
PTS / KWS
1.5
PS0
PS1
PS2
PS3
PS4
PS5
Block Diagram shows the maximum configuration
Not all pins or all peripherals are available on all devices and packages.
Rerouting options are not shown.
Figure 1-1. MC9S12ZVM-Family Block Diagram
MC9S12ZVM Family Reference Manual Rev. 1.5
28
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.6
Device Memory Map
Table 1-3 shows the device register memory map. All modules that can be instantiated more than once on
S12 devices are listed with an index number, even if they are only instantiated once on this device family.
Table 1-3. Module Register Address Ranges
Address
Module
Size
(Bytes)
0x0000–0x0003
Part ID Register Section 1.6.2
4
0x0004–0x000F
Reserved
12
0x0010–0x001F
INT
16
0x0020–0x006F
Reserved
80
0x0070–0x008F
MMC
32
0x0090–0x00FF
MMC Reserved
112
0x0100–0x017F
DBG
128
0x0180–0x01FF
Reserved
128
0x0200–0x02FF
PIM
256
0x0300–0x037F
Reserved
128
0x0380–0x039F
FTMRZ
32
0x03A0–0x03BF
Reserved
32
0x03C0–0x03CF
RAM ECC
16
0x03D0–0x04FF
Reserved
304
0x0500–0x053F
PMF
64
0x0540–0x057F
Reserved
64
0x0580–0x059F
PTU
32
0x05A0–0x05BF
Reserved
32
0x05C0–0x05EF
TIM0
48
0x05F0–0x05FF
Reserved
16
0x0600–0x063F
ADC0
64
0x0640–0x067F
ADC1
64
0x0680–0x069F
Reserved
32
(1)0x06A0–0x06BF
GDU
32
0x06C0–0x06DF
CPMU
32
0x06E0–0x06EF
Reserved
16
0x06F0–0x06F7
BATS
8
0x06F8–0x06FF
Reserved
8
0x0700–0x0707
SCI0
8
0x0708–0x070F
Reserved
8
0x0710–0x0717
SCI1
8
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
29
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-3. Module Register Address Ranges
Address
Module
Size
(Bytes)
0x0718–0x077F
Reserved
104
0x0780–0x0787
SPI0
8
0x0788–0x07FF
Reserved
120
0x0800–0x083F
CAN0
64
0x0840–0x097F
Reserved
320
0x0980–0x0987
LINPHY (S12ZVML derivatives)
8
0x0980–0x0987
HV Physical Interface
(S12ZVM32, S12ZVM16 derivatives)
8
0x0988–0x0FFF
Reserved
1656
1. Address range = 0x0690-0x069F on Maskset N06E
NOTE
Reserved register space shown above is not allocated to any module. This
register space is reserved for future use. Writing to these locations has no
effect. Read access to these locations returns zero.
1.6.1
Flash Module
This device family instantiates different flash modules, depending on derivative. The flash documentation
for the all devices is featured in the FTMRZ section.
MC9S12ZVM Family Reference Manual Rev. 1.5
30
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Register Space
0x00_0000
0x00_1000
4 KB
RAM
max. 1 MByte - 4 KB
0x10_0000
EEPROM
max. 1 MByte - 48 KB
Reserved
Reserved (read only)
NVM IFR
512 Byte
0x1F_4000
6 KB
0x1F_8000
256 Byte
0x1F_C000
0x20_0000
Unmapped
6 MByte
0x80_0000
Program NVM
max. 8 MB
Unmapped
address range
Low address aligned
High address aligned
0xFF_FFFF
Figure 1-2. MC9S12ZVM-Family Global Memory Map. (See Table 1-2 for individual device details)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
31
Chapter 1 Device Overview MC9S12ZVM-Family
1.6.2
Part ID Assignments
The part ID is located in four 8-bit registers at addresses 0x0000-0x0003. The read-only value is a unique
part ID for each revision of the chip. Table 1-4 shows the assigned part ID number and mask set number.
Table 1-4. Assigned Part ID Numbers
1.7
Device
Mask Set Number
Part ID
Option
MC9S12ZVML12
N06E
0x00170000
LIN
MC9S12ZVMC12
N06E
0x00170001
CAN-VREG
MC9S12ZVML12
0N95G
0x00172000
LIN
MC9S12ZVMC12
0N95G
0x00172001
CAN-VREG
MC9S12ZVML12
1N95G
0x00172100
LIN
MC9S12ZVML64
1N95G
0x00172100
LIN
MC9S12ZVML32
1N95G
0x00172100
LIN
MC9S12ZVMC12
1N95G
0x00172101
CAN-VREG
MC9S12ZVMC64
1N95G
0x00172101
CAN-VREG
MC9S12ZVML31
0N14N
0x00150000
LIN
MC9S12ZVM32
0N14N
0x00150000
HV Physical Interface
MC9S12ZVM16
0N14N
0x00150000
HV Physical Interface
Signal Description and Device Pinouts
This section describes signals that connect off-chip. It includes pin out diagrams a table of signal
properties, and detailed discussion of signals. Internal inter module signal mapping at device level is
described in 1.8 Internal Signal Mapping.
1.7.1
Pin Assignment Overview
Table 1-5 provides a summary of which ports are available.
Table 1-5. Port Availability by Option
Port
64 LQFP
Port AD
PAD[8:0]
Port E
PE[1:0]
Port P
PP[2:0]
Port S
PS[5:0]
Port T
PT[3:0]
sum of ports
24
MC9S12ZVM Family Reference Manual Rev. 1.5
32
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
NOTE
To avoid current drawn from floating inputs, all non-bonded pins should be
configured as output or configured as input with a pull up or pull down
device enabled
1.7.2
Detailed External Signal Descriptions
This section describes the properties of signals available at device pins. Signal names associated with
modules that can be instantiated more than once on an S12 are indexed, even if the module is only
instantiated once on the MC9S12ZVM-Family. If a signal already includes a channel number, then the index
is inserted before the channel number. Thus ANx_y corresponds to AN instance x, channel number y.
1.7.2.1
RESET — External Reset Signal
The RESET signal is an active low bidirectional control signal. It acts as an input to initialize the MCU to
a known start-up state, and an output when an internal MCU function causes a reset. The RESET pin has
an internal pull-up device.
1.7.2.2
TEST — Test Pin
This input only pin is reserved for factory test. This pin has an internal pull-down device.
NOTE
The TEST pin must be tied to ground in all applications.
1.7.2.3
MODC — Mode C Signal
The MODC signal is used as an MCU operating mode select during reset. The state of this signal is latched
to the MODC bit at the rising edge of RESET. The signal has an internal pull-up device.
1.7.2.4
PAD[8:0] / KWAD[8:0] — Port AD, Input Pins of ADC
PAD[8:0] are general-purpose input or output signals. The signals can be configured on per signal basis as
interrupt inputs with wake-up capability (KWAD[8:0]). These signals can have a pull-up or pull-down
device selected and enabled on per signal basis. During and out of reset the pull devices are disabled.
1.7.2.5
PE[1:0] — Port E I/O Signals
PE[1:0] are general-purpose input or output signals. The signals can have a pull-down device, enabled by
on a per pin basis. Out of reset the pull-down devices are enabled.
1.7.2.6
PP[2:0] / KWP[2:0] — Port P I/O Signals
PP[2:0] are general-purpose input or output signals. The signals can be configured on per signal basis as
interrupt inputs with wake-up capability (KWP[2:0]). They can have a pull-up or pull-down device
selected and enabled on per signal basis. During and out of reset the pull devices are disabled.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
33
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.7
PS[5:0] / KWS[5:0] — Port S I/O Signals
PS[5:0] are general-purpose input or output signals. The signals can be configured on per signal basis as
interrupt inputs with wake-up capability (KWS[5:0]). They can have a pull-up or pull-down device
selected and enabled on per signal basis. During and out of reset the pull-up devices are enabled.
1.7.2.8
PT[3:0] — Port T I/O Signals
PT[3:0] are general-purpose input or output signals. They can have a pull-up or pull-down device selected
and enabled on per signal basis. During and out of reset the pull devices are disabled.
1.7.2.9
AN0_[4:0], AN1_[3:0]— ADC Input Signals
These are the analog inputs of the Analog-to-Digital Converters. ADC0 has 5 analog input channels
connected to PAD port pins. ADC1 has 4 analog input channels connected to PAD port pins.
1.7.2.10
VRH, VRL — ADC Reference Signals
VRH and VRL are the reference voltage input pins for the analog-to-digital converter.
1.7.2.11
SPI0 Signals
1.7.2.11.1
SS0 Signal
This signal is associated with the slave select SS functionality of the serial peripheral interface SPI0.
1.7.2.11.2
SCK0 Signal
This signal is associated with the serial clock SCK functionality of the serial peripheral interface SPI0.
1.7.2.11.3
MISO0 Signal
This signal is associated with the MISO functionality of the serial peripheral interface SPI0. This signal
acts as master input during master mode or as slave output during slave mode.
1.7.2.11.4
MOSI0 Signal
This signal is associated with the MOSI functionality of the serial peripheral interface SPI0. This signal
acts as master output during master mode or as slave input during slave mode
1.7.2.12
1.7.2.12.1
SCI[1:0] Signals
RXD[1:0] Signals
These signals are associated with the receive functionality of the serial communication interfaces
(SCI[1:0]).
MC9S12ZVM Family Reference Manual Rev. 1.5
34
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.12.2
TXD[1:0] Signals
These signals are associated with the transmit functionality of the serial communication interfaces
(SCI[1:0]).
1.7.2.13
1.7.2.13.1
CAN0 Signals
RXCAN0 Signal
This signal is associated with the receive functionality of the scalable controller area network controller
(MSCAN0).
1.7.2.13.2
TXCAN0 Signal
This signal is associated with the transmit functionality of the scalable controller area network controller
(MSCAN0).
1.7.2.14
Timer IOC0_[3:0] Signals
The signals IOC0_[3:0] are associated with the input capture or output compare functionality of the timer
(TIM0) module.
1.7.2.15
PWM[5:0] Signals
The signals PWM[5:0] are associated with the PMF module digital channel outputs.
1.7.2.16
1.7.2.16.1
PTU Signals
PTUT[1:0] Signals
These signals are the PTU trigger output signals. These signals are routed to pins for debugging purposes.
1.7.2.16.2
PTURE Signal
This signal is the PTU reload enable output signal. This signal is routed to a pin for debugging purposes.
1.7.2.17
Interrupt Signals — IRQ and XIRQ
IRQ is a maskable level or falling edge sensitive input. XIRQ is a non-maskable level-sensitive interrupt.
1.7.2.18
1.7.2.18.1
Oscillator and Clock Signals
Oscillator Pins — EXTAL and XTAL
EXTAL and XTAL are the crystal driver and external clock pins. On reset all the device clocks are derived
from the internal PLLCLK, independent of EXTAL and XTAL. XTAL is the oscillator output.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
35
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.18.2
ECLK
This signal is associated with the output of the bus clock (ECLK).
NOTE
This feature is only intended for debug purposes at room temperature.
It must not be used for clocking external devices in an application.
1.7.2.19
1.7.2.19.1
BDC and Debug Signals
BKGD — Background Debug signal
The BKGD signal is used as a pseudo-open-drain signal for the background debug communication. The
BKGD signal has an internal pull-up device.
1.7.2.19.2
PDO — Profiling Data Output
This is the profiling data output signal used when the DBG module profiling feature is enabled. This signal
is output only and provides a serial, encoded data stream that can be used by external development tools
to reconstruct the internal CPU code flow.
1.7.2.19.3
PDOCLK — Profiling Data Output Clock
This is the PDO clock signal used when the DBG module profiling feature is enabled. This signal is output
only. During code profiling this is the clock signal that can be used by external development tools to
sample the PDO signal.
1.7.2.19.4
DBGEEV — External Event Input
This signal is the DBG external event input. It is input only. Within the DBG module, it allows an external
event to force a state sequencer transition, or trace buffer entry, or to gate trace buffer entries. A falling
edge at the external event signal constitutes an event. Rising edges have no effect. The maximum
frequency of events is half the internal core bus frequency.
1.7.2.20
FAULT5 — External Fault Input
This is the PMF fault input signal, with configurable polarity, that can be used to disable PMF operation
when asserted. Asynchronous shutdown of the GDU outputs HG[2:0] and LG[2:0] is not supported. Select
QSMPm[1:0] > 0 in PMF.
1.7.2.21
1.7.2.21.1
LIN Physical Layer Signals
LIN0
On S12ZVML derivatives this pad is connected to the single-wire LIN data bus.
On the S12ZVM32 and S12ZVM16 derivatives this is a single pin bidirectional high voltage physical
interface. It operates in the VSUP voltage range. It can be connected to an external single-wire data bus.
MC9S12ZVM Family Reference Manual Rev. 1.5
36
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.21.2
LP0TXD
This is the LIN physical layer (or HV physical interface) transmitter input signal.
1.7.2.21.3
LP0RXD
This is the LIN physical layer (or HV physical interface) receiver output signal.
1.7.2.21.4
LP0DR1
This is the LIN (or HV physical interface) LP0DR1 register bit, visible at the designated pin for debug
purposes.
1.7.2.22
Gate Drive Unit (GDU) Signals
These are associated with driving the external FETs.
1.7.2.22.1
HD — FET predriver High side Drain Input
This is the drain connection of the external high-side FETs. The voltage present at this input is scaled down
by an internal voltage divider, and can be routed to the internal ADC via an analog multiplexer.
This is also used as the LINPHY supply, VLINSUP.
1.7.2.22.2
VBS[2:0] - Bootstrap Capacitor Connections
These signals are the bootstrap capacitor connections for phases HS[2:0]. The capacitor connected
between HS[2:0] and these signals provides the gate voltage and current to drive the external FET.
1.7.2.22.3
HG[2:0] - High-Side Gate signals
The pins are the gate drives for the three high-side power FETs. The drivers provide a high current with
low impedance to turn on and off the high-side power FETs.
1.7.2.22.4
HS[2:0] - High-Side Source signals
The pins are the source connection for the high-side power FETs and the drain connection for the low-side
power FETs. The low voltage end of the bootstrap capacitor is also connected to this pin.
1.7.2.22.5
VLS[2:0] - Voltage Supply for Low -Side Drivers
The pins are the voltage supply pins for the three low-side FET pre-drivers. This pins should be connected
to the voltage regulator output pin VLS_OUT.
1.7.2.22.6
LG[2:0] - Low-Side Gate signals
The pins are the gate drives for the low-side power FETs. The drivers provide a high current with low
impedance to turn on and off the low-side power FETs.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
37
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.22.7
LS[2:0] - Low-Side Source signals
The pins are the low-side source connections for the low-side power FETs. The pins are the power ground
pins used to return the gate currents from the low-side power FETs.
1.7.2.22.8
CP - Charge Pump Output signal
This pin is the switching node of the charge pump circuit. The supply voltage for charge pump driver is
the output of the voltage regulator VLS_OUT. The output voltage of this pin switches typically between
0V and 11V. Must be left unconnected if not used.
1.7.2.22.9
VCP - Charge Pump Input for High-Side Driver Supply
This is the charge pump input for the FET high-side gate drive supply circuit. The pin must be left
unconnected if not used.
1.7.2.22.10
BST - Boost signal
This pin provides the basic switching elements required to implement a boost converter for low battery
voltage conditions. This requires external diodes, capacitors and a coil. This pin must be left unconnected
if not used.
1.7.2.22.11
VSSB - Boost Ground signal
This pin is a separate ground pin for the on chip boost converter switching device.
1.7.2.22.12
VLS_OUT - 11V Voltage Regulator Output
This pin is the output of the integrated voltage regulator. The output voltage is typically VVLS=11V. The
input voltage to the voltage regulator is the VSUP pin.
1.7.2.22.13
AMPP[1:0] - Current Sense Amplifier Non-Inverting Input
These are the current sense amplifier non-inverting inputs.
1.7.2.22.14
AMPM[1:0] - Current Sense Amplifier Inverting Input
These are the current sense amplifier inverting inputs.
1.7.2.22.15
AMP[1:0] - Current Sense Amplifier Output
These are the current sense amplifier outputs.
1.7.2.23
CAN Physical Interface Support
The MCU can supply an external CAN physical interface device directly, thus removing the need for an
external voltage regulator.
MC9S12ZVM Family Reference Manual Rev. 1.5
38
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.2.23.1
BCTLC
BCTLC provides the base current of an external bipolar that supplies an external CAN physical interface.
This signal is only available on S12ZVMC versions.
1.7.2.23.2
VDDC
VDDC is the CANPHY supply. This is the output voltage of the external bipolar, fed back to the MCU.
This signal is only available on S12ZVMC versions.
1.7.2.24
High Current Output — EVDD1
This is a high current, low voltage drop output intended for supplying external devices in a range of up to
20mA. Configuring the pin direction as output automatically enables the high current capability.
1.7.2.25
BCTL
BCTL is the ballast connection for the on chip voltage regulator. It provides the base current of an external
bipolar for the VDDX and VDDA supplies.
1.7.3
Power Supply Pins
The power and ground pins are described below. Because fast signal transitions place high, short-duration
current demands on the power supply, use bypass capacitors with high-frequency characteristics and place
them as close to the MCU as possible.
NOTE
All ground pins must be connected together in the application.
1.7.3.1
VDDX1, VDDX2, VSSX1 — Digital I/O Power and Ground Pins
VDDX1, VDDX2 are voltage regulator outputs to supply the digital I/O drivers.
The VSSX1 pin is the ground pin for the digital I/O drivers.
Bypass requirements on VDDX2, VDDX1, VSSX1 depend on how heavily the MCU pins are loaded.
1.7.3.2
VDDA, VSSA — Power Supply Pins for ADC
These are the power supply and ground pins for the analog-to-digital converter and the voltage regulator.
1.7.3.3
VDD, VSS2 — Core Power and Ground Pin
The VDD voltage supply of nominally 1.8V is generated by the internal voltage regulator. The return
current path is through the VSS2 pin.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
39
Chapter 1 Device Overview MC9S12ZVM-Family
1.7.3.4
VDDF, VSS1 — NVM Power and Ground Pin
The VDDF voltage supply of nominally 2.8V is generated by the internal voltage regulator. The return
current path is through the VSS1 pin.
1.7.3.5
LGND — LINPHY Ground Pin
On S12ZVM(L) parts LGND is the ground pin for the LIN physical layer LINPHY. This signal must be
connected to board ground, even if the LINPHY is not used.
On S12ZVM32 and S12ZVM16 parts this the ground pin for the HV physical interface. It must be
connected to board ground even when the HV physical interface is not used.
1.7.3.6
VSUP — Voltage Supply Pin for Voltage Regulator
VSUP is the main supply pin typically coming from the car battery/alternator in the 12V supply voltage
range. This is the voltage supply input from which the voltage regulator generates the on chip voltage
supplies. It must be protected externally against a reverse battery connection.
1.7.4
Package and Pinouts
The following package options are offered.
• 64LQFP-EP (exposed pad) with internal LIN PHY or HV physical interface.
• 64LQFP-EP (exposed pad) with CAN VREG to support a low cost external CAN PHY.
• 48LQFP-EP (exposed pad)
The exposed pad must be connected to a grounded contact pad on the PCB.
The exposed pad has an electrical connection within the package to VSSFLAG (VSSX die connection).
The pin out details are shown in the following diagrams. Signals in brackets denote routing options.
MC9S12ZVM Family Reference Manual Rev. 1.5
40
Freescale Semiconductor
The exposed pad on the package bottom must be
connected to a grounded contact pad on the PCB.
64
63
62
61
60
59
58
57
56
55
54
53
52
51
50
49
On MC9S12ZVM options the LIN0 pin is mapped to
the HV physical interface function
LGND
VSSX1
VDDX1
PP0 / EVDD1 / KWP0 / (PWM0) / ECLK / FAULT5 / XIRQ
PP1 / KWP1 / (PWM1) / IRQ
PP2 / KWP2 / (PWM2)
VDDF
VSS1
PE0 / EXTAL
PE1 / XTAL
RESET
PT3 / IOC0_3 / (SS0)
PT2 / IOC0_2 / (PWM5) / (SCK0)
PT1 / IOC0_1 / (PWM4) / (MOSI0) / (TXD0) / LP0DR1 / PTURE
PT0 / IOC0_0 / (PWM3) / (MISO0) / (RXD0)
HS1
Chapter 1 Device Overview MC9S12ZVM-Family
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
MC9S12ZVML and
MC9S12ZVM option
64-pin LQFP-EP
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
HG1
VBS1
VLS1
LG1
LS1
LS2
LG2
VLS2
VBS2
HG2
HS2
HS0
HG0
VBS0
VLS0
LG0
VDDX2
TEST
VSS2
VDD
AN0_0 / AMP0 / KWAD0 / PAD0
AN0_1 / AMPM0 / KWAD1 / PAD1
AN0_2 / AMPP0 / KWAD2 / PAD2
AN0_3 / KWAD3 / PAD3
AN0_4 / KWAD4 / PAD4
AN1_0 / AMP1 / KWAD5 / PAD5
(SS0) / AN1_1 / AMPM1 / KWAD6 / PAD6
AN1_2 / AMPP1 / KWAD7 / PAD7
VRH / AN1_3 / KWAD8 / PAD8
VDDA
VSSA
LS0
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
LIN0
MODC / BKGD
PTUT0 / (LP0RXD) / RXCAN0 / RXD1 / KWS0 / PS0
PTUT1 / (LP0TXD) / TXCAN0 / TXD1 / KWS1 / PS1
MISO0 / (RXD1) / KWS2 / PS2
MOSI0 / (TXD1) / DBGEEV / KWS3 / PS3
PDOCLK / SCK0 / KWS4 / PS4
PDO / SS0 / KWS5 / PS5
BCTL
HD
VCP
BST
VSSB
CP
VLS_OUT
VSUP
Figure 1-3. MC9S12ZVM and MC9S12ZVML option 64-pin LQFP pin out
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
41
Chapter 1 Device Overview MC9S12ZVM-Family
64
63
62
61
60
59
58
57
56
55
54
53
52
51
50
49
VDDC
VSSX1
VDDX1
PP0 / EVDD1 / KWP0 / (PWM0) / ECLK / FAULT5 / XIRQ
PP1 / KWP1 / (PWM1) / IRQ
PP2 / KWP2 / (PWM2)
VDDF
VSS1
PE0 / EXTAL
PE1 / XTAL
RESET
PT3 / IOC0_3 / (SS0)
PT2 / IOC0_2 / (PWM5) / (SCK0)
PT1 / IOC0_1 / (PWM4) / (MOSI0) / (TXD0) / PTURE
PT0 / IOC0_0 / (PWM3) / (MISO0) / (RXD0)
HS1
The exposed pad on the package bottom must be
connected to a grounded contact pad on the PCB.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
MC9S12ZVMC Option
64-pin LQFP-EP
48
47
46
45
44
43
42
41
40
39
38
37
36
35
34
33
HG1
VBS1
VLS1
LG1
LS1
LS2
LG2
VLS2
VBS2
HG2
HS2
HS0
HG0
VBS0
VLS0
LG0
VDDX2
TEST
VSS2
VDD
AN0_0 / AMP0 / KWAD0 / PAD0
AN0_1 / AMPM0 / KWAD1 / PAD1
AN0_2 / AMPP0 / KWAD2 / PAD2
AN0_3 / KWAD3 / PAD3
AN0_4 / KWAD4 / PAD4
AN1_0 / AMP1 / KWAD5 / PAD5
(SS0) / AN1_1 / AMPM1 / KWAD6 / PAD6
AN1_2 / AMPP1 / KWAD7 / PAD7
VRH / AN1_3 / KWAD8 / PAD8
VDDA
VSSA
LS0
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
BCTLC
MODC / BKGD
PTUT0 / RXCAN0 / RXD1 / KWS0 / PS0
PTUT1 / TXCAN0 / TXD1 / KWS1 / PS1
MISO0 / (RXD1) / KWS2 / PS2
MOSI0 / (TXD1) / DBGEEV / KWS3 / PS3
PDOCLK / SCK0 / KWS4 / PS4
PDO / SS0 / KWS5 / PS5
BCTL
HD
VCP
BST
VSSB
CP
VLS_OUT
VSUP
Figure 1-4. MC9S12ZVMC Option 64-pin LQFP pin out
MC9S12ZVM Family Reference Manual Rev. 1.5
42
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
48
47
46
45
44
43
42
41
40
39
38
37
The LIN0 pin is mapped to the HV physical interface
LGND
VSSX1
VDDX1
PP0 / EVDD1 / KWP0 / (PWM0) / ECLK / FAULT5 / XIRQ
VDDF
VSS1
PE0 / EXTAL
PE1 / XTAL
RESET
PT0 / IOC0_0 / (PWM3) / (RXD0)
HS1
HG1
The exposed pad on the package bottom must be
connected to a grounded contact pad on the PCB.
1
2
3
4
5
6
7
8
9
10
11
12
MC9S12ZVM Option
48-pin LQFP-EP
36
35
34
33
32
31
30
29
28
27
26
25
VBS1
LG1
LS1
LS2
LG2
VLS2
VBS2
HG2
HS2
HS0
HG0
VBS0
VDDX2
TEST
VSS2
VDD
AN0_0 / AMP0 / KWAD0 / PAD0
AN0_1 / AMPM0 / KWAD1 / PAD1
AN0_2 / AMPP0 / KWAD2 / PAD2
VRH / AN1_3 / KWAD8 / PAD8
VDDA
VSSA
LS0
LG0
13
14
15
16
17
18
19
20
21
22
23
24
LIN0
MODC / BKGD
PTUT0 / (LP0RXD) / RXD1 / KWS0 / PS0
PTUT1 / (LP0TXD) / TXD1 / KWS1 / PS1
BCTL
HD
VCP
BST
VSSB
CP
VLS_OUT
VSUP
Figure 1-5. MC9S12ZVM, MC9S12ZVML Option 48-pin LQFP
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
43
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-6. Pin Summary (Sheet 1 of 3)
LQFP Option
Function
CTRL
Reset
State
—
—
—
—
—
—
—
—
—
VDDX
—
Up
RXCAN0
LP0RXD
PTUT0
(2)
VDDX
PERS/
PPSS
Up
(1)
TXCAN0
LP0TXD
PTUT1
(2)
VDDX
PERS/
PPSS
Up
(1)
64M
/ML
64
MC
48
Pin
1st
Func.
2nd
Func.
3rd
Func.
4th
Func.
5th
Func.
1
—
1
LIN0
—
—
—
—
—
—
1
—
BCTLC
—
—
—
—
2
2
2
BKGD
MODC
—
—
3
3
3
PS0
KWS0
RXD1
4
4
4
PS1
KWS1
TXD1
Power
Supply
Internal Pull
Resistor
5
5
—
PS2
KWS2
RXD1
MISO0
—
—
VDDX
PERS/
PPSS
Up
6
6
—
PS3
KWS3
DBGEEV
TXD1
MOSI0
—
VDDX
PERS/
PPSS
Up
7
7
—
PS4
KWS4
SCK0
PDOCLK
—
—
VDDX
PERS/
PPSS
Up
(1)
8
8
—
PS5
KWS5
SS0
PDO(1)
—
—
VDDX
PERS/
PPSS
Up
9
9
5
BCTL
—
—
—
—
—
—
—
—
10
10
6
HD
—
—
—
—
—
—
—
—
11
11
7
VCP
—
—
—
—
—
—
—
—
12
12
8
BST
—
—
—
—
—
—
—
—
13
13
9
VSSB
—
—
—
—
—
—
—
—
14
14
10
CP
—
—
—
—
—
—
—
—
15
15
11
VLS_OUT
—
—
—
—
—
—
—
—
16
16
12
VSUP
—
—
—
—
—
VSUP
—
—
17
17
13
VDDX2
—
—
—
—
—
VDDX
—
—
18
18
14
TEST
—
—
—
—
—
—
RESET
Down
19
19
15
VSS2
—
—
—
—
—
—
—
—
20
20
16
VDD
—
—
—
—
—
VDD
—
—
21
21
17
PAD0
KWAD0
AN0_0
AMP0
—
—
VDDA
PERADL/
PPSADL
Off
22
22
18
PAD1
KWAD1
AN0_1
AMPM0
—
—
VDDA
PERADL/
PPSADL
Off
23
23
19
PAD2
KWAD2
AN0_2
AMPP0
—
—
VDDA
PERADL/
PPSADL
Off
MC9S12ZVM Family Reference Manual Rev. 1.5
44
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-6. Pin Summary (Sheet 2 of 3)
LQFP Option
Function
Power
Supply
Internal Pull
Resistor
64M
/ML
64
MC
48
Pin
1st
Func.
2nd
Func.
3rd
Func.
4th
Func.
5th
Func.
24
24
—
PAD3
KWAD3
AN0_3
—
—
—
VDDA
PERADL/
PPSADL
Off
25
25
—
PAD4
KWAD4
AN0_4
—
—
—
VDDA
PERADL/
PPSADL
Off
26
26
—
PAD5
KWAD5
AN1_0
AMP1
—
—
VDDA
PERADL/
PPSADL
Off
27
27
—
PAD6
KWAD6
AN1_1
AMPM1
SS0
—
VDDA
PERADL/
PPSADL
Off
28
28
—
PAD7
KWAD7
AN1_2
AMPP1
—
—
VDDA
PERADL/
PPSADL
Off
29
29
20
PAD8
KWAD8
AN1_3
VRH
—
—
VDDA
PERADH/
PPSADH
Off
30
30
21
VDDA
—
—
—
—
—
VDDA
—
—
31
31
22
VSSA
—
—
—
—
—
—
—
—
32
32
23
LS0
—
—
—
—
—
—
—
—
33
33
24
LG0
—
—
—
—
—
—
—
—
34
34
—
VLS0
—
—
—
—
—
—
—
—
35
35
25
VBS0
—
—
—
—
—
—
—
—
36
36
26
HG0
—
—
—
—
—
—
—
—
37
37
27
HS0
—
—
—
—
—
—
—
—
38
38
28
HS2
—
—
—
—
—
—
—
—
39
39
29
HG2
—
—
—
—
—
—
—
—
40
40
30
VBS2
—
—
—
—
—
—
—
—
41
41
31
VLS2
—
—
—
—
—
—
—
—
42
42
32
LG2
—
—
—
—
—
—
—
—
43
43
33
LS2
—
—
—
—
—
—
—
—
44
44
34
LS1
—
—
—
—
—
—
—
—
45
45
35
LG1
—
—
—
—
—
—
—
—
46
46
—
VLS1
—
—
—
—
—
—
—
—
47
47
36
VBS1
—
—
—
—
—
—
—
—
48
48
37
HG1
—
—
—
—
—
—
—
—
49
49
38
HS1
—
—
—
—
—
—
—
—
CTRL
Reset
State
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
45
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-6. Pin Summary (Sheet 3 of 3)
LQFP Option
Function
Power
Supply
Internal Pull
Resistor
64M
/ML
64
MC
48
Pin
1st
Func.
2nd
Func.
3rd
Func.
4th
Func.
5th
Func.
50
50
39
PT0
IOC0_0
PWM3
MISO0
RXD0(1)
—
VDDX
PERT/
PPST
Off
51
51
—
PT1
IOC0_1
PWM4
MOSI0
TXD0(1)
LP0DR1
(2)/
PTURE
VDDX
PERT/
PPST
Off
52
52
—
PT2
IOC0_2
PWM5
SCK0
—
—
VDDX
PERT/
PPST
Off
53
53
—
PT3
IOC0_3
SS0
—
—
—
VDDX
PERT/
PPST
Off
54
54
40
RESET
—
—
—
—
—
VDDX
TEST pin
Up
55
55
41
PE1
XTAL
—
—
—
—
VDDX
PERE/
PPSE
Down
56
56
42
PE0
EXTAL
—
—
—
—
VDDX
PERE/
PPSE
Down
57
57
43
VSS1
—
—
—
—
—
—
—
—
58
58
44
VDDF
—
—
—
—
—
VDDF
—
—
59
59
—
PP2
KWP2
PWM2
—
—
—
VDDX
PERP/
PPSP
Off
60
60
—
PP1
KWP1
PWM1
IRQ
—
—
VDDX
PERP/
PPSP
Off
61
61
45
PP0 /
EVDD1
KWP0
PWM0
ECLK
FAULT5
XIRQ
VDDX
PERP/
PPSP
Off
62
62
46
VDDX1
—
—
—
—
—
VDDX
—
—
63
63
47
VSSX1
—
—
—
—
—
—
—
—
64
—
48
LGND
—
—
—
—
—
—
—
—
—
64
—
VDDC
—
—
—
—
—
—
—
—
CTRL
Reset
State
1. These functions are only available on the S12ZVML and S12ZVMC versions.
2. LP0RXD, LP0TXD and LP0DR1 functions are only available on the S12ZVM(L) versions.
1.8
Internal Signal Mapping
This section specifies the mapping of inter-module signals at device level.
MC9S12ZVM Family Reference Manual Rev. 1.5
46
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.8.1
ADC Connectivity
1.8.1.1
ADC Reference Voltages
For both ADC modules, VRH_1 is mapped to VDDA; VRH_0 is mapped to PAD[8]; VRL_0 and VRL_1
are both mapped to VSSA, whereby VRL_0 is the preferred reference for low noise.
1.8.1.2
ADC Internal Channels
The ADC0 and ADC1 internal channel mapping is shown in Table 1-7 and Table 1-8 respectively.
The GDU current sense amplifier outputs are mapped to pins with ADC input functionality. Thus
configuring the ADC to convert these pin channels automatically converts the current sense outputs.
The ADC internal temperature sensors must be calibrated by the user. No electrical parameters are
specified for these sensors. The VREG temperature sensor electrical parameters are given in the
appendices.
Table 1-7. Usage of ADC0 Internal Channels
ADC Channel
ADCCMD_1 CH_SEL[5:0]
Usage
0
0
1
0
0
0
Internal_0
ADC0 temperature sensor
0
0
1
0
0
1
Internal_1
VREG temperature sensor or bandgap (VBG)(1)
0
0
1
0
1
0
Internal_2
GDU phase multiplexer voltage
0
0
1
0
1
1
Internal_3
GDU DC link voltage monitor
0
0
1
1
0
0
Internal_4
BATS VSUP sense voltage
0
0
1
1
0
1
Internal_5
Reserved
0
0
1
1
1
0
Internal_6
Reserved
0
0
1
1
1
1
Internal_7
Reserved
1. Selectable in CPMU
Table 1-8. Usage of ADC1 Internal Channels
ADC Channel
ADCCMD_1 CH_SEL[5:0]
Usage
0
0
1
0
0
0
Internal_0
ADC1 temperature sensor
0
0
1
0
0
1
Internal_1
VREG temperature sensor or bandgap (VBG)(1)
0
0
1
0
1
0
Internal_2
GDU phase multiplexer voltage
0
0
1
0
1
1
Internal_3
GDU DC link voltage monitor
0
0
1
1
0
0
Internal_4
Reserved
0
0
1
1
0
1
Internal_5
Reserved
0
0
1
1
1
0
Internal_6
Reserved
0
0
1
1
1
1
Internal_7
Reserved
1. Selectable in CPMU
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
47
Chapter 1 Device Overview MC9S12ZVM-Family
1.8.2
Motor Control Loop Signals
The motor control loop signals are described in 1.13.3.1 Motor Control Loop Overview
1.8.3
Device Level PMF Connectivity
Table 1-9. Mapping of PMF signals
1.8.4
PMF Connection
Usage
Channel0
High-Side Gate and Source Pins HG[0], HS[0]
Channel1
Low-Side Gate and Source Pins LG[0], LS[0]
Channel2
High-Side Gate and Source Pins HG[1], HS[1]
Channel3
Low-Side Gate and Source Pins LG[1], LS[1]
Channel4
High-Side Gate and Source Pins HG[2], HS[2]
Channel5
Low-Side Gate and Source Pins LG[2], LS[2]
FAULT5
External FAULT5 pin
FAULT4
HD Over voltage or GDU over current
FAULT3
VLS under voltage
FAULT2
GDU Desaturation[2] or GDU over current
FAULT1
GDU Desaturation[1] or GDU over current
FAULT0
GDU Desaturation[0] or GDU over current
IS2
GDU Phase Status[2]
IS1
GDU Phase Status[1]
IS0
GDU Phase Status[0]
async_event_edge_sel[1:0]
Tied to b11 (both edges active)
BDC Clock Source Connectivity
The BDC clock, BDCCLK, is mapped to the IRCCLK generated in the CPMU module.
The BDC clock, BDCFCLK is mapped to the device bus clock, generated in the CPMU module.
1.8.5
LINPHY Connectivity
The VLINPHY supply is connected to the device HD pin.
The LINPHY0 signals are mapped internally to SCI0. The receiver can be routed to TIM0 input capture
channel3 . These routing options are described in detail in the PIM section.
1.8.6
HVPHY Connectivity
The HVPHY signals (S12ZVM32 and S12ZVM16 derivatives only) are mapped internally to SCI0. The
receiver can be routed to TIM0 input capture channel3.
MC9S12ZVM Family Reference Manual Rev. 1.5
48
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.8.7
FTMRZ Connectivity
The soc_erase_all_req input to the flash module is driven directly by a BDC erase flash request resulting
from the BDC ERASE_FLASH command.
The FTMRZ FCLKDIV register is forced to 0x05 by the BDC ERASE_FLASH command. This
configures the clock frequency correctly for the initial bus frequency on leaving reset. The bus frequency
must not be changed before launching the ERASE_FLASH command.
The device bus frequency, below which the flash wait states can be disabled, is specified in the device
operating conditions table in Table A-6.
1.8.8
CPMU Connectivity
The API clock generated in the CPMU is not mapped to a device pin in the MC9S12ZVM-Family.
1.9
Modes of Operation
The MCU can operate in different modes. These are described in 1.9.1 Chip Configuration Modes.
The MCU can operate in different power modes to facilitate power saving when full system performance
is not required. These are described in 1.9.3 Low Power Modes.
Some modules feature a software programmable option to freeze the module status whilst the background
debug module is active to facilitate debugging. This is referred to as freeze mode at module level.
1.9.1
Chip Configuration Modes
The different modes and the security state of the MCU affect the debug features (enabled or disabled).
The operating mode out of reset is determined by the state of the MODC signal during reset (Table 1-10).
The MODC bit in the MODE register shows the current operating mode and provides limited mode
switching during operation. The state of the MODC signal is latched into this bit on the rising edge of
RESET.
Table 1-10. Chip Modes
Chip Modes
1.9.1.1
MODC
Normal single chip
1
Special single chip
0
Normal Single-Chip Mode
This mode is intended for normal device operation. The opcode from the on-chip memory is being
executed after reset (requires the reset vector to be programmed correctly). The processor program is
executed from internal memory.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
49
Chapter 1 Device Overview MC9S12ZVM-Family
1.9.1.2
Special Single-Chip Mode
This mode is used for debugging operation, boot-strapping, or security related operations. The background
debug mode (BDM) is active on leaving reset in this mode
1.9.2
Debugging Modes
The background debug mode (BDM) can be activated by the BDC module or directly when resetting into
Special Single-Chip mode. Detailed information can be found in the BDC module section.
Writing to internal memory locations using the debugger, whilst code is running or at a breakpoint, can
change the flow of application code.
The MC9S12ZVM-Family supports BDC communication throughout the device Stop mode. During Stop
mode, writes to control registers can alter the operation and lead to unexpected results. It is thus
recommended not to reconfigure the peripherals during STOP using the debugger.
On the S12ZVML and S12ZVMC versions, the DBG module supports breakpoint, tracing and profiling
features. At board level the profiling pins can use the same 6-pin connector typically used for the BDC
BKGD pin. The connector pin mapping shown in Figure 1-6 is supported by device evaluation boards and
leading development tool vendors.
GND
2
1
BKGD
RST
4
3
PDO
VDDX
6
5
PDOCLK
Figure 1-6. Standard Debug Connector Pin Mapping
1.9.3
Low Power Modes
The device has two dynamic-power modes (run and wait) and two static low-power modes stop and pseudo
stop). For a detailed description refer to the CPMU section.
• Dynamic power mode: Run
— Run mode is the main full performance operating mode with the entire device clocked. The user
can configure the device operating speed through selection of the clock source and the phase
locked loop (PLL) frequency. To save power, unused peripherals must not be enabled.
• Dynamic power mode: Wait
— This mode is entered when the CPU executes the WAI instruction. In this mode the CPU does
not execute instructions. The internal CPU clock is switched off. All peripherals can be active
in system wait mode. For further power consumption the peripherals can individually turn off
their local clocks. Asserting RESET, XIRQ, IRQ, or any other interrupt that is not masked,
either locally or globally by a CCR bit, ends system wait mode.
• Static power modes:
Static power (Stop) modes are entered following the CPU STOP instruction unless an NVM
command is active. When no NVM commands are active, the Stop request is acknowledged and
MC9S12ZVM Family Reference Manual Rev. 1.5
50
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
the device enters either Stop or Pseudo Stop mode. Further to the general system aspects of Stop
mode discussed here, the motor control loop specific considerations are described in
Section 1.13.3.10.
— Pseudo-stop: In this mode the system clocks are stopped but the oscillator is still running and
the real time interrupt (RTI), watchdog (COP) and Autonomous Periodic Interrupt (API) may
be enabled. Other peripherals are turned off. This mode consumes more current than system
STOP mode but, as the oscillator continues to run, the full speed wake up time from this mode
is significantly shorter.
— Stop: In this mode the oscillator is stopped and clocks are switched off. The counters and
dividers remain frozen. The autonomous periodic interrupt (API) may remain active but has a
very low power consumption. The key pad, SCI and MSCAN transceiver modules can be
configured to wake the device, whereby current consumption is negligible.
If the BDC is enabled in Stop mode, the VREG remains in full performance mode and the
CPMU continues operation as in run mode. With BDC enabled and BDCCIS bit set, then all
clocks remain active to allow BDC access to internal peripherals. If the BDC is enabled and
BDCCIS is clear, then the BDCSI clock remains active, but bus and core clocks are disabled.
With the BDC enabled during Stop, the VREG full performance mode and clock activity lead
to higher current consumption than with BDC disabled. If the BDC is enabled in Stop mode,
then the BATS voltage monitoring remains enabled.
1.10
Security
The MCU security mechanism prevents unauthorized access to the flash memory. It must be emphasized
that part of the security must lie with the application code. An extreme example would be application code
that dumps the contents of the internal memory. This would defeat the purpose of security. Also, if an
application has the capability of downloading code through a serial port and then executing that code (e.g.
an application containing bootloader code), then this capability could potentially be used to read the
EEPROM and Flash memory contents even when the microcontroller is in the secure state. In this
example, the security of the application could be enhanced by requiring a response authentication before
any code can be downloaded.
Device security details are also described in the flash block description.
1.10.1
Features
The security features of the S12Z chip family are:
• Prevent external access of the non-volatile memories (Flash, EEPROM) content
• Restrict execution of NVM commands
1.10.2
Securing the Microcontroller
The chip can be secured by programming the security bits located in the options/security byte in the Flash
memory array. These non-volatile bits keep the device secured through reset and power-down.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
51
Chapter 1 Device Overview MC9S12ZVM-Family
This byte can be erased and programmed like any other Flash location. Two bits of this byte are used for
security (SEC[1:0]). The contents of this byte are copied into the Flash security register (FSEC) during a
reset sequence.
The meaning of the security bits SEC[1:0] is shown in Table 1-11. For security reasons, the state of device
security is controlled by two bits. To put the device in unsecured mode, these bits must be programmed to
SEC[1:0] = ‘10’. All other combinations put the device in a secured mode. The recommended value to put
the device in secured state is the inverse of the unsecured state, i.e. SEC[1:0] = ‘01’.
Table 1-11. Security Bits
SEC[1:0]
Security State
00
1 (secured)
01
1 (secured)
10
0 (unsecured)
11
1 (secured)
NOTE
Please refer to the Flash block description for more security byte details.
1.10.3
Operation of the Secured Microcontroller
By securing the device, unauthorized access to the EEPROM and Flash memory contents is prevented.
Secured operation has the following effects on the microcontroller:
1.10.3.1
•
•
Background debug controller (BDC) operation is completely disabled.
Execution of Flash and EEPROM commands is restricted (described in flash block description).
1.10.3.2
•
•
Normal Single Chip Mode (NS)
Special Single Chip Mode (SS)
Background debug controller (BDC) commands are restricted
Execution of Flash and EEPROM commands is restricted (described in flash block description).
In special single chip mode the device is in active BDM after reset. In special single chip mode on a secure
device, only the BDC mass erase and BDC control and status register commands are possible. BDC access
to memory mapped resources is disabled. The BDC can only be used to erase the EEPROM and Flash
memory without giving access to their contents.
1.10.4
Unsecuring the Microcontroller
Unsecuring the microcontroller can be done using three different methods:
1. Backdoor key access
2. Reprogramming the security bits
3. Complete memory erase
MC9S12ZVM Family Reference Manual Rev. 1.5
52
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.10.4.1
Unsecuring the MCU Using the Backdoor Key Access
In normal single chip mode, security can be temporarily disabled using the backdoor key access method.
This method requires that:
• The backdoor key has been programmed to a valid value
• The KEYEN[1:0] bits within the Flash options/security byte select ‘enabled’.
• The application program programmed into the microcontroller has the capability to write to the
backdoor key locations
The backdoor key values themselves would not normally be stored within the application data, which
means the application program would have to be designed to receive the backdoor key values from an
external source (e.g. through a serial port)
The backdoor key access method allows debugging of a secured microcontroller without having to erase
the Flash. This is particularly useful for failure analysis.
NOTE
No backdoor key word is allowed to have the value 0x0000 or 0xFFFF.
1.10.5
Reprogramming the Security Bits
Security can also be disabled by erasing and reprogramming the security bits within the flash
options/security byte to the unsecured value. Since the erase operation will erase the entire sector
(0x7F_FE00–0x7F_FFFF) the backdoor key and the interrupt vectors will also be erased; this method is
not recommended for normal single chip mode. The application software can only erase and program the
Flash options/security byte if the Flash sector containing the Flash options/security byte is not protected
(see Flash protection). Thus Flash protection is a useful means of preventing this method. The
microcontroller enters the unsecured state after the next reset following the programming of the security
bits to the unsecured value.
This method requires that:
• The application software previously programmed into the microcontroller has been designed to
have the capability to erase and program the Flash options/security byte.
• The Flash sector containing the Flash options/security byte is not protected.
1.10.6
Complete Memory Erase
The microcontroller can be unsecured by erasing the entire EEPROM and Flash memory contents. If
ERASE_FLASH is successfully completed, then the Flash unsecures the device and programs the security
byte automatically.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
53
Chapter 1 Device Overview MC9S12ZVM-Family
1.11
1.11.1
Resets and Interrupts
Resets
Table 1-12. lists all reset sources and the vector locations. Resets are explained in detail in the Chapter 8,
“S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)”.
Table 1-12. Reset Sources and Vector Locations
Vector Address
Reset Source
CCR
Mask
Local Enable
0xFFFFFC
Power-On Reset (POR)
None
None
None
None
None
None
None
OSCE Bit in CPMUOSC register
None
CR[2:0] in CPMUCOP register
Low Voltage Reset (LVR)
External pin RESET
Clock monitor reset
COP watchdog reset
1.11.2
Interrupt Vectors
Table 1-13 lists all interrupt sources and vectors in the default order of priority. The interrupt module
description provides an interrupt vector base register (IVBR) to relocate the vectors.
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
CCR
Mask
Local Enable
Unimplemented page1 op-code trap
(SPARE)
None
None
-
-
Vector base + 0x1F4
Unimplemented page2 op-code trap
(TRAP)
None
None
-
-
Vector base + 0x1F0
Software interrupt instruction (SWI)
None
None
-
-
Vector base + 0x1EC
System call interrupt instruction
(SYS)
None
None
-
-
Vector base + 0x1E8
Machine exception
None
None
-
-
Vector Address(1)
Interrupt Source
Vector base + 0x1F8
Vector base + 0x1E4
Reserved
Vector base + 0x1E0
Reserved
Wake up
Wake up
from STOP from WAIT
Vector base + 0x1DC
Spurious interrupt
—
None
-
-
Vector base + 0x1D8
XIRQ interrupt request
X bit
None
Yes
Yes
Vector base + 0x1D4
IRQ interrupt request
I bit
IRQCR(IRQEN)
Yes
Yes
Vector base + 0x1D0
RTI time-out interrupt
I bit
CPMUINT (RTIE)
See CPMU
section
Yes
MC9S12ZVM Family Reference Manual Rev. 1.5
54
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
Vector Address(1)
Interrupt Source
CCR
Mask
Local Enable
Vector base + 0x1CC
TIM0 timer channel 0
I bit
TIM0TIE (C0I)
No
Yes
Vector base + 0x1C8
TIM0 timer channel 1
I bit
TIM0TIE (C1I)
No
Yes
Vector base + 0x1C4
TIM0 timer channel 2
I bit
TIM0TIE (C2I)
No
Yes
Vector base + 0x1C0
TIM0 timer channel 3
I bit
TIM0TIE (C3I)
No
Yes
No
Yes
Vector base + 0x1BC
to
Vector base + 0x1B0
Wake up
Wake up
from STOP from WAIT
Reserved
Vector base + 0x1AC
TIM0 timer overflow
I bit
TIM0TSCR2(TOI)
Reserved
Vector base + 0x1A8
to
Vector base + 0x1A4
Vector base + 0x1A0
SPI0
I bit
SPI0CR1 (SPIE, SPTIE)
No
Yes
Vector base + 0x19C
SCI0
I bit
SCI0CR2
(TIE, TCIE, RIE, ILIE)
Yes
Yes
Vector base + 0x198
SCI1
I bit
SCI1CR2
(TIE, TCIE, RIE, ILIE)
Yes
Yes
Vector base + 0x194
Reserved
Vector base + 0x190
Reserved
Vector base + 0x18C
ADC0 Error
I bit
ADC0EIE (IA_EIE, CMD_EIE,
EOL_EIE, TRIG_EIE,
RSTAR_EIE, LDOK_EIE)
ADC0IE(CONIF_OIE)
No
Yes
Vector base + 0x188
ADC0 conversion sequence abort
I bit
ADC0IE(SEQAD_IE)
No
Yes
Vector base + 0x184
ADC0 conversion complete
I bit
ADC0CONIE[15:0]
No
Yes
Vector base + 0x180
Oscillator status interrupt
I bit
CPMUINT (OSCIE)
No
Yes
Vector base + 0x17C
PLL lock interrupt
I bit
CPMUINT (LOCKIE)
No
Yes
No
Yes
Vector base + 0x178
to
Vector base + 0x174
Vector base + 0x170
Reserved
RAM error
I bit
Vector base + 0x16C
to
Vector base + 0x168
EECIE (SBEEIE)
Reserved
Vector base + 0x164
FLASH error
I bit
FERCNFG (SFDIE)
No
Yes
Vector base + 0x160
FLASH command
I bit
FCNFG (CCIE)
No
Yes
Vector base + 0x15C
CAN0 wake-up
I bit
CAN0RIER (WUPIE)
Yes
Yes
Vector base + 0x158
CAN0 errors
I bit
CAN0RIER (CSCIE, OVRIE)
No
Yes
Vector base + 0x154
CAN0 receive
I bit
CAN0RIER (RXFIE)
No
Yes
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
55
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
Vector Address(1)
Interrupt Source
CCR
Mask
Local Enable
Vector base + 0x150
CAN0 transmit
I bit
CAN0TIER (TXEIE[2:0])
Vector base + 0x14C
to
Vector base + 0x148
Vector base + 0x144
Wake up
Wake up
from STOP from WAIT
No
Yes
Reserved
LINPHY over-current interrupt
I bit
LPIE (LPDTIE,LPOCIE)
No
Yes
Vector base + 0x140 BATS supply voltage monitor interrupt
I bit
BATIE (BVHIE,BVLIE)
No
Yes
Vector base + 0x13C
GDU Desaturation Error
I bit
GDUIE (GDSEIE)
No
Yes
Vector base + 0x138
GDU Voltage Limit Detected
I bit
GDUIE (GOCIE, GHHDIE,
GLVLSIE)
No
Yes
PIES[5:0]
Yes
Yes
Vector base + 0x134
to
Vector base + 0x128
Vector base + 0x124
Reserved
Port S interrupt
I bit
Vector base + 0x120
Reserved
Vector base + 0x11C
ADC1 Error
I bit
ADC1EIE (IA_EIE, CMD_EIE,
EOL_EIE, TRIG_EIE,
RSTAR_EIE, LDOK_EIE)
ADC1IE(CONIF_OIE)
No
Yes
Vector base + 0x118
ADC1 conversion sequence abort
I bit
ADC1IE(SEQAD_IE)
No
Yes
Vector base + 0x114
ADC1 conversion complete
I bit
ADC1CONIE[15:0]
No
Yes
Vector base + 0x110
Reserved
Vector base + 0x10C
Port P interrupt
I bit
PIEP[2:0]
Yes
Yes
Vector base + 0x108
EVDD1 over-current interrupt
I bit
PIEP(OCIE1)
No
Yes
Vector base + 0x104
Low-voltage interrupt (LVI)
I bit
CPMULVCTL (LVIE)
No
Yes
Vector base + 0x100
Autonomous periodical interrupt
(API)
I bit
Yes
Yes
Vector base + 0xFC
High temperature interrupt
I bit
Yes
Yes
Vector base + 0xF8
CPMUAPICTRL (APIE)
CPMUHTCTL(HTIE)
Reserved
Vector base + 0xF4
Port AD interrupt
I bit
PIEADH(PIEADH0)
PIEADL(PIEADL[7:0])
Yes
Yes
Vector base + 0xF0
PTU Reload Overrun
I bit
PTUIEH(PTUROIE)
No
Yes
Vector base + 0xEC
PTU Trigger0 Error
I bit
PTUIEL(TG0AEIE,
TG0REIE,TG0TEIE)
No
Yes
Vector base + 0xE8
PTU Trigger1 Error
I bit
PTUIEL(TG1AEIE, TG1REIE,
TG1TEIE)
No
Yes
Vector base + 0xE4
PTU Trigger0 Done
I bit
PTUIEL(TG0DIE)
No
Yes
Vector base + 0xE0
PTU Trigger1 Done
I bit
PTUIEL(TG1DIE)
No
Yes
MC9S12ZVM Family Reference Manual Rev. 1.5
56
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Table 1-13. Interrupt Vector Locations (Sheet 1 of 4)
Vector Address(1)
Interrupt Source
CCR
Mask
Vector base + 0xDC
to
Vector base + 0xD4
Local Enable
Wake up
Wake up
from STOP from WAIT
Reserved
Vector base + 0xD0
PMF Reload A
I bit
PMFENCA(PWMRIEA)
No
Yes
Vector base + 0xCC
PMF Reload B
I bit
PMFENCB(PWMRIEB)
No
Yes
Vector base + 0xC8
PMF Reload C
I bit
PMFENCC(PWMRIEC)
No
Yes
Vector base + 0xC4
PMF Fault
I bit
PMFFIE(FIE[5:0])
No
Yes
Vector base + 0xC0
PMF Reload Overrun
I bit
PMFROIE(PMFROIEA,PMF
ROIEB,PMFROIEC)
No
Yes
Vector base + 0xBC
to
Vector base + 0x10
Reserved
1. 15 bits vector address based
1.11.3
Effects of Reset
When a reset occurs, MCU registers and control bits are initialized. Refer to the respective block sections
for register reset states.
On each reset, the Flash module executes a reset sequence to load Flash configuration registers.
1.11.3.1
Flash Configuration Reset Sequence Phase
On each reset, the Flash module will hold CPU activity while loading Flash module registers from the
Flash memory. If double faults are detected in the reset phase, Flash module protection and security may
be active on leaving reset. This is explained in more detail in the Flash module description.
1.11.3.2
Reset While Flash Command Active
If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The
state of the word being programmed or the sector/block being erased is not guaranteed.
1.11.3.3
I/O Pins
Refer to the PIM section for reset configurations of all peripheral module ports.
1.11.3.4
RAM
The system RAM arrays, including their ECC syndromes, are initialized following a power on reset. All
other RAM arrays are not initialized out of any type of reset.
With the exception of a power-on-reset the RAM content is unaltered by a reset occurrence.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
57
Chapter 1 Device Overview MC9S12ZVM-Family
1.12
Module device level dependencies
1.12.1
CPMU COP Configuration
The COP time-out rate bits CR[2:0] and the WCOP bit in the CPMUCOP register are loaded from the
Flash configuration field byte at global address 0xFF_FE0E during the reset sequence. See Table 1-14 and
Table 1-15 for coding.
Table 1-14. Initial COP Rate Configuration
NV[2:0] in
FOPT Register
CR[2:0] in
CPMUCOP Register
000
111
001
110
010
101
011
100
100
011
101
010
110
001
111
000
Table 1-15. Initial WCOP Configuration
1.12.2
NV[3] in
FOPT Register
WCOP in
CPMUCOP Register
1
0
0
1
CPMU High Temperature Trimming
The value loaded from the flash into the CPMUHTTR register is a default value for the device family.
There is no device specific trimming carried out during production. The specified VHT value is a typical
value that is part dependent and should thus be calibrated.
1.12.3
Flash IFR Mapping
Table 1-16. Flash IFR Mapping
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
ADC0 reference conversion using VDDA/VSSA
IFR Byte Address
0x1F_C040 & 0x1F_C041
ADC0 reference conversion using PAD8/VSSA
0x1F_C042 & 0x1F_C043
ADC1 reference conversion using VDDA/VSSA
0x1F_C044 & 0x1F_C045
ADC1 reference conversion using PAD8/VSSA
0x1F_C046 & 0x1F_C047
MC9S12ZVM Family Reference Manual Rev. 1.5
58
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.13
Application Information
1.13.1
ADC Calibration
For applications that do not provide external ADC reference voltages, the VDDA/VSSA supplies can be
used as sources for VRH/VRL respectively. Since the VDDA must be connected to VDDX at board level
in the application, the accuracy of the VDDA reference is limited by the internal voltage regulator
accuracy. In order to compensate for VDDA reference voltage variation in this case, the reference voltage
is measured during production test using the internal reference voltage VBG, which has a narrow variation
over temperature and external voltage supply. VBG is mapped to an internal channel of each ADC module
(Table 1-7,Table 1-8). The resulting 12-bit right justified ADC conversion results of VBG are stored to the
flash IFR for reference, as listed in Table 1-16.
The measurement conditions of the reference conversion are listed in the device electrical parameters
appendix. By measuring the voltage VBG in the application environment and comparing the result to the
reference value in the IFR, it is possible to determine the current ADC reference voltage VRH :
StoredReference
V RH = ------------------------------------------------------- • 5V
ConvertedReference
The exact absolute value of an analog conversion can be determined as follows:
StoredReference • 5V
Result = ConvertedADInput • -----------------------------------------------------------------nConvertedReference • 2
With:
ConvertedADInput:
ConvertedReference:
StoredReference:
n:
Result of the analog to digital conversion of the desired pin
Result of internal channel conversion
Value in IFR location
ADC resolution (12 bit)
NOTE
The ADC reference voltage VRH must remain at a constant level throughout
the conversion process.
1.13.2
SCI Baud Rate Detection
The baud rate for SCI0 and SCI1 is achieved by using a timer channel to measure the data rate on the RXD
signal.
1. Establish the link:
— For SCI0: Set [T0IC3RR1:T0IC3RR0]=0b01 to disconnect IOC0_3 from TIM0 input capture
channel 3 and reroute the timer input to the RXD0 signal of SCI0.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
59
Chapter 1 Device Overview MC9S12ZVM-Family
— For SCI1: Set [T0IC3RR1:T0IC3RR0]=0b10 to disconnect IOC0_3 from TIM0 input capture
channel 3 and reroute the timer input to the RXD1 signal of SCI1.
2. Determine pulse width of incoming data: Configure TIM0 IC3 to measure time between incoming
signal edges.
1.13.3
Motor Control Application Overview
The following sections provide information for using the device in motor control applications. These
sections provide a description of motor control loop considerations that are not detailed in the individual
module sections, since they concern device level inter module operation specific for motor control. More
detailed information is available in application notes. The applications described are as follows:
1. BDCM - wiper pumps fans
2. BLDCM - pumps, fans and blowers
– based on Hall sensors
– sensorless based on back-EMF zero crossing comparators
– sensorless based on back-EMF ADC measurements
3. PMSM - high-end wiper, pumps, fans and blowers
– simple sinewave commutation with position sensor Hall effect, sine-cos
– FOC with sine-cos position sensor
– sensorless 3-phase sinewave control
MC9S12ZVM Family Reference Manual Rev. 1.5
60
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
1.13.3.1
Motor Control Loop Overview
The mapping of motor control events at device level as depicted in Figure 1-7 is listed in Table 1-17,
whereby the columns list the names used in the module level descriptions
Figure 1-7. Internal Control Loop Configuration
TIM
OC0
GDU
zero crossing
comparators
GPHS
commutation_event
PMF
SENSOR
reloada async_reload
async reload
reload
async reload
PTU
ADC0
If PTU enabled
If PTU enabled
reload
dc_bus_voltage
glb_ldok
PHMUX
back-EMF
dc_bus_current
M
P1
P2
P3
glb_ldok
trigger_0
ADC1
async reload
reload
trigger_1
reload
The control loop consists of the PMF, GDU, ADC and PTU modules. The control loop operates using
either static, dynamic or asynchronous timing. In the following text the event names given in bold type
correspond to those shown in Figure 1-7. The PTU and ADC operate using lists stored in memory. These
lists define trigger points for the PTU, commands for the ADC and results from the ADC. If the PTU is
enabled the reload and async_reload events are immediately passed through to the ADC and GDU
modules.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
61
Chapter 1 Device Overview MC9S12ZVM-Family
.
Table 1-17. Control Loop Events
Device Level Event
TIM
PMF
PTU
ADC0
ADC1
commutation_event
OC0(1)
commutation_event
—
—
—
reload
—
reloada(2)
reload
Restart
Restart
async_reload
—
async_reload
async_reload
Seq_abort
Seq_abort
trigger_0
—
—
trigger_0
Trigger
—
trigger_1
—
—
trigger_1
—
Trigger
glb_ldok
—
glb_ldok
glb_ldok
LoadOK
LoadOK
1. TIM channel OC0 must be configured to toggle on both edges.
2. PMF events reloadb and reloadc are not connected at device level
Each control loop cycle is started by a PMF reload event. The PMF reload event restarts the PTU time
base. If the PTU is enabled, the reload is immediately passed through to the ADC and GDU modules.
The PMF generates the reload event at the required PWM reload frequency. The PMF reload event causes
the PTU time base to restart, to acquire the first trigger times from the list and the ADCs to start loading
the ADC conversion command from the Command Sequence List (CSL).
NOTE
In the PTU there is 7 bus cycle maximum time window after the reload
event assertion to access the first trigger times from the list. In this window
the trigger can not be generated. In the ADC there is 10 bus cycle maximum
time window after the reload event assertion to access the first ADC
command from the list. In this window the ADC conversion can not be
started. If the measurement is control loop related these delays are
negligible due to much larger delays in the PWM-GDU-feedback loop.
When the trigger time is encountered the corresponding PTU trigger generates the trigger_x event for the
associated ADC. For simultaneous sampling the PTU generates simultaneous trigger_x events for both
ADCs. At the trigger_x event the ADC starts the first conversion of the next conversion sequence in the
CSL (the first ADC command is already downloaded).
A commutation event is used by the PMF to generate an async_reload event. The async_reload is used by
the PTU to update lists and re-initialize the trigger lists. If the PTU is enabled the async_reload is
immediately passed through to the ADC.
1.13.3.2
Control Loop Timing Considerations
Delays within the separate control loop elements require consideration to ensure correct synchronization.
Regarding the raw PWM signal as the starting point and stepping through the control loop stages, the
factors shown in Figure 1-8 contribute to delays within the control loop, starting with the deadtime
MC9S12ZVM Family Reference Manual Rev. 1.5
62
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
insertion, going through the external FETs and back into the internal ADC measurements of external
voltages and currents.
Figure 1-8. Control Loop Delay Overview
PWM cycle
PWM base
PWM with
deadtime
TDEAD_x
GDU
propagation
FET
turn on
tdelon
tHGON
Current sense
settling time
(tcslsst)
ADC delay
The PWM deadtime (TDEAD_X) is an integral number of bus clock cycles, configured by the PMF
deadtime registers.
The GDU propagation delays (tdelon, tdeloff) are specified in the electrical parameter Table E-1.
The FET turn on times (tHGON) are load dependent but are specified for particular loads in the electrical
parameter Table E-1.
The current sense amplifier delay is highly dependent on external components.
The ADC delay until a result is available is specified as the conversion period NCONV in Table C-1.
1.13.3.3
Static Timing Operation
The timing frame is static if it is the same in every control cycle (defined by reload frequency) and is
relative to start of the control cycle. The only settings modified from one control cycle to the next one are
the PWM duty cycle registers.
The main control cycle synchronization event is the PMF reload event. The PMF reload event can be
generated every n PWM periods.
This mode can optionally be extended by a timer channel trigger to PMF to change the PWM channel
operation (e.g. used for BLDCM commutation). In this case, the PMF configuration can propagate the
trigger through the control loop or can prevent propagation so the static timing of the control cycle and
inter-block coherency are not affected by the trigger.
At the end of the conversion sequence the first ADC command from the new sequence is loaded and the
ADCx waits for the next trigger_x. The PTU continues to generate the trigger_x events for each trigger
time from the list until a new reload or async_reload occurs.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
63
Chapter 1 Device Overview MC9S12ZVM-Family
Before the upcoming reload event the CPU:
• reads the ADC results from the buffered Conversion Result List
• clears the conversion complete flag
• services the reload by setting new duty cycle values
• sets the PTULDOK bit (corresponding to glb_ldok) to signal the duty cycle coherence
The CPU actions are typically performed in an ISR triggered by the conversion complete flag.
1.13.3.4
Static Timing Fault Handling
The following Faults and/or errors can occur:
• Desaturation error, Overvoltage, Undervoltage, Temperature sensor, External fault
The application run-time error is handled by the GDU without CPU interaction. Firstly the FETs are
disabled and the PMF signals switched to an inactive state. To re-enable the operation first the GDU fault
and then PWM fault must be cleared, to automatically re-enable the FET driving at the next PWM
boundary.
• PTU reload overrun error
This is an application run-time error caused by the CPU not setting PTULDOK on time. Servicing this type
of error is application dependent and may range from a further reload attempt to a total shut down.
• PTU trigger generator reload error, PTU trigger generator error
Since all timing is static, this error should only occur during application debugging. This type of error
occurring in a static timing configuration indicates possible data corruption. This can be serviced by a
control loop shutdown.
• PTU memory access error, Memory access double bit ECC error
This type of error occurring in an application indicates data corruption. This can be serviced by a control
loop shutdown.
• ADC sequence overrun, ADC command overrun, ADC command error
Since all timing is static, this error should only occur during application debugging. This type of error
occurring in an application indicates possible data corruption. This can be serviced by a control loop
shutdown.
1.13.3.5
Dynamic Timing Operation
The timing frame is dynamic if the following are modified on a cycle by cycle basis:
• PMF - duty cycle value registers (PMF_VALx), modulo registers
• PTU - Trigger Event List (PTU_TELx)
• ADC - Command Sequence List (ADCx_CSL)
The main philosophy is that all cycle-by-cycle settings for cycle n need to be done within cycle n-1. The
main control cycle synchronization event is the PMF reload event, which can be generated every n PWM
periods.
MC9S12ZVM Family Reference Manual Rev. 1.5
64
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
This mode can optionally be extended by a timer channel trigger PMF to change PWM channel operation
(e.g. used for BLDCM commutation).
The event flow is the same as for static timing.
Before the upcoming reload event the CPU:
• reads the ADC results from the buffered Conversion Result List
• clears the conversion complete flag
• services the reload by setting new duty cycle values and a new PMF modulo value
• updates the non-active PTU_TELx
• updates the non-active ADCx_CSL
• sets the PTULDOK bit (corresponding to glb_ldok) to signal the duty cycle coherence
The CPU actions are typically performed in an ISR triggered by the conversion complete flag.
1.13.3.6
Dynamic Timing Fault Handling
The following Faults and/or errors can occur:
• Desaturation error, Overvoltage, Undervoltage, Temperature sensor, External fault
The application run-time error is handled by the GDU without CPU interaction. Firstly the FETs are
disabled and the PMF signals switched to an inactive state. To re-enable the operation first the GDU fault
and then PWM fault must be cleared, to automatically re-enable the FET driving at the next PWM
boundary.
• PTU reload overrun error
This is an application run-time error caused by the CPU not setting PTULDOK on time. Servicing this type
of error is application dependent and may range from a further reload attempt to a total shut down.
• PTU trigger generator reload error, PTU trigger generator error
This indicates an application run-time error caused by a settings mismatch. Servicing this type of error is
application dependent. In some cases, the ADC values for the current control cycle can be ignored.
• PTU memory access error, Memory access double bit ECC error
This type of error occurring in an application indicates possible data corruption. This can be serviced by a
control loop shutdown.
• ADC sequence overrun, ADC command overrun, ADC command error
This indicates an application run-time error caused by a settings mismatch. Servicing this type of error is
application dependent. In some cases, the ADC values for the current control cycle can be ignored.
1.13.3.7
Asynchronous Timing
This case is an extension of the dynamic timing case by an asynchronous event generated by the Timer.
Note the asynchronous term is referenced to the control cycle.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
65
Chapter 1 Device Overview MC9S12ZVM-Family
The timing frame is the same as in dynamic timing case plus it can be asynchronously restarted at any time
within the control cycle.
At the asynchronous commutation_event
• the PMF actions are:
1. counter re-start, re-initialization
2. PWM configuration re-initialization according to the selected PWM settings (center/edge-aligned
pattern, normal/inverted type etc.)
3. re-initialization of the dead time generators (in case the commutation takes place at a time when
one of the dead times is being generated)
4. re-initialization of the PWM outputs according to pre-set PWM channel output settings in double
buffered registers (mask, swap, output control)
5. re-initialization of the automatic fault clearing
6. generates async_reload event for the PTU
7. optionally updates the PWM duty cycle values based on LDOK state
• the PTU actions are:
1. abortion of the trigger_x event generation
2. re-initialization and re-start the PTU counter
3. update of the current list index TGxList based on the glb_ldok state
4. fetch first trigger time from updated TGxList
5. passes the async_reload event immediately to the ADC (if the PTU is enabled)
6. generates the reload event for the ADC
• the ADC actions are:
1. the conversion in progress is completed
2. the ADC conversion sequence is aborted and the SEQA flag is set to indicate that the final
conversion occurred during the abortion process (potentially coinciding with a commutation and
is thus less precise than under normal conditions)
3. update of the current lists index ADxLists
4. re-start of the conversion sequencing upon successful abortion - fetches the first ADC command
from the ADCx_CSL, re-sets the result pointer to the top of the list
Note: in case the lists index ADxLists is not updated at the sequence abortion the new restarted
A/D conversions will overwrite the previously converted results.
• the GDU actions are:
1. standard operation
1.13.3.8
Control Loop Startup Guidelines
The sequence for control loop start up is to firstly configure the signal measurement (inputs/feedback).
Once the measurement is properly configured (correct value is measured at defined time) the output
actuation (control action) is configured. The following modules are involved in signal measurements.
• TIM (to identify asynchronous commutation) [BLDC applications only]
MC9S12ZVM Family Reference Manual Rev. 1.5
66
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
•
•
•
•
PMF (to generate main synchronous events for PTU and ADC)
PTU (to generate delay relative to synchronous events generated by PMF)
ADC (to acquire analog signals under synchronous control)
GDU (zero crossing comparators, Back-EMF muxing) [application dependent]
The TIM OC0 channel identifies the commutation event and restarts the PMF counter. In order to establish
this link TIM and PMF need to be configured and started. Then to sample accurately within one PMF cycle
the PTU needs to be used, so the next step is to configure the PTU to establish PMF to PTU link. The PTU
sends triggers to the ADC to perform a measurement of control signals. So the next step is to configure the
ADC. In some cases the GDU involvement is required and therefore configured.
The control action involves the PMF (to generate the duty cycle for GDU) and the GDU (to propagate the
signal to the MOSFETs). Since the PMF has already been configured for the measurements, only the GDU
need be configured to complete startup. Sometimes the GDU can be configured earlier but the GDU output
is always enabled last.
The recommended startup sequence is summarized as follows:
• Configure TIM and PMF to establish the link between TIM OC0 commutation event and PMF
• Configure PTU to establish the PMF to PTU link and ensure correct sampling within PMF cycle
• Configure the ADC
• Configure the GDU
1.13.3.9
Control Loop Shutdown Guidelines
1. Remove energy stored in the system after the power stage
kinetic energy - stop all rotating/moving mass
magnetic energy - gracefully drive currents to zero
2. Put GDU and PMF outputs to safe state
1.13.3.10 Control Loop Stop Mode Considerations
In Stop mode the PWM, PTU, ADC can not run because the bus clock is not running. Thus the GDU must
transition to a disabled state. Before entering Stop mode the application must perform the following steps:
1. Remove energy stored in the system after the power stage
kinetic energy - stop all rotating/moving mass
magnetic energy - gracefully drive currents to zero
2. Put GDU and PMF outputs to safe state
3. Verify GDU and PMF safe states
4. Verify fault flags and service if necessary
5. Execute the STOP instruction
The return from stop is expected in reverse order:
1. On returning from Stop mode the clocks are automatically enabled coherently
2. Initialize and check device proper functionality (charge pump etc.)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
67
Chapter 1 Device Overview MC9S12ZVM-Family
3.
4.
5.
6.
Check functionality of the external system
Initializes control loop operation, however with PMF and GDU outputs still in safe state
Read the ADC values to check the system
Start driving energy into the system
based on the measurements from the previous step, the PWM duty cycle values are calculated
7. PMF and GDU outputs are enabled (actively driven)
The device does not support putting the FETs in an active driving state during STOP as the GDU charge
pump clock is not running. This means the device cannot be put in stop mode if the FETS need to be in an
active driving state to protect the system from external energy supply (e.g. externally driven motorgenerator).
NOTE
It is imperative, that whatever the modules perform on entering/exiting Stop
mode, the pre-set complementary mode of operation and dead time insertion
must be guaranteed all the times.
1.13.3.11 Application Signal Visibility
In typical motor control applications, TIM OC0 is used internally to indicate commutation events. To
switch off OC0 visibility at port pin PT0:
• Disable output compare signal on pin PT0 in TIM: OCPD[OCPD0]=0b1.
1.13.3.12 Debug Signal Visibility
Depending on required visibility of internal signals on port pins enable the following registers:
• Set [PWMPRR]=0b1 in PIM if monitoring of internal PWM waveforms is needed. PWM5-3 are
driven out on pins PT[2:0] and PWM2-0 on pins PP[2:0].
• Enable output compare channel OC0 to output commutation event on pin PT0 in TIM:
OCPD[OCPD0]=0b0.
• Set PTUDEBUG[PTUREPE]=0b1 in PTU to output the reload event.
• Set PTUDEBUG[PTUTxPE]=0b1 with x=0,1 in PTU to output the trigger events.
1.13.4
BDCM Complementary Mode Operation
This section describes BDCM control using center aligned complementary mode with deadtime insertion.
The DC Brushed motor power stage topology is a classical full bridge as shown in Figure 1-9. The DC
Brushed motor is driven by the DC voltage source. A rotational field is created by means of commutator
and brushes on the motor. These drives are still very popular because sophisticated calculations and
algorithms such as commutation, waveform generation, or space vector modulation are not required.
MC9S12ZVM Family Reference Manual Rev. 1.5
68
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Figure 1-9. DC Brushed Motor External Configuration
+ 1/2 U
PWM
0
PWM
2
B
A
PWM
1
PWM
3
- 1/2 U
Usually the control consists of an outer, speed control loop with inner current (torque) control loop. The
inner loop controls DC voltage applied onto the motor winding. The control loop is calculated regularly
within a given period. In most cases, this period matches the PWM reload period.
Driving the DC motor from a DC voltage source, the motor can work in all four quadrants. The
complementary mode of operation with deadtime insertion is needed for smooth reversal of the motor
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
69
Chapter 1 Device Overview MC9S12ZVM-Family
current (motor torque), hence smooth full four quadrant control. Usually the center-aligned PWM is
chosen to lower electromagnetic emissions.
Figure 1-10. BDCM Control Loop Configuration
GDU
PMF
dc_bus_voltage
M
dc_bus_current0
sine/
cosine
sensor
reloada
reload
glb_ldok
PTU
trigger_0
ADC0
trigger_1
reload
ADC1
The PWM frequency selection is always a compromise between audible noise, electromagnetic emissions,
current ripples and power switching losses.
The BDCM control loop goal is to provide a controlled DC voltage to the motor winding, whereby it is
controlled cycle-by-cycle using a speed, current or torque feedback loop.
The center aligned PWM waveforms generated by the PMF module are applied to the bridge as shown in
Figure 1-11 whereby the base waveform for PWM0 and PWM1 is depicted at the top and the
complementary PWM0 and PWM1 waveforms are shown with deadtime insertion depicted by the gray
phases before the switching edges.
MC9S12ZVM Family Reference Manual Rev. 1.5
70
Freescale Semiconductor
Chapter 1 Device Overview MC9S12ZVM-Family
Figure 1-11. BDCM Complementary Mode Waveform
PWM0, PWM1 base
PWM2, PWM3 base
TPWM
PWM0
PWM2
PWM1
PWM3
Assuming first quadrant operation, forward accelerating operation, the applied voltage at node A must
exceed the applied voltage at node B (Figure 1-9). Thus the PWM0 duty cycle must exceed the PWM2
duty cycle.
The PWM duty cycle of PWM0 defines the voltage at the first power stage branch.
The PWM duty cycle of PWM2 defines the voltage at the second power stage branch.
Modulating the PWM duty cycle every period using the function FPWM then the duty cycle is expressed as:
PWM0 duty-cycle = 0.5 + (0.5 * FPWM); For -1 tP_PASS guarantee a wakeup event.
Please refer to the appendix table “Pin Interrupt Characteristics” for pulse length limits.
To maximize current saving the RC oscillator is active only if the following condition is true on any
individual pin:
Sample count IPL[2:0]).
3. The I-bit in the condition code register (CCW) of the CPU must be cleared.
4. There is no access violation interrupt request pending.
5. There is no SYS, SWI, SPARE, TRAP, Machine Exception or XIRQ request pending.
MC9S12ZVM Family Reference Manual Rev. 1.5
138
Freescale Semiconductor
Chapter 4 Interrupt (S12ZINTV0)
NOTE
All non I-bit maskable interrupt requests always have higher priority than Ibit maskable interrupt requests. If an I-bit maskable interrupt request is
interrupted by a non I-bit maskable interrupt request, the currently active
interrupt processing level (IPL) remains unaffected. It is possible to nest
non I-bit maskable interrupt requests, e.g., by nesting SWI, SYS or TRAP
calls.
4.4.2.1
Interrupt Priority Stack
The current interrupt processing level (IPL) is stored in the condition code register (CCW) of the CPU.
This way the current IPL is automatically pushed to the stack by the standard interrupt stacking procedure.
The new IPL is copied to the CCW from the priority level of the highest priority active interrupt request
channel which is configured to be handled by the CPU. The copying takes place when the interrupt vector
is fetched. The previous IPL is automatically restored from the stack by executing the RTI instruction.
4.4.3
Priority Decoder
The INT module contains a priority decoder to determine the relative priority for all interrupt requests
pending for the CPU.
A CPU interrupt vector is not supplied until the CPU requests it. Therefore, it is possible that a higher
priority interrupt request could override the original exception which caused the CPU to request the vector.
In this case, the CPU will receive the highest priority vector and the system will process this exception first
instead of the original request.
If the interrupt source is unknown (for example, in the case where an interrupt request becomes inactive
after the interrupt has been recognized, but prior to the vector request), the vector address supplied to the
CPU defaults to that of the spurious interrupt vector.
NOTE
Care must be taken to ensure that all exception requests remain active until
the system begins execution of the applicable service routine; otherwise, the
exception request may not get processed at all or the result may be a
spurious interrupt request (vector at address (vector base + 0x0001DC)).
4.4.4
Reset Exception Requests
The INT module supports one system reset exception request. The different reset types are mapped to this
vector (for details please refer to the Clock and Power Management Unit module (CPMU)):
1. Pin reset
2. Power-on reset
3. Low-voltage reset
4. Clock monitor reset request
5. COP watchdog reset request
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
139
Chapter 4 Interrupt (S12ZINTV0)
4.4.5
Exception Priority
The priority (from highest to lowest) and address of all exception vectors issued by the INT module upon
request by the CPU are shown in Table 4-8. Generally, all non-maskable interrupts have higher priorities
than maskable interrupts. Please note that between the four software interrupts (Unimplemented op-code
trap page1/page2 requests, SWI request, SYS request) there is no real priority defined since they cannot
occur simultaneously (the S12Z CPU executes one instruction at a time).
Table 4-8. Exception Vector Map and Priority
Vector Address(1)
0xFFFFFC
Source
Pin reset, power-on reset, low-voltage reset, clock monitor reset, COP watchdog reset
(Vector base + 0x0001F8)
Unimplemented page1 op-code trap (SPARE) vector request
(Vector base + 0x0001F4)
Unimplemented page2 op-code trap (TRAP) vector request
(Vector base + 0x0001F0)
Software interrupt instruction (SWI) vector request
(Vector base + 0x0001EC)
System call interrupt instruction (SYS) vector request
(Vector base + 0x0001E8)
Machine exception vector request
(Vector base + 0x0001E4)
Reserved
(Vector base + 0x0001E0)
Reserved
(Vector base + 0x0001DC)
Spurious interrupt
(Vector base + 0x0001D8)
XIRQ interrupt request
(Vector base + 0x0001D4)
IRQ interrupt request
(Vector base + 0x000010
..
Vector base + 0x0001D0)
Device specific I-bit maskable interrupt sources (priority determined by the associated
configuration registers, in descending order)
1. 24 bits vector address based
4.4.6
Interrupt Vector Table Layout
The interrupt vector table contains 128 entries, each 32 bits (4 bytes) wide. Each entry contains a 24-bit
address (3 bytes) which is stored in the 3 low-significant bytes of the entry. The content of the most
significant byte of a vector-table entry is ignored. Figure 4-13 illustrates the vector table entry format.
Bits
[31:24]
[23:0]
(unused)
ISR Address
Figure 4-13. Interrupt Vector Table Entry
4.5
4.5.1
Initialization/Application Information
Initialization
After system reset, software should:
• Initialize the interrupt vector base register if the interrupt vector table is not located at the default
location (0xFFFE00–0xFFFFFB).
MC9S12ZVM Family Reference Manual Rev. 1.5
140
Freescale Semiconductor
Chapter 4 Interrupt (S12ZINTV0)
•
Initialize the interrupt processing level configuration data registers (INT_CFADDR,
INT_CFDATA0–7) for all interrupt vector requests with the desired priority levels. It might be a
good idea to disable unused interrupt requests.
Enable I-bit maskable interrupts by clearing the I-bit in the CCW.
Enable the X-bit maskable interrupt by clearing the X-bit in the CCW (if required).
•
•
4.5.2
Interrupt Nesting
The interrupt request priority level scheme makes it possible to implement priority based interrupt request
nesting for the I-bit maskable interrupt requests.
• I-bit maskable interrupt requests can be interrupted by an interrupt request with a higher priority,
so that there can be up to seven nested I-bit maskable interrupt requests at a time (refer to Figure 414 for an example using up to three nested interrupt requests).
I-bit maskable interrupt requests cannot be interrupted by other I-bit maskable interrupt requests per
default. In order to make an interrupt service routine (ISR) interruptible, the ISR must explicitly clear the
I-bit in the CCW (CLI). After clearing the I-bit, I-bit maskable interrupt requests with higher priority can
interrupt the current ISR.
An ISR of an interruptible I-bit maskable interrupt request could basically look like this:
• Service interrupt, e.g., clear interrupt flags, copy data, etc.
• Clear I-bit in the CCW by executing the CPU instruction CLI (thus allowing interrupt requests with
higher priority)
• Process data
• Return from interrupt by executing the instruction RTI
0
Stacked IPL
IPL in CCW
0
0
4
0
0
0
4
7
4
3
1
0
7
6
L7
5
RTI
4
RTI
Processing Levels
3
L3 (Pending)
2
L4
RTI
1
L1 (Pending)
0
RTI
Reset
Figure 4-14. Interrupt Processing Example
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
141
Chapter 4 Interrupt (S12ZINTV0)
4.5.3
4.5.3.1
Wake Up from Stop or Wait Mode
CPU Wake Up from Stop or Wait Mode
Every I-bit maskable interrupt request which is configured to be handled by the CPU is capable of waking
the MCU from stop or wait mode. Additionally machine exceptions can wake-up the MCU from stop or
wait mode.
To determine whether an I-bit maskable interrupts is qualified to wake up the CPU or not, the same settings
as in normal run mode are applied during stop or wait mode:
• If the I-bit in the CCW is set, all I-bit maskable interrupts are masked from waking up the MCU.
• An I-bit maskable interrupt is ignored if it is configured to a priority level below or equal to the
current IPL in CCW.
The X-bit maskable interrupt request can wake up the MCU from stop or wait mode at anytime, even if
the X-bit in CCW is set1. If the X-bit maskable interrupt request is used to wake-up the MCU with the Xbit in the CCW set, the associated ISR is not called. The CPU then resumes program execution with the
instruction following the WAI or STOP instruction. This feature works following the same rules like any
interrupt request, i.e. care must be taken that the X-bit maskable interrupt request used for wake-up
remains active at least until the system begins execution of the instruction following the WAI or STOP
instruction; otherwise, wake-up may not occur.
1. The capability of the XIRQ pin to wake-up the MCU with the X bit set may not be available if, for example, the XIRQ pin is
shared with other peripheral modules on the device. Please refer to the Port Integration Module (PIM) section of the MCU
reference manual for details.
MC9S12ZVM Family Reference Manual Rev. 1.5
142
Freescale Semiconductor
Chapter 5
Background Debug Controller (S12ZBDCV2)
Table 5-1. Revision History
Revision
Number
Revision
Date
Sections
Affected
V2.04
03.Dec.2012
Section 5.1.3.3
Included BACKGROUND/ Stop mode dependency
V2.05
22.Jan.2013
Section 5.3.2.2
Improved NORESP description and added STEP1/ Wait mode dependency
V2.06
22.Mar.2013
Section 5.3.2.2
Improved NORESP description of STEP1/ Wait mode dependency
V2.07
11.Apr.2013
V2.08
31.May.2013
Section 5.4.4.4
Section 5.4.7.1
Removed misleading WAIT and BACKGROUND interdepency description
Added subsection dedicated to Long-ACK
V2.09
29.Aug.2013
Section 5.4.4.12
Noted that READ_DBGTB is only available for devices featuring a trace
buffer.
V2.10
21.Oct.2013
Section 5.1.3.3.2 Improved description of NORESP dependence on WAIT and BACKROUND
5.1
Description of Changes
Section 5.1.3.3.1 Improved STOP and BACKGROUND interdepency description
Introduction
The background debug controller (BDC) is a single-wire, background debug system implemented in onchip hardware for minimal CPU intervention. The device BKGD pin interfaces directly to the BDC.
The S12ZBDC maintains the standard S12 serial interface protocol but introduces an enhanced handshake
protocol and enhanced BDC command set to support the linear instruction set family of S12Z devices and
offer easier, more flexible internal resource access over the BDC serial interface.
5.1.1
Glossary
Table 5-2. Glossary Of Terms
Term
Definition
DBG
On chip Debug Module
BDM
Active Background Debug Mode
CPU
S12Z CPU
SSC
Special Single Chip Mode (device operating mode
NSC
Normal Single Chip Mode (device operating mode)
BDCSI
Background Debug Controller Serial Interface. This refers to the single pin BKGD serial interface.
EWAIT
Optional S12 feature which allows external devices to delay external accesses until deassertion of EWAIT
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
143
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.1.2
Features
The BDC includes these distinctive features:
• Single-wire communication with host development system
• SYNC command to determine communication rate
• Genuine non-intrusive handshake protocol
• Enhanced handshake protocol for error detection and stop mode recognition
• Active out of reset in special single chip mode
• Most commands not requiring active BDM, for minimal CPU intervention
• Full global memory map access without paging
• Simple flash mass erase capability
5.1.3
Modes of Operation
S12 devices feature power modes (run, wait, and stop) and operating modes (normal single chip, special
single chip). Furthermore, the operation of the BDC is dependent on the device security status.
5.1.3.1
BDC Modes
The BDC features module specific modes, namely disabled, enabled and active. These modes are
dependent on the device security and operating mode. In active BDM the CPU ceases execution, to allow
BDC system access to all internal resources including CPU internal registers.
5.1.3.2
Security and Operating mode Dependency
In device run mode the BDC dependency is as follows
• Normal modes, unsecure device
General BDC operation available. The BDC is disabled out of reset.
• Normal modes, secure device
BDC disabled. No BDC access possible.
• Special single chip mode, unsecure
BDM active out of reset. All BDC commands are available.
• Special single chip mode, secure
BDM active out of reset. Restricted command set available.
When operating in secure mode, BDC operation is restricted to allow checking and clearing security by
mass erasing the on-chip flash memory. Secure operation prevents BDC access to on-chip memory other
than mass erase. The BDC command set is restricted to those commands classified as Always-available.
MC9S12ZVM Family Reference Manual Rev. 1.5
144
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.1.3.3
5.1.3.3.1
Low-Power Modes
Stop Mode
The execution of the CPU STOP instruction leads to stop mode only when all bus masters (CPU, or others,
depending on the device) have finished processing. The operation during stop mode depends on the
ENBDC and BDCCIS bit settings as summarized in Table 5-3
Table 5-3. BDC STOP Operation Dependencies
ENBDC
BDCCIS
Description Of Operation
0
0
BDC has no effect on STOP mode.
0
1
BDC has no effect on STOP mode.
1
0
Only BDCSI clock continues
1
1
All clocks continue
A disabled BDC has no influence on stop mode operation. In this case the BDCSI clock is disabled in stop
mode thus it is not possible to enable the BDC from within stop mode.
STOP Mode With BDC Enabled And BDCCIS Clear
If the BDC is enabled and BDCCIS is clear, then the BDC prevents the BDCCLK clock (Figure 5-5) from
being disabled in stop mode. This allows BDC communication to continue throughout stop mode in order
to access the BDCCSR register. All other device level clock signals are disabled on entering stop mode.
NOTE
This is intended for application debugging, not for fast flash programming.
Thus the CLKSW bit must be clear to map the BDCSI to BDCCLK.
With the BDC enabled, an internal acknowledge delays stop mode entry and exit by 2 BDCSI clock + 2
bus clock cycles. If no other module delays stop mode entry and exit, then these additional clock cycles
represent a difference between the debug and not debug cases. Furthermore if a BDC internal access is
being executed when the device is entering stop mode, then the stop mode entry is delayed until the internal
access is complete (typically for 1 bus clock cycle).
Accesses to the internal memory map are not possible when the internal device clocks are disabled. Thus
attempted accesses to memory mapped resources are suppressed and the NORESP flag is set. Resources
can be accessed again by the next command received following exit from Stop mode.
A BACKGROUND command issued whilst in stop mode remains pending internally until the device
leaves stop mode. This means that subsequent active BDM commands, issued whilst BACKGROUND is
pending, set the ILLCMD flag because the device is not yet in active BDM.
If ACK handshaking is enabled, then the first ACK, following a stop mode entry is long to indicate a stop
exception. The BDC indicates a stop mode occurrence by setting the BDCCSR bit STOP. If the host
attempts further communication before the ACK pulse generation then the OVRUN bit is set.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
145
Chapter 5 Background Debug Controller (S12ZBDCV2)
STOP Mode With BDC Enabled And BDCCIS Set
If the BDC is enabled and BDCCIS is set, then the BDC prevents core clocks being disabled in stop mode.
This allows BDC communication, for access of internal memory mapped resources, but not CPU registers,
to continue throughout stop mode.
A BACKGROUND command issued whilst in stop mode remains pending internally until the device
leaves stop mode. This means that subsequent active BDM commands, issued whilst BACKGROUND is
pending, set the ILLCMD flag because the device is not yet in active BDM.
If ACK handshaking is enabled, then the first ACK, following a stop mode entry is long to indicate a stop
exception. The BDC indicates a stop mode occurrence by setting the BDCCSR bit STOP. If the host
attempts further communication before the ACK pulse generation then the OVRUN bit is set.
5.1.3.3.2
Wait Mode
The device enters wait mode when the CPU starts to execute the WAI instruction. The second part of the
WAI instruction (return from wait mode) can only be performed when an interrupt occurs. Thus on
entering wait mode the CPU is in the middle of the WAI instruction and cannot permit access to CPU
internal resources, nor allow entry to active BDM. Thus only commands classified as Non-Intrusive or
Always-Available are possible in wait mode.
On entering wait mode, the WAIT flag in BDCCSR is set. If the ACK handshake protocol is enabled then
the first ACK generated after WAIT has been set is a long-ACK pulse. Thus the host can recognize a wait
mode occurrence. The WAIT flag remains set and cannot be cleared whilst the device remains in wait
mode. After the device leaves wait mode the WAIT flag can be cleared by writing a “1” to it.
A BACKGROUND command issued whilst in wait mode sets the NORESP bit and the BDM active
request remains pending internally until the CPU leaves wait mode due to an interrupt. The device then
enters BDM with the PC pointing to the address of the first instruction of the ISR.
With ACK disabled, further Non-Intrusive or Always-Available commands are possible, in this pending
state, but attempted Active-Background commands set NORESP and ILLCMD because the BDC is not in
active BDM state.
With ACK enabled, if the host attempts further communication before the ACK pulse generation then the
OVRUN bit is set.
Similarly the STEP1 command issued from a WAI instruction cannot be completed by the CPU until the
CPU leaves wait mode due to an interrupt. The first STEP1 into wait mode sets the BDCCSR WAIT bit.
If the part is still in Wait mode and a further STEP1 is carried out then the NORESP and ILLCMD bits are
set because the device is no longer in active BDM for the duration of WAI execution.
5.1.4
Block Diagram
A block diagram of the BDC is shown in Figure 5-1.
MC9S12ZVM Family Reference Manual Rev. 1.5
146
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
HOST
SYSTEM
BKGD
SERIAL INTERFACE CONTROL
AND SHIFT REGISTER
CLOCK DOMAIN
CONTROL
INSTRUCTION
DECODE AND
FSM
BDCSI
CORE CLOCK
ADDRESS
BUS INTERFACE
AND
CONTROL LOGIC
BDCCSR REGISTER
AND DATAPATH
CONTROL
DATA
BUS CONTROL
CPU CONTROL
ERASE FLASH
FLASH ERASED
FLASH SECURE
Figure 5-1. BDC Block Diagram
5.2
External Signal Description
A single-wire interface pin (BKGD) is used to communicate with the BDC system. During reset, this pin
is a device mode select input. After reset, this pin becomes the dedicated serial interface pin for the BDC.
BKGD is a pseudo-open-drain pin with an on-chip pull-up. Unlike typical open-drain pins, the external
RC time constant on this pin due to external capacitance, plays almost no role in signal rise time. The
custom protocol provides for brief, actively driven speed-up pulses to force rapid rise times on this pin
without risking harmful drive level conflicts. Refer to Section 5.4.6” for more details.
5.3
5.3.1
Memory Map and Register Definition
Module Memory Map
Table 5-4 shows the BDC memory map.
Table 5-4. BDC Memory Map
Global Address
Module
Size
(Bytes)
Not Applicable
BDC registers
2
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
147
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.3.2
Register Descriptions
The BDC registers are shown in Figure 5-2. Registers are accessed only by host-driven communications
to the BDC hardware using READ_BDCCSR and WRITE_BDCCSR commands. They are not accessible
in the device memory map.
Global
Address
Register
Name
Bit 7
Not
Applicable
BDCCSRH R
Not
Applicable
BDCCSRL
W
R
W
ENBDC
WAIT
6
BDMACT
STOP
5
4
0
BDCCIS
RAMWF
OVRUN
= Unimplemented, Reserved
3
2
STEAL
CLKSW
NORESP
RDINV
0
1
Bit 0
UNSEC
ERASE
ILLACC
ILLCMD
= Always read zero
Figure 5-2. BDC Register Summary
5.3.2.1
BDC Control Status Register High (BDCCSRH)
Register Address: This register is not in the device memory map. It is accessible using BDC inherent addressing commands
7
R
W
6
ENBDC
BDMACT
5
BDCCIS
4
0
3
2
STEAL
CLKSW
1
0
UNSEC
ERASE
Reset
Secure AND SSC-Mode
1
1
0
0
0
0
0
0
Unsecure AND SSC-Mode
1
1
0
0
0
0
1
0
Secure AND NSC-Mode
0
0
0
0
0
0
0
0
Unsecure AND NSC-Mode
0
0
0
0
0
0
1
0
= Unimplemented, Reserved
0
= Always read zero
Figure 5-3. BDC Control Status Register High (BDCCSRH)
Read: All modes through BDC operation only.
Write: All modes through BDC operation only, when not secured, but subject to the following:
— Bits 7,3 and 2 can only be written by WRITE_BDCCSR commands.
— Bit 5 can only be written by WRITE_BDCCSR commands when the device is not in stop mode.
— Bits 6, 1 and 0 cannot be written. They can only be updated by internal hardware.
MC9S12ZVM Family Reference Manual Rev. 1.5
148
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-5. BDCCSRH Field Descriptions
Field
Description
7
ENBDC
Enable BDC — This bit controls whether the BDC is enabled or disabled. When enabled, active BDM can be
entered and non-intrusive commands can be carried out. When disabled, active BDM is not possible and the
valid command set is restricted. Further information is provided in Table 5-7.
0 BDC disabled
1 BDC enabled
Note: ENBDC is set out of reset in special single chip mode.
6
BDMACT
BDM Active Status — This bit becomes set upon entering active BDM. BDMACT is cleared as part of the active
BDM exit sequence.
0 BDM not active
1 BDM active
Note: BDMACT is set out of reset in special single chip mode.
5
BDCCIS
BDC Continue In Stop — If ENBDC is set then BDCCIS selects the type of BDC operation in stop mode (as
shown in Table 5-3). If ENBDC is clear, then the BDC has no effect on stop mode and no BDC communication
is possible.If ACK pulse handshaking is enabled, then the first ACK pulse following stop mode entry is a long
ACK. This bit cannot be written when the device is in stop mode.
0 Only the BDCSI clock continues in stop mode
1 All clocks continue in stop mode
3
STEAL
Steal enabled with ACK— This bit forces immediate internal accesses with the ACK handshaking protocol
enabled. If ACK handshaking is disabled then BDC accesses steal the next bus cycle.
0 If ACK is enabled then BDC accesses await a free cycle, with a timeout of 512 cycles
1 If ACK is enabled then BDC accesses are carried out in the next bus cycle
2
CLKSW
Clock Switch — The CLKSW bit controls the BDCSI clock source. This bit is initialized to “0” by each reset and
can be written to “1”. Once it has been set, it can only be cleared by a reset. When setting CLKSW a minimum
delay of 150 cycles at the initial clock speed must elapse before the next command can be sent. This guarantees
that the start of the next BDC command uses the new clock for timing subsequent BDC communications.
0 BDCCLK used as BDCSI clock source
1 Device fast clock used as BDCSI clock source
Note: Refer to the device specification to determine which clock connects to the BDCCLK and fast clock inputs.
1
UNSEC
Unsecure — If the device is unsecure, the UNSEC bit is set automatically.
0 Device is secure.
1 Device is unsecure.
Note: When UNSEC is set, the device is unsecure and the state of the secure bits in the on-chip Flash EEPROM
can be changed.
0
ERASE
Erase Flash — This bit can only be set by the dedicated ERASE_FLASH command. ERASE is unaffected by
write accesses to BDCCSR. ERASE is cleared either when the mass erase sequence is completed, independent
of the actual status of the flash array or by a soft reset.
Reading this bit indicates the status of the requested mass erase sequence.
0 No flash mass erase sequence pending completion
1 Flash mass erase sequence pending completion.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
149
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.3.2.2
BDC Control Status Register Low (BDCCSRL)
Register Address: This register is not in the device memory map. It is accessible using BDC inherent addressing commands
R
W
Reset
7
6
5
4
3
2
1
0
WAIT
STOP
RAMWF
OVRUN
NORESP
RDINV
ILLACC
ILLCMD
0
0
0
0
0
0
0
0
Figure 5-4. BDC Control Status Register Low (BDCCSRL)
Read: BDC access only.
Write: Bits [7:5], [3:0] BDC access only, restricted to flag clearing by writing a “1” to the bit position.
Write: Bit 4 never. It can only be cleared by a SYNC pulse.
If ACK handshaking is enabled then BDC commands with ACK causing a BDCCSRL[3:1] flag setting
condition also generate a long ACK pulse. Subsequent commands that are executed correctly generate a
normal ACK pulse. Subsequent commands that are not correctly executed generate a long ACK pulse. The
first ACK pulse after WAIT or STOP have been set also generates a long ACK. Subsequent ACK pulses
are normal, whilst STOP and WAIT remain set.
Long ACK pulses are not immediately generated if an overrun condition is caused by the host driving the
BKGD pin low whilst a target ACK is pending, because this would conflict with an attempted host
transmission following the BKGD edge. When a whole byte has been received following the offending
BKGD edge, the OVRUN bit is still set, forcing subsequent ACK pulses to be long.
Unimplemented BDC opcodes causing the ILLCMD bit to be set do not generate a long ACK because this
could conflict with further transmission from the host. If the ILLCMD is set for another reason, then a long
ACK is generated for the current command if it is a BDC command with ACK.
Table 5-6. BDCCSRL Field Descriptions
Field
Description
7
WAIT
WAIT Indicator Flag — Indicates that the device entered wait mode. Writing a “1” to this bit whilst in wait mode
has no effect. Writing a “1” after exiting wait mode, clears the bit.
0 Device did not enter wait mode
1 Device entered wait mode.
6
STOP
STOP Indicator Flag — Indicates that the CPU requested stop mode following a STOP instruction. Writing a
“1” to this bit whilst not in stop mode clears the bit. Writing a “1” to this bit whilst in stop mode has no effect.
This bit can only be set when the BDC is enabled.
0 Device did not enter stop mode
1 Device entered stop mode.
5
RAMWF
RAM Write Fault — Indicates an ECC double fault during a BDC write access to RAM.
Writing a “1” to this bit, clears the bit.
0 No RAM write double fault detected.
1 RAM write double fault detected.
MC9S12ZVM Family Reference Manual Rev. 1.5
150
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-6. BDCCSRL Field Descriptions (continued)
Field
Description
4
OVRUN
Overrun Flag — Indicates unexpected host activity before command completion.
This occurs if a new command is received before the current command completion.
With ACK enabled this also occurs if the host drives the BKGD pin low whilst a target ACK pulse is pending
To protect internal resources from misinterpreted BDC accesses following an overrun, internal accesses are
suppressed until a SYNC clears this bit.
A SYNC clears the bit.
0 No overrun detected.
1 Overrun detected when issuing a BDC command.
3
NORESP
No Response Flag — Indicates that the BDC internal action or data access did not complete. This occurs in the
following scenarios:
a) If no free cycle for an access is found within 512 core clock cycles. This could typically happen if a code loop
without free cycles is executing with ACK enabled and STEAL clear.
b) With ACK disabled or STEAL set, when an internal access is not complete before the host starts
data/BDCCSRL retrieval or an internal write access is not complete before the host starts the next BDC
command.
c) Attempted internal memory or SYNC_PC accesses during STOP mode set NORESP if BDCCIS is clear.
In the above cases, on setting NORESP, the BDC aborts the access if permitted. (For devices supporting
EWAIT, BDC external accesses with EWAIT assertions, prevent a command from being aborted until EWAIT
is deasserted).
d) If a BACKGROUND command is issued whilst the device is in wait mode the NORESP bit is set but the
command is not aborted. The active BDM request is completed when the device leaves wait mode.
Furthermore subsequent CPU register access commands during wait mode set the NORESP bit, should it
have been cleared.
e) If a command is issued whilst awaiting return from Wait mode. This can happen when using STEP1 to step
over a CPU WAI instruction, if the CPU has not returned from Wait mode before the next BDC command is
received.
f) If STEP1 is issued with the BDC enabled as the device enters Wait mode regardless of the BDMACT state.
When NORESP is set a value of 0xEE is returned for each data byte associated with the current access.
Writing a “1” to this bit, clears the bit.
0 Internal action or data access completed.
1 Internal action or data access did not complete.
2
RDINV
Read Data Invalid Flag — Indicates invalid read data due to an ECC error during a BDC initiated read access.
The access returns the actual data read from the location.
Writing a “1” to this bit, clears the bit.
0 No invalid read data detected.
1 Invalid data returned during a BDC read access.
1
ILLACC
Illegal Access Flag — Indicates an attempted illegal access. This is set in the following cases:
When the attempted access addresses unimplemented memory
When the access attempts to write to the flash array
When a CPU register access is attempted with an invalid CRN (Section 5.4.5.1).
Illegal accesses return a value of 0xEE for each data byte
Writing a “1” to this bit, clears the bit.
0 No illegal access detected.
1 Illegal BDC access detected.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
151
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-6. BDCCSRL Field Descriptions (continued)
Field
Description
0
ILLCMD
Illegal Command Flag — Indicates an illegal BDC command. This bit is set in the following cases:
When an unimplemented BDC command opcode is received.
When a DUMP_MEM{_WS}, FILL_MEM{_WS} or READ_SAME{_WS} is attempted in an illegal sequence.
When an active BDM command is received whilst BDM is not active
When a non Always-available command is received whilst the BDC is disabled or a flash mass erase is ongoing.
When a non Always-available command is received whilst the device is secure
Read commands return a value of 0xEE for each data byte
Writing a “1” to this bit, clears the bit.
0 No illegal command detected.
1 Illegal BDC command detected.
5.4
5.4.1
Functional Description
Security
If the device resets with the system secured, the device clears the BDCCSR UNSEC bit. In the secure state
BDC access is restricted to the BDCCSR register. A mass erase can be requested using the
ERASE_FLASH command. If the mass erase is completed successfully, the device programs the security
bits to the unsecure state and sets the BDC UNSEC bit. If the mass erase is unsuccessful, the device
remains secure and the UNSEC bit is not set.
For more information regarding security, please refer to device specific security information.
5.4.2
Enabling BDC And Entering Active BDM
BDM can be activated only after being enabled. BDC is enabled by setting the ENBDC bit in the BDCCSR
register, via the single-wire interface, using the command WRITE_BDCCSR.
After being enabled, BDM is activated by one of the following1:
• The BDC BACKGROUND command
• A CPU BGND instruction
• The DBG Breakpoint mechanism
Alternatively BDM can be activated directly from reset when resetting into Special Single Chip Mode.
The BDC is ready for receiving the first command 10 core clock cycles after the deassertion of the internal
reset signal. This is delayed relative to the external pin reset as specified in the device reset documentation.
On S12Z devices an NVM initialization phase follows reset. During this phase the BDC commands
classified as always available are carried out immediately, whereas other BDC commands are subject to
delayed response due to the NVM initialization phase.
NOTE
After resetting into SSC mode, the initial PC address must be supplied by
the host using the WRITE_Rn command before issuing the GO command.
1. BDM active immediately out of special single-chip reset.
MC9S12ZVM Family Reference Manual Rev. 1.5
152
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
When BDM is activated, the CPU finishes executing the current instruction. Thereafter only BDC
commands can affect CPU register contents until the BDC GO command returns from active BDM to user
code or a device reset occurs. When BDM is activated by a breakpoint, the type of breakpoint used
determines if BDM becomes active before or after execution of the next instruction.
NOTE
Attempting to activate BDM using a BGND instruction whilst the BDC is
disabled, the CPU requires clock cycles for the attempted BGND execution.
However BACKGROUND commands issued whilst the BDC is disabled
are ignored by the BDC and the CPU execution is not delayed.
5.4.3
Clock Source
The BDC clock source can be mapped to a constant frequency clock source or a PLL based fast clock. The
clock source for the BDC is selected by the CLKSW bit as shown in Figure 5-5. The BDC internal clock
is named BDCSI clock. If BDCSI clock is mapped to the BDCCLK by CLKSW then the serial interface
communication is not affected by bus/core clock frequency changes. If the BDC is mapped to BDCFCLK
then the clock is connected to a PLL derived source at device level (typically bus clock), thus can be
subject to frequency changes in application. Debugging through frequency changes requires SYNC pulses
to re-synchronize. The sources of BDCCLK and BDCFCLK are specified at device level.
BDC accesses of internal device resources always use the device core clock. Thus if the ACK handshake
protocol is not enabled, the clock frequency relationship must be taken into account by the host.
When changing the clock source via the CLKSW bit a minimum delay of 150 cycles at the initial clock
speed must elapse before a SYNC can be sent. This guarantees that the start of the next BDC command
uses the new clock for timing subsequent BDC communications.
BDCCLK
BDCFCLK
0
BDCSI Clock
BDC serial interface
and FSM
1
CLKSW
Core clock
BDC device resource
interface
Figure 5-5. Clock Switch
5.4.4
BDC Commands
BDC commands can be classified into three types as shown in Table 5-7.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
153
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-7. BDC Command Types
Command Type
Secure
Status
BDC
Status
Always-available
Secure or
Unsecure
Enabled or
Disabled
Non-intrusive
Active background
Unsecure
Unsecure
Enabled
Active
CPU Status
Command Set
—
•
•
•
•
Read/write access to BDCCSR
Mass erase flash memory using ERASE_FLASH
SYNC
ACK enable/disable
Code
execution
allowed
•
•
•
•
•
•
•
•
Read/write access to BDCCSR
Memory access
Memory access with status
Mass erase flash memory using ERASE_FLASH
Debug register access
BACKGROUND
SYNC
ACK enable/disable
Code
execution
halted
•
•
•
•
•
•
•
•
•
•
Read/write access to BDCCSR
Memory access
Memory access with status
Mass erase flash memory using ERASE_FLASH
Debug register access
Read or write CPU registers
Single-step the application
Exit active BDM to return to the application program (GO)
SYNC
ACK enable/disable
Non-intrusive commands are used to read and write target system memory locations and to enter active
BDM. Target system memory includes all memory and registers within the global memory map, including
external memory.
Active background commands are used to read and write all memory locations and CPU resources.
Furthermore they allow single stepping through application code and to exit from active BDM.
Non-intrusive commands can only be executed when the BDC is enabled and the device unsecure. Active
background commands can only be executed when the system is not secure and is in active BDM.
Non-intrusive commands do not require the system to be in active BDM for execution, although, they can
still be executed in this mode. When executing a non-intrusive command with the ACK pulse handshake
protocol disabled, the BDC steals the next bus cycle for the access. If an operation requires multiple cycles,
then multiple cycles can be stolen. Thus if stolen cycles are not free cycles, the application code execution
is delayed. The delay is negligible because the BDC serial transfer rate dictates that such accesses occur
infrequently.
For data read commands, the external host must wait at least 16 BDCSI clock cycles after sending the
address before attempting to obtain the read data. This is to be certain that valid data is available in the
BDC shift register, ready to be shifted out. For write commands, the external host must wait 16 bdcsi
cycles after sending the data to be written before attempting to send a new command. This is to avoid
disturbing the BDC shift register before the write has been completed. The external host must wait at least
for 16 bdcsi cycles after a control command before starting any new serial command.
MC9S12ZVM Family Reference Manual Rev. 1.5
154
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
If the ACK pulse handshake protocol is enabled and STEAL is cleared, then the BDC waits for the first
free bus cycle to make a non-intrusive access. If no free bus cycle occurs within 512 core clock cycles then
the BDC aborts the access, sets the NORESP bit and uses a long ACK pulse to indicate an error condition
to the host.
Table 5-8 summarizes the BDC command set. The subsequent sections describe each command in detail
and illustrate the command structure in a series of packets, each consisting of eight bit times starting with
a falling edge. The bar across the top of the blocks indicates that the BKGD line idles in the high state. The
time for an 8-bit command is 8 × 16 target BDCSI clock cycles.
The nomenclature below is used to describe the structure of the BDC commands. Commands begin with
an 8-bit hexadecimal command code in the host-to-target direction (most significant bit first)
/
d
dack
ad24
rd8
rd16
rd24
rd32
rd64
rd.sz
wd8
wd16
wd32
wd.sz
ss
sz
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
crn
WS
=
=
separates parts of the command
delay 16 target BDCSI clock cycles (DLY)
delay (16 cycles) no ACK; or delay (=> 32 cycles) then ACK.(DACK)
24-bit memory address in the host-to-target direction
8 bits of read data in the target-to-host direction
16 bits of read data in the target-to-host direction
24 bits of read data in the target-to-host direction
32 bits of read data in the target-to-host direction
64 bits of read data in the target-to-host direction
read data, size defined by sz, in the target-to-host direction
8 bits of write data in the host-to-target direction
16 bits of write data in the host-to-target direction
32 bits of write data in the host-to-target direction
write data, size defined by sz, in the host-to-target direction
the contents of BDCCSRL in the target-to-host direction
memory operand size (00 = byte, 01 = word, 10 = long)
(sz = 11 is reserved and currently defaults to long)
core register number, 32-bit data width
command suffix signaling the operation is with status
Table 5-8. BDC Command Summary
Command
Mnemonic
Command
Classification
ACK
Command
Structure
Description
SYNC
Always
Available
N/A
N/A(1)
Request a timed reference pulse to
determine the target BDC communication
speed
ACK_DISABLE
Always
Available
No
0x03/d
Disable the communication handshake.
This command does not issue an ACK
pulse.
ACK_ENABLE
Always
Available
Yes
0x02/dack
Enable the communication handshake.
Issues an ACK pulse after the command is
executed.
Non-Intrusive
Yes
0x04/dack
Halt the CPU if ENBDC is set. Otherwise,
ignore as illegal command.
BACKGROUND
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
155
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-8. BDC Command Summary (continued)
Command
Mnemonic
Command
Classification
ACK
Command
Structure
DUMP_MEM.sz
Non-Intrusive
Yes
(0x32+4 x sz)/dack/rd.sz
Dump (read) memory based on operand
size (sz). Used with READ_MEM to dump
large blocks of memory. An initial
READ_MEM is executed to set up the
starting address of the block and to retrieve
the first result. Subsequent DUMP_MEM
commands retrieve sequential operands.
DUMP_MEM.sz_WS
Non-Intrusive
No
(0x33+4 x sz)/d/ss/rd.sz
Dump (read) memory based on operand
size (sz) and report status. Used with
READ_MEM{_WS} to dump large blocks of
memory. An initial READ_MEM{_WS} is
executed to set up the starting address of
the block and to retrieve the first result.
Subsequent DUMP_MEM{_WS}
commands retrieve sequential operands.
FILL_MEM.sz
Non-Intrusive
Yes
(0x12+4 x sz)/wd.sz/dack
Fill (write) memory based on operand size
(sz). Used with WRITE_MEM to fill large
blocks of memory. An initial WRITE_MEM
is executed to set up the starting address of
the block and to write the first operand.
Subsequent FILL_MEM commands write
sequential operands.
FILL_MEM.sz_WS
Non-Intrusive
No
(0x13+4 x sz)/wd.sz/d/ss
Fill (write) memory based on operand size
(sz) and report status. Used with
WRITE_MEM{_WS} to fill large blocks of
memory. An initial WRITE_MEM{_WS} is
executed to set up the starting address of
the block and to write the first operand.
Subsequent FILL_MEM{_WS} commands
write sequential operands.
GO
Active
Background
Yes
0x08/dack
Resume CPU user code execution
GO_UNTIL(2)
Active
Background
Yes
0x0C/dack
Go to user program. ACK is driven upon
returning to active background mode.
Non-Intrusive
Yes
0x00/dack
No operation
Active
Background
Yes
(0x60+CRN)/dack/rd32
READ_MEM.sz
Non-Intrusive
Yes
(0x30+4 x sz)/ad24/dack/rd.sz Read the appropriately-sized (sz) memory
value from the location specified by the 24bit address
READ_MEM.sz_WS
Non-Intrusive
No
(0x31+4 x sz)/ad24/d/ss/rd.sz Read the appropriately-sized (sz) memory
value from the location specified by the 24bit address and report status
READ_DBGTB
Non-Intrusive
Yes
NOP
READ_Rn
(0x07)/dack/rd32/dack/rd32
Description
Read the requested CPU register
Read 64-bits of DBG trace buffer
MC9S12ZVM Family Reference Manual Rev. 1.5
156
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-8. BDC Command Summary (continued)
Command
Mnemonic
Command
Classification
ACK
Command
Structure
READ_SAME.sz
Non-Intrusive
Yes
(0x50+4 x sz)/dack/rd.sz
Read from location. An initial READ_MEM
defines the address, subsequent
READ_SAME reads return content of
same address
READ_SAME.sz_WS
Non-Intrusive
No
(0x51+4 x sz)/d/ss/rd.sz
Read from location. An initial READ_MEM
defines the address, subsequent
READ_SAME reads return content of
same address
Always
Available
No
0x2D/rd16
SYNC_PC
Non-Intrusive
Yes
0x01/dack/rd24
WRITE_MEM.sz
Non-Intrusive
Yes
(0x10+4 x
sz)/ad24/wd.sz/dack
WRITE_MEM.sz_WS
Non-Intrusive
No
Active
Background
Yes
(0x40+CRN)/wd32/dack
WRITE_BDCCSR
Always
Available
No
0x0D/wd16
ERASE_FLASH
Always
Available
No
0x95/d
Active
Background
Yes
0x09/dack
READ_BDCCSR
WRITE_Rn
STEP1 (TRACE1)
Description
Read the BDCCSR register
Read current PC
Write the appropriately-sized (sz) memory
value to the location specified by the 24-bit
address
(0x11+4 x sz)/ad24/wd.sz/d/ss Write the appropriately-sized (sz) memory
value to the location specified by the 24-bit
address and report status
Write the requested CPU register
Write the BDCCSR register
Mass erase internal flash
Execute one CPU command.
1. The SYNC command is a special operation which does not have a command code.
2. The GO_UNTIL command is identical to the GO command if ACK is not enabled.
5.4.4.1
SYNC
The SYNC command is unlike other BDC commands because the host does not necessarily know the
correct speed to use for serial communications until after it has analyzed the response to the SYNC
command.
To issue a SYNC command, the host:
1. Ensures that the BKGD pin is high for at least 4 cycles of the slowest possible BDCSI clock
without reset asserted.
2. Drives the BKGD pin low for at least 128 cycles of the slowest possible BDCSI clock.
3. Drives BKGD high for a brief speed-up pulse to get a fast rise time. (This speedup pulse is typically
one cycle of the host clock which is as fast as the maximum target BDCSI clock).
4. Removes all drive to the BKGD pin so it reverts to high impedance.
5. Listens to the BKGD pin for the sync response pulse.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
157
Chapter 5 Background Debug Controller (S12ZBDCV2)
Upon detecting the sync request from the host (which is a much longer low time than would ever occur
during normal BDC communications), the target:
1. Discards any incomplete command
2. Waits for BKGD to return to a logic high.
3. Delays 16 cycles to allow the host to stop driving the high speed-up pulse.
4. Drives BKGD low for 128 BDCSI clock cycles.
5. Drives a 1-cycle high speed-up pulse to force a fast rise time on BKGD.
6. Removes all drive to the BKGD pin so it reverts to high impedance.
7. Clears the OVRRUN flag (if set).
The host measures the low time of this 128-cycle SYNC response pulse and determines the correct speed
for subsequent BDC communications. Typically, the host can determine the correct communication speed
within a few percent of the actual target speed and the serial protocol can easily tolerate this speed error.
If the SYNC request is detected by the target, any partially executed command is discarded. This is referred
to as a soft-reset, equivalent to a timeout in the serial communication. After the SYNC response, the target
interprets the next negative edge (issued by the host) as the start of a new BDC command or the start of
new SYNC request.
A SYNC command can also be used to abort a pending ACK pulse. This is explained in Section 5.4.8.
5.4.4.2
ACK_DISABLE
Disable host/target handshake protocol
Always Available
0x03
host →
target
D
L
Y
Disables the serial communication handshake protocol. The subsequent commands, issued after the
ACK_DISABLE command, do not execute the hardware handshake protocol. This command is not
followed by an ACK pulse.
5.4.4.3
ACK_ENABLE
Enable host/target handshake protocol
Always Available
0x02
host →
target
D
A
C
K
Enables the hardware handshake protocol in the serial communication. The hardware handshake is
implemented by an acknowledge (ACK) pulse issued by the target MCU in response to a host command.
The ACK_ENABLE command is interpreted and executed in the BDC logic without the need to interface
MC9S12ZVM Family Reference Manual Rev. 1.5
158
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
with the CPU. An ACK pulse is issued by the target device after this command is executed. This command
can be used by the host to evaluate if the target supports the hardware handshake protocol. If the target
supports the hardware handshake protocol, subsequent commands are enabled to execute the hardware
handshake protocol, otherwise this command is ignored by the target. Table 5-8 indicates which
commands support the ACK hardware handshake protocol.
For additional information about the hardware handshake protocol, refer to Section 5.4.7,” and
Section 5.4.8.”
5.4.4.4
BACKGROUND
Enter active background mode (if enabled)
Non-intrusive
0x04
host →
target
D
A
C
K
Provided ENBDC is set, the BACKGROUND command causes the target MCU to enter active BDM as
soon as the current CPU instruction finishes. If ENBDC is cleared, the BACKGROUND command is
ignored.
A delay of 16 BDCSI clock cycles is required after the BACKGROUND command to allow the target
MCU to finish its current CPU instruction and enter active background mode before a new BDC command
can be accepted.
The host debugger must set ENBDC before attempting to send the BACKGROUND command the first
time. Normally the host sets ENBDC once at the beginning of a debug session or after a target system reset.
During debugging, the host uses GO commands to move from active BDM to application program
execution and uses the BACKGROUND command or DBG breakpoints to return to active BDM.
A BACKGROUND command issued during stop or wait modes cannot immediately force active BDM
because the WAI instruction does not end until an interrupt occurs. For the detailed mode dependency
description refer to Section 5.1.3.3.
The host can recognize this pending BDM request condition because both NORESP and WAIT are set, but
BDMACT is clear. Whilst in wait mode, with the pending BDM request, non-intrusive BDC commands
are allowed.
5.4.4.5
DUMP_MEM.sz, DUMP_MEM.sz_WS
DUMP_MEM.sz
Read memory specified by debug address register, then
increment address
0x32
Non-intrusive
Data[7-0]
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
159
Chapter 5 Background Debug Controller (S12ZBDCV2)
DUMP_MEM.sz
host →
target
D
A
C
K
0x36
host →
target
D
A
C
K
0x3A
host →
target
D
A
C
K
target →
host
Data[15-8]
Data[7-0]
target →
host
target →
host
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
target →
host
target →
host
target →
host
target →
host
DUMP_MEM.sz_WS
Read memory specified by debug address register with status,
then increment address
0x33
host →
target
BDCCSRL
D
L
Y
0x37
host →
target
D
L
Y
0x3B
host →
target
D
L
Y
target →
host
Non-intrusive
Data[7-0]
target →
host
BDCCSRL
Data[15-8]
Data[7-0]
target →
host
target →
host
BDCCSRL
Data[31-24]
Data23-16]
Data[15-8]
target →
host
target →
host
target →
host
target →
host
target →
host
Data[7-0]
target →
host
DUMP_MEM{_WS} is used with the READ_MEM{_WS} command to access large blocks of memory.
An initial READ_MEM{_WS} is executed to set-up the starting address of the block and to retrieve the
first result. The DUMP_MEM{_WS} command retrieves subsequent operands. The initial address is
incremented by the operand size (1, 2, or 4) and saved in a temporary register. Subsequent
DUMP_MEM{_WS} commands use this address, perform the memory read, increment it by the current
operand size, and store the updated address in the temporary register. If the with-status option is specified,
the BDCCSRL status byte is returned before the read data. This status byte reflects the state after the
memory read was performed. If enabled, an ACK pulse is driven before the data bytes are transmitted. The
effect of the access size and alignment on the next address to be accessed is explained in more detail in
Section 5.4.5.2”.
MC9S12ZVM Family Reference Manual Rev. 1.5
160
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
NOTE
DUMP_MEM{_WS} is a valid command only when preceded by SYNC,
NOP, READ_MEM{_WS}, or another DUMP_MEM{_WS} command.
Otherwise, an illegal command response is returned, setting the ILLCMD
bit. NOP can be used for inter-command padding without corrupting the
address pointer.
The size field (sz) is examined each time a DUMP_MEM{_WS} command is processed, allowing the
operand size to be dynamically altered. The examples show the DUMP_MEM.B{_WS},
DUMP_MEM.W{_WS} and DUMP_MEM.L{_WS} commands.
5.4.4.6
FILL_MEM.sz, FILL_MEM.sz_WS
FILL_MEM.sz
Write memory specified by debug address register, then
increment address
Non-intrusive
0x12
Data[7-0]
host →
target
host →
target
0x16
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
0x1A
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
host →
target
host →
target
D
A
C
K
D
A
C
K
D
A
C
K
FILL_MEM.sz_WS
Write memory specified by debug address register with
status, then increment address
Non-intrusive
BDCCSRL
0x13
Data[7-0]
host →
target
host →
target
0x17
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
D
L
Y
target →
host
BDCCSRL
D
L
Y
target →
host
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
161
Chapter 5 Background Debug Controller (S12ZBDCV2)
FILL_MEM.sz_WS
0x1B
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
host →
target
host →
target
host →
target
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
FILL_MEM{_WS} is used with the WRITE_MEM{_WS} command to access large blocks of memory.
An initial WRITE_MEM{_WS} is executed to set up the starting address of the block and write the first
datum. If an initial WRITE_MEM{_WS} is not executed before the first FILL_MEM{_WS}, an illegal
command response is returned. The FILL_MEM{_WS} command stores subsequent operands. The initial
address is incremented by the operand size (1, 2, or 4) and saved in a temporary register. Subsequent
FILL_MEM{_WS} commands use this address, perform the memory write, increment it by the current
operand size, and store the updated address in the temporary register. If the with-status option is specified,
the BDCCSRL status byte is returned after the write data. This status byte reflects the state after the
memory write was performed. If enabled an ACK pulse is generated after the internal write access has been
completed or aborted. The effect of the access size and alignment on the next address to be accessed is
explained in more detail in Section 5.4.5.2”
NOTE
FILL_MEM{_WS} is a valid command only when preceded by SYNC,
NOP, WRITE_MEM{_WS}, or another FILL_MEM{_WS} command.
Otherwise, an illegal command response is returned, setting the ILLCMD
bit. NOP can be used for inter command padding without corrupting the
address pointer.
The size field (sz) is examined each time a FILL_MEM{_WS} command is processed, allowing the
operand size to be dynamically altered. The examples show the FILL_MEM.B{_WS},
FILL_MEM.W{_WS} and FILL_MEM.L{_WS} commands.
5.4.4.7
GO
Go
Non-intrusive
0x08
host →
target
D
A
C
K
This command is used to exit active BDM and begin (or resume) execution of CPU application code. The
CPU pipeline is flushed and refilled before normal instruction execution resumes. Prefetching begins at
the current address in the PC. If any register (such as the PC) is altered by a BDC command whilst in BDM,
the updated value is used when prefetching resumes. If enabled, an ACK is driven on exiting active BDM.
If a GO command is issued whilst the BDM is inactive, an illegal command response is returned and the
ILLCMD bit is set.
MC9S12ZVM Family Reference Manual Rev. 1.5
162
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.4.8
GO_UNTIL
Go Until
Active Background
0x0C
host →
target
D
A
C
K
This command is used to exit active BDM and begin (or resume) execution of application code. The CPU
pipeline is flushed and refilled before normal instruction execution resumes. Prefetching begins at the
current address in the PC. If any register (such as the PC) is altered by a BDC command whilst in BDM,
the updated value is used when prefetching resumes.
After resuming application code execution, if ACK is enabled, the BDC awaits a return to active BDM
before driving an ACK pulse. timeouts do not apply when awaiting a GO_UNTIL command ACK.
If a GO_UNTIL is not acknowledged then a SYNC command must be issued to end the pending
GO_UNTIL.
If a GO_UNTIL command is issued whilst BDM is inactive, an illegal command response is returned and
the ILLCMD bit is set.
If ACK handshaking is disabled, the GO_UNTIL command is identical to the GO command.
5.4.4.9
NOP
No operation
Active Background
0x00
host →
target
D
A
C
K
NOP performs no operation and may be used as a null command where required.
5.4.4.10
READ_Rn
Read CPU register
Active Background
0x60+CRN
host →
target
Data [31-24] Data [23-16]
D
A
C
K
target →
host
target →
host
Data [15-8]
Data [7-0]
target →
host
target →
host
This command reads the selected CPU registers and returns the 32-bit result. Accesses to CPU registers
are always 32-bits wide, regardless of implemented register width. Bytes that are not implemented return
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
163
Chapter 5 Background Debug Controller (S12ZBDCV2)
zero. The register is addressed through the CPU register number (CRN). See Section 5.4.5.1 for the CRN
address decoding. If enabled, an ACK pulse is driven before the data bytes are transmitted.
If the device is not in active BDM, this command is illegal, the ILLCMD bit is set and no access is
performed.
5.4.4.11
READ_MEM.sz, READ_MEM.sz_WS
READ_MEM.sz
Read memory at the specified address
0x30
Address[23-0]
host →
target
host →
target
0x34
Address[23-0]
host →
target
host →
target
0x38
Address[23-0]
host →
target
host →
target
Non-intrusive
Data[7-0]
D
A
C
K
D
A
C
K
D
A
C
K
target →
host
Data[15-8]
Data[7-0]
target →
host
target →
host
Data[31-24]
Data[23-16]
Data[15-8]
Data[7-0]
target →
host
target →
host
target →
host
target →
host
READ_MEM.sz_WS
Read memory at the specified address with status
0x31
Address[23-0]
host →
target
host →
target
0x35
Address[23-0]
host →
target
host →
target
0x39
Address[23-0]
host →
target
host →
target
Non-intrusive
BDCCSRL
D
L
Y
D
L
Y
D
L
Y
target →
host
Data[7-0]
target →
host
BDCCSRL
Data [15-8]
Data [7-0]
target →
host
target →
host
BDCCSRL
Data[31-24]
Data[23-16]
Data [15-8]
target →
host
target →
host
target →
host
target →
host
target →
host
Data [7-0]
target →
host
Read data at the specified memory address. The address is transmitted as three 8-bit packets (msb to lsb)
immediately after the command.
The hardware forces low-order address bits to zero longword accesses to ensure these accesses are on 0modulo-size alignments. Byte alignment details are described in Section 5.4.5.2”. If the with-status option
is specified, the BDCCSR status byte is returned before the read data. This status byte reflects the state
MC9S12ZVM Family Reference Manual Rev. 1.5
164
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
after the memory read was performed. If enabled, an ACK pulse is driven before the data bytes are
transmitted.
The examples show the READ_MEM.B{_WS}, READ_MEM.W{_WS} and READ_MEM.L{_WS}
commands.
5.4.4.12
READ_DBGTB
Read DBG trace buffer
TB Line [31- TB Line [23- TB Line [15- TB Line [724]
16]
8]
0]
0x07
host →
target
Non-intrusive
D
A
C
K
target →
host
target →
host
target →
host
TB Line [63- TB Line [55- TB Line [47- TB Line [3956]
48]
40]
32]
D
A
C
K
target →
host
target →
host
target →
host
target →
host
target →
host
This command is only available on devices, where the DBG module includes a trace buffer. Attempted use
of this command on devices without a traace buffer return 0x00.
Read 64 bits from the DBG trace buffer. Refer to the DBG module description for more detailed
information. If enabled an ACK pulse is generated before each 32-bit longword is ready to be read by the
host. After issuing the first ACK a timeout is still possible whilst accessing the second 32-bit longword,
since this requires separate internal accesses. The first 32-bit longword corresponds to trace buffer line
bits[31:0]; the second to trace buffer line bits[63:32]. If ACK handshaking is disabled, the host must wait
16 clock cycles (DLY) after completing the first 32-bit read before starting the second 32-bit read.
5.4.4.13
READ_SAME.sz, READ_SAME.sz_WS
READ_SAME
Read same location specified by previous READ_MEM{_WS}
0x54
host →
target
D
A
C
K
Data[15-8]
Data[7-0]
target →
host
target →
host
Non-intrusive
READ_SAME_WS
Read same location specified by previous READ_MEM{_WS}
0x55
host →
target
D
L
Y
BDCCSRL
Data [15-8]
target →
host
target →
host
Non-intrusive
Data [7-0]
target →
host
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
165
Chapter 5 Background Debug Controller (S12ZBDCV2)
Read from location defined by the previous READ_MEM. The previous READ_MEM command defines
the address, subsequent READ_SAME commands return contents of same address. The example shows
the sequence for reading a 16-bit word size. Byte alignment details are described in Section 5.4.5.2”. If
enabled, an ACK pulse is driven before the data bytes are transmitted.
NOTE
READ_SAME{_WS} is a valid command only when preceded by SYNC,
NOP, READ_MEM{_WS}, or another READ_SAME{_WS} command.
Otherwise, an illegal command response is returned, setting the ILLCMD
bit. NOP can be used for inter-command padding without corrupting the
address pointer.
5.4.4.14
READ_BDCCSR
Read BDCCSR Status Register
0x2D
host →
target
D
L
Y
Always Available
BDCCSR
[15:8]
BDCCSR
[7-0]
target
→ host
target
→ host
Read the BDCCSR status register. This command can be executed in any mode.
5.4.4.15
SYNC_PC
Sample current PC
0x01
host →
target
D
A
C
K
Non-intrusive
PC
data[23–16]
PC
data[15–8]
PC
data[7–0]
target →
host
target →
host
target →
host
This command returns the 24-bit CPU PC value to the host. Unsuccessful SYNC_PC accesses return 0xEE
for each byte. If enabled, an ACK pulse is driven before the data bytes are transmitted. The value of 0xEE
is returned if a timeout occurs, whereby NORESP is set. This can occur if the CPU is executing the WAI
instruction, or the STOP instruction with BDCCIS clear, or if a CPU access is delayed by EWAIT. If the
CPU is executing the STOP instruction and BDCCIS is set, then SYNC_PC returns the PC address of the
instruction following STOP in the code listing.
This command can be used to dynamically access the PC for performance monitoring as the execution of
this command is considerably less intrusive to the real-time operation of an application than a
BACKGROUND/read-PC/GO command sequence. Whilst the BDC is not in active BDM, SYNC_PC
returns the PC address of the instruction currently being executed by the CPU. In active BDM, SYNC_PC
returns the address of the next instruction to be executed on returning from active BDM. Thus following
a write to the PC in active BDM, a SYNC_PC returns that written value.
MC9S12ZVM Family Reference Manual Rev. 1.5
166
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.4.16
WRITE_MEM.sz, WRITE_MEM.sz_WS
WRITE_MEM.sz
Write memory at the specified address
Non-intrusive
0x10
Address[23-0]
Data[7–0]
host →
target
host → target
host →
target
0x14
Address[23-0]
Data[15–8]
Data[7–0]
host →
target
host → target
host →
target
host →
target
0x18
Address[23-0]
host →
target
host → target
D
A
C
K
D
A
C
K
Data[31–24] Data[23–16]
host →
target
Data[15–8]
Data[7–0]
host →
target
host →
target
host →
target
D
A
C
K
WRITE_MEM.sz_WS
Write memory at the specified address with status
Non-intrusive
0x11
Address[23-0]
Data[7–0]
BDCCSRL
host →
target
host →
target
host →
target
0x15
Address[23-0]
Data[15–8]
Data[7–0]
host →
target
host →
target
host →
target
host →
target
0x19
Address[23-0]
host →
target
host →
target
D
L
Y
target →
host
Data[31–24] Data[23–16]
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
Data[15–8]
Data[7–0]
host →
target
host →
target
BDCCSRL
D
L
Y
target →
host
Write data to the specified memory address. The address is transmitted as three 8-bit packets (msb to lsb)
immediately after the command.
If the with-status option is specified, the status byte contained in BDCCSRL is returned after the write data.
This status byte reflects the state after the memory write was performed. The examples show the
WRITE_MEM.B{_WS}, WRITE_MEM.W{_WS}, and WRITE_MEM.L{_WS} commands. If enabled
an ACK pulse is generated after the internal write access has been completed or aborted.
The hardware forces low-order address bits to zero longword accesses to ensure these accesses are on 0modulo-size alignments. Byte alignment details are described in Section 5.4.5.2”.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
167
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.4.17
WRITE_Rn
Write general-purpose CPU register
0x40+CRN
Active Background
Data [31–24] Data [23–16] Data [15–8]
host →
target
host →
target
host →
target
host →
target
Data [7–0]
host →
target
D
A
C
K
If the device is in active BDM, this command writes the 32-bit operand to the selected CPU generalpurpose register. See Section 5.4.5.1 for the CRN details. Accesses to CPU registers are always 32-bits
wide, regardless of implemented register width. If enabled an ACK pulse is generated after the internal
write access has been completed or aborted.
If the device is not in active BDM, this command is rejected as an illegal operation, the ILLCMD bit is set
and no operation is performed.
5.4.4.18
WRITE_BDCCSR
Write BDCCSR
Always Available
0x0D
host →
target
BDCCSR
Data [15-8]
BDCCSR
Data [7-0]
host →
target
host →
target
D
L
Y
16-bit write to the BDCCSR register. No ACK pulse is generated. Writing to this register can be used to
configure control bits or clear flag bits. Refer to the register bit descriptions.
5.4.4.19
ERASE_FLASH
Erase FLASH
Always Available
0x95
host →
target
D
L
Y
Mass erase the internal flash. This command can always be issued. On receiving this command twice in
succession, the BDC sets the ERASE bit in BDCCSR and requests a flash mass erase. Any other BDC
command following a single ERASE_FLASH initializes the sequence, such that thereafter the
ERASE_FLASH must be applied twice in succession to request a mass erase. If 512 BDCSI clock cycles
elapse between the consecutive ERASE_FLASH commands then a timeout occurs, which forces a soft
reset and initializes the sequence. The ERASE bit is cleared when the mass erase sequence has been
completed. No ACK is driven.
MC9S12ZVM Family Reference Manual Rev. 1.5
168
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
During the mass erase operation, which takes many clock cycles, the command status is indicated by the
ERASE bit in BDCCSR. Whilst a mass erase operation is ongoing, Always-available commands can be
issued. This allows the status of the erase operation to be polled by reading BDCCSR to determine when
the operation is finished.
The status of the flash array can be verified by subsequently reading the flash error flags to determine if
the erase completed successfully.
ERASE_FLASH can be aborted by a SYNC pulse forcing a soft reset.
NOTE: Device Bus Frequency Considerations
The ERASE_FLASH command requires the default device bus clock
frequency after reset. Thus the bus clock frequency must not be changed
following reset before issuing an ERASE_FLASH command.
5.4.4.20
STEP1
Step1
Active Background
0x09
host →
target
D
A
C
K
This command is used to step through application code. In active BDM this command executes the next
CPU instruction in application code. If enabled an ACK is driven.
If a STEP1 command is issued and the CPU is not halted, the command is ignored.
Using STEP1 to step through a CPU WAI instruction is explained in Section 5.1.3.3.2.
5.4.5
BDC Access Of Internal Resources
Unsuccessful read accesses of internal resources return a value of 0xEE for each data byte. This enables a
debugger to recognize a potential error, even if neither the ACK handshaking protocol nor a status
command is currently being executed. The value of 0xEE is returned in the following cases.
• Illegal address access, whereby ILLACC is set
• Invalid READ_SAME or DUMP_MEM sequence
• Invalid READ_Rn command (BDM inactive or CRN incorrect)
• Internal resource read with timeout, whereby NORESP is set
5.4.5.1
BDC Access Of CPU Registers
The CRN field of the READ_Rn and WRITE_Rn commands contains a pointer to the CPU registers. The
mapping of CRN to CPU registers is shown in Table 5-9. Accesses to CPU registers are always 32-bits
wide, regardless of implemented register width. This means that the BDC data transmission for these
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
169
Chapter 5 Background Debug Controller (S12ZBDCV2)
commands is 32-bits long. The valid bits of the transfer are listed in the Valid Data Bits column. The other
bits of the transmission are redundant.
Attempted accesses of CPU registers using a CRN of 0xD,0xE or 0xF is invalid, returning the value 0xEE
for each byte and setting the ILLACC bit.
Table 5-9. CPU Register Number (CRN) Mapping
CPU Register
Valid Data Bits
Command
Opcode
Command
Opcode
D0
[7:0]
WRITE_D0
0x40
READ_D0
0x60
5.4.5.2
D1
[7:0]
WRITE_D1
0x41
READ_D1
0x61
D2
[15:0]
WRITE_D2
0x42
READ_D2
0x62
D3
[15:0]
WRITE_D3
0x43
READ_D3
0x63
D4
[15:0]
WRITE_D4
0x44
READ_D4
0x64
D5
[15:0]
WRITE_D5
0x45
READ_D5
0x65
D6
[31:0]
WRITE_D6
0x46
READ_D6
0x66
D7
[31:0]
WRITE_D7
0x47
READ_D7
0x67
X
[23:0]
WRITE_X
0x48
READ_X
0x68
Y
[23:0]
WRITE_Y
0x49
READ_Y
0x69
SP
[23:0]
WRITE_SP
0x4A
READ_SP
0x6A
PC
[23:0]
WRITE_PC
0x4B
READ_PC
0x6B
CCR
[15:0]
WRITE_CCR
0x4C
READ_CCR
0x6C
BDC Access Of Device Memory Mapped Resources
The device memory map is accessed using READ_MEM, DUMP_MEM, WRITE_MEM, FILL_MEM
and READ_SAME, which support different access sizes, as explained in the command descriptions.
When an unimplemented command occurs during a DUMP_MEM, FILL_MEM or READ_SAME
sequence, then that sequence is ended.
Illegal read accesses return a value of 0xEE for each byte. After an illegal access FILL_MEM and
READ_SAME commands are not valid, and it is necessary to restart the internal access sequence with
READ_MEM or WRITE_MEM. An illegal access does not break a DUMP_MEM sequence. After read
accesses that cause the RDINV bit to be set, DUMP_MEM and READ_SAME commands are valid, it is
not necessary to restart the access sequence with a READ_MEM.
The hardware forces low-order address bits to zero for longword accesses to ensure these accesses are
realigned to 0-modulo-size alignments.
Word accesses map to 2-bytes from within a 4-byte field as shown in Table 5-10. Thus if address bits [1:0]
are both logic “1” the access is realigned so that it does not straddle the 4-byte boundary but accesses data
from within the addressed 4-byte field.
MC9S12ZVM Family Reference Manual Rev. 1.5
170
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
Table 5-10. Field Location to Byte Access Mapping
Address[1:0]
Access Size
00
01
10
11
00
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
01
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
10
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
Realigned
11
32-bit
Data[31:24]
Data[23:16]
Data [15:8]
Data [7:0]
Realigned
00
16-bit
Data [15:8]
Data [7:0]
01
16-bit
10
16-bit
Data [15:8]
Data [7:0]
11
16-bit
Data [15:8]
Data [7:0]
00
8-bit
01
8-bit
10
8-bit
11
8-bit
Data [15:8]
Note
Realigned
Data [7:0]
Realigned
Data [7:0]
Data [7:0]
Data [7:0]
Data [7:0]
Denotes byte that is not transmitted
5.4.5.2.1
FILL_MEM and DUMP_MEM Increments and Alignment
FILL_MEM and DUMP_MEM increment the previously accessed address by the previous access size to
calculate the address of the current access. On misaligned longword accesses, the address bits [1:0] are
forced to zero, therefore the following FILL_MEM or DUMP_MEM increment to the first address in the
next 4-byte field. This is shown in Table 5-11, the address of the first DUMP_MEM.32 following
READ_MEM.32 being calculated from 0x004000+4.
When misaligned word accesses are realigned, then the original address (not the realigned address) is
incremented for the following FILL_MEM, DUMP_MEM command.
Misaligned word accesses can cause the same locations to be read twice as shown in rows 6 and 7. The
hardware ensures alignment at an attempted misaligned word access across a 4-byte boundary, as shown
in row 7. The following word access in row 8 continues from the realigned address of row 7.
d
Table 5-11. Consecutive Accesses With Variable Size
Row
Command
Address
Address[1:0]
1
READ_MEM.32
0x004003
11
2
DUMP_MEM.32
0x004004
00
3
DUMP_MEM.16
0x004008
00
Accessed
Accessed
4
DUMP_MEM.16
0x00400A
10
5
DUMP_MEM.08
0x00400C
00
6
DUMP_MEM.16
0x00400D
01
7
DUMP_MEM.16
0x00400E
10
8
DUMP_MEM.16
0x004010
01
00
01
10
11
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
171
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.5.2.2
READ_SAME Effects Of Variable Access Size
READ_SAME uses the unadjusted address given in the previous READ_MEM command as a base
address for subsequent READ_SAME commands. When the READ_MEM and READ_SAME size
parameters differ then READ_SAME uses the original base address buts aligns 32-bit and 16-bit accesses,
where those accesses would otherwise cross the aligned 4-byte boundary. Table 5-12 shows some
examples of this.
d
5.4.6
Table 5-12. Consecutive READ_SAME Accesses With Variable Size
Row
Command
Base Address
00
01
10
11
1
READ_MEM.32
0x004003
Accessed
Accessed
Accessed
Accessed
2
READ_SAME.32
—
Accessed
Accessed
3
READ_SAME.16
—
4
READ_SAME.08
—
5
READ_MEM.08
0x004000
Accessed
6
READ_SAME.08
—
Accessed
7
READ_SAME.16
—
Accessed
Accessed
8
READ_SAME.32
—
Accessed
Accessed
9
READ_MEM.08
0x004002
Accessed
10
READ_SAME.08
—
Accessed
11
READ_SAME.16
—
Accessed
Accessed
12
READ_SAME.32
—
Accessed
Accessed
13
READ_MEM.08
0x004003
14
READ_SAME.08
—
15
READ_SAME.16
—
16
READ_SAME.32
—
17
READ_MEM.16
18
19
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
0x004001
Accessed
Accessed
READ_SAME.08
—
Accessed
READ_SAME.16
—
Accessed
Accessed
20
READ_SAME.32
—
Accessed
Accessed
Accessed
21
READ_MEM.16
0x004003
Accessed
Accessed
22
READ_SAME.08
—
23
READ_SAME.16
—
Accessed
Accessed
24
READ_SAME.32
—
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
Accessed
BDC Serial Interface
The BDC communicates with external devices serially via the BKGD pin. During reset, this pin is a mode
select input which selects between normal and special modes of operation. After reset, this pin becomes
the dedicated serial interface pin for the BDC.
The BDC serial interface uses an internal clock source, selected by the CLKSW bit in the BDCCSR
register. This clock is referred to as the target clock in the following explanation.
MC9S12ZVM Family Reference Manual Rev. 1.5
172
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
The BDC serial interface uses a clocking scheme in which the external host generates a falling edge on the
BKGD pin to indicate the start of each bit time. This falling edge is sent for every bit whether data is
transmitted or received. Data is transferred most significant bit (MSB) first at 16 target clock cycles per
bit. The interface times out if during a command 512 clock cycles occur between falling edges from the
host. The timeout forces the current command to be discarded.
The BKGD pin is a pseudo open-drain pin and has a weak on-chip active pull-up that is enabled at all
times. It is assumed that there is an external pull-up and that drivers connected to BKGD do not typically
drive the high level. Since R-C rise time could be unacceptably long, the target system and host provide
brief drive-high (speedup) pulses to drive BKGD to a logic 1. The source of this speedup pulse is the host
for transmit cases and the target for receive cases.
The timing for host-to-target is shown in Figure 5-6 and that of target-to-host in Figure 5-7 and
Figure 5-8. All cases begin when the host drives the BKGD pin low to generate a falling edge. Since the
host and target operate from separate clocks, it can take the target up to one full clock cycle to recognize
this edge; this synchronization uncertainty is illustrated in Figure 5-6. The target measures delays from this
perceived start of the bit time while the host measures delays from the point it actually drove BKGD low
to start the bit up to one target clock cycle earlier. Synchronization between the host and target is
established in this manner at the start of every bit time.
Figure 5-6 shows an external host transmitting a logic 1 and transmitting a logic 0 to the BKGD pin of a
target system. The host is asynchronous to the target, so there is up to a one clock-cycle delay from the
host-generated falling edge to where the target recognizes this edge as the beginning of the bit time. Ten
target clock cycles later, the target senses the bit level on the BKGD pin. Internal glitch detect logic
requires the pin be driven high no later than eight target clock cycles after the falling edge for a logic 1
transmission.
Since the host drives the high speedup pulses in these two cases, the rising edges look like digitally driven
signals.
BDCSI clock
(TARGET MCU)
HOST
TRANSMIT 1
HOST
TRANSMIT 0
10 CYCLES
SYNCHRONIZATION
UNCERTAINTY
EARLIEST START
OF NEXT BIT
TARGET SENSES BIT LEVEL
PERCEIVED START
OF BIT TIME
Figure 5-6. BDC Host-to-Target Serial Bit Timing
Figure 5-7 shows the host receiving a logic 1 from the target system. The host holds the BKGD pin low
long enough for the target to recognize it (at least two target clock cycles). The host must release the low
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
173
Chapter 5 Background Debug Controller (S12ZBDCV2)
drive at the latest after 6 clock cycles, before the target drives a brief high speedup pulse seven target clock
cycles after the perceived start of the bit time. The host should sample the bit level about 10 target clock
cycles after it started the bit time.
BDCSI clock
(TARGET MCU)
HOST DRIVE
TO BKGD PIN
TARGET MCU
SPEEDUP PULSE
HIGH-IMPEDANCE
HIGH-IMPEDANCE
HIGH-IMPEDANCE
PERCEIVED START
OF BIT TIME
R-C RISE
BKGD PIN
10 CYCLES
10 CYCLES
EARLIEST START
OF NEXT BIT
HOST SAMPLES BKGD PIN
Figure 5-7. BDC Target-to-Host Serial Bit Timing (Logic 1)
Figure 5-8 shows the host receiving a logic 0 from the target. The host initiates the bit time but the target
finishes it. Since the target wants the host to receive a logic 0, it drives the BKGD pin low for 13 target
clock cycles then briefly drives it high to speed up the rising edge. The host samples the bit level about 10
target clock cycles after starting the bit time.
MC9S12ZVM Family Reference Manual Rev. 1.5
174
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
BDCSI clock
(TARGET MCU)
HOST DRIVE
TO BKGD PIN
HIGH-IMPEDANCE
SPEEDUP
PULSE
TARGET MCU
DRIVE AND
SPEED-UP PULSE
PERCEIVED START
OF BIT TIME
BKGD PIN
10 CYCLES
EARLIEST START
OF NEXT BIT
10 CYCLES
HOST SAMPLES BKGD PIN
Figure 5-8. BDC Target-to-Host Serial Bit Timing (Logic 0)
5.4.7
Serial Interface Hardware Handshake (ACK Pulse) Protocol
BDC commands are processed internally at the device core clock rate. Since the BDCSI clock can be
asynchronous relative to the bus frequency, a handshake protocol is provided so the host can determine
when an issued command has been executed. This section describes the hardware handshake protocol.
The hardware handshake protocol signals to the host controller when a BDC command has been executed
by the target. This protocol is implemented by a low pulse (16 BDCSI clock cycles) followed by a brief
speedup pulse on the BKGD pin, generated by the target MCU when a command, issued by the host, has
been successfully executed (see Figure 5-9). This pulse is referred to as the ACK pulse. After the ACK
pulse has finished, the host can start the bit retrieval if the last issued command was a read command, or
start a new command if the last command was a write command or a control command.
BDCSI clock
(TARGET MCU)
HIGH-IMPEDANCE
16 CYCLES
TARGET
TRANSMITS
ACK PULSE
HIGH-IMPEDANCE
32 CYCLES
SPEED UP PULSE
MINIMUM DELAY
FROM THE BDC COMMAND
BKGD PIN
EARLIEST
START OF
NEXT BIT
16th CYCLE OF THE
LAST COMMAND BIT
Figure 5-9. Target Acknowledge Pulse (ACK)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
175
Chapter 5 Background Debug Controller (S12ZBDCV2)
The handshake protocol is enabled by the ACK_ENABLE command. The BDC sends an ACK pulse when
the ACK_ENABLE command has been completed. This feature can be used by the host to evaluate if the
target supports the hardware handshake protocol. If an ACK pulse is issued in response to this command,
the host knows that the target supports the hardware handshake protocol.
Unlike the normal bit transfer, where the host initiates the transmission by issuing a negative edge on the
BKGD pin, the serial interface ACK handshake pulse is initiated by the target MCU by issuing a negative
edge on the BKGD pin. Figure 5-9 specifies the timing when the BKGD pin is being driven. The host must
follow this timing constraint in order to avoid the risk of an electrical conflict at the BKGD pin.
When the handshake protocol is enabled, the STEAL bit in BDCCSR selects if bus cycle stealing is used
to gain immediate access. If STEAL is cleared, the BDC is configured for low priority bus access using
free cycles, without stealing cycles. This guarantees that BDC accesses remain truly non-intrusive to not
affect the system timing during debugging. If STEAL is set, the BDC gains immediate access, if necessary
stealing an internal bus cycle.
NOTE
If bus steals are disabled then a loop with no free cycles cannot allow access.
In this case the host must recognize repeated NORESP messages and then
issue a BACKGROUND command to stop the target and access the data.
Figure 5-10 shows the ACK handshake protocol without steal in a command level timing diagram. The
READ_MEM.B command is used as an example. First, the 8-bit command code is sent by the host,
followed by the address of the memory location to be read. The target BDC decodes the command. Then
an internal access is requested by the BDC. When a free bus cycle occurs the READ_MEM.B operation
is carried out. If no free cycle occurs within 512 core clock cycles then the access is aborted, the NORESP
flag is set and the target generates a Long-ACK pulse.
Having retrieved the data, the BDC issues an ACK pulse to the host controller, indicating that the
addressed byte is ready to be retrieved. After detecting the ACK pulse, the host initiates the data read part
of the command.
TARGET
BKGD PIN
READ_MEM.B
ADDRESS[23–0]
HOST
HOST
BYTE IS
RETRIEVED
TARGET
NEW BDC COMMAND
HOST
TARGET
BDC ISSUES THE
ACK PULSE (NOT TO SCALE)
BDC DECODES
THE COMMAND
MCU EXECUTES THE
READ_MEM.B
COMMAND
Figure 5-10. Handshake Protocol at Command Level
Alternatively, setting the STEAL bit configures the handshake protocol to make an immediate internal
access, independent of free bus cycles.
MC9S12ZVM Family Reference Manual Rev. 1.5
176
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
The ACK handshake protocol does not support nested ACK pulses. If a BDC command is not
acknowledged by an ACK pulse, the host needs to abort the pending command first in order to be able to
issue a new BDC command. The host can decide to abort any possible pending ACK pulse in order to be
sure a new command can be issued. Therefore, the protocol provides a mechanism in which a command,
and its corresponding ACK, can be aborted.
Commands With-Status do not generate an ACK, thus if ACK is enabled and a With-Status command is
issued, the host must use the 512 cycle timeout to calculate when the data is ready for retrieval.
5.4.7.1
Long-ACK Hardware Handshake Protocol
If a command results in an error condition, whereby a BDCCSRL flag is set, then the target generates a
“Long-ACK” low pulse of 64 BDCSI clock cycles, followed by a brief speed pulse. This indicates to the
host that an error has occurred. The host can subsequently read BDCCSR to determine the type of error.
Whether normal ACK or Long-ACK, the ACK pulse is not issued earlier than 32 BDCSI clock cycles after
the BDC command was issued. The end of the BDC command is assumed to be the 16th BDCSI clock
cycle of the last bit. The 32 cycle minimum delay differs from the 16 cycle delay time with ACK disabled.
If a BDC access request does not gain access within 512 core clock cycles, the request is aborted, the
NORESP flag is set and a Long-ACK pulse is transmitted to indicate an error case.
Following a STOP or WAI instruction, if the BDC is enabled, the first ACK, following stop or wait mode
entry is a long ACK to indicate an exception.
5.4.8
Hardware Handshake Abort Procedure
The abort procedure is based on the SYNC command. To abort a command that has not responded with an
ACK pulse, the host controller generates a sync request (by driving BKGD low for at least 128 BDCSI
clock cycles and then driving it high for one BDCSI clock cycle as a speedup pulse). By detecting this long
low pulse in the BKGD pin, the target executes the SYNC protocol, see Section 5.4.4.1”, and assumes that
the pending command and therefore the related ACK pulse are being aborted. After the SYNC protocol
has been completed the host is free to issue new BDC commands.
The host can issue a SYNC close to the 128 clock cycles length, providing a small overhead on the pulse
length to assure the sync pulse is not misinterpreted by the target. See Section 5.4.4.1”.
Figure 5-11 shows a SYNC command being issued after a READ_MEM, which aborts the READ_MEM
command. Note that, after the command is aborted a new command is issued by the host.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
177
Chapter 5 Background Debug Controller (S12ZBDCV2)
READ_MEM.B CMD
IS ABORTED BY THE SYNC REQUEST
(NOT TO SCALE)
BKGD PIN
READ_MEM.B
HOST
ADDRESS[23-0]
SYNC RESPONSE
FROM THE TARGET
(NOT TO SCALE)
READ_BDCCSR
TARGET
HOST
TARGET
NEW BDC COMMAND
HOST
TARGET
NEW BDC COMMAND
BDC DECODES
AND TRYS TO EXECUTE
THE READ_MEM.B CMD
Figure 5-11. ACK Abort Procedure at the Command Level (Not To Scale)
Figure 5-12 shows a conflict between the ACK pulse and the SYNC request pulse. The target is executing
a pending BDC command at the exact moment the host is being connected to the BKGD pin. In this case,
an ACK pulse is issued simultaneously to the SYNC command. Thus there is an electrical conflict between
the ACK speedup pulse and the SYNC pulse. As this is not a probable situation, the protocol does not
prevent this conflict from happening.
AT LEAST 128 CYCLES
BDCSI clock
(TARGET MCU)
ACK PULSE
TARGET MCU
DRIVES TO
BKGD PIN
HIGH-IMPEDANCE
ELECTRICAL CONFLICT
HOST
DRIVES SYNC
TO BKGD PIN
SPEEDUP PULSE
HOST AND TARGET
DRIVE TO BKGD PIN
HOST SYNC REQUEST PULSE
BKGD PIN
16 CYCLES
Figure 5-12. ACK Pulse and SYNC Request Conflict
5.4.9
Hardware Handshake Disabled (ACK Pulse Disabled)
The default state of the BDC after reset is hardware handshake protocol disabled. It can also be disabled
by the ACK_DISABLE BDC command. This provides backwards compatibility with the existing host
devices which are not able to execute the hardware handshake protocol. For host devices that support the
hardware handshake protocol, true non-intrusive debugging and error flagging is offered.
If the ACK pulse protocol is disabled, the host needs to use the worst case delay time at the appropriate
places in the protocol.
MC9S12ZVM Family Reference Manual Rev. 1.5
178
Freescale Semiconductor
Chapter 5 Background Debug Controller (S12ZBDCV2)
If the handshake protocol is disabled, the access is always independent of free cycles, whereby BDC has
higher priority than CPU. Since at least 2 bytes (command byte + data byte) are transferred over BKGD
the maximum intrusiveness is only once every few hundred cycles.
After decoding an internal access command, the BDC then awaits the next internal core clock cycle. The
relationship between BDCSI clock and core clock must be considered. If the host retrieves the data
immediately, then the BDCSI clock frequency must not be more than 4 times the core clock frequency, in
order to guarantee that the BDC gains bus access within 16 the BDCSI cycle DLY period following an
access command. If the BDCSI clock frequency is more than 4 times the core clock frequency, then the
host must use a suitable delay time before retrieving data (see 5.5.1/5-180). Furthermore, for stretched read
accesses to external resources via a device expanded bus (if implemented) the potential extra stretch cycles
must be taken into consideration before attempting to obtain read data.
If the access does not succeed before the host starts data retrieval then the NORESP flag is set but the
access is not aborted. The NORESP state can be used by the host to recognize an unexpected access
conflict due to stretched expanded bus accesses. Although the NORESP bit is set when an access does not
succeed before the start of data retrieval, the access may succeed in following bus cycles if the internal
access has already been initiated.
5.4.10
Single Stepping
When a STEP1 command is issued to the BDC in active BDM, the CPU executes a single instruction in
the user code and returns to active BDM. The STEP1 command can be issued repeatedly to step through
the user code one instruction at a time.
If an interrupt is pending when a STEP1 command is issued, the interrupt stacking operation occurs but
no user instruction is executed. In this case the stacking counts as one instruction. The device re-enters
active BDM with the program counter pointing to the first instruction in the interrupt service routine.
When stepping through the user code, the execution of the user code is done step by step but peripherals
are free running. Some peripheral modules include a freeze feature, whereby their clocks are halted when
the device enters active BDM. Timer modules typically include the freeze feature. Serial interface modules
typically do not include the freeze feature. Hence possible timing relations between CPU code execution
and occurrence of events of peripherals no longer exist.
If the handshake protocol is enabled and BDCCIS is set then stepping over the STOP instruction causes
the Long-ACK pulse to be generated and the BDCCSR STOP flag to be set. When stop mode is exited due
to an interrupt the device enters active BDM and the PC points to the start of the corresponding interrupt
service routine. Stepping can be continued.
Stepping over a WAI instruction, the STEP1 command cannot be finished because active BDM cannot be
entered after CPU starts to execute the WAI instruction.
Stepping over the WAI instruction causes the BDCCSR WAIT and NORESP flags to be set and, if the
handshake protocol is enabled, then the Long-ACK pulse is generated. Then the device enters wait mode,
clears the BDMACT bit and awaits an interrupt to leave wait mode. In this time non-intrusive BDC
commands are possible, although the STEP1 has actually not finished. When an interrupt occurs the device
leaves wait mode, enters active BDM and the PC points to the start of the corresponding interrupt service
routine. A further ACK related to stepping over the WAI is not generated.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
179
Chapter 5 Background Debug Controller (S12ZBDCV2)
5.4.11
Serial Communication Timeout
The host initiates a host-to-target serial transmission by generating a falling edge on the BKGD pin. If
BKGD is kept low for more than 128 target clock cycles, the target understands that a SYNC command
was issued. In this case, the target waits for a rising edge on BKGD in order to answer the SYNC request
pulse. When the BDC detects the rising edge a soft reset is generated, whereby the current BDC command
is discarded. If the rising edge is not detected, the target keeps waiting forever without any timeout limit.
If a falling edge is not detected by the target within 512 clock cycles since the last falling edge, a timeout
occurs and the current command is discarded without affecting memory or the operating mode of the
MCU. This is referred to as a soft-reset. This timeout also applies if 512 cycles elapse between 2
consecutive ERASE_FLASH commands. The soft reset is disabled whilst the internal flash mass erase
operation is pending completion.
timeouts are also possible if a BDC command is partially issued, or data partially retrieved. Thus if a time
greater than 512 BDCSI clock cycles is observed between two consecutive negative edges, a soft-reset
occurs causing the partially received command or data retrieved to be discarded. The next negative edge
at the BKGD pin, after a soft-reset has occurred, is considered by the target as the start of a new BDC
command, or the start of a SYNC request pulse.
5.5
5.5.1
Application Information
Clock Frequency Considerations
Read commands without status and without ACK must consider the frequency relationship between
BDCSI and the internal core clock. If the core clock is slow, then the internal access may not have been
carried out within the standard 16 BDCSI cycle delay period (DLY). The host must then extend the DLY
period or clock frequencies accordingly. Taking internal clock domain synchronizers into account, the
minimum number of BDCSI periods required for the DLY is expressed by:
#DLY > 3(f(BDCSI clock) / f(core clock)) + 4
and the minimum core clock frequency with respect to BDCSI clock frequency is expressed by
Minimum f(core clock) = (3/(#DLY cycles -4))f(BDCSI clock)
For the standard 16 period DLY this yields f(core clock)>= (1/4)f(BDCSI clock)
MC9S12ZVM Family Reference Manual Rev. 1.5
180
Freescale Semiconductor
Chapter 6
S12Z Debug (S12ZDBGV2) Module
Table 6-1. Revision History Table
Revision
Number
Revision
Date
Sections
Affected
2.08
16.NOV.2012
Section 6.5.1
2.09
19.DEC.2012
General
2.10
28.JUN.2013
General
Section 6.3.2.21
Section 6.3.2.1
Section 6.3.2.5
2.11
15.JUL.2013
Section 6.3.2
6.1
Description Of Changes
Modified step over breakpoint information
Formatting corrections
Emphasized need to set TSOURCE for tracing or profiling
Corrected DBGCDM write access dependency
Corrrected ARM versus PTACT dependency
Modified DBGTBH read access dependencies
Added explicit names to state control register bit fields
Introduction
NOTE
The device overview family comparison specifies which devices include the
S12Z Debug Lite module and which include the standard S12Z Debug
module version. This chapter describes the standard version. The feature
differences are listed in Table 6-2.
Table 6-2. Comparison of S12Z Debug and S12Z Debug Lite
S12Z Debug
S12Z Debug Lite
Tracing included
Tracing not included
Profiling included
Profiling not included
Comparator C included
Comparator C not included
Match2 trigger included
Match2 trigger not included
The DBG module provides on-chip breakpoints and trace buffer with flexible triggering capability to allow
non-intrusive debug of application software. The DBG module is optimized for the S12Z architecture and
allows debugging of CPU module operations.
Typically the DBG module is used in conjunction with the BDC module, whereby the user configures the
DBG module for a debugging session over the BDC interface. Once configured the DBG module is armed
and the device leaves active BDM returning control to the user program, which is then monitored by the
DBG module. Alternatively the DBG module can be configured over a serial interface using SWI routines.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
181
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.1.1
Glossary
Table 6-3. Glossary Of Terms
Term
Definition
COF
Change Of Flow.
Change in the program flow due to a conditional branch, indexed jump or interrupt
PC
Program Counter
BDM
Background Debug Mode.
In this mode CPU application code execution is halted.
Execution of BDC “active BDM” commands is possible.
BDC
Background Debug Controller
WORD
16-bit data entity
Data Line
64-bit data entity
CPU
S12Z CPU module
Trigger
A trace buffer input that triggers tracing start, end or mid point
6.1.2
Overview
The comparators monitor the bus activity of the CPU. A single comparator match or a series of matches
can trigger bus tracing and/or generate breakpoints. A state sequencer determines if the correct series of
matches occurs. Similarly an external event can trigger bus tracing and/or generate breakpoints.
The trace buffer is visible through a 2-byte window in the register address map and can be read out using
standard 16-bit word reads.
6.1.3
•
•
•
Features
Four comparators (A, B, C, and D)
— Comparators A and C compare the full address bus and full 32-bit data bus
— Comparators A and C feature a data bus mask register
— Comparators B and D compare the full address bus only
— Each comparator can be configured to monitor PC addresses or addresses of data accesses
— Each comparator can select either read or write access cycles
— Comparator matches can force state sequencer state transitions
Three comparator modes
— Simple address/data comparator match mode
— Inside address range mode, Addmin ≤ Address ≤ Addmax
— Outside address range match mode, Address < Addmin or Address > Addmax
State sequencer control
— State transitions forced by comparator matches
MC9S12ZVM Family Reference Manual Rev. 1.5
182
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
•
•
•
•
6.1.4
— State transitions forced by software write to TRIG
— State transitions forced by an external event
The following types of breakpoints
— CPU breakpoint entering active BDM on breakpoint (BDM)
— CPU breakpoint executing SWI on breakpoint (SWI)
Trace control
— Tracing session triggered by state sequencer
— Begin, End, and Mid alignment of tracing to trigger
Four trace modes
— Normal: change of flow (COF) PC information is stored (see Section 6.4.5.2.1) for change of
flow definition.
— Loop1: same as Normal but inhibits consecutive duplicate source address entries
— Detail: address and data for all read/write access cycles are stored
— Pure PC: All program counter addresses are stored.
2 Pin (data and clock) profiling interface
— Output of code flow information
Modes of Operation
The DBG module can be used in all MCU functional modes.
The DBG module can issue breakpoint requests to force the device to enter active BDM or an SWI ISR.
The BDC BACKGROUND command is also handled by the DBG to force the device to enter active BDM.
When the device enters active BDM through a BACKGROUND command with the DBG module armed,
the DBG remains armed.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
183
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.1.5
Block Diagram
B
EXTERNAL EVENT
TRIG
COMPARATOR A
COMPARATOR B
COMPARATOR C
COMPARATOR D
COMPARATOR
MATCH CONTROL
CPU BUS
BUS INTERFACE
REGISTERS
MATCH0
MATCH1
STATE SEQUENCER
AND
EVENT CONTROL
BREAKPOINT
REQUESTS
MATCH2
MATCH3
TRACE
CONTROL
TRIGGER
PROFILE
OUTPUT
TRACE BUFFER
READ TRACE DATA (DBG READ DATA BUS)
Figure 6-1. Debug Module Block Diagram
6.2
6.2.1
External Signal Description
External Event Input
The DBG module features an external event input signal, DBGEEV. The mapping of this signal to a device
pin is specified in the device specific documentation. This function can be enabled and configured by the
EEVE field in the DBGC1 control register. This signal is input only and allows an external event to force
a state sequencer transition, or trace buffer entry, or to gate trace buffer entries. With the external event
function enabled, a falling edge at the external event pin constitutes an event. Rising edges have no effect.
If configured for gating trace buffer entries, then a low level at the pin allows entries, but a high level
suppresses entries. The maximum frequency of events is half the internal core bus frequency. The function
is explained in the EEVE field description.
NOTE
Due to input pin synchronization circuitry, the DBG module sees external
events 2 bus cycles after they occur at the pin. Thus an external event
occurring less than 2 bus cycles before arming the DBG module is perceived
to occur whilst the DBG is armed.
When the device is in stop mode the synchronizer clocks are disabled and
the external events are ignored.
MC9S12ZVM Family Reference Manual Rev. 1.5
184
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.2.2
Profiling Output
The DBG module features a profiling data output signal PDO. The mapping of this signal to a device pin
is specified in the device specific documentation. The device pin is enabled for profiling by setting the
PDOE bit. The profiling function can be enabled by the PROFILE bit in the DBGTCRL control register.
This signal is output only and provides a serial, encoded data stream that can be used by external
development tools to reconstruct the internal CPU code flow, as specified in Section 6.4.6. During code
profiling the device PDOCLK output is used as a clock signal.
6.3
6.3.1
Memory Map and Registers
Module Memory Map
A summary of the registers associated with the DBG module is shown in Figure 6-2. Detailed descriptions
of the registers and bits are given in the subsections that follow.
Address
Name
Bit 7
6
5
4
3
2
0x0100
DBGC1
R
W
ARM
0
TRIG
reserved
BDMBP
BRKCPU
reserved
0x0101
DBGC2
R
W
0
0
0
0
0x0102
DBGTCRH
R
reserved
W
0x0103
DBGTCRL
R
W
0
0
0
0
0x0104
DBGTB
R
W
Bit 15
Bit 14
Bit 13
0x0105
DBGTB
R
W
Bit 7
Bit 6
Bit 5
0x0106
DBGCNT
R
W
0
0x0107
DBGSCR1
R
W
C3SC1
C3SC0
C2SC1
C2SC0
0x0108
DBGSCR2
R
W
C3SC1
C3SC0
C2SC1
0x0109
DBGSCR3
R
W
C3SC1
C3SC0
0x010A
DBGEFR
0x010B
DBGSR
TRANGE
Bit 0
EEVE
CDCM
ABCM
TRCMOD
TALIGN
DSTAMP
PDOE
PROFILE
STAMP
Bit 12
Bit 11
Bit 10
Bit 9
Bit 8
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
C1SC1
C1SC0
C0SC1
C0SC0
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
TRIGF
0
EEVF
ME3
ME2
ME1
ME0
0
0
PTACT
0
SSF2
SSF1
SSF0
CNT
R PTBOVF
W
R
W
TSOURCE
1
TBF
Figure 6-2. Quick Reference to DBG Registers
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
185
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Address
Name
Bit 7
6
5
4
3
2
1
Bit 0
0x010C0x010F
Reserved
R
W
0
0
0
0
0
0
0
0
0x0110
DBGACTL
R
W
0
NDB
INST
RW
RWE
reserved
COMPE
0x01110x0114
Reserved
R
W
0
0
0
0
0
0
0
0x0115
DBGAAH
R
W
DBGAA[23:16]
0x0116
DBGAAM
R
W
DBGAA[15:8]
0x0117
DBGAAL
R
W
DBGAA[7:0]
0x0118
DBGAD0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x0119
DBGAD1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x011A
DBGAD2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
0x011B
DBGAD3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x011C
DBGADM0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x011D
DBGADM1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x011E
DBGADM2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
0x011F
DBGADM3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x0120
DBGBCTL
R
W
0
0
RW
RWE
reserved
COMPE
0x01210x0124
Reserved
R
W
0
0
0
0
0
0
0x0125
DBGBAH
R
W
DBGBA[23:16]
0x0126
DBGBAM
R
W
DBGBA[15:8]
0x0127
DBGBAL
R
W
DBGBA[7:0]
INST
0
0
0
0
0
Figure 6-2. Quick Reference to DBG Registers
MC9S12ZVM Family Reference Manual Rev. 1.5
186
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Address
Name
Bit 7
6
5
4
3
2
1
Bit 0
0x01280x012F
Reserved
R
W
0
0
0
0
0
0
0
0
0x0130
DBGCCTL
R
W
0
NDB
INST
RW
RWE
reserved
COMPE
0x01310x0134
Reserved
R
W
0
0
0
0
0
0
0
0x0135
DBGCAH
R
W
DBGCA[23:16]
0x0136
DBGCAM
R
W
DBGCA[15:8]
0x0137
DBGCAL
R
W
DBGCA[7:0]
0x0138
DBGCD0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x0139
DBGCD1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x013A
DBGCD2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
0x013B
DBGCD3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x013C
DBGCDM0
R
W
Bit 31
30
29
28
27
26
25
Bit 24
0x013D
DBGCDM1
R
W
Bit 23
22
21
20
19
18
17
Bit 16
0x013E
DBGCDM2
R
W
Bit 15
14
13
12
11
10
9
Bit 8
0x013F
DBGCDM3
R
W
Bit 7
6
5
4
3
2
1
Bit 0
0x0140
DBGDCTL
R
W
0
0
RW
RWE
reserved
COMPE
0x01410x0144
Reserved
R
W
0
0
0
0
0
0
0x0145
DBGDAH
R
W
DBGDA[23:16]
0x0146
DBGDAM
R
W
DBGDA[15:8]
INST
0
0
0
0
0
Figure 6-2. Quick Reference to DBG Registers
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
187
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Address
Name
Bit 7
0x0147
DBGDAL
R
W
0x01480x017F
Reserved
R
W
6
5
4
3
2
1
Bit 0
0
0
0
DBGDA[7:0]
0
0
0
0
0
Figure 6-2. Quick Reference to DBG Registers
6.3.2
Register Descriptions
This section consists of the DBG register descriptions in address order. When ARM is set in DBGC1, the
only bits in the DBG module registers that can be written are ARM, and TRIG
6.3.2.1
Debug Control Register 1 (DBGC1)
Address: 0x0100
7
0x0100
Reset
6
ARM
0
0
TRIG
0
5
4
3
2
reserved
BDMBP
BRKCPU
reserved
0
0
0
0
1
0
EEVE
0
0
Figure 6-3. Debug Control Register (DBGC1)
Read: Anytime
Write: Bit 7 Anytime with the exception that it cannot be set if PTACT is set. An ongoing profiling session
must be finished before DBG can be armed again.
Bit 6 can be written anytime but always reads back as 0.
Bits 5:0 anytime DBG is not armed and PTACT is clear.
NOTE
On a write access to DBGC1 and simultaneous hardware disarm from an
internal event, the hardware disarm has highest priority, clearing the ARM
bit and generating a breakpoint, if enabled.
NOTE
When disarming the DBG by clearing ARM with software, the contents of
bits[5:0] are not affected by the write, since up until the write operation,
ARM = 1 preventing these bits from being written. These bits must be
cleared using a second write if required.
MC9S12ZVM Family Reference Manual Rev. 1.5
188
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-4. DBGC1 Field Descriptions
Field
Description
7
ARM
Arm Bit — The ARM bit controls whether the DBG module is armed. This bit can be set and cleared by register
writes and is automatically cleared when the state sequencer returns to State0 on completing a debugging
session. On setting this bit the state sequencer enters State1.
0 Debugger disarmed. No breakpoint is generated when clearing this bit by software register writes.
1 Debugger armed
6
TRIG
Immediate Trigger Request Bit — This bit when written to 1 requests an immediate transition to final state
independent of comparator status. This bit always reads back a 0. Writing a 0 to this bit has no effect.
0 No effect.
1 Force state sequencer immediately to final state.
4
BDMBP
Background Debug Mode Enable — This bit determines if a CPU breakpoint causes the system to enter
Background Debug Mode (BDM) or initiate a Software Interrupt (SWI). If this bit is set but the BDC is not enabled,
then no breakpoints are generated.
0 Breakpoint to Software Interrupt if BDM inactive. Otherwise no breakpoint.
1 Breakpoint to BDM, if BDC enabled. Otherwise no breakpoint.
3
BRKCPU
CPU Breakpoint Enable — The BRKCPU bit controls whether the debugger requests a breakpoint to CPU upon
transitions to State0. If tracing is enabled, the breakpoint is generated on completion of the tracing session. If
tracing is not enabled, the breakpoint is generated immediately. Please refer to Section 6.4.7 for further details.
0 Breakpoints disabled
1 Breakpoints enabled
1–0
EEVE
External Event Enable — The EEVE bits configure the external event function. Table 6-5 explains the bit
encoding.
Table 6-5. EEVE Bit Encoding
6.3.2.2
EEVE
Description
00
External event function disabled
01
External event forces a trace buffer entry if tracing is enabled
10
External event is mapped to the state sequencer, replacing comparator channel 3
11
External event pin gates trace buffer entries
Debug Control Register2 (DBGC2)
Address: 0x0101
R
7
6
5
4
0
0
0
0
0
0
0
3
0
1
CDCM
W
Reset
2
0
0
ABCM
0
0
0
= Unimplemented or Reserved
Figure 6-4. Debug Control Register2 (DBGC2)
Read: Anytime.
Write: Anytime the module is disarmed and PTACT is clear.
This register configures the comparators for range matching.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
189
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-6. DBGC2 Field Descriptions
Field
Description
3–2
CDCM[1:0]
C and D Comparator Match Control — These bits determine the C and D comparator match mapping as
described in Table 6-7.
1–0
ABCM[1:0]
A and B Comparator Match Control — These bits determine the A and B comparator match mapping as
described in Table 6-8.
Table 6-7. CDCM Encoding
CDCM
Description
00
Match2 mapped to comparator C match....... Match3 mapped to comparator D match.
01
Match2 mapped to comparator C/D inside range....... Match3 disabled.
10
Match2 mapped to comparator C/D outside range....... Match3 disabled.
11
Reserved(1)
1. Currently defaults to Match2 mapped to inside range: Match3 disabled.
Table 6-8. ABCM Encoding
ABCM
Description
00
Match0 mapped to comparator A match....... Match1 mapped to comparator B match.
01
Match0 mapped to comparator A/B inside range....... Match1 disabled.
10
Match0 mapped to comparator A/B outside range....... Match1 disabled.
11
Reserved(1)
1. Currently defaults to Match0 mapped to inside range: Match1 disabled
6.3.2.3
Debug Trace Control Register High (DBGTCRH)
Address: 0x0102
R
W
Reset
7
6
reserved
TSOURCE
0
0
5
4
3
TRANGE
0
2
1
TRCMOD
0
0
0
TALIGN
0
0
0
Figure 6-5. Debug Trace Control Register (DBGTCRH)
Read: Anytime.
Write: Anytime the module is disarmed and PTACT is clear.
WARNING
DBGTCR[7] is reserved. Setting this bit maps the tracing to an unimplemented bus, thus
preventing proper operation.
This register configures the trace buffer for tracing and profiling.
MC9S12ZVM Family Reference Manual Rev. 1.5
190
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-9. DBGTCRH Field Descriptions
Field
6
TSOURCE
Description
Trace Control Bits — The TSOURCE enables the tracing session.
0 No CPU tracing/profiling selected
1 CPU tracing/profiling selected
5–4
TRANGE
Trace Range Bits — The TRANGE bits allow filtering of trace information from a selected address range when
tracing from the CPU in Detail mode. These bits have no effect in other tracing modes. To use a comparator for
range filtering, the corresponding COMPE bit must remain cleared. If the COMPE bit is set then the comparator
is used to generate events and the TRANGE bits have no effect. See Table 6-10 for range boundary definition.
3–2
TRCMOD
Trace Mode Bits — See Section 6.4.5.2 for detailed Trace Mode descriptions. In Normal Mode, change of flow
information is stored. In Loop1 Mode, change of flow information is stored but redundant entries into trace
memory are inhibited. In Detail Mode, address and data for all memory and register accesses is stored. See
Table 6-11.
1–0
TALIGN
Trigger Align Bits — These bits control whether the trigger is aligned to the beginning, end or the middle of a
tracing or profiling session. See Table 6-12.
Table 6-10. TRANGE Trace Range Encoding
TRANGE
Tracing Range
00
Trace from all addresses (No filter)
01
Trace only in address range from $00000 to Comparator D
10
Trace only in address range from Comparator C to $FFFFFF
11
Trace only in range from Comparator C to Comparator D
Table 6-11. TRCMOD Trace Mode Bit Encoding
TRCMOD
Description
00
Normal
01
Loop1
10
Detail
11
Pure PC
Table 6-12. TALIGN Trace Alignment Encoding
TALIGN
Description
00
Trigger ends data trace
01
Trigger starts data trace
10
32 lines of data trace follow trigger
11
(1)
Reserved
1. Tracing/Profiling disabled.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
191
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.4
Debug Trace Control Register Low (DBGTCRL)
Address: 0x0103
R
7
6
5
4
0
0
0
0
0
0
0
0
W
Reset
3
2
1
0
DSTAMP
PDOE
PROFILE
STAMP
0
0
0
0
= Unimplemented or Reserved
Figure 6-6. Debug Trace Control Register Low (DBGTCRL)
Read: Anytime.
Write: Anytime the module is disarmed and PTACT is clear.
This register configures the profiling and timestamp features
Table 6-13. DBGTCRL Field Descriptions
Field
Description
3
DSTAMP
Comparator D Timestamp Enable — This bit, when set, enables Comparator D matches to generate
timestamps in Detail, Normal and Loop1 trace modes.
0 Comparator D match does not generate timestamp
1 Comparator D match generates timestamp if timestamp function is enabled
2
PDOE
Profile Data Out Enable — This bit, when set, configures the device profiling pins for profiling.
0 Device pins not configured for profiling
1 Device pins configured for profiling
1
PROFILE
Profile Enable — This bit, when set, enables the profile function, whereby a subsequent arming of the DBG
activates profiling.
When PROFILE is set, the TRCMOD bits are ignored.
0 Profile function disabled
1 Profile function enabled
0
STAMP
Timestamp Enable — This bit, when set, enables the timestamp function. The timestamp function adds a
timestamp to each trace buffer entry in Detail, Normal and Loop1 trace modes.
0 Timestamp function disabled
1 Timestamp function enabled
6.3.2.5
Debug Trace Buffer Register (DBGTB)
Address: 0x0104, 0x0105
15
R
W
14
13
12
11
10
9
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
POR
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Other
Resets
—
—
—
—
—
—
—
—
—
—
—
—
—
—
—
—
Figure 6-7. Debug Trace Buffer Register (DBGTB)
MC9S12ZVM Family Reference Manual Rev. 1.5
192
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Read: Only when unlocked AND not armed and the TSOURCE bit is set, otherwise an error code (0xEE)
is returned. Only aligned word read operations are supported. Misaligned word reads or byte reads return
the error code 0xEE for each byte. The PROFILE bit must be clear to read profiling data,
Write: Aligned word writes when the DBG is disarmed and both PTACT and PROFILE are clear unlock
the trace buffer for reading but do not affect trace buffer contents.
Table 6-14. DBGTB Field Descriptions
Field
Description
15–0
Bit[15:0]
Trace Buffer Data Bits — The Trace Buffer Register is a window through which the lines of the trace buffer may
be read 16 bits at a time. Each valid read of DBGTB increments an internal trace buffer pointer which points to
the next address to be read. When the ARM bit is written to 1 the trace buffer is locked to prevent reading. The
trace buffer can only be unlocked for reading by writing to DBGTB with an aligned word write when the module
is disarmed. The DBGTB register can be read only as an aligned word. Byte reads or misaligned access of these
registers returns 0xEE and does not increment the trace buffer pointer. Similarly word reads while the debugger
is armed or trace buffer is locked return 0xEEEE. The POR state is undefined Other resets do not affect the trace
buffer contents.
6.3.2.6
Debug Count Register (DBGCNT)
Address: 0x0106
7
R
6
5
4
0
3
2
1
0
—
0
—
0
—
0
CNT
W
Reset
POR
0
0
—
0
—
0
—
0
—
0
= Unimplemented or Reserved
Figure 6-8. Debug Count Register (DBGCNT)
Read: Anytime.
Write: Never.
Table 6-15. DBGCNT Field Descriptions
Field
Description
6–0
CNT[6:0]
Count Value — The CNT bits [6:0] indicate the number of valid data lines stored in the trace buffer. Table 6-16
shows the correlation between the CNT bits and the number of valid data lines in the trace buffer. When the CNT
rolls over to zero, the TBF bit in DBGSR is set. Thereafter incrementing of CNT continues if configured for endalignment or mid-alignment.
The DBGCNT register is cleared when ARM in DBGC1 is written to a one. The DBGCNT register is cleared by
power-on-reset initialization but is not cleared by other system resets. If a reset occurs during a debug session,
the DBGCNT register still indicates after the reset, the number of valid trace buffer entries stored before the reset
occurred. The DBGCNT register is not decremented when reading from the trace buffer.
Table 6-16. CNT Decoding Table
TBF (DBGSR)
CNT[6:0]
Description
0
0000000
No data valid
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
193
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-16. CNT Decoding Table
6.3.2.7
TBF (DBGSR)
CNT[6:0]
Description
0
0000001
32 bits of one line valid
0
0000010
0000100
0000110
..
1111100
1 line valid
2 lines valid
3 lines valid
..
62 lines valid
0
1111110
63 lines valid
1
0000000
64 lines valid; if using Begin trigger alignment,
ARM bit is cleared and the tracing session ends.
1
0000010
..
1111110
64 lines valid,
oldest data has been overwritten by most recent data
Debug State Control Register 1 (DBGSCR1)
Address: 0x0107
R
W
Reset
7
6
5
4
3
2
1
0
C3SC1
C3SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
0
0
0
0
0
0
0
0
Figure 6-9. Debug State Control Register 1 (DBGSCR1)
Read: Anytime.
Write: If DBG is not armed and PTACT is clear.
The state control register 1 selects the targeted next state whilst in State1. The matches refer to the outputs
of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.12”.
Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control
register.
Table 6-17. DBGSCR1 Field Descriptions
Field
Description
1–0
C0SC[1:0]
Channel 0 State Control.
These bits select the targeted next state whilst in State1 following a match0.
3–2
C1SC[1:0]
Channel 1 State Control.
These bits select the targeted next state whilst in State1 following a match1.
5–4
C2SC[1:0]
Channel 2 State Control.
These bits select the targeted next state whilst in State1 following a match2.
7–6
C3SC[1:0]
Channel 3 State Control.
If EEVE !=10, these bits select the targeted next state whilst in State1 following a match3.
If EEVE = 10, these bits select the targeted next state whilst in State1 following an external event.
MC9S12ZVM Family Reference Manual Rev. 1.5
194
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-18. State1 Match State Sequencer Transitions
CxSC[1:0]
Function
00
Match has no effect
01
Match forces sequencer to State2
10
Match forces sequencer to State3
11
Match forces sequencer to Final State
In the case of simultaneous matches, the match on the higher channel number (3...0) has priority.
6.3.2.8
Debug State Control Register 2 (DBGSCR2)
Address: 0x0108
R
W
Reset
7
6
5
4
3
2
1
0
C3SC1
C3SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
0
0
0
0
0
0
0
0
Figure 6-10. Debug State Control Register 2 (DBGSCR2)
Read: Anytime.
Write: If DBG is not armed and PTACT is clear.
The state control register 2 selects the targeted next state whilst in State2. The matches refer to the outputs
of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.12”.
Comparators must be enabled by setting the comparator enable bit in the associated DBGXCTL control
register.
Table 6-19. DBGSCR2 Field Descriptions
Field
Description
1–0
C0SC[1:0]
Channel 0 State Control.
These bits select the targeted next state whilst in State2 following a match0.
3–2
C1SC[1:0]
Channel 1 State Control.
These bits select the targeted next state whilst in State2 following a match1.
5–4
C2SC[1:0]
Channel 2 State Control.
These bits select the targeted next state whilst in State2 following a match2.
7–6
C3SC[1:0]
Channel 3 State Control.
If EEVE !=10, these bits select the targeted next state whilst in State2 following a match3.
If EEVE =10, these bits select the targeted next state whilst in State2 following an external event.
Table 6-20. State2 Match State Sequencer Transitions
CxSC[1:0]
Function
00
Match has no effect
01
Match forces sequencer to State1
10
Match forces sequencer to State3
11
Match forces sequencer to Final State
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
195
Chapter 6 S12Z Debug (S12ZDBGV2) Module
In the case of simultaneous matches, the match on the higher channel number (3...0) has priority.
6.3.2.9
Debug State Control Register 3 (DBGSCR3)
Address: 0x0109
R
W
Reset
7
6
5
4
3
2
1
0
C3SC1
C3SC0
C2SC1
C2SC0
C1SC1
C1SC0
C0SC1
C0SC0
0
0
0
0
0
0
0
0
Figure 6-11. Debug State Control Register 3 (DBGSCR3)
Read: Anytime.
Write: If DBG is not armed and PTACT is clear.
The state control register three selects the targeted next state whilst in State3. The matches refer to the
outputs of the comparator match control logic as depicted in Figure 6-1 and described in Section 6.3.2.12”.
Comparators must be enabled by setting the comparator enable bit in the associated DBGxCTL control
register.
Table 6-21. DBGSCR3 Field Descriptions
Field
Description
1–0
C0SC[1:0]
Channel 0 State Control.
These bits select the targeted next state whilst in State3 following a match0.
3–2
C1SC[1:0]
Channel 1 State Control.
These bits select the targeted next state whilst in State3 following a match1.
5–4
C2SC[1:0]
Channel 2 State Control.
These bits select the targeted next state whilst in State3 following a match2.
7–6
C3SC[1:0]
Channel 3 State Control.
If EEVE !=10, these bits select the targeted next state whilst in State3 following a match3.
If EEVE =10, these bits select the targeted next state whilst in State3 following an external event.
Table 6-22. State3 Match State Sequencer Transitions
CxSC[1:0]
Function
00
Match has no effect
01
Match forces sequencer to State1
10
Match forces sequencer to State2
11
Match forces sequencer to Final State
In the case of simultaneous matches, the match on the higher channel number (3....0) has priority.
MC9S12ZVM Family Reference Manual Rev. 1.5
196
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.10
Debug Event Flag Register (DBGEFR)
Address: 0x010A
R
7
6
5
4
3
2
1
0
PTBOVF
TRIGF
0
EEVF
ME3
ME2
ME1
ME0
0
0
0
0
0
0
0
0
W
Reset
= Unimplemented or Reserved
Figure 6-12. Debug Event Flag Register (DBGEFR)
Read: Anytime.
Write: Never
DBGEFR contains flag bits each mapped to events whilst armed. Should an event occur, then the
corresponding flag is set. With the exception of TRIGF, the bits can only be set when the ARM bit is set.
The TRIGF bit is set if a TRIG event occurs when ARM is already set, or if the TRIG event occurs
simultaneous to setting the ARM bit.All other flags can only be cleared by arming the DBG module. Thus
the contents are retained after a debug session for evaluation purposes.
A set flag does not inhibit the setting of other flags.
Table 6-23. DBGEFR Field Descriptions
Field
7
PTBOVF
Description
Profiling Trace Buffer Overflow Flag — Indicates the occurrence of a trace buffer overflow event during a
profiling session.
0 No trace buffer overflow event
1 Trace buffer overflow event
6
TRIGF
TRIG Flag — Indicates the occurrence of a TRIG event during the debug session.
0 No TRIG event
1 TRIG event
4
EEVF
External Event Flag — Indicates the occurrence of an external event during the debug session.
0 No external event
1 External event
3–0
ME[3:0]
6.3.2.11
Match Event[3:0]— Indicates a comparator match event on the corresponding comparator channel.
Debug Status Register (DBGSR)
Address: 0x010B
R
7
6
5
4
3
2
1
0
TBF
0
0
PTACT
0
SSF2
SSF1
SSF0
—
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
Reset
POR
= Unimplemented or Reserved
Figure 6-13. Debug Status Register (DBGSR)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
197
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Read: Anytime.
Write: Never.
Table 6-24. DBGSR Field Descriptions
Field
Description
7
TBF
Trace Buffer Full — The TBF bit indicates that the trace buffer has been filled with data since it was last armed.
If this bit is set, then all trace buffer lines contain valid data, regardless of the value of DBGCNT bits CNT[6:0].
The TBF bit is cleared when ARM in DBGC1 is written to a one. The TBF is cleared by the power on reset
initialization. Other system generated resets have no affect on this bit
4
PTACT
Profiling Transmission Active — The PTACT bit, when set, indicates that the profiling transmission is still
active. When clear, PTACT then profiling transmission is not active. The PTACT bit is set when profiling begins
with the first PTS format entry to the trace buffer. The PTACT bit is cleared when the profiling transmission ends.
2–0
SSF[2:0]
State Sequencer Flag Bits — The SSF bits indicate the current State Sequencer state. During a debug session
on each transition to a new state these bits are updated. If the debug session is ended by software clearing the
ARM bit, then these bits retain their value to reflect the last state of the state sequencer before disarming. If a
debug session is ended by an internal event, then the state sequencer returns to State0 and these bits are
cleared to indicate that State0 was entered during the session. On arming the module the state sequencer enters
State1 and these bits are forced to SSF[2:0] = 001. See Table 6-25.
Table 6-25. SSF[2:0] — State Sequence Flag Bit Encoding
6.3.2.12
SSF[2:0]
Current State
000
State0 (disarmed)
001
State1
010
State2
011
State3
100
Final State
101,110,111
Reserved
Debug Comparator A Control Register (DBGACTL)
Address: 0x0110
7
R
0
W
Reset
0
6
5
NDB
INST
0
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-14. Debug Comparator A Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
MC9S12ZVM Family Reference Manual Rev. 1.5
198
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-26. DBGACTL Field Descriptions
Field
Description
6
NDB
Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator
register value or when the data bus differs from the register value. This bit is ignored if the INST bit in the
same register is set.
0 Match on data bus equivalence to comparator register contents
1 Match on data bus difference to comparator register contents
5
INST
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
3
RW
2
RWE
0
COMPE
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is ignored when INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
Table 6-27 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if
INST is set, because matches based on opcodes reaching the execution stage are data independent.
Table 6-27. Read or Write Comparison Logic Table
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
1
1
1
Read match
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
199
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.13
Debug Comparator A Address Register (DBGAAH, DBGAAM, DBGAAL)
Address: 0x0115, DBGAAH
23
22
21
R
19
18
17
16
DBGAA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0116, DBGAAM
15
R
DBGAA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0117, DBGAAL
7
R
DBGAA[7:0]
W
Reset
0
0
0
0
Figure 6-15. Debug Comparator A Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-28. DBGAAH, DBGAAM, DBGAAL Field Descriptions
Field
Description
23–16
DBGAA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
15–0
DBGAA
[15:0]
Comparator Address Bits [15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.5
200
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.14
Debug Comparator A Data Register (DBGAD)
Address: 0x0118, 0x0119, 0x011A, 0x011B
31
R
W
W
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
Reset
R
30
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
Reset
0
0
0
0
0
0
0
Figure 6-16. Debug Comparator A Data Register (DBGAD)
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGAD0, DBGAD1, DBGAD2, DBGAD3
map to DBGAD[31:0] respectively.
Table 6-29. DBGAD Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGAD0,
DBGAD1)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
15–0
Bits[15:0]
(DBGAD2,
DBGAD3)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
6.3.2.15
Debug Comparator A Data Mask Register (DBGADM)
Address: 0x011C, 0x011D, 0x011E, 0x011F
31
R
W
Reset
R
W
Reset
30
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
0
0
0
0
0
0
0
Figure 6-17. Debug Comparator A Data Mask Register (DBGADM)
Read: Anytime.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
201
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGADM0, DBGADM1, DBGADM2,
DBGADM3 map to DBGADM[31:0] respectively.
Table 6-30. DBGADM Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGADM0,
DBGADM1)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
15-0
Bits[15:0]
(DBGADM2,
DBGADM3)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
6.3.2.16
Debug Comparator B Control Register (DBGBCTL)
Address: 0x0120
R
7
6
0
0
W
Reset
0
0
5
INST
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-18. Debug Comparator B Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-31. DBGBCTL Field Descriptions
Field(1)
5
INST
3
RW
2
RWE
0
COMPE
Description
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is ignored when INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
1. If the ABCM field selects range mode comparisons, then DBGACTL bits configure the comparison, DBGBCTL is ignored.
MC9S12ZVM Family Reference Manual Rev. 1.5
202
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-32 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if
INST is set, as matches based on instructions reaching the execution stage are data independent.
Table 6-32. Read or Write Comparison Logic Table
6.3.2.17
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
1
1
1
Read match
Debug Comparator B Address Register (DBGBAH, DBGBAM, DBGBAL)
Address: 0x0125, DBGBAH
23
22
21
R
19
18
17
16
DBGBA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0126, DBGBAM
15
R
DBGBA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0127, DBGBAL
7
R
DBGBA[7:0]
W
Reset
0
0
0
0
Figure 6-19. Debug Comparator B Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-33. DBGBAH, DBGBAM, DBGBAL Field Descriptions
Field
Description
23–16
DBGBA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
15–0
DBGBA
[15:0]
Comparator Address Bits[15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
203
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.18
Debug Comparator C Control Register (DBGCCTL)
Address: 0x0130
7
R
6
0
W
Reset
5
NDB
INST
0
0
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-20. Debug Comparator C Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-34. DBGCCTL Field Descriptions
Field
Description
6
NDB
Not Data Bus — The NDB bit controls whether the match occurs when the data bus matches the comparator
register value or when the data bus differs from the register value. This bit is ignored if the INST bit in the
same register is set.
0 Match on data bus equivalence to comparator register contents
1 Match on data bus difference to comparator register contents
5
INST
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
3
RW
2
RWE
0
COMPE
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is not used if INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
Table 6-35 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if
INST is set, because matches based on opcodes reaching the execution stage are data independent.
Table 6-35. Read or Write Comparison Logic Table
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
MC9S12ZVM Family Reference Manual Rev. 1.5
204
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-35. Read or Write Comparison Logic Table
6.3.2.19
RWE Bit
RW Bit
RW Signal
Comment
1
1
1
Read match
Debug Comparator C Address Register (DBGCAH, DBGCAM, DBGCAL)
Address: 0x0135, DBGCAH
23
22
21
R
19
18
17
16
DBGCA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0136, DBGCAM
15
R
DBGCA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0137, DBGCAL
7
R
DBGCA[7:0]
W
Reset
0
0
0
0
Figure 6-21. Debug Comparator C Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-36. DBGCAH, DBGCAM, DBGCAL Field Descriptions
Field
Description
23–16
DBGCA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
15–0
DBGCA
[15:0]
Comparator Address Bits[15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
205
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.3.2.20
Debug Comparator C Data Register (DBGCD)
Address: 0x0138, 0x0139, 0x013A, 0x013B
31
R
W
W
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
Reset
R
30
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
Reset
0
0
0
0
0
0
0
Figure 6-22. Debug Comparator C Data Register (DBGCD)
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGCD0, DBGCD1, DBGCD2, DBGCD3
map to DBGCD[31:0] respectively.
XGATE data accesses have a maximum width of 16-bits and are mapped to DBGCD[15:0].
Table 6-37. DBGCD Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGCD0,
DBGCD1)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
15–0
Bits[15:0]
(DBGCD2,
DBGCD3)
Comparator Data Bits — These bits control whether the comparator compares the data bus bits to a logic one
or logic zero. The comparator data bits are only used in comparison if the corresponding data mask bit is logic 1.
0 Compare corresponding data bit to a logic zero
1 Compare corresponding data bit to a logic one
6.3.2.21
Debug Comparator C Data Mask Register (DBGCDM)
Address: 0x013C, 0x013D, 0x013E, 0x013F
31
R
W
Reset
R
W
Reset
30
29
28
27
26
25
24
23
22
21
20
19
18
17
16
Bit 31 Bit 30 Bit 29 Bit 28 Bit 27 Bit 26 Bit 25 Bit 24 Bit 23 Bit 22 Bit 21 Bit 20 Bit 19 Bit 18 Bit 17 Bit 16
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
Bit 8
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
0
0
0
0
0
0
0
Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9
0
0
0
0
0
0
0
Figure 6-23. Debug Comparator C Data Mask Register (DBGCDM)
Read: Anytime.
MC9S12ZVM Family Reference Manual Rev. 1.5
206
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Write: If DBG not armed and PTACT is clear.
This register can be accessed with a byte resolution, whereby DBGCDM0, DBGCDM1, DBGCDM2,
DBGCDM3 map to DBGCDM[31:0] respectively.
XGATE data accesses have a maximum width of 16-bits and are mapped to DBGCDM[15:0].
Table 6-38. DBGCDM Field Descriptions
Field
Description
31–16
Bits[31:16]
(DBGCDM0,
DBGCDM1)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
15–0
Bits[15:0]
(DBGCDM2,
DBGCDM3)
Comparator Data Mask Bits — These bits control whether the comparator compares the data bus bits to the
corresponding comparator data compare bits.
0 Do not compare corresponding data bit
1 Compare corresponding data bit
6.3.2.22
Debug Comparator D Control Register (DBGDCTL)
Address: 0x0140
R
7
6
0
0
0
0
W
Reset
5
INST
0
4
0
0
3
2
1
0
RW
RWE
reserved
COMPE
0
0
0
0
= Unimplemented or Reserved
Figure 6-24. Debug Comparator D Control Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-39. DBGDCTL Field Descriptions
Field(1)
5
INST
3
RW
2
RWE
0
COMPE
Description
Instruction Select — This bit configures the comparator to compare PC or data access addresses.
0 Comparator compares addresses of data accesses
1 Comparator compares PC address
Read/Write Comparator Value Bit — The RW bit controls whether read or write is used in compare for the
associated comparator. The RW bit is ignored if RWE is clear or INST is set.
0 Write cycle is matched
1 Read cycle is matched
Read/Write Enable Bit — The RWE bit controls whether read or write comparison is enabled for the
associated comparator. This bit is ignored if INST is set.
0 Read/Write is not used in comparison
1 Read/Write is used in comparison
Enable Bit — Determines if comparator is enabled
0 The comparator is not enabled
1 The comparator is enabled
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
207
Chapter 6 S12Z Debug (S12ZDBGV2) Module
1. If the CDCM field selects range mode comparisons, then DBGCCTL bits configure the comparison, DBGDCTL is ignored.
Table 6-40 shows the effect for RWE and RW on the comparison conditions. These bits are ignored if
INST is set, because matches based on opcodes reaching the execution stage are data independent.
Table 6-40. Read or Write Comparison Logic Table
6.3.2.23
RWE Bit
RW Bit
RW Signal
Comment
0
x
0
RW not used in comparison
0
x
1
RW not used in comparison
1
0
0
Write match
1
0
1
No match
1
1
0
No match
1
1
1
Read match
Debug Comparator D Address Register (DBGDAH, DBGDAM, DBGDAL)
Address: 0x0145, DBGDAH
23
22
21
R
19
18
17
16
DBGDA[23:16]
W
Reset
20
0
0
0
0
0
0
0
0
14
13
12
11
10
9
8
Address: 0x0146, DBGDAM
15
R
DBGDA[15:8]
W
Reset
0
0
0
0
0
0
0
0
6
5
4
3
2
1
0
0
0
0
0
Address: 0x0147, DBGDAL
7
R
DBGDA[7:0]
W
Reset
0
0
0
0
Figure 6-25. Debug Comparator D Address Register
Read: Anytime.
Write: If DBG not armed and PTACT is clear.
Table 6-41. DBGDAH, DBGDAM, DBGDAL Field Descriptions
Field
Description
23–16
DBGDA
[23:16]
Comparator Address Bits [23:16]— These comparator address bits control whether the comparator compares
the address bus bits [23:16] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
MC9S12ZVM Family Reference Manual Rev. 1.5
208
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-41. DBGDAH, DBGDAM, DBGDAL Field Descriptions
Field
15–0
DBGDA
[15:0]
6.4
Description
Comparator Address Bits[15:0]— These comparator address bits control whether the comparator compares
the address bus bits [15:0] to a logic one or logic zero.
0 Compare corresponding address bit to a logic zero
1 Compare corresponding address bit to a logic one
Functional Description
This section provides a complete functional description of the DBG module.
6.4.1
DBG Operation
The DBG module operation is enabled by setting ARM in DBGC1. When armed it supports storing of data
in the trace buffer and can be used to generate breakpoints to the CPU. The DBG module is made up of
comparators, control logic, the trace buffer, and the state sequencer, Figure 6-1.
The comparators monitor the bus activity of the CPU. Comparators can be configured to monitor opcode
addresses (effectively the PC address) or data accesses. Comparators can be configured during data
accesses to mask out individual data bus bits and to use R/W access qualification in the comparison.
Comparators can be configured to monitor a range of addresses.
When configured for data access comparisons, the match is generated if the address (and optionally data)
of a data access matches the comparator value.
Configured for monitoring opcode addresses, the match is generated when the associated opcode reaches
the execution stage of the instruction queue, but before execution of that opcode.
When a match with a comparator register value occurs, the associated control logic can force the state
sequencer to another state (see Figure 6-26).
The state sequencer can transition freely between the states 1, 2 and 3. On transition to Final State bus
tracing can be triggered. On completion of tracing the state sequencer enters State0. If tracing is disabled
or End aligned tracing is enabled then the state sequencer transitions immediately from Final State to
State0. The transition to State0 generates breakpoints if breakpoints are enabled.
Independent of the comparators, state sequencer transitions can be forced by the external event input or by
writing to the TRIG bit in the DBGC1 control register.
The trace buffer is visible through a 2-byte window in the register address map and can be read out using
standard 16-bit word reads.
6.4.2
Comparator Modes
The DBG contains four comparators, A, B, C, and D. Each comparator compares the address stored in
DBGXAH, DBGXAM, and DBGXAL with the PC (opcode addresses) or selected address bus (data
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
209
Chapter 6 S12Z Debug (S12ZDBGV2) Module
accesses). Furthermore, comparators A and C can compare the data buses to values stored in DBGXD3-0
and allow data bit masking.
The comparators can monitor the buses for an exact address or an address range. The comparator
configuration is controlled by the control register contents and the range control by the DBGC2 contents.
The comparator control register also allows the type of data access to be included in the comparison
through the use of the RWE and RW bits. The RWE bit controls whether the access type is compared for
the associated comparator and the RW bit selects either a read or write access for a valid match.
The INST bit in each comparator control register is used to determine the matching condition. By setting
INST, the comparator matches opcode addresses, whereby the databus, data mask, RW and RWE bits are
ignored. The comparator register must be loaded with the exact opcode address.
The comparator can be configured to match memory access addresses by clearing the INST bit.
Each comparator match can force a transition to another state sequencer state (see Section 6.4.3”).
Once a successful comparator match has occurred, the condition that caused the original match is not
verified again on subsequent matches. Thus if a particular data value is matched at a given address, this
address may not contain that data value when a subsequent match occurs.
Comparators C and D can also be used to select an address range to trace from, when tracing CPU accesses
in Detail mode. This is determined by the TRANGE bits in the DBGTCRH register. The TRANGE
encoding is shown in Table 6-10. If the TRANGE bits select a range definition using comparator D and
the COMPE bit is clear, then comparator D is configured for trace range definition. By setting the COMPE
bit the comparator is configured for address bus comparisons, the TRANGE bits are ignored and the
tracing range function is disabled. Similarly if the TRANGE bits select a range definition using comparator
C and the COMPE bit is clear, then comparator C is configured for trace range definition.
Match[0, 1, 2, 3] map directly to Comparators [A, B, C, D] respectively, except in range modes (see
Section 6.3.2.2”). Comparator priority rules are described in the event priority section (Section 6.4.3.5”).
6.4.2.1
Exact Address Comparator Match
With range comparisons disabled, the match condition is an exact equivalence of address bus with the
value stored in the comparator address registers. Qualification of the type of access (R/W) is also possible.
Code may contain various access forms of the same address, for example a 16-bit access of ADDR[n] or
byte access of ADDR[n+1] both access n+1. The comparators ensure that any access of the address defined
by the comparator address register generates a match, as shown in the example of Table 6-42. Thus if the
comparator address register contains ADDR[n+1] any access of ADDR[n+1] matches. This means that a
16-bit access of ADDR[n] or 32-bit access of ADDR[n-1] also match because they also access
ADDR[n+1]. The right hand columns show the contents of DBGxA that would match for each access.
Table 6-42. Comparator Address Bus Matches
Access
Address
ADDR[n]
ADDR[n+1]
ADDR[n+2]
ADDR[n+3]
32-bit
ADDR[n]
Match
Match
Match
Match
16-bit
ADDR[n]
Match
Match
No Match
No Match
16-bit
ADDR[n+1]
No Match
Match
Match
No Match
MC9S12ZVM Family Reference Manual Rev. 1.5
210
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-42. Comparator Address Bus Matches
Access
Address
ADDR[n]
ADDR[n+1]
ADDR[n+2]
ADDR[n+3]
8-bit
ADDR[n]
Match
No Match
No Match
No Match
If the comparator INST bit is set, the comparator address register contents are compared with the PC, the
data register contents and access type bits are ignored. The comparator address register must be loaded
with the address of the first opcode byte.
6.4.2.2
Address and Data Comparator Match
Comparators A and C feature data comparators, for data access comparisons. The comparators do not
evaluate if accessed data is valid. Accesses across aligned 32-bit boundaries are split internally into
consecutive accesses. The data comparator mapping to accessed addresses for the CPU is shown in
Table 6-43, whereby the Address column refers to the lowest 2 bits of the lowest accessed address. This
corresponds to the most significant data byte.
Table 6-43. Comparator Data Byte Alignment
Address[1:0]
Data Comparator
00
DBGxD0
01
DBGxD1
10
DBGxD2
11
DBGxD3
The fixed mapping of data comparator bytes to addresses within a 32-bit data field ensures data matches
independent of access size. To compare a single data byte within the 32-bit field, the other bytes within
that field must be masked using the corresponding data mask registers. This ensures that any access of that
byte (32-bit,16-bit or 8-bit) with matching data causes a match. If no bytes are masked then the data
comparator always compares all 32-bits and can only generate a match on a 32-bit access with correct 32bit data value. In this case, 8-bit or 16-bit accesses within the 32-bit field cannot generate a match even if
the contents of the addressed bytes match because all 32-bits must match. In Table 6-44 the Access
Address column refers to the address bits[1:0] of the lowest accessed address (most significant data byte).
Table 6-44. Data Register Use Dependency On CPU Access Type
Memory Address[2:0]
Case
Access
Address
Access
Size
000
001
010
011
1
00
32-bit
DBGxD0
DBGxD1
DBGxD2
DBGxD3
2
01
32-bit
DBGxD1
DBGxD2
DBGxD3
DBGxD0
3
10
32-bit
DBGxD2
DBGxD3
DBGxD0
DBGxD1
4
11
32-bit
DBGxD3
DBGxD0
DBGxD1
5
00
16-bit
6
01
16-bit
7
10
16-bit
DBGxD0
100
101
110
DBGxD2
DBGxD1
DBGxD1
DBGxD2
DBGxD2
DBGxD3
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
211
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Memory Address[2:0]
Case
Access
Address
Access
Size
8
11
16-bit
9
00
8-bit
10
01
8-bit
11
10
8-bit
12
11
8-bit
13
00
8-bit
000
001
010
011
100
DBGxD3
DBGxD0
101
110
DBGxD0
DBGxD1
DBGxD2
DBGxD3
DBGxD0
Denotes byte that is not accessed.
For a match of a 32-bit access with data compare, the address comparator must be loaded with the address
of the lowest accessed byte. For Case1 Table 6-44 this corresponds to 000, for Case2 it corresponds to 001.
To compare all 32-bits, it is required that no bits are masked.
6.4.2.3
Data Bus Comparison NDB Dependency
The NDB control bit allows data bus comparators to be configured to either match on equivalence or on
difference. This allows monitoring of a difference in the contents of an address location from an expected
value.
When matching on an equivalence (NDB=0), each individual data bus bit position can be masked out by
clearing the corresponding mask bit, so that it is ignored in the comparison. A match occurs when all data
bus bits with corresponding mask bits set are equivalent. If all mask register bits are clear, then a match is
based on the address bus only, the data bus is ignored.
When matching on a difference, mask bits can be cleared to ignore bit positions. A match occurs when any
data bus bit with corresponding mask bit set is different. Clearing all mask bits, causes all bits to be ignored
and prevents a match because no difference can be detected. In this case address bus equivalence does not
cause a match. Bytes that are not accessed are ignored. Thus when monitoring a multi byte field for a
difference, partial accesses of the field only return a match if a difference is detected in the accessed bytes.
Table 6-45. NDB and MASK bit dependency
6.4.2.4
NDB
DBGADM
Comment
0
0
Do not compare data bus bit.
0
1
Compare data bus bit. Match on equivalence.
1
0
Do not compare data bus bit.
1
1
Compare data bus bit. Match on difference.
Range Comparisons
Range comparisons are accurate to byte boundaries. Thus for data access comparisons a match occurs if
at least one byte of the access is in the range (inside range) or outside the range (outside range). For opcode
comparisons only the address of the first opcode byte is compared with the range.
MC9S12ZVM Family Reference Manual Rev. 1.5
212
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
When using the AB comparator pair for a range comparison, the data bus can be used for qualification by
using the comparator A data and data mask registers. Similarly when using the CD comparator pair for a
range comparison, the data bus can be used for qualification by using the comparator C data and data mask
registers. The DBGACTL/DBGCCTL RW and RWE bits can be used to qualify the range comparison on
either a read or a write access. The corresponding DBGBCTL/DBGDCTL bits are ignored. The
DBGACTL/DBGCCTL COMPE/INST bits are used for range comparisons. The DBGBCTL/DBGDCTL
COMPE/INST bits are ignored in range modes.
6.4.2.4.1
Inside Range (CompAC_Addr ≤ address ≤ CompBD_Addr)
In the Inside Range comparator mode, either comparator pair A and B or comparator pair C and D can be
configured for range comparisons by the control register (DBGC2). The match condition requires a
simultaneous valid match for both comparators. A match condition on only one comparator is not valid.
6.4.2.4.2
Outside Range (address < CompAC_Addr or address > CompBD_Addr)
In the Outside Range comparator mode, either comparator pair A and B or comparator pair C and D can
be configured for range comparisons. A single match condition on either of the comparators is recognized
as valid. Outside range mode in combination with opcode address matches can be used to detect if opcodes
are from an unexpected range.
NOTE
When configured for data access matches, an outside range match would
typically occur at any interrupt vector fetch or register access. This can be
avoided by setting the upper or lower range limit to $FFFFFF or $000000
respectively. Interrupt vector fetches do not cause opcode address matches.
6.4.3
Events
Events are used as qualifiers for a state sequencer change of state. The state control register for the current
state determines the next state for each event. An event can immediately initiate a transition to the next
state sequencer state whereby the corresponding flag in DBGSR is set.
6.4.3.1
6.4.3.1.1
Comparator Match Events
Opcode Address Comparator Match
The comparator is loaded with the address of the selected instruction and the comparator control register
INST bit is set. When the opcode reaches the execution stage of the instruction queue a match occurs just
before the instruction executes, allowing a breakpoint immediately before the instruction boundary. The
comparator address register must contain the address of the first opcode byte for the match to occur.
Opcode address matches are data independent thus the RWE and RW bits are ignored. CPU compares are
disabled when BDM becomes active.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
213
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.3.1.2
Data Access Comparator Match
Data access matches are generated when an access occurs at the address contained in the comparator
address register. The match can be qualified by the access data and by the access type (read/write). The
breakpoint occurs a maximum of 2 instructions after the access in the CPU flow. Note, if a COF occurs
between access and breakpoint, the opcode address of the breakpoint can be elsewhere in the memory map.
Opcode fetches are not classed as data accesses. Thus data access matches are not possible on opcode
fetches.
6.4.3.2
External Event
The DBGEEV input signal can force a state sequencer transition, independent of internal comparator
matches. The DBGEEV is an input signal mapped directly to a device pin and configured by the EEVE
field in DBGC1. The external events can change the state sequencer state, or force a trace buffer entry, or
gate trace buffer entries.
If configured to change the state sequencer state, then the external match is mapped to DBGSCRx bits
C3SC[1:0]. In this configuration, internal comparator channel3 is de-coupled from the state sequencer but
can still be used for timestamps. The DBGEFR bit EEVF is set when an external event occurs.
6.4.3.3
Setting The TRIG Bit
Independent of comparator matches it is possible to initiate a tracing session and/or breakpoint by writing
the TRIG bit in DBGC1 to a logic “1”. This forces the state sequencer into the Final State. If configured
for End aligned tracing or for no tracing, the transition to Final State is followed immediately by a
transition to State0. If configured for Begin- or Mid Aligned tracing, the state sequencer remains in Final
State until tracing is complete, then it transitions to State0.
Breakpoints, if enabled, are issued on the transition to State0.
6.4.3.4
Profiling Trace Buffer Overflow Event
During code profiling a trace buffer overflow forces the state sequencer into the disarmed State0 and, if
breakpoints are enabled, issues a breakpoint request to the CPU.
6.4.3.5
Event Priorities
If simultaneous events occur, the priority is resolved according to Table 6-46. Lower priority events are
suppressed. It is thus possible to miss a lower priority event if it occurs simultaneously with an event of a
higher priority. The event priorities dictate that in the case of simultaneous matches, the match on the
higher comparator channel number (3,2,1,0) has priority.
If a write access to DBGC1 with the ARM bit position set occurs simultaneously to a hardware disarm
from an internal event, then the ARM bit is cleared due to the hardware disarm.
Table 6-46. Event Priorities
Priority
Source
Action
Highest
TB Overflow
Immediate force to state 0, generate breakpoint and terminate tracing
MC9S12ZVM Family Reference Manual Rev. 1.5
214
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-46. Event Priorities
TRIG
Force immediately to final state
DBGEEV
Force to next state as defined by state control registers (EEVE=2’b10)
Match3
Force to next state as defined by state control registers
Match2
Force to next state as defined by state control registers
Match1
Force to next state as defined by state control registers
Match0
Force to next state as defined by state control registers
Lowest
6.4.4
State Sequence Control
State 0
(Disarmed)
ARM = 1
State1
Final State
State2
State3
Figure 6-26. State Sequencer Diagram
The state sequencer allows a defined sequence of events to provide a breakpoint and/or a trigger point for
tracing of data in the trace buffer. When the DBG module is armed by setting the ARM bit in the DBGC1
register, the state sequencer enters State1. Further transitions between the states are controlled by the state
control registers and depend upon event occurrences (see Section 6.4.3). From Final State the only
permitted transition is back to the disarmed State0. Transition between the states 1 to 3 is not restricted.
Each transition updates the SSF[2:0] flags in DBGSR accordingly to indicate the current state. If
breakpoints are enabled, then an event based transition to State0 generates the breakpoint request. A
transition to State0 resulting from writing “0” to the ARM bit does not generate a breakpoint request.
6.4.4.1
Final State
On entering Final State a trigger may be issued to the trace buffer according to the trigger position control
as defined by the TALIGN field (see Section 6.3.2.3”).
If tracing is enabled and either Begin or Mid aligned triggering is selected, the state sequencer remains in
Final State until completion of the trace. On completion of the trace the state sequencer returns to State0
and the debug module is disarmed; if breakpoints are enabled, a breakpoint request is generated.
If tracing is disabled or End aligned triggering is selected, then when the Final State is reached the state
sequencer returns to State0 immediately and the debug module is disarmed. If breakpoints are enabled, a
breakpoint request is generated on transitions to State0.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
215
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.5
Trace Buffer Operation
The trace buffer is a 64 lines deep by 64-bits wide RAM array. If the TSOURCE bit is set the DBG module
can store trace information in the RAM array in a circular buffer format. Data is stored in mode dependent
formats, as described in the following sections. After each trace buffer entry, the counter register
DBGCNT is incremented. Trace buffer rollover is possible when configured for End- or Mid-Aligned
tracing, such that older entries are replaced by newer entries. Tracing of CPU activity is disabled when the
BDC is active.
The RAM array can be accessed through the register DBGTB using 16-bit wide word accesses. After each
read, the internal RAM pointer is incremented so that the next read will receive fresh information. Reading
the trace buffer whilst the DBG is armed returns invalid data and the trace buffer pointer is not
incremented.
In Detail mode the address range for CPU access tracing can be limited to a range specified by the
TRANGE bits in DBGTCRH. This function uses comparators C and D to define an address range inside
which accesses should be traced. Thus traced accesses can be restricted, for example, to particular register
or RAM range accesses.
The external event pin can be configured to force trace buffer entries in Normal or Loop1 trace modes. All
tracing modes support trace buffer gating. In Pure PC and Detail modes external events do not force trace
buffer entries.
If the external event pin is configured to gate trace buffer entries then any trace mode is valid.
6.4.5.1
Trace Trigger Alignment
Using the TALIGN bits (see Section 6.3.2.3”) it is possible to align the trigger with the end, the middle, or
the beginning of a tracing session.
If End or Mid-Alignment is selected, tracing begins when the ARM bit in DBGC1 is set and State1 is
entered. The transition to Final State if End-Alignment is selected, ends the tracing session. The transition
to Final State if Mid-Alignment is selected signals that another 32 lines are traced before ending the tracing
session. Tracing with Begin-Alignment starts at the trigger and ends when the trace buffer is full.
Table 6-47. Tracing Alignment
TALIGN
Tracing Begin
00
On arming
At trigger
01
At trigger
When trace buffer is full
10
On arming
When 32 trace buffer lines have
been filled after trigger
11
6.4.5.1.1
Tracing End
Reserved
Storing with Begin-Alignment
Storing with Begin-Alignment, data is not stored in the trace buffer until the Final State is entered. Once
the trigger condition is met the DBG module remains armed until 64 lines are stored in the trace buffer.
MC9S12ZVM Family Reference Manual Rev. 1.5
216
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Using Begin-Alignment together with opcode address comparisons, if the instruction is about to be
executed then the trace is started. If the trigger is at the address of a COF instruction, whilst tracing COF
addresses, then that COF address is stored to the trace buffer. If breakpoints are enabled, the breakpoint is
generated upon entry into State0 on completion of the tracing session; thus the breakpoint does not occur
at the instruction boundary.
6.4.5.1.2
Storing with Mid-Alignment
Storing with Mid-Alignment, data is stored in the trace buffer as soon as the DBG module is armed. When
the trigger condition is met, another 32 lines are traced before ending the tracing session, irrespective of
the number of lines stored before the trigger occurred, then the DBG module is disarmed and no more data
is stored. Using Mid-Alignment with opcode address triggers, if the instruction is about to be executed then
the trace is continued for another 32 lines. If breakpoints are enabled, the breakpoint is generated upon
entry into State0 on completion of the tracing session; thus the breakpoint does not occur at the instruction
boundary. When configured for Compressed Pure-PC tracing, the MAT info bit is set to indicate the last
PC entry before a trigger event.
6.4.5.1.3
Storing with End-Alignment
Storing with End-Alignment, data is stored in the trace buffer until the Final State is entered. Following
this trigger, the DBG module immediately transitions to State0. If the trigger is at the address of a COF
instruction the trigger event is not stored in the trace buffer.
6.4.5.2
Trace Modes
The DBG module can operate in four trace modes. The mode is selected using the TRCMOD bits in the
DBGTCRH register. Normal, Loop1 and Detail modes can be configured to store a timestamp with each
entry, by setting the STAMP bit. The modes are described in the following subsections.
In addition to the listed trace modes it is also possible to use code profiling to fill the trace buffer with a
highly compressed COF format. This can be subsequently read out in the same fashion as the listed trace
modes (see Section 6.4.6).
6.4.5.2.1
Normal Mode
In Normal Mode, change of flow (COF) program counter (PC) addresses are stored.
CPU COF addresses are defined as follows:
• Source address of taken conditional branches (bit-conditional, and loop primitives)
• Destination address of indexed JMP and JSR instruction.s
• Destination address of RTI and RTS instructions.
• Vector address of interrupts
BRA, BSR, BGND as well as non-indexed JMP and JSR instructions are not classified as change of flow
and are not stored in the trace buffer.
COF addresses stored include the full address bus of CPU and an information byte, which contains bits to
indicate whether the stored address was a source, destination or vector address.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
217
Chapter 6 S12Z Debug (S12ZDBGV2) Module
NOTE
When a CPU indexed jump instruction is executed, the destination address
is stored to the trace buffer on instruction completion, indicating the COF
has taken place. If an interrupt occurs simultaneously then the next
instruction carried out is actually from the interrupt service routine. The
instruction at the destination address of the original program flow gets
executed after the interrupt service routine.
In the following example an IRQ interrupt occurs during execution of the
indexed JMP at address MARK1. The NOP at the destination (SUB_1) is
not executed until after the IRQ service routine but the destination address
is entered into the trace buffer to indicate that the indexed JMP COF has
taken place.
MARK1:
MARK2:
LD
JMP
NOP
SUB_1:
NOP
ADDR1:
NOP
DBNE
IRQ_ISR: LD
ST
RTI
X,#SUB_1
(0,X)
; IRQ interrupt occurs during execution of this
;
; JMP Destination address TRACE BUFFER ENTRY 1
; RTI Destination address TRACE BUFFER ENTRY 3
;
; Source address TRACE BUFFER ENTRY 4
D0,PART5
D1,#$F0
D1,VAR_C1
; IRQ Vector $FFF2 = TRACE BUFFER ENTRY 2
;
The execution flow taking into account the IRQ is as follows
LD
MARK1:
JMP
IRQ_ISR: LD
ST
RTI
SUB_1:
NOP
NOP
ADDR1:
DBNE
X,#SUB_1
(0,X)
D1,#$F0
D1,VAR_C1
;
;
;
;
;
D0,PART5
The Normal Mode trace buffer format is shown in the following tables. Whilst tracing in Normal or Loop1
modes each array line contains 2 data entries, thus in this case the DBGCNT[0] is incremented after each
separate entry. Information byte bits indicate if an entry is a source, destination or vector address.
The external event input can force trace buffer entries independent of COF occurrences, in which case the
EEVI bit is set and the PC value of the last instruction is stored to the trace buffer. If the external event
coincides with a COF buffer entry a single entry is made with the EEVI bit set.
Normal mode profiling with timestamp is possible when tracing from a single source by setting the
STAMP bit in DBGTCRL. This results in a different format (see Table 6-49).
Table 6-48. Normal and Loop1 Mode Trace Buffer Format without Timestamp
8-Byte Wide Trace Buffer Line
Mode
7
6
5
4
3
2
1
0
MC9S12ZVM Family Reference Manual Rev. 1.5
218
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-48. Normal and Loop1 Mode Trace Buffer Format without Timestamp
CPU
CINF1
CPCH1
CPCM1
CPCL1
CINF0
CPCH0
CPCM0
CPCL0
CINF3
CPCH3
CPCM3
CPCL3
CINF2
CPCH2
CPCM2
CPCL2
Table 6-49. Normal and Loop1 Mode Trace Buffer Format with Timestamp
8-Byte Wide Trace Buffer Line
Mode
CPU
7
6
5
4
3
2
1
0
Timestamp
Timestamp
Reserved
Reserved
CINF0
CPCH0
CPCM0
CPCL0
Timestamp
Timestamp
Reserved
Reserved
CINF1
CPCH1
CPCM1
CPCL1
CINF contains information relating to the CPU.
CPU Information Byte CINF For Normal And Loop1 Modes
Bit 7
Bit 6
CET
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
0
0
CTI
EEVI
0
TOVF
Figure 6-27. CPU Information Byte CINF
Table 6-50. CINF Bit Descriptions
Field
Description
7–6
CET
CPU Entry Type Field — Indicates the type of stored address of the trace buffer entry as described in Table 6-51
3
CTI
Comparator Timestamp Indicator — This bit indicates if the trace buffer entry corresponds to a comparator
timestamp.
0 Trace buffer entry initiated by trace mode specification conditions or timestamp counter overflow
1 Trace buffer entry initiated by comparator D match
2
EEVI
External Event Indicator — This bit indicates if the trace buffer entry corresponds to an external event.
0 Trace buffer entry not initiated by an external event
1 Trace buffer entry initiated by an external event
0
TOVF
Timestamp Overflow Indicator — Indicates if the trace buffer entry corresponds to a timestamp overflow
0 Trace buffer entry not initiated by a timestamp overflow
1 Trace buffer entry initiated by a timestamp overflow
Table 6-51. CET Encoding
CET
Entry Type Description
00
Non COF opcode address (entry forced by an external event)
01
Vector destination address
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
219
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-51. CET Encoding
CET
Entry Type Description
10
Source address of COF opcode
11
Destination address of COF opcode
6.4.5.2.2
Loop1 Mode
Loop1 Mode, similarly to Normal Mode also stores only COF address information to the trace buffer, it
however allows the filtering out of redundant information.
The intent of Loop1 Mode is to prevent the trace buffer from being filled entirely with duplicate
information from a looping construct such as delays using the DBNE instruction. The DBG monitors trace
buffer entries and prevents consecutive duplicate address entries resulting from repeated branches.
Loop1 Mode only inhibits consecutive duplicate source address entries that would typically be stored in
most tight looping constructs. It does not inhibit repeated entries of destination addresses or vector
addresses, since repeated entries of these could indicate a bug in application code that the DBG module is
designed to help find.
The trace buffer format for Loop1 Mode is the same as that of Normal Mode.
6.4.5.2.3
Detail Mode
When tracing CPU activity in Detail Mode, address and data of data and vector accesses are traced. The
information byte indicates the size of access and the type of access (read or write).
ADRH, ADRM, ADRL denote address high, middle and low byte respectively. The numerical suffix
indicates which tracing step. DBGCNT increments by 2 for each line completed.
If timestamps are enabled then each CPU entry can span 2 trace buffer lines, whereby the second line
includes the timestamp. If a valid PC occurs in the same cycle as the timestamp, it is also stored to the trace
buffer and the PC bit is set. The second line featuring the timestamp is only stored if no further data access
occurs in the following cycle. This is shown in Table 6-53, where data accesses 2 and 3 occur in
consecutive cycles, suppressing the entry2 timestamp. If 2 lines are used for an entry, then DBGCNT
increments by 4. A timestamp line is indicated by bit1 in the TSINF byte. The timestamp counter is only
reset each time a timestamp line entry is made. It is not reset when the data and address trace buffer line
entry is made.
Table 6-52. Detail Mode Trace Buffer Format without Timestamp
8-Byte Wide Trace Buffer Line
Mode
CPU
Detail
7
6
5
4
3
2
1
0
CDATA31
CDATA21
CDATA11
CDATA01
CINF1
CADRH1
CADRM1
CADRL1
CDATA32
CDATA22
CDATA12
CDATA02
CINF2
CADRH2
CADRM2
CADRL2
MC9S12ZVM Family Reference Manual Rev. 1.5
220
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Table 6-53. Detail Mode Trace Buffer Format with Timestamp
8-Byte Wide Trace Buffer Line
Mode
CPU
Detail
7
6
5
4
3
2
1
0
CDATA31
CDATA21
CDATA11
CDATA01
CINF1
CADRH1
CADRM1
CADRL1
Timestamp
Timestamp
Reserved
Reserved
TSINF1
CPCH1
CPCM1
CPCL1
CDATA32
CDATA22
CDATA12
CDATA02
CINF2
CADRH2
CADRM2
CADRL2
CDATA33
CDATA23
CDATA13
CDATA03
CINF3
CADRH3
CADRM3
CADRL3
Timestamp
Timestamp
Reserved
Reserved
TSINF3
CPCH3
CPCM3
CPCL3
Detail Mode data entries store the bytes aligned to the address of the MSB accessed (Byte1 Table 6-54).
Thus accesses split across 32-bit boundaries are wrapped around.
Table 6-54. Detail Mode Data Byte Alignment
Access
Address
Access
Size
CDATA31
CDATA21
CDATA11
CDATA01
00
32-bit
Byte1
Byte2
Byte3
Byte4
01
32-bit
Byte4
Byte1
Byte2
Byte3
10
32-bit
Byte3
Byte4
Byte1
Byte2
Byte1
11
32-bit
Byte2
Byte3
Byte4
00
24-bit
Byte1
Byte2
Byte3
01
24-bit
Byte1
Byte2
Byte3
10
24-bit
Byte1
Byte2
Byte3
11
24-bit
Byte2
Byte3
00
16-bit
Byte1
Byte2
01
16-bit
10
16-bit
Byte1
Byte1
Byte2
Byte1
11
16-bit
Byte2
00
8-bit
Byte1
01
8-bit
10
8-bit
11
8-bit
Byte2
Byte1
Byte1
Byte1
Byte1
Denotes byte that is not accessed.
Information Bytes
BYTE
Bit 7
CINF
TSINF
Bit 6
CSZ
0
0
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
CRW
0
0
0
0
0
0
0
CTI
PC
1
TOVF
Figure 6-28. Information Bytes CINF and XINF
When tracing in Detail Mode, CINF provides information about the type of CPU access being made.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
221
Chapter 6 S12Z Debug (S12ZDBGV2) Module
TSINF provides information about a timestamp. Bit1 indicates if the byte is a TSINF byte.
Table 6-55. CINF Field Descriptions
Field
Description
7–6
CSZ
Access Type Indicator — This field indicates the CPU access size.
00 8-bit Access
0116-bit Access
10 24-bit Access
11 32-bit Access
5
CRW
Read/Write Indicator — Indicates if the corresponding stored address corresponds to a read or write access.
0 Write Access
1 Read Access
Table 6-56. TSINF Field Descriptions
Field
Description
3
CTI
Comparator Timestamp Indicator — This bit indicates if the trace buffer entry corresponds to a comparator
timestamp.
0 Trace buffer entry initiated by trace mode specification conditions or timestamp counter overflow
1 Trace buffer entry initiated by comparator D match
2
PC
Program Counter Valid Indicator — Indicates if the PC entry is valid on the timestamp line.
0 Trace buffer entry does not include PC value
1 Trace buffer entry includes PC value
0
TOVF
6.4.5.2.4
Timestamp Overflow Indicator — Indicates if the trace buffer entry corresponds to a timestamp overflow
0 Trace buffer entry not initiated by a timestamp overflow
1 Trace buffer entry initiated by a timestamp overflow
Pure PC Mode
In Pure PC Mode, the PC addresses of all opcodes loaded into the execution stage, including illegal
opcodes, are stored.
Tracing from a single source, compression is implemented to increase the effective trace depth. A
compressed entry consists of the lowest PC byte only. A full entry consists of all PC bytes. If the PC
remains in the same 256 byte range, then a compressed entry is made, otherwise a full entry is made. The
full entry is always the last entry of a record.
Each trace buffer line consists of 7 payload bytes, PLB0-6, containing full or compressed CPU PC
addresses and 1 information byte to indicate the type of entry (compressed or base address) for each
payload byte.
Each trace buffer line is filled from right to left. The final entry on each line is always a base address, used
as a reference for the previous entries on the same line. Whilst tracing, a base address is typically stored
MC9S12ZVM Family Reference Manual Rev. 1.5
222
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
in bytes[6:4], the other payload bytes may be compressed or complete addresses as indicated by the info
byte bits.
Table 6-57. Pure PC Mode Trace Buffer Format Single Source
8-Byte Wide Trace Buffer Line
Mode
CPU
7
6
5
4
3
2
1
0
CXINF
BASE
BASE
BASE
PLB3
PLB2
PLB1
PLB0
If the info bit for byte3 indicates a full CPU PC address, whereby bytes[5:3] are used, then the info bit
mapped to byte[4] is redundant and the byte[6] is unused because a line overflow has occurred. Similarly
a base address stored in bytes[4:2] causes line overflow, so bytes[6:5] are unused.
CXINF[6:4] indicate how many bytes in a line contain valid data, since tracing may terminate before a
complete line has been filled.
CXINF Information Byte Source Tracing
7
CXINF
MAT
6
5
PLEC
4
3
2
1
0
NB3
NB2
NB1
NB0
Figure 6-29. Pure PC Mode CXINF
Table 6-58. CXINF Field Descriptions
Field
Description
MAT
Mid Aligned Trigger— This bit indicates a mid aligned trigger position. When a mid aligned trigger occurs, the
next trace buffer entry is a base address and the counter is incremented to a new line, independent of the number
of bytes used on the current line. The MAT bit is set on the current line, to indicate the position of the trigger.
When configured for begin or end aligned trigger, this bit has no meaning.
NOTE: In the case when ARM and TRIG are simultaneously set together in the same cycle that a new PC value
is registered, then this PC is stored to the same trace buffer line and MAT set.
0 Line filled without mid aligned trigger occurrence
1 Line last entry is the last PC entry before a mid aligned trigger
PLEC[2:0]
NBx
Payload Entry Count— This field indicates the number of valid bytes in the trace buffer line
Binary encoding is used to indicate up to 7 valid bytes.
Payload Compression Indicator— This field indicates if the corresponding payload byte is the lowest byte of a
base PC entry
0 Corresponding payload byte is a not the lowest byte of a base PC entry
1 Corresponding payload byte is the lowest byte of a base PC entry
Pure PC mode tracing does not support timestamps or external event entries.
6.4.5.3
Timestamp
When set, the STAMP bit in DBGTCRL configures the DBG to add a timestamp to trace buffer entries in
Normal, Loop1 and Detail trace buffer modes. The timestamp is generated from a 16-bit counter and is
stored to the trace buffer line each time a trace buffer entry is made.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
223
Chapter 6 S12Z Debug (S12ZDBGV2) Module
The number of core clock cycles since the last entry equals the timestamp + 1. The core clock runs at twice
the frequency of the bus clock. The timestamp of the first trace buffer entry is 0x0000. With timestamps
enabled trace buffer entries are initiated in the following ways:
• according to the trace mode specification, for example COF PC addresses in Normal mode
• on a timestamp counter overflow
If the timestamp counter reaches 0xFFFF then a trace buffer entry is made, with timestamp=
0xFFFF and the timestamp overflow bit TOVF is set.
• on a match of comparator D
If STAMP and DSTAMP are set then comparator D is used for forcing trace buffer entries with
timestamps. The state control register settings determine if comparator D is also used to trigger the
state sequencer. Thus if the state control register configuration does not use comparator D, then it
is used solely for the timestamp function. If comparator D initiates a timestamp then the CTI bit is
set in the INFO byte. This can be used in Normal/Loop1 mode to indicate when a particular data
access occurs relative to the PC flow. For example when the timing of an access may be unclear
due to the use of indexes.
NOTE
If comparator D is configured to match a PC address then associated
timestamps trigger a trace buffer entry during execution of the previous
instruction. Thus the PC stored to the trace buffer is that of the previous
instruction.The comparator must contain the PC address of the instruction’s
first opcode byte
Timestamps are disabled in Pure PC mode.
6.4.5.4
Reading Data from Trace Buffer
The data stored in the trace buffer can be read using either the background debug controller (BDC) module
or the CPU provided the DBG module is not armed and is configured for tracing by TSOURCE. When the
ARM bit is set the trace buffer is locked to prevent reading. The trace buffer can only be unlocked for
reading by an aligned word write to DBGTB when the module is disarmed. The trace buffer can only be
read through the DBGTB register using aligned word reads. Reading the trace buffer while the DBG
module is armed, or trace buffer locked returns 0xEE and no shifting of the RAM pointer occurs. Any byte
or misaligned reads return 0xEE and do not cause the trace buffer pointer to increment to the next trace
buffer address.
Reading the trace buffer is prevented by internal hardware whilst profiling is active because the RAM
pointer is used to indicate the next row to be transmitted. Thus attempted reads of DBGTB do not return
valid data when the PROFILE bit is set. To initialize the pointer and read profiling data, the PROFILE bit
must be cleared and remain cleared.
The trace buffer data is read out first-in first-out. By reading CNT in DBGCNT the number of valid 64-bit
lines can be determined. DBGCNT does not decrement as data is read.
Whilst reading, an internal pointer is used to determine the next line to be read. After a tracing session, the
pointer points to the oldest data entry, thus if no overflow has occurred, the pointer points to line0. The
MC9S12ZVM Family Reference Manual Rev. 1.5
224
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
pointer is initialized by each aligned write to DBGTB to point to the oldest data again. This enables an
interrupted trace buffer read sequence to be easily restarted from the oldest data entry. After reading all
trace buffer lines, the next read wraps around and returns the contents of line0.
The least significant word of each 64-bit wide array line is read out first. All bytes, including those
containing invalid information are read out.
6.4.5.5
Trace Buffer Reset State
The trace buffer contents are not initialized by a system reset. Thus should a system reset occur, the trace
session information from immediately before the reset occurred can be read out. The DBGCNT bits are
not cleared by a system reset. Thus should a reset occur, the number of valid lines in the trace buffer is
indicated by DBGCNT. The internal pointer is cleared by a system reset. It can be initialized by an aligned
word write to DBGTB following a reset during debugging, so that it points to the oldest valid data again.
Debugging occurrences of system resets is best handled using mid or end trigger alignment since the reset
may occur before the trace trigger, which in the begin trigger alignment case means no information would
be stored in the trace buffer.
6.4.6
6.4.6.1
Code Profiling
Code Profiling Overview
Code profiling supplies encoded COF information on the PDO pin and the reference clock on the
PDOCLK pin. If the TSOURCE bit is set then code profiling is enabled by setting the PROFILE bit. The
associated device pin is configured for code profiling by setting the PDOE bit. Once enabled, code
profiling is activated by arming the DBG. During profiling, if PDOE is set, the PDO operates as an output
pin at a half the internal bus frequency, driving both high and low.
Independent of PDOE status, profiling data is stored to the trace buffer and can be read out in the usual
manner when the debug session ends and the PROFILE bit has been cleared.
The external debugger uses both edges of the clock output to strobe the data on PDO. The first PDOCLK
edge is used to sample the first data bit on PDO.
Figure 6-30. Profiling Output Interface
CLOCK
PDOCLK
DATA
TBUF
PDO
DEV TOOL
DBG
MCU
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
225
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Figure 6-31 shows the profiling clock, PDOCLK, whose edges are offset from the bus clock, to ease setup
and hold time requirements relative to PDO, which is synchronous to the bus clock.
Figure 6-31. PDO Profiling Clock Control
STROBE
BUS CLOCK
PDO
CLOCK ENABLE
PDOCLK
The trace buffer is used as a temporary storage medium to store COF information before it is transmitted.
COF information can be transmitted whilst new information is written to the trace buffer. The trace buffer
data is transmitted at PDO least significant bit first. After the first trace buffer entry is made, transmission
begins in the first clock period in which no further data is written to the trace buffer.
If a trace buffer line transmission completes before the next trace buffer line is ready, then the clock output
is held at a constant level until the line is ready for transfer.
6.4.6.2
Profiling Configuration, Alignment and Mode Dependencies
The PROFILE bit must be set and the DBG armed to enable profiling. Furthermore the PDOE bit must be
set to configure the PDO and PDOCLK pins for profiling.
If TALIGN is configured for End-Aligned tracing then profiling begins as soon as the module is armed.
If TALIGN is configured for Begin-aligned tracing, then profiling begins when the state sequencer enters
Final State and continues until a software disarm or trace buffer overflow occurs; thus profiling does not
terminate after 64 line entries have been made.
Mid-Align tracing is not supported whilst profiling; if the TALIGN bits are configured for Mid-Align
tracing when PROFILE is set, then the alignment defaults to end alignment.
Profiling entries continue until either a trace buffer overflow occurs or the DBG is disarmed by a state
machine transition to State0. The profiling output transmission continues, even after disarming, until all
trace buffer entries have been transmitted. The PTACT bit indicates if a profiling transmission is still
active. The PTBOVF indicates if a trace buffer overflow has occurred.
The profiling timestamp feature is used only for the PTVB and PTW formats, thus differing from
timestamps offered in other modes.
Profiling does not support trace buffer gating. The external pin gating feature is ignored during profiling.
When the DBG module is disarmed but profiling transmission is ongoing, register write accesses are
suppressed.
When the DBG module is disarmed but profiling transmission is still ongoing, reading from the DBGTB
returns the code 0xEE.
MC9S12ZVM Family Reference Manual Rev. 1.5
226
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.6.3
Code Profiling Internal Data Storage Format
When profiling starts, the first trace buffer entry is made to provide the start address. This uses a 4 byte
format (PTS), including the INFO byte and a 3-byte PC start address. In order to avoid trace buffer
overflow a fully compressed format is used for direct (conditional branch) COF information.
Table 6-59. Profiling Trace buffer line format
Format
8-Byte Wide Trace Buffer Line
7
6
5
4
3
Indirect
Indirect
Indirect
Direct
Direct
1
Direct
Direct
INFO
0
Direct
Direct
Direct
Direct
INFO
PC Start Address
PTS
PTIB
2
PTHF
0
INFO
PTVB
Timestamp
Timestamp
Vector
Direct
Direct
Direct
Direct
INFO
PTW
Timestamp
Timestamp
0
Direct
Direct
Direct
Direct
INFO
The INFO byte indicates the line format used. Up to 4 bytes of each line are dedicated to branch COFs.
Further bytes are used for storing indirect COF information (indexed jumps and interrupt vectors).
Indexed jumps force a full line entry with the PTIB format and require 3-bytes for the full 24-bit
destination address. Interrupts force a full line entry with the PTVB format, whereby vectors are stored as
a single byte and a 16-bit timestamp value is stored simultaneously to indicate the number of bus cycles
relative to the previous COF. At each trace buffer entry the 16-bit timestamp counter is cleared. The device
vectors use address[8:0] whereby address[1:0] are constant zero for vectors. Thus the value stored to the
PTVB vector byte is equivalent to (Vector Address[8:1]).
After the PTS entry, the pointer increments and the DBG begins to fill the next line with direct COF
information. This continues until the direct COF field is full or an indirect COF occurs, then the INFO byte
and, if needed, indirect COF information are entered on that line and the pointer increments to the next line.
If a timestamp overflow occurs, indicating a 65536 bus clock cycles without COF, then an entry is made
with the TSOVF bit set, INFO[6] (Table 6-60) and profiling continues.
If a trace buffer overflow occurs, a final entry is made with the TBOVF bit set, profiling is terminated and
the DBG is disarmed. Trace buffer overflow occurs when the trace buffer contains 64 lines pending
transmission.
Whenever the DBG is disarmed during profiling, a final entry is made with the TERM bit set to indicate
the final entry.
When a final entry is made then by default the PTW line format is used, except if a COF occurs in the same
cycle in which case the corresponding PTIB/PTVB/PTHF format is used. Since the development tool
receives the INFO byte first, it can determine in advance the format of data it is about to receive. The
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
227
Chapter 6 S12Z Debug (S12ZDBGV2) Module
transmission of the INFO byte starts when a line is complete. Whole bytes are always transmitted. The
grey shaded bytes of Table 6-59 are not transmitted.
Figure 6-32. INFO byte encoding
7
6
5
4
0
TSOVF
TBOVF
TERM
3
2
1
0
Line Format
Table 6-60. Profiling Format Encoding
6.4.6.4
INFO[3:0]
Line Format
Source
Description
0000
PTS
CPU
Initial CPU entry
0001
PTIB
CPU
Indexed jump with up to 31 direct COFs
0010
PTHF
CPU
31 direct COFs without indirect COF
0011
PTVB
CPU
Vector with up to 31 direct COFs
0111
PTW
CPU
Error (Error codes in INFO[7:4])
Others
Reserved
CPU
Reserved
INFO[7:4]
Bit Name
INFO[7]
Reserved
CPU
Reserved
INFO[6]
TSOVF
CPU
Timestamp Overflow
INFO[5]
TBOVF
CPU
Trace Buffer Overflow
INFO[4]
TERM
CPU
Profiling terminated by disarming
Vector[7:0]
Vector[7:0]
CPU
Device Interrupt Vector Address [8:1]
Description
Direct COF Compression
Each branch COF is stored to the trace buffer as a single bit (0=branch not taken, 1=branch taken) until an
indirect COF (indexed jump, return, or interrupt) occurs. The branch COF entries are stored in the byte
fields labelled “Direct” in Table 6-59. These entries start at byte1[0] and continue through to byte4[7], or
until an indirect COF occurs, whichever occurs sooner. The entries use a format whereby the left most
asserted bit is always the stop bit, which indicates that the bit to its right is the first direct COF and byte1[0]
is the last COF that occurred before the indirect COF. This is shown in Table 6-61, whereby the Bytes 4 to
1 of the trace buffer are shown for 3 different cases. The stop bit field for each line is shaded.
In line0, the left most asserted bit is Byte4[7]. This indicates that all remaining 31 bits in the 4-byte field
contain valid direct COF information, whereby each 1 represents branch taken and each 0 represents
branch not taken. The stop bit of line1 indicates that all 30 bits to it’s right are valid, after the 30th direct
COF entry, an indirect COF occurred, that is stored in bytes 7 to 5. In this case the bit to the left of the stop
bit is redundant. Line2 indicates that an indirect COF occurred after 8 direct COF entries. The indirect COF
address is stored in bytes 7 to 5. All bits to the left of the stop bit are redundant.
MC9S12ZVM Family Reference Manual Rev. 1.5
228
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
Line
Byte4
Byte3
Byte2
Byte1
Line0
1
0
0
1
0
0
1
0
0
1
0
1
1
0
0
1
0
0
1
0
0
0
0
1
1
0
0
0
0
1
1
0
Line1
0
1
1
0
0
1
0
1
1
0
0
1
0
0
1
0
1
1
0
0
1
0
0
1
0
1
1
0
0
1
0
0
Line2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
0
1
Table 6-61. Profiling Direct COF Format
6.4.7
Breakpoints
Breakpoints can be generated by state sequencer transitions to State0. Transitions to State0 are forced by
the following events
• Through comparator matches via Final State.
• Through software writing to the TRIG bit in the DBGC1 register via Final State.
• Through the external event input (DBGEEV) via Final State.
• Through a profiling trace buffer overflow event.
Breakpoints are not generated by software writes to DBGC1 that clear the ARM bit.
6.4.7.1
Breakpoints From Comparator Matches or External Events
Breakpoints can be generated when the state sequencer transitions to State0 following a comparator match
or an external event.
If a tracing session is selected by TSOURCE, the transition to State0 occurs when the tracing session has
completed, thus if Begin or Mid aligned triggering is selected, the breakpoint is requested only on
completion of the subsequent trace. If End aligned tracing or no tracing session is selected, the transition
to State0 and associated breakpoints are immediate.
6.4.7.2
Breakpoints Generated Via The TRIG Bit
When TRIG is written to “1”, the Final State is entered. If a tracing session is selected by TSOURCE,
State0 is entered and breakpoints are requested only when the tracing session has completed, thus if Begin
or Mid aligned triggering is selected, the breakpoint is requested only on completion of the subsequent
trace. If no tracing session is selected, the state sequencer enters State0 immediately and breakpoints are
requested. TRIG breakpoints are possible even if the DBG module is disarmed.
6.4.7.3
DBG Breakpoint Priorities
If a TRIG occurs after Begin or Mid aligned tracing has already been triggered by a comparator instigated
transition to Final State, then TRIG no longer has an effect. When the associated tracing session is
complete, the breakpoint occurs. Similarly if a TRIG is followed by a subsequent comparator match, it has
no effect, since tracing has already started.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
229
Chapter 6 S12Z Debug (S12ZDBGV2) Module
6.4.7.3.1
DBG Breakpoint Priorities And BDC Interfacing
Breakpoint operation is dependent on the state of the S12ZBDC module. BDM cannot be entered from a
breakpoint unless the BDC is enabled (ENBDC bit is set in the BDC). If BDM is already active,
breakpoints are disabled. In addition, while executing a BDC STEP1 command, breakpoints are disabled.
When the DBG breakpoints are mapped to BDM (BDMBP set), then if a breakpoint request, either from
a BDC BACKGROUND command or a DBG event, coincides with an SWI instruction in application
code, (i.e. the DBG requests a breakpoint at the next instruction boundary and the next instruction is an
SWI) then the CPU gives priority to the BDM request over the SWI request.
On returning from BDM, the SWI from user code gets executed. Breakpoint generation control is
summarized in Table 6-62.
Table 6-62. Breakpoint Mapping Summary
6.5
6.5.1
BRKCPU
BDMBP Bit
(DBGC1[4])
BDC
Enabled
BDM
Active
Breakpoint
Mapping
0
X
X
X
No Breakpoint
1
0
X
0
Breakpoint to SWI
1
0
1
1
No Breakpoint
1
1
0
X
No Breakpoint
1
1
1
0
Breakpoint to BDM
1
1
1
1
No Breakpoint
Application Information
Avoiding Unintended Breakpoint Re-triggering
Returning from an instruction address breakpoint using an RTI or BDC GO command without PC
modification, returns to the instruction that generated the breakpoint. If an active breakpoint or trigger still
exists at that address, this can re-trigger, disarming the DBG. If configured for BDM breakpoints, the user
must apply the BDC STEP1 command to increment the PC past the current instruction.
If configured for SWI breakpoints, the DBG can be re configured in the SWI routine. If a comparator
match occurs at an SWI vector address then a code SWI and DBG breakpoint SWI could occur
simultaneously. In this case the SWI routine is executed twice before returning.
6.5.2
Debugging Through Reset
To debug through reset, the debugger can recognize a reset occurrence and pull the device BKGD pin low.
This forces the device to leave reset in special single chip (SSC) mode, because the BKGD pin is used as
the MODC signal in the reset phase. When the device leaves reset in SSC mode, CPU execution is halted
and the device is in active BDM. Thus the debugger can configure the DBG for tracing and breakpoints
before returning to application code execution. In this way it is possible to analyze the sequence of events
emerging from reset. The recommended handling of the internal reset scenario is as follows:
MC9S12ZVM Family Reference Manual Rev. 1.5
230
Freescale Semiconductor
Chapter 6 S12Z Debug (S12ZDBGV2) Module
•
•
•
•
•
•
6.5.3
When a reset occurs the debugger pulls BKGD low until the reset ends, forcing SSC mode entry.
Then the debugger reads the reset flags to determine the cause of reset.
If required, the debugger can read the trace buffer to see what happened just before reset. Since the
trace buffer and DBGCNT register are not affected by resets other than POR.
The debugger configures and arms the DBG to start tracing on returning to application code.
The debugger then sets the PC according to the reset flags.
Then the debugger returns to user code with GO or STEP1.
Breakpoints from other S12Z sources
The DBG is neither affected by CPU BGND instructions, nor by BDC BACKGROUND commands.
6.5.4
Code Profiling
The code profiling data output pin PDO is mapped to a device pin that can also be used as GPIO in an
application. If profiling is required and all pins are required in the application, it is recommended to use
the device pin for a simple output function in the application, without feedback to the chip. In this way the
application can still be profiled, since the pin has no effect on code flow.
The PDO provides a simple bit stream that must be strobed at both edges of the profiling clock when
profiling. The external development tool activates profiling by setting the DBG ARM bit, with PROFILE
and PDOE already set. Thereafter the first bit of the profiling bit stream is valid at the first rising edge of
the profiling clock. No start bit is provided. The external development tool must detect this first rising edge
after arming the DBG. To detect the end of profiling, the DBG ARM bit can be monitored using the BDC.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
231
Chapter 6 S12Z Debug (S12ZDBGV2) Module
MC9S12ZVM Family Reference Manual Rev. 1.5
232
Freescale Semiconductor
Chapter 7
ECC Generation Module (SRAM_ECCV1)
7.1
Introduction
The purpose of ECC logic is to detect and correct as much as possible memory data bit errors. These soft
errors, mainly generated by alpha radiation, can occur randomly during operation. "Soft error" means that
only the information inside the memory cell is corrupt; the memory cell itself is not damaged. A write
access with correct data solves the issue. If the ECC algorithm is able to correct the data, then the system
can use this corrected data without any issues. If the ECC algorithm is able to detect, but not correct the
error, then the system is able to ignore the memory read data to avoid system malfunction.
The ECC value is calculated based on an aligned 2 byte memory data word. The ECC algorithm is able to
detect and correct single bit ECC errors. Double bit ECC errors will be detected but the system is not able
to correct these errors. This kind of ECC code is called SECDED code. This ECC code requires 6
additional parity bits for each 2 byte data word.
7.1.1
Features
The SRAM_ECC module provides the ECC logic for the system memory based on a SECDED algorithm.
The SRAM_ECC module includes the following features:
•
SECDED ECC code
–
Single bit error detection and correction per 2 byte data word
–
Double bit error detection per 2 byte data word
•
Memory initialization function
•
Byte wide system memory write access
•
Automatic single bit ECC error correction for read and write accesses
•
Debug logic to read and write raw use data and ECC values
7.2
Memory Map and Register Definition
This section provides a detailed description of all memory and registers for the SRAM_ECC module.
7.2.1
Register Summary
Figure 7-1 shows the summary of all implemented registers inside the SRAM_ECC module.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
233
Chapter 7 ECC Generation Module (SRAM_ECCV1)
NOTE
Register Address = Module Base Address + Address Offset, where the
Module Base Address is defined at the MCU level and the Address Offset
is defined at the module level.
Address Offset
Register Name
0x0000
ECCSTAT
R
0x0001
ECCIE
R
0x0002
ECCIF
R
0x0003 - 0x0006
Reserved
R
0x0007
ECCDPTRH
R
0x0008
ECCDPTRM
R
0x0009
ECCDPTRL
R
6
5
4
3
2
1
Bit 0
0
0
0
0
0
0
0
RDY
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
W
W
SBEEIE
SBEEIF
0
W
DPTR[23:16]
W
DPTR[15:8]
W
R
0x000C
ECCDDH
R
0x000D
ECCDDL
R
0x000E
ECCDE
R
0
DPTR[7:1]
W
0x000A - 0x000B
Reserved
0x000F
ECCDCMD
Bit 7
0
0
0
0
0
0
0
0
ECCDW
ECCDR
W
DDATA[15:8]
W
DDATA[7:0]
W
0
0
DECC[5:0]
W
R
W
ECCDRR
0
0
0
0
0
= Unimplemented, Reserved, Read as zero
Figure 7-1. SRAM_ECC Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.5
234
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
7.2.2
Register Descriptions
This section consists of register descriptions in address order. Each description includes a standard register
diagram with an associated figure number. Details of register bit and field functions follow the register
diagrams, in bit order.
7.2.2.1
ECC Status Register (ECCSTAT)
Access: User read only(1)
Module Base + 0x00000
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
RDY
0
0
0
0
0
0
0
0
W
Reset
1. Read: Anytime
Write: Never
Figure 7-2. ECC Status Register (ECCSTAT)
Table 7-2. ECCSTAT Field Description
Field
Description
0
RDY
ECC Ready— Shows the status of the ECC module.
0 Internal SRAM initialization is ongoing, access to the SRAM is disabled
1 Internal SRAM initialization is done, access to the SRAM is enabled
7.2.2.2
ECC Interrupt Enable Register (ECCIE)
Access: User read/write(1)
Module Base + 0x00001
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
SBEEIE
W
Reset
0
0
0
0
0
0
0
0
1. Read: Anytime
Write: Anytime
Figure 7-3. ECC Interrupt Enable Register (ECCIE)
Table 7-3. ECCIE Field Description
Field
0
SBEEIE
Description
Single bit ECC Error Interrupt Enable — Enables Single ECC Error interrupt.
0 Interrupt request is disabled
1 Interrupt will be requested whenever SBEEIF is set
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
235
Chapter 7 ECC Generation Module (SRAM_ECCV1)
7.2.2.3
ECC Interrupt Flag Register (ECCIF)
Access: User read/write(1)
Module Base + 0x0002
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
SBEEIF
W
Reset
0
0
0
0
0
0
0
0
1. Read: Anytime
Write: Anytime, write 1 to clear
Figure 7-4. ECC Interrupt Flag Register (ECCIF)
Table 7-4. ECCIF Field Description
Field
0
SBEEIF
Description
Single bit ECC Error Interrupt Flag — The flag is set to 1 when a single bit ECC error occurs.
0 No occurrences of single bit ECC error since the last clearing of the flag
1 Single bit ECC error has occured since the last clearing of the flag
MC9S12ZVM Family Reference Manual Rev. 1.5
236
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
ECC Debug Pointer Register (ECCDPTRH, ECCDPTRM,
ECCDPTRL)
7.2.2.4
Access: User read/write(1)
Module Base + 0x0007
7
6
5
4
3
2
1
0
0
0
0
0
R
DPTR[23:16]
W
Reset
0
0
0
0
Module Base + 0x0008
7
Access: User read/write
6
5
4
3
2
1
0
0
0
0
0
R
DPTR[15:8]
W
Reset
0
0
0
0
Module Base + 0x0009
7
Access: User read/write
6
5
4
3
2
1
R
0
0
DPTR[7:1]
W
Reset
0
0
0
0
0
0
0
0
= Unimplemented
Figure 7-5. ECC Debug Pointer Register (ECCDPTRH, ECCDPTRM, ECCDPTRL)
1. Read: Anytime
Write: Anytime
Table 7-5. ECCDPTR Register Field Descriptions
Field
Description
DPTR
[23:0]
ECC Debug Pointer — This register contains the system memory address which will be used for a debug
access. Address bits not relevant for SRAM address space are not writeable, so the software should read back
the pointer value to make sure the register contains the intended memory address. It is possible to write an
address value to this register which points outside the system memory. There is no additional monitoring of the
register content; therefore, the software must make sure that the address value points to the system memory
space.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
237
Chapter 7 ECC Generation Module (SRAM_ECCV1)
ECC Debug Data (ECCDDH, ECCDDL)
7.2.2.5
Access: User read/write(1)
Module Base + 0x000C
7
6
5
4
3
2
1
0
0
0
0
0
R
DDATA[15:8]
W
Reset
0
0
0
0
Module Base + 0x000D
7
Access: User read/write
6
5
4
3
2
1
0
0
0
0
0
R
DDATA[7:0]
W
Reset
0
0
0
0
= Unimplemented
Figure 7-6. ECC Debug Data (ECCDDH, ECCDDL)
1. Read: Anytime
Write: Anytime
Table 7-6. ECCDD Register Field Descriptions
Field
Description
DDATA
[23:0]
7.2.2.6
ECC Debug Raw Data — This register contains the raw data which will be written into the system memory
during a debug write command or the read data from the debug read command.
ECC Debug ECC (ECCDE)
Access: User read/write(1)
Module Base + 0x000E
R
7
6
0
0
5
4
3
2
1
0
0
0
0
DECC[5:0]
W
Reset
0
0
0
0
0
1. Read: Anytime
Write: Anytime
Figure 7-7. ECC Debug ECC (ECCDE)
Table 7-7. ECCDE Field Description
Field
Description
5:0
ECC Debug ECC — This register contains the raw ECC value which will be written into the system memory
DECC[5:0] during a debug write command or the ECC read value from the debug read command.
MC9S12ZVM Family Reference Manual Rev. 1.5
238
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
7.2.2.7
ECC Debug Command (ECCDCMD)
Access: User read/write(1)
Module Base + 0x000F
7
R
6
5
4
3
2
0
0
0
0
0
ECCDRR
1
0
ECCDW
ECCDR
0
0
W
Reset
0
0
0
0
0
0
1. Read: Anytime
Write: Anytime, in special mode only
Figure 7-8. ECC Debug Command (ECCDCMD)
Table 7-8. ECCDCMD Field Description
Field
Description
7
ECC Disable Read Repair Function— Writing one to this register bit will disable the automatic single bit ECC
ECCDRR error repair function during read access; see also chapter 7.3.7, “ECC Debug Behavior”.
0 Automatic single ECC error repair function is enabled
1 Automatic single ECC error repair function is disabled
1
ECCDW
ECC Debug Write Command — Writing one to this register bit will perform a debug write access, to the system
memory. During this access the debug data word (DDATA) and the debug ECC value (DECC) will be written to
the system memory address defined by DPTR. If the debug write access is done, this bit is cleared. Writing 0
has no effect. It is not possible to set this bit if the previous debug access is ongoing (ECCDW or ECCDR bit set).
0
ECCDR
ECC Debug Read Command — Writing one to this register bit will perform a debug read access from the system
memory address defined by DPTR. If the debug read access is done, this bit is cleared and the raw memory read
data are available in register DDATA and the raw ECC value is available in register DECC. Writing 0 has no
effect. If the ECCDW and ECCDR bit are set at the same time, then only the ECCDW bit is set and the Debug
Write Command is performed. It is not possible to set this bit if the previous debug access is ongoing (ECCDW
or ECCDR bit set).
7.3
Functional Description
The bus system allows 1, 2, 3 and 4 byte write access to a 4 byte aligned memory address, but the ECC
value is generated based on an aligned 2 byte data word. Depending on the access type, the access is
separated into different access cycles. Table 7-9 shows the different access types with the expected number
of access cycles and the performed internal operations.
Table 7-9. Memory access cycles
Access type
ECC
error
access
cycle
Internal operation
Memory
content
Error indication
2 and 4 byte
aligned write
access
—
1
write to memory
new data
—
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
239
Chapter 7 ECC Generation Module (SRAM_ECCV1)
Table 7-9. Memory access cycles
Access type
1 or 3 byte write,
non-aligned 2
byte write
read access
ECC
error
access
cycle
no
2
single
bit
2
double
bit
2
no
1
Memory
content
Error indication
old + new
data
—
corrected +
new data
SBEEIF
unchanged
initiator module is
informed
read from memory
unchanged
-
read data from the memory
corrected
data
SBEEIF
Internal operation
read data from the memory
write old + new data to the memory
read data from the memory
write corrected + new data to the
memory
read data from the memory
ignore write data
single
bit
1(1)
double
bit
1
write corrected data back to memory
read from memory
unchanged data mark as invalid
1. The next back to back read access to the memory will be delayed by one clock cycle
The single bit ECC error generates an interrupt when enabled. The double bit ECC errors are reported by
the SRAM_ECC module, but handled at MCU level. For more information, see the MMC description.
7.3.1
Aligned 2 and 4 Byte Memory Write Access
During an aligned 2 or 4 byte memory write access, no ECC check is performed. The internal ECC logic
generates the new ECC value based on the write data and writes the data words together with the generated
ECC values into the memory.
7.3.2
Other Memory Write Access
Other types of write accesses are separated into a read-modify-write operation. During the first cycle, the
logic reads the data from the memory and performs an ECC check. If no ECC errors were detected then
the logic generates the new ECC value based on the read and write data and writes the new data word
together with the new ECC value into the memory. If required both 2 byte data words are updated.
If the module detects a single bit ECC error during the read cycle, then the logic generates the new ECC
value based on the corrected read and new write read. In the next cycle, the new data word and the new
ECC value are written into the memory. If required both 2 byte data words are updated. The SBEEIF bit
is set. Hence, the single bit ECC error was corrected by the write access. Figure 7-9 shows an example of
a 2 byte non-aligned memory write access.
If the module detects a double bit ECC error during the read cycle, then the write access to the memory is
blocked and the initiator module is informed about the error.
MC9S12ZVM Family Reference Manual Rev. 1.5
240
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
.
2 byte use data
ECC
2 byte use data
read out data
and correct if
single bit ECC
error was found
4 byte read data from system memory
read out data
and correct if
single bit ECC
error was found
correct read data
correct read data
write data
correct
read data write data
ECC
write data
ECC
write data
2 byte write data
correct
read data
ECC
4 byte write data to system memory
Figure 7-9. 2 byte non-aligned write access
7.3.3
Memory Read Access
During each memory read access an ECC check is performed. If the logic detects a single bit ECC error,
then the module corrects the data, so that the access initiator module receives correct data. In parallel, the
logic writes the corrected data back to the memory, so that this read access repairs the single bit ECC error.
This automatic ECC read repair function is disabled by setting the ECCDRR bit.
If a single bit ECC error was detected, then the SBEEIF flag is set.
If the logic detects a double bit ECC error, then the data word is flagged as invalid, so that the access
initiator module can ignore the data.
7.3.4
Memory Initialization
To avoid spurious ECC error reporting, memory operations that allow a read before a first write (like the
read-modify-write operation of the unaligned access) require that the memory contains valid ECC values
before the first read-modify-write access is performed. The ECC module provides logic to initialize the
complete memory content with zero during the power up phase. During the initialization process the access
to the SRAM is disabled and the RDY status bit is cleared. If the initialization process is done, SRAM
access is possible and the RDY status bit is set.
7.3.5
Interrupt Handling
This section describes the interrupts generated by the SRAM_ECC module and their individual sources.
Vector addresses and interrupt priority are defined at the MCU level.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
241
Chapter 7 ECC Generation Module (SRAM_ECCV1)
Table 7-10. SRAM_ECC Interrupt Sources
Module Interrupt Sources
Single bit ECC error
7.3.6
Local Enable
ECCIE[SBEEIE]
ECC Algorithm
The table below shows the equation for each ECC bit based on the 16 bit data word.
Table 7-11. ECC Calculation
7.3.7
ECC bit
Use data
ECC[0]
~ ( ^ ( data[15:0] & 0x443F ) )
ECC[1]
~ ( ^ ( data[15:0] & 0x13C7 ) )
ECC[2]
~ ( ^ ( data[15:0] & 0xE1D1 ) )
ECC[3]
~ ( ^ ( data[15:0] & 0xEE60 ) )
ECC[4]
~ ( ^ ( data[15:0] & 0x3E8A ) )
ECC[5]
~ ( ^ ( data[15:0] & 0x993C ) )
ECC Debug Behavior
For debug purposes, it is possible to read and write the uncorrected use data and the raw ECC value directly
from the memory. For these debug accesses a register interface is available. The debug access is performed
with the lowest priority; other memory accesses must be done before the debug access starts. If a debug
access is requested during an ongoing memory initialization process, then the debug access is performed
if the memory initialization process is done.
If the ECCDRR bit is set, then the automatic single bit ECC error repair function for all read accesses is
disabled. In this case a read access from a system memory location with single bit ECC error will produce
correct data and the single bit ECC error is flagged by the SBEEIF, but the data inside the system memory
are unchanged.
By writing wrong ECC values into the system memory the debug access can be used to force single and
double bit ECC errors to check the software error handling.
It is not possible to set the ECCDW or ECCDR bit if the previous debug access is ongoing (ECCDW or
ECCDR bit active). This ensures that the ECCDD and ECCDE registers contains consistent data. The
software should read out the status of the ECCDW and ECCDR register bit before a new debug access is
requested.
7.3.7.1
ECC Debug Memory Write Access
Writing one to the ECCDW bit performs a debug write access to the memory address defined by register
DPTR. During this access, the raw data DDATA and the ECC value DECC are written directly into the
system memory. If the debug write access is done, the ECCDW register bit is cleared. The debug write
MC9S12ZVM Family Reference Manual Rev. 1.5
242
Freescale Semiconductor
Chapter 7 ECC Generation Module (SRAM_ECCV1)
access is always a 2 byte aligned memory access, so that no ECC check is performed and no single or
double bit ECC error indication is activated.
7.3.7.2
ECC Debug Memory Read Access
Writing one to the ECCDR bit performs a debug read access from the memory address defined by register
DPTR. If the ECCDR bit is cleared then the register DDATA contains the uncorrected read data from the
memory. The register DECC contains the ECC value read from the memory. Independent of the ECCDRR
register bit setting, the debug read access will not perform an automatic ECC repair during read access.
During the debug read access no ECC check is performed, so that no single or double bit ECC error
indication is activated.
If the ECCDW and the ECCDR bits are set at the same time, then only the debug write access is performed.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
243
Chapter 7 ECC Generation Module (SRAM_ECCV1)
MC9S12ZVM Family Reference Manual Rev. 1.5
244
Freescale Semiconductor
Chapter 8
S12 Clock, Reset and Power Management Unit
(S12CPMU_UHV_V6)
Revision History
Rev. No.
(Item No)
V06.02
V06.03
V06.04
V06.05
8.1
Date
(Submitted By)
20 Dec. 2012
18 June 2013
21 Aug. 2013
3 Jan. 2014
Sections Affected
Substantial Change(s)
• Format and font corrections
• Table 8-31. CPMUOSC2 Field Descriptions: removed Bit6 and
Bit4-0 description as these bits no longer exist.
• EXTCON register Bit: correct reset value to 1
• PMRF register Bit: corrected description
• Memory map: corrected address typo CPMUAPIRH register
•
•
•
•
corrected bit numbering for CSAD Bit
fPLLRST changed to fVCORST
corrected typo in heading of CPMUOSC2 Field Description
changed frequency upper limit of external Pierce Oscillator
(XOSCLCP) from 16MHz to 20MHz
• corrected description of CSAD Bit
Introduction
This specification describes the function of the Clock, Reset and Power Management Unit
(S12CPMU_UHV_V6).
• The Pierce oscillator (XOSCLCP) provides a robust, low-noise and low-power external clock
source. It is designed for optimal start-up margin with typical crystal oscillators.
• The Voltage regulator (VREGAUTO) operates from the range 6V to 18V. It provides all the
required chip internal voltages and voltage monitors.
• The Phase Locked Loop (PLL) provides a highly accurate frequency multiplier with internal filter.
• The Internal Reference Clock (IRC1M) provides a 1MHz internal clock.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
245
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1.1
Features
The Pierce Oscillator (XOSCLCP) contains circuitry to dynamically control current gain in the output
amplitude. This ensures a signal with low harmonic distortion, low power and good noise immunity.
• Supports crystals or resonators from 4MHz to 20MHz.
• High noise immunity due to input hysteresis and spike filtering.
• Low RF emissions with peak-to-peak swing limited dynamically
• Transconductance (gm) sized for optimum start-up margin for typical crystals
• Dynamic gain control eliminates the need for external current limiting resistor
• Integrated resistor eliminates the need for external bias resistor
• Low power consumption: Operates from internal 1.8V (nominal) supply, Amplitude control limits
power
• Optional oscillator clock monitor reset
• Optional full swing mode for higher immunity against noise injection on the cost of higher power
consumption and increased emission
The Voltage Regulator (VREGAUTO) has the following features:
• Input voltage range from 6 to 18V (nominal operating range)
• Low-voltage detect (LVD) with low-voltage interrupt (LVI)
• Power-on reset (POR)
• Low-voltage reset (LVR)
• On Chip Temperature Sensor and Bandgap Voltage measurement via internal ADC channel.
• Voltage Regulator providing Full Performance Mode (FPM) and Reduced Performance Mode
(RPM)
• External ballast device support to reduce internal power dissipation
• Capable of supplying both the MCU internally plus external components
• Over-temperature interrupt
The Phase Locked Loop (PLL) has the following features:
• Highly accurate and phase locked frequency multiplier
• Configurable internal filter for best stability and lock time
• Frequency modulation for defined jitter and reduced emission
• Automatic frequency lock detector
• Interrupt request on entry or exit from locked condition
• PLL clock monitor reset
• Reference clock either external (crystal) or internal square wave (1MHz IRC1M) based.
• PLL stability is sufficient for LIN communication in slave mode, even if using IRC1M as reference
clock
The Internal Reference Clock (IRC1M) has the following features:
MC9S12ZVM Family Reference Manual Rev. 1.5
246
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
•
•
Frequency trimming
(A factory trim value for 1MHz is loaded from Flash Memory into the IRCTRIM register after
reset, which can be overwritten by application if required)
Temperature Coefficient (TC) trimming.
(A factory trim value is loaded from Flash Memory into the IRCTRIM register to turn off TC
trimming after reset. Application can trim the TC if required by overwriting the IRCTRIM
register).
Other features of the S12CPMU_UHV_V6 include
• Oscillator clock monitor to detect loss of crystal
• Autonomous periodical interrupt (API)
• Bus Clock Generator
— Clock switch to select either PLLCLK or external crystal/resonator based Bus Clock
— PLLCLK divider to adjust system speed
• System Reset generation from the following possible sources:
— Power-on reset (POR)
— Low-voltage reset (LVR)
— COP system watchdog, COP reset on time-out, windowed COP
— Loss of oscillation (Oscillator clock monitor fail)
— Loss of PLL clock (PLL clock monitor fail)
— External pin RESET
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
247
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1.2
Modes of Operation
This subsection lists and briefly describes all operating modes supported by the S12CPMU_UHV_V6.
8.1.2.1
Run Mode
The voltage regulator is in Full Performance Mode (FPM).
NOTE
The voltage regulator is active, providing the nominal supply voltages with
full current sourcing capability (see also Appendix for VREG electrical
parameters). The features ACLK clock source, Low Voltage Interrupt (LVI),
Low Voltage Reset (LVR) and Power-On Reset (POR) are available.
The Phase Locked Loop (PLL) is on.
The Internal Reference Clock (IRC1M) is on.
The API is available.
•
•
•
PLL Engaged Internal (PEI)
— This is the default mode after System Reset and Power-On Reset.
— The Bus Clock is based on the PLLCLK.
— After reset the PLL is configured for 50MHz VCOCLK operation.
Post divider is 0x03, so PLLCLK is VCOCLK divided by 4, that is 12.5MHz and Bus Clock is
6.25MHz.
The PLL can be re-configured for other bus frequencies.
— The reference clock for the PLL (REFCLK) is based on internal reference clock IRC1M.
PLL Engaged External (PEE)
— The Bus Clock is based on the PLLCLK.
— This mode can be entered from default mode PEI by performing the following steps:
– Configure the PLL for desired bus frequency.
– Program the reference divider (REFDIV[3:0] bits) to divide down oscillator frequency if
necessary.
– Enable the external oscillator (OSCE bit).
– Wait for oscillator to start up (UPOSC=1) and PLL to lock (LOCK=1).
PLL Bypassed External (PBE)
— The Bus Clock is based on the Oscillator Clock (OSCCLK).
— The PLLCLK is always on to qualify the external oscillator clock. Therefore it is necessary to
make sure a valid PLL configuration is used for the selected oscillator frequency.
— This mode can be entered from default mode PEI by performing the following steps:
– Make sure the PLL configuration is valid for the selected oscillator frequency.
MC9S12ZVM Family Reference Manual Rev. 1.5
248
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
– Enable the external oscillator (OSCE bit).
– Wait for oscillator to start up (UPOSC=1).
– Select the Oscillator Clock (OSCCLK) as source of the Bus Clock (PLLSEL=0).
— The PLLCLK is on and used to qualify the external oscillator clock.
8.1.2.2
Wait Mode
For S12CPMU_UHV_V6 Wait Mode is the same as Run Mode.
8.1.2.3
Stop Mode
This mode is entered by executing the CPU STOP instruction.
The voltage regulator is in Reduced Performance Mode (RPM).
NOTE
The voltage regulator output voltage may degrade to a lower value than in
Full Performance Mode (FPM), additionally the current sourcing capability
is substantially reduced (see also Appendix for VREG electrical
parameters). Only clock source ACLK is available and the Power On Reset
(POR) circuitry is functional. The Low Voltage Interrupt (LVI) and Low
Voltage Reset (LVR) are disabled.
The API is available.
The Phase Locked Loop (PLL) is off.
The Internal Reference Clock (IRC1M) is off.
Core Clock and Bus Clock are stopped.
Depending on the setting of the PSTP and the OSCE bit, Stop Mode can be differentiated between Full
Stop Mode (PSTP = 0 or OSCE=0) and Pseudo Stop Mode (PSTP = 1 and OSCE=1). In addition, the
behavior of the COP in each mode will change based on the clocking method selected by
COPOSCSEL[1:0].
• Full Stop Mode (PSTP = 0 or OSCE=0)
External oscillator (XOSCLCP) is disabled.
— If COPOSCSEL1=0:
The COP and RTI counters halt during Full Stop Mode.
After wake-up from Full Stop Mode the Core Clock and Bus Clock are running on PLLCLK
(PLLSEL=1). COP and RTI are running on IRCCLK (COPOSCSEL0=0, RTIOSCSEL=0).
— If COPOSCSEL1=1:
The clock for the COP is derived from ACLK (trimmable internal RC-Oscillator clock). During
Full Stop Mode the ACLK for the COP can be stopped (COP static) or running (COP active)
depending on the setting of bit CSAD. When bit CSAD is set the ACLK clock source for the
COP is stopped during Full Stop Mode and COP continues to operate after exit from Full Stop
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
249
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
•
Mode. For this COP configuration (ACLK clock source, CSAD set) a latency time (please refer
to CSAD bit description for details) occurs when entering or exiting (Full, Pseudo) Stop Mode.
When bit CSAD is clear the ACLK clock source is on for the COP during Full Stop Mode and
COP is operating.
During Full Stop Mode the RTI counter halts.
After wake-up from Full Stop Mode the Core Clock and Bus Clock are running on PLLCLK
(PLLSEL=1). The COP runs on ACLK and RTI is running on IRCCLK (COPOSCSEL0=0,
RTIOSCSEL=0).
Pseudo Stop Mode (PSTP = 1 and OSCE=1)
External oscillator (XOSCLCP) continues to run.
— If COPOSCSEL1=0:
If the respective enable bits are set (PCE=1 and PRE=1) the COP and RTI will continue to run
with a clock derived from the oscillator clock.
The clock configuration bits PLLSEL, COPOSCSEL0, RTIOSCSEL are unchanged.
— If COPOSCSEL1=1:
If the respective enable bit for the RTI is set (PRE=1) the RTI will continue to run with a clock
derived from the oscillator clock.
The clock for the COP is derived from ACLK (trimmable internal RC-Oscillator clock). During
Pseudo Stop Mode the ACLK for the COP can be stopped (COP static) or running (COP active)
depending on the setting of bit CSAD. When bit CSAD is set the ACLK for the COP is stopped
during Pseudo Stop Mode and COP continues to operate after exit from Pseudo Stop Mode.
For this COP configuration (ACLK clock source, CSAD set) a latency time (please refer to
CSAD bit description for details) occurs when entering or exiting (Pseudo, Full) Stop Mode.
When bit CSAD is clear the ACLK clock source is on for the COP during Pseudo Stop Mode
and COP is operating.
The clock configuration bits PLLSEL, COPOSCSEL0, RTIOSCSEL are unchanged.
NOTE
When starting up the external oscillator (either by programming OSCE bit
to 1 or on exit from Full Stop Mode with OSCE bit already 1) the software
must wait for a minimum time equivalent to the startup-time of the external
oscillator tUPOSC before entering Pseudo Stop Mode.
8.1.2.4
Freeze Mode (BDM active)
For S12CPMU_UHV_V6 Freeze Mode is the same as Run Mode except for RTI and COP which can be
frozen in Active BDM Mode with the RSBCK bit in the CPMUCOP register. After exiting BDM Mode
RTI and COP will resume its operations starting from this frozen status.
Additionally the COP can be forced to the maximum time-out period in Active BDM Mode. For details
please see also the RSBCK and CR[2:0] bit description field of Table 8-13 in Section 8.3.2.10,
“S12CPMU_UHV_V6 COP Control Register (CPMUCOP)
MC9S12ZVM Family Reference Manual Rev. 1.5
250
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.1.3
S12CPMU_UHV_V6 Block Diagram
VSUP
vsup
monitor
ADC
VDDA
VSSA
Low Voltage Detect VDDA
Low Voltage Detect
Voltage
VDDX, VDD, VDDF
Regulator
LVRF
6V to 18V
Power-On Detect
(VREGAUTO)
PORF
VDDX
VSSX
VSS1,2
VDD
VDDF
VDDC
LVIE Low Voltage Interrupt
LVDS
S12CPMU_UHV
COP time-out
COPRF
PMRF
OMRF
Power-On Reset
BCTL
BCTLC
osc monitor fail
Reset
Generator
System Reset
PLL monitor fail
RESET
OSCCLK
OSCCLK
Monitor
Loop
Controlled
REFDIV[3:0]
IRCTRIM[9:0]
Pierce
XTAL Oscillator
(XOSCLCP)
Internal
Reference
4MHz-20MHz
Reference
Divider
Clock
(IRC1M)
PSTP
OSCMOD
IRCCLK
IRCCLK
OSCCLK
EXTAL
REFCLK
FBCLK
PLLSEL
POSTDIV[4:0]
OSCE
Lock
detect
Oscillator status Interrupt
OSCIE
UPOSC UPOSC=0 sets PLLSEL bit
Phase
locked
Loop with
internal
Filter (PLL)
Post
Divider
1,2,.32
divide
by 4
ECLK2X
(Core Clock)
PLLCLK
HTDS
High
Temperature
Sense
VCOFRQ[1:0]
LOCK
LOCKIE
Divide by
2*(SYNDIV+1)
ACLK
CSAD
SYNDIV[5:0]
divide
by 2
IRCCLK
COPOSCSEL1
Bus Clock
Watchdog
ACLK
APICLK
APIE
RTIE
COP time-out
to Reset
Generator IRCCLK
OSCCLK
UPOSC=0 clears
PCE
CPMUCOP
OSCCLK
RTIOSCSEL
API Interrupt
RTI Interrupt
Real Time
Interrupt (RTI)
RTICLK
COPOSCSEL0
PLL lock interrupt
Autonomous API_EXTCLK
Periodic
Interrupt (API)
divide
by 2
RC
Osc.
COPCLK COP
HT Interrupt
HTIE
VCOCLK
REFFRQ[1:0]
UPOSC
ECLK
divide
by 2 (Bus Clock)
PRE
CPMURTI
Figure 8-1. Block diagram of S12CPMU_UHV_V6
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
251
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
Figure 8-2 shows a block diagram of the XOSCLCP.
OSCMOD
Peak
Detector
Clock monitor fail
Monitor
+
_
Gain Control
OSCCLK
VDD=1.8V
VSS
Rf
Quartz Crystals
EXTAL
or
Ceramic Resonators
XTAL
C1
C2
VSS
VSS
Figure 8-2. XOSCLCP Block Diagram
MC9S12ZVM Family Reference Manual Rev. 1.5
252
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.2
Signal Description
This section lists and describes the signals that connect off chip as well as internal supply nodes and special
signals.
8.2.1
RESET
Pin RESET is an active-low bidirectional pin. As an input it initializes the MCU asynchronously to a
known start-up state. As an open-drain output it indicates that an MCU-internal reset has been triggered.
8.2.2
EXTAL and XTAL
These pins provide the interface for a crystal to control the internal clock generator circuitry. EXTAL is
the input to the crystal oscillator amplifier. XTAL is the output of the crystal oscillator amplifier. If
XOSCLCP is enabled, the MCU internal OSCCLK_LCP is derived from the EXTAL input frequency. If
OSCE=0, the EXTAL pin is pulled down by an internal resistor of approximately 200 kΩ and the XTAL
pin is pulled down by an internal resistor of approximately 700 kΩ.
NOTE
Freescale recommends an evaluation of the application board and chosen
resonator or crystal by the resonator or crystal supplier.
The loop controlled circuit (XOSCLCP) is not suited for overtone
resonators and crystals.
8.2.3
VSUP — Regulator Power Input Pin
Pin VSUP is the power input of VREGAUTO. All currents sourced into the regulator loads flow through
this pin.
A suitable reverse battery protection network can be used to connect VSUP to the car battery supply
network.
8.2.4
VDDA, VSSA — Regulator Reference Supply Pins
Pins VDDA and VSSA,are used to supply the analog parts of the regulator. Internal precision reference
circuits are supplied from these signals.
An off-chip decoupling capacitor (220 nF(X7R ceramic)) between VDDA and VSSA is required and can
improve the quality of this supply.
VDDA has to be connected externally to VDDX.
8.2.5
VDDX, VSSX— Pad Supply Pins
VDDX is the supply domain for the digital Pads.
An off-chip decoupling capacitor (10μF plus 220 nF(X7R ceramic)) between VDDX and VSSX is
required.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
253
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
This supply domain is monitored by the Low Voltage Reset circuit.
VDDX has to be connected externally to VDDA.
8.2.6
BCTL— Base Control Pin for external PNP
BCTL is the ballast connection for the on chip voltage regulator. It provides the base current of an external
BJT (PNP) of the VDDX and VDDA supplies. An additional 5.6KΩ resistor between emitter and base of
the BJT is required.
8.2.7
VSS1,2 — Core Ground Pins
VSS1,2 are the core logic supply return pins. They must be grounded.
8.2.8
VDD— Core Logic Supply Pin
VDD is the supply domain for the core logic.
An off-chip decoupling capacitor (220 nF(X7R ceramic)) between VDD and VSS is required and can
improve the quality of this supply.
This supply domain is monitored by the Low Voltage Reset circuit and The Power On Reset circuit.
8.2.9
VDDF— NVM Logic Supply Pin
VDDF is the supply domain for the NVM logic.
An off-chip decoupling capacitor (220 nF(X7R ceramic)) between VDDF and VSS is required and can
improve the quality of this supply.
This supply domain is monitored by the Low Voltage Reset circuit.
8.2.10
API_EXTCLK — API external clock output pin
This pin provides the signal selected via APIES and is enabled with APIEA bit. See the device
specification if this clock output is available on this device and to which pin it might be connected.
8.2.11
TEMPSENSE — Internal Temperature Sensor Output Voltage
Depending on the VSEL setting either the voltage level generated by the temperature sensor or the VREG
bandgap voltage is driven to a special channel input of the ADC Converter. See device level specification
for connectivity of ADC special channels.
MC9S12ZVM Family Reference Manual Rev. 1.5
254
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.3
Memory Map and Registers
This section provides a detailed description of all registers accessible in the S12CPMU_UHV_V6.
8.3.1
Module Memory Map
The S12CPMU_UHV_V6 registers are shown in Figure 8-3.
Address
Offset
Register
Name
Bit 7
6
5
4
3
2
1
Bit 0
0x0000
R
CPMU
RESERVED00 W
0
0
0
0
0
0
0
0
0x0001
R
CPMU
RESERVED01 W
0
0
0
0
0
0
0
0
0x0002
R
CPMU
RESERVED02 W
0
0
0
0
0
0
0
0
R
0
PORF
LVRF
OMRF
PMRF
0x0003
CPMURFLG
0x0004
CPMU
SYNR
0x0005
CPMU
REFDIV
W
0x0006
CPMU
POSTDIV
W
0x0007
CPMUIFLG
0x0008
CPMUINT
0x0009
CPMUCLKS
0x000A
CPMUPLL
0x000B
CPMURTI
0x000C
CPMUCOP
0x000D
RESERVED
CPMUTEST0
W
0x000E
RESERVED
CPMUTEST1
W
W
R
W
R
R
R
W
R
W
R
W
R
VCOFRQ[1:0]
REFFRQ[1:0]
0
W
R
W
R
R
0
0
0
0
0
0
0
PLLSEL
PSTP
CSAD
COP
OSCSEL1
0
0
FM1
FM0
RTDEC
RTR6
RTR5
WCOP
RSBCK
0
0
0
0
0
RTIF
RTIE
COPRF
0
SYNDIV[5:0]
0
W
R
0
REFDIV[3:0]
POSTDIV[4:0]
LOCK
0
0
0
PRE
PCE
RTI
OSCSEL
COP
OSCSEL0
0
0
0
0
RTR4
RTR3
RTR2
RTR1
RTR0
0
0
CR2
CR1
CR0
0
0
0
0
0
0
0
0
0
0
0
0
LOCKIF
LOCKIE
WRTMASK
OSCIF
OSCIE
UPOSC
0
= Unimplemented or Reserved
Figure 8-3. CPMU Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
255
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
Address
Offset
Register
Name
0x000F
CPMU
ARMCOP
0x0010
CPMU
HTCTL
W
0x0011
CPMU
LVCTL
W
0x0012
CPMU
APICTL
0x0013 CPMUACLKTR
Bit 7
5
4
3
2
1
Bit 0
R
0
0
0
0
0
0
0
0
W
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
R
0
0
HTIE
HTIF
0
0
0
LVIE
LVIF
0
0
APIE
APIF
ACLKTR5
ACLKTR4
ACLKTR3
0
0
APIR15
APIR14
APIR13
APIR12
APIR11
APIR10
APIR9
APIR8
APIR7
APIR6
APIR5
APIR4
APIR3
APIR2
APIR1
APIR0
0
0
0
0
0
0
0
0
0
0
0
HTTR3
HTTR2
HTTR1
HTTR0
R
R
W
R
W
R
0x0014
CPMUAPIRH
0x0015
CPMUAPIRL
0x0016
RESERVED
CPMUTEST3
0x0017
CPMUHTTR
0x0018
CPMU
IRCTRIMH
W
0x0019
CPMU
IRCTRIML
W
0x001A
CPMUOSC
0x001B
CPMUPROT
0x001C
RESERVED
CPMUTEST2
W
0x001D
CPMU
VREGCTL
W
0x001E
CPMUOSC2
0x001F
6
W
R
W
R
APICLK
VSEL
0
HTE
HTDS
0
0
LVDS
APIES
APIEA
APIFE
ACLKTR2 ACLKTR1 ACLKTR0
W
R
W
HTOE
R
R
R
W
R
0
TCTRIM[4:0]
IRCTRIM[9:8]
IRCTRIM[7:0]
OSCE
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
EXTCON
EXTXON
INTXON
OMRE
OSCMOD
0
0
Reserved
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
R
R
R
W
R
CPMU
RESERVED1F W
0
PROT
0
= Unimplemented or Reserved
Figure 8-3. CPMU Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.5
256
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
8.3.2
Register Descriptions
This section describes all the S12CPMU_UHV_V6 registers and their individual bits.
Address order is as listed in Figure 8-3
8.3.2.1
S12CPMU_UHV_V6 Reset Flags Register (CPMURFLG)
This register provides S12CPMU_UHV_V6 reset flags.
Module Base + 0x0003
7
R
6
5
PORF
LVRF
Note 1
Note 2
0
4
3
0
2
1
0
OMRF
PMRF
Note 4
Note 5
0
COPRF
W
Reset
0
0
Note 3
0
1. PORF is set to 1 when a power on reset occurs. Unaffected by System Reset.
2. LVRF is set to 1 when a low voltage reset occurs. Unaffected by System Reset. Set by power on reset.
3. COPRF is set to 1 when COP reset occurs. Unaffected by System Reset. Cleared by power on reset.
4. OMRF is set to 1 when an oscillator clock monitor reset occurs. Unaffected by System Reset. Cleared by power on reset.
5. PMRF is set to 1 when a PLL clock monitor reset occurs. Unaffected by System Reset. Cleared by power on reset.
= Unimplemented or Reserved
Figure 8-4. S12CPMU_UHV_V6 Flags Register (CPMURFLG)
Read: Anytime
Write: Refer to each bit for individual write conditions
Table 8-1. CPMURFLG Field Descriptions
Field
Description
6
PORF
Power on Reset Flag — PORF is set to 1 when a power on reset occurs. This flag can only be cleared by writing
a 1. Writing a 0 has no effect.
0 Power on reset has not occurred.
1 Power on reset has occurred.
5
LVRF
Low Voltage Reset Flag — LVRF is set to 1 when a low voltage reset occurs on the VDD, VDDF or VDDX
domain. This flag can only be cleared by writing a 1. Writing a 0 has no effect.
0 Low voltage reset has not occurred.
1 Low voltage reset has occurred.
3
COPRF
COP Reset Flag — COPRF is set to 1 when a COP (Computer Operating Properly) reset occurs. Refer to 8.5.5,
“Computer Operating Properly Watchdog (COP) Reset and 8.3.2.10, “S12CPMU_UHV_V6 COP Control
Register (CPMUCOP) for details.This flag can only be cleared by writing a 1. Writing a 0 has no effect.
0 COP reset has not occurred.
1 COP reset has occurred.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
257
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
Table 8-1. CPMURFLG Field Descriptions (continued)
Field
Description
1
OMRF
Oscillator Clock Monitor Reset Flag — OMRF is set to 1 when a loss of oscillator (crystal) clock occurs. Refer
to8.5.3, “Oscillator Clock Monitor Reset for details.This flag can only be cleared by writing a 1. Writing a 0 has
no effect.
0 Loss of oscillator clock reset has not occurred.
1 Loss of oscillator clock reset has occurred.
0
PMRF
PLL Clock Monitor Reset Flag — PMRF is set to 1 when a loss of PLL clock occurs. This flag can only be
cleared by writing a 1. Writing a 0 has no effect.
0 Loss of PLL clock reset has not occurred.
1 Loss of PLL clock reset has occurred.
8.3.2.2
S12CPMU_UHV_V6 Synthesizer Register (CPMUSYNR)
The CPMUSYNR register controls the multiplication factor of the PLL and selects the VCO frequency
range.
Module Base + 0x0004
7
6
5
4
3
2
1
0
0
0
0
R
VCOFRQ[1:0]
SYNDIV[5:0]
W
Reset
0
1
0
1
1
Figure 8-5. S12CPMU_UHV_V6 Synthesizer Register (CPMUSYNR)
Read: Anytime
Write: If PROT=0 (CPMUPROT register) and PLLSEL=1 (CPMUCLKS register), then write anytime.
Else write has no effect.
NOTE
Writing to this register clears the LOCK and UPOSC status bits.
If PLL has locked (LOCK=1)
f VCO = 2 × f REF × ( SYNDIV + 1 )
NOTE
fVCO must be within the specified VCO frequency lock range. Bus
frequency fbus must not exceed the specified maximum.
The VCOFRQ[1:0] bits are used to configure the VCO gain for optimal stability and lock time. For correct
PLL operation the VCOFRQ[1:0] bits have to be selected according to the actual target VCOCLK
MC9S12ZVM Family Reference Manual Rev. 1.5
258
Freescale Semiconductor
Chapter 8 S12 Clock, Reset and Power Management Unit (S12CPMU_UHV_V6)
frequency as shown in Table 8-2. Setting the VCOFRQ[1:0] bits incorrectly can result in a non functional
PLL (no locking and/or insufficient stability).
Table 8-2. VCO Clock Frequency Selection
8.3.2.3
VCOCLK Frequency Ranges
VCOFRQ[1:0]
32MHz Voct
Voct
6 bit
DAC
+
I
GCSE0
GCSO0[2:0]
VAMP = a Vsense + Vref
-
Voffset
17.5.9
Rp
AMPM[0]
Rn
Rp / a
AMPP[0]
=
AMP[0]
+
=
Output Voltage to ADC
Vref
Vsense
Rsense
Rn / a
GDU DC Link Voltage Monitor
In addition to the feature described in Section 17.4.2.10, “GDU Phase Mux Register (GDUPHMUX) the
voltage on pin HD divide by 5 is routed to an ADC channel. See SOC section for ADC channel number.
This feature is only available if GFDE is set.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
665
Chapter 17 Gate Drive Unit (GDUV4/V5)
17.5.10 Boost Converter
The GDU module integrates the necessary hardware to build a boost converter with external components
in case of low voltage condition. The external components needed are two Schottky diodes, one coil, and
capacitors. See Figure 17-25. The boost converter clock which is driving the transistor T1 (see Figure 1725) is derived from the bus clock. This clock can be divided down as described in Table 17-11. The boost
converter also includes a circuit to limit the current through coil. This current limit can be adjusted with
the bits GBCL[3:0] in the GDUBCL register. See GDU electrical parameters.
The output voltage of the boost converter on VSUP pin is divided down and compared with a reference
voltage Vref . As long as the divided voltage VVSUP is below Vref the boost converter clock is enabled
assuming that GBOE (GDU Boost Option Enable) is set.
Figure 17-25. Boost Converter Option with external Components1
VBAT
L
D1
C2
C1
D2
BST
VSUP
Boost Converter Clock
Bus Clock Input
Clock Frequency
&
Duty Cycle
T1
Output Voltage Control
ICOIL
Current Limitation
R2
Enable
Disable
-
-
+
+
GBCL[3:0]
Vrefcl
GBOE
GBOCD[4:0]
=
R
R1
Vref
=
GBODC[1:0]
VSSB
1. Diode D2 shown is optional if coil is connected behind reverse battery protection.
MC9S12ZVM Family Reference Manual Rev. 1.5
666
Freescale Semiconductor
Chapter 17 Gate Drive Unit (GDUV4/V5)
17.5.11 Interrupts
This section describes the interrupts generated in the GDU module. The interrupts are only available in
CPU run mode. Entering and exiting stop mode has no effect on the interrupt flags. The GDU module has
two interrupt vectors which are listed in Table 17-26. The low-side and high-side desaturation error flags
are combined into one interrupt line and the over and under voltage detection are combined into another
interrupt line. (see SOC section interrupt vector table)
Table 17-26. GDU Module Interrupt Sources
GDU Module Interrupt
Source
Module Internal Interrupt Source
Local Enable
0
GDU desaturation error
interrupt
GDU low-side and high-side desaturation
error flags GDHSF[2:0] and GDLSF[2:0]
GDSEIE = 1
1
GDU over/under voltage
detection and overcurrent
detection interrupt
GDU low voltage condition on pin VLS
(GLVLSIF)
GLVLSIE = 1
GDU high voltage condition on pin HD
(GHHDIF)
GHHDIE = 1
GDU Overcurrent Condition
(GOCIF[1:0])
GOCIE[1:0]=11
#
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
667
Chapter 17 Gate Drive Unit (GDUV4/V5)
17.6
Application Information
17.6.1
FET Pre-Driver Details
The basic concept of the high-side driver is shown in Figure 17-26. If the FET pre-driver is switched on
the transistor T2 is driving the output HG. For on resistance Rgduon of transistor T2 refer to GDU
electricals. The output current is limited to IOUT which is derived from the reference current IREF. The
current source is controlled by the slew rate control bits GSRCHS[2:0]. If the FET pre-driver is switched
off transistors T3 and T4 are switched on. For on resistance Rgduoffn and Rgduoffp of transistors T3 and T4
refer to GDU electricals.
The reference current IREF is controlled by the slew rate conrol bits GSRCHS[2:0] :
•
IREF = 10uA + GSRCHS 10uA, [10uA, 20uA . . . 80uA]
Assuming an ideal op-amp the voltage across R1 is equal voltage across R2 and IOUT2 is given by:
•
•
V1 = V2 = IREF R1 = IOUT2 R2
IOUT2 = IREF (R1/R2)
With the ratio of the transistor sizes of T1 and T2 k=450, and the ratio of the resistors R1/R2=36, and
neglect the current through RHSpul the output current IOUT is:
•
•
•
IOUT1 = k IOUT2
IOUT = IOUT1 + IOUT2 = IREF (R1/R2) (1+k)
IOUT ~ IREF (R1/R2) k
Figure 17-26. FET Pre-Driver Concept for High-Side Driver
VBS
R1
R2
V1
V2
Iout2
_
IREF
Iout1
Rgduon
+
T2
T1
HG
Iout
Driver On
GSRCHS[2:0]
RHSpul
Driver Off
T3
T4
Rgduoffn
Rgduoffp
CG
HS
MC9S12ZVM Family Reference Manual Rev. 1.5
668
Freescale Semiconductor
Chapter 17 Gate Drive Unit (GDUV4/V5)
17.6.2
Calculation of Bootstrap Capacitor
The size of the bootstrap capacitor CBS depends on the total gate charge QG needed to turn on the power
FET used in the application. If the bootstrap capacitor is too small there can be a large voltage drop due to
charge sharing between bootstrap capacitor CBS and the total gate capacitance of the power FET CG. The
resulting voltage on the gate of the power FET can be calculated as follow:
Eqn. 17-1
V BS
Q BS
V G = -------------------------- = -------------------CG
C BS + C G
1 + ----------C BS
For example if CBS = 20 CG then the resulting gate voltage is VG = 0.95 VBS.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
669
Chapter 17 Gate Drive Unit (GDUV4/V5)
MC9S12ZVM Family Reference Manual Rev. 1.5
670
Freescale Semiconductor
Chapter 18
LIN/HV Physical Layer (S12LINPHYV3)
Table 18-1. Revision History Table
Rev. No.
Date
(Item No.) (Submitted By)
V02.09
V02.10
V02.11
V02.12
V02.13
V03.01
18.1
Sections
Affected
27 Jun 2013
21 Aug 2013
Feature list
Substantial Change(s)
- Added the SAE J2602-2 LIN compliance.
Overcurrent and
TxD-dominant - Specified the time after which the interrupt flags are set again after having
timeout interrupt been cleared while the error condition is still present.
descriptions
19 Sep 2013
All
20 Sep 2013
Standby Mode
8 Oct 2013
All
08 May 2014
All
- Removed preliminary note.
- Fixed grammar and spelling throughout the document.
- Clarified Standby mode behavior.
- More grammar, spelling, and formating fixes throughout the document.
- Added HV PHY feature.
Introduction
This chapter provides information for both the LIN physical interface and the HV interface. Devices
may include either a LINPHY or HVPHY module. The device overview section specifies the
LINPHY/HVPHY to device mapping.
The LIN (Local Interconnect Network) bus pin provides a physical layer for single-wire communication
in automotive applications. The LIN Physical Layer is designed to meet the LIN Physical Layer 2.2
specification from LIN consortium.
The HV physical interface provides a physical layer for single-wire communication. It can be used, among
other examples, for PWM applications since it can be connected to an internal timer.
NOTE
All references to LIN (e.g. names of bits, registers, signals, pins, interrupts,
etc.) apply to the HV physical interface as well. The same names have been
kept to highlight and facilitate the hardware and software compatibility
between both versions. Nevertheless, cases where particular LIN features do
not apply to the HV physical interface version are specifically mentioned.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
671
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.1.1
Features
The LIN Physical Layer module includes the following distinctive features:
• Compliant with LIN Physical Layer 2.2 specification.
• Compliant with the SAE J2602-2 LIN standard.
• Standby mode with glitch-filtered wake-up.
• Slew rate selection optimized for the baud rates: 10.4 kbit/s, 20 kbit/s and Fast Mode (up to
250 kbit/s).
• Switchable 34 kΩ/330 kΩ pullup resistors (in shutdown mode, 330 kΩ only)
• Current limitation for LIN Bus pin falling edge.
• Overcurrent protection.
• LIN TxD-dominant timeout feature monitoring the LPTxD signal.
• Automatic transmitter shutdown in case of an overcurrent or TxD-dominant timeout.
• Fulfills the OEM “Hardware Requirements for LIN (CAN and FlexRay) Interfaces in Automotive
Applications” v1.3.
The HV Physical Layer module includes the following distinctive features:
• Compliant with the ISO9141 (K-line) standard.
• Standby mode with glitch-filtered wake-up.
• Slew rate selection optimized for: 5.2 kHz, 10 kHz and Fast Mode (up to 125 kHz).
• Switchable 34 kΩ/330 kΩ pullup resistors (in shutdown mode, 330 kΩ only).
• Current limitation for LIN Bus pin falling edge.
• Overcurrent protection.
The LIN/HV transmitter is a low-side MOSFET with current limitation and overcurrent transmitter
shutdown. A selectable internal pullup resistor with a serial diode structure is integrated, so no external
pullup components are required for the application in a slave node. To be used as a master node, an external
resistor of 1 kΩ must be placed in parallel between VLINSUP and the LIN Bus pin, with a diode between
VLINSUP and the resistor. The fall time from recessive to dominant and the rise time from dominant to
recessive is selectable and controlled to guarantee communication quality and reduce EMC emissions. The
symmetry between both slopes is guaranteed.
18.1.2
Modes of Operation
The LIN/HV Physical Layer can operate in the following four modes:
1. Shutdown Mode
The LIN/HV Physical Layer is fully disabled. No wake-up functionality is available. The internal
pullup resistor is replaced by a high ohmic one (330 kΩ) to maintain the LIN Bus pin in the
recessive state. All registers are accessible.
MC9S12ZVM Family Reference Manual Rev. 1.5
672
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
2. Normal Mode
The full functionality is available. Both receiver and transmitter are enabled.
3. Receive Only Mode
The transmitter is disabled and the receiver is running in full performance mode.
4. Standby Mode
The transmitter of the LIN/HV Physical Layer is disabled. If the wake-up feature is enabled, the
internal pullup resistor can be selected (330 kΩ or 34 kΩ). The receiver enters a low power mode
and optionally it can pass wake-up events to the Serial Communication Interface (SCI). If the
wake-up feature is enabled and if the LIN Bus pin is driven with a dominant level longer than
tWUFR followed by a rising edge, the LIN/HV Physical Layer sends a wake-up pulse to the SCI,
which requests a wake-up interrupt. (This feature is only available if the LIN/HV Physical Layer
is routed to the SCI).
18.1.3
Block Diagram
Figure 18-1 shows the block diagram of the LIN/HV Physical Layer. The module consists of a receiver
with wake-up control, a transmitter with slope and timeout control, a current sensor with overcurrent
protection as well as a registers control block.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
673
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
+
*,
" #$%
#
!
''( )
* *
&
%+ " #$ -
,
*
. *
*
*
Figure 18-1. LIN/HV Physical Layer Block Diagram
NOTE
The external 220 pF capacitance between LIN and LGND is strongly
recommended for correct operation.
MC9S12ZVM Family Reference Manual Rev. 1.5
674
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.2
External Signal Description
This section lists and describes the signals that connect off chip as well as internal supply nodes and special
signals.
18.2.1
LIN — LIN Bus Pin
This pad is connected to the single-wire LIN data bus.
18.2.2
LGND — LIN Ground Pin
This pin is the device LIN ground connection. It is used to sink currents related to the LIN Bus pin. A decoupling capacitor external to the device (typically 220 pF, X7R ceramic) between LIN and LGND can
further improve the quality of this ground and filter noise.
18.2.3
VLINSUP — Positive Power Supply
External power supply to the chip. The VLINSUP supply mapping is described in device level
documentation.
18.2.4
LPTxD — LIN Transmit Pin
This pin can be routed to the SCI, LPDR1 register bit, an external pin, or other options. Please refer to the
PIM chapter of the device specification for the available routing options.
In the HV Phy version, LPTxD can be used to send diagnostic feedback.
This input is only used in normal mode; in other modes the value of this pin is ignored.
18.2.5
LPRxD — LIN Receive Pin
This pin can be routed to the SCI, an external pin, or other options like a timer. Please refer to the PIM
chapter of the device specification for the available routing options.
In the HV Phy version, LPRxD can be used to receive control information since it can be connected to an
internal timer channel.
In standby mode this output is disabled, and sends only a short pulse in case the wake-up functionality is
enabled and a valid wake-up pulse was received in the LIN Bus.
18.3
Memory Map and Register Definition
This section provides a detailed description of all registers accessible in the LIN/HV Physical Layer.
18.3.1
Module Memory Map
A summary of the registers associated with the LIN/HV Physical Layer module is shown in Table 18-2.
Detailed descriptions of the registers and bits are given in the subsections that follow.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
675
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
NOTE
Register Address = Module Base Address + Address Offset, where the
Module Base Address is defined at the MCU level and the Address Offset
is defined at the module level.
Address Offset
Register Name
Bit 7
6
5
4
3
2
1
Bit 0
0
0
LPE
RXONLY
LPWUE
LPPUE
Reserved
Reserved
LPSLR1
LPSLR0
0x0000
LPDR
R
W
0
0
0
0
0x0001
LPCR
R
W
0
0
0
0
Reserved
Reserved
Reserved
Reserved
Reserved
0
0
0
0
0
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
LPDT
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0x0002
Reserved
R
Reserved
W
0x0003
LPSLRM
R
LPDTDIS
W
0x0004
Reserved
R
Reserved
W
0x0005
LPSR
R
W
0x0006
LPIE
R
W
LPDTIE
LPOCIE
0x0007
LPIF
R
W
LPDTIF
LPOCIF
LPDR1
LPDR0
Figure 18-2. Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.5
676
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.3.2
Register Descriptions
This section describes all the registers of the LIN/HV Physical Layer and their individual bits.
18.3.2.1
Port LP Data Register (LPDR)
Access: User read/write(1)
Module Base + Address 0x0000
R
7
6
5
4
3
2
0
0
0
0
0
0
0
0
0
0
0
W
Reset
0
1
LPDR1
1
0
LPDR0
1
= Unimplemented
Figure 18-3. Port LP Data Register (LPDR)
1. Read: Anytime
Write: Anytime
Table 18-2. LPDR Field Description
Field
Description
1
LPDR1
Port LP Data Bit 1 — The LPTxD input of the LIN/HV Physical Layer (see Figure 18-1) can be directly controlled
by this register bit. The routing of the LPTxD input is done in the Port Inetrgation Module (PIM). Please refer to
the device PIM description for more info.In the HV Phy version, this bit can be use to send diagnostic feedback.
0
LPDR0
Port LP Data Bit 0 — Read-only bit. The LIN Physical Layer LPRxD output state can be read at any time.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
677
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.3.2.2
LIN Control Register (LPCR)
Access: User read/write(1)
Module Base + Address 0x0001
R
7
6
5
4
0
0
0
0
0
0
0
0
W
Reset
3
2
1
0
LPE
RXONLY
LPWUE
LPPUE
0
0
0
0
= Unimplemented
Figure 18-4. LIN Control Register (LPCR)
1. Read: Anytime
Write: Anytime,
Table 18-3. LPCR Field Description
Field
Description
3
LPE
LIN Enable Bit — If set, this bit enables the LIN Physical Layer.
0 The LIN Physical Layer is in shutdown mode. None of the LIN Physical Layer functions are available, except
that the bus line is held in its recessive state by a high ohmic (330kΩ) resistor. All registers are normally
accessible.
1 The LIN Physical Layer is not in shutdown mode.
2
RXONLY
Receive Only Mode bit — This bit controls RXONLY mode.
0 The LIN Physical Layer is not in receive only mode.
1 The LIN Physical Layer is in receive only mode.
1
LPWUE
LIN Wake-Up Enable — This bit controls the wake-up feature in standby mode.
0 In standby mode the wake-up feature is disabled.
1 In standby mode the wake-up feature is enabled.
0
LPPUE
LIN Pullup Resistor Enable — Selects pullup resistor.
0 The pullup resistor is high ohmic (330 kΩ).
1 The 34 kΩ pullup is switched on (except if LPE=0 or when in standby mode with LPWUE=0).
MC9S12ZVM Family Reference Manual Rev. 1.5
678
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.3.2.3
Reserved Register
Access: User read/write(1)
Module Base + Address 0x0002
R
W
Reset
7
6
5
4
3
2
1
0
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
x
x
x
x
x
x
x
x
= Unimplemented
Figure 18-5. LIN Test register
1. Read: Anytime
Write: Only in special mode
NOTE
This reserved register is designed for factory test purposes only, and is not
intended for general user access. Writing to this register when in special
mode can alter the module’s functionality.
Table 18-4. Reserved Register Field Description
Field
7-0
Reserved
18.3.2.4
Description
These reserved bits are used for test purposes. Writing to these bits can alter the module functionality.
LIN Slew Rate Mode Register (LPSLRM)
Access: User read/write(1)
Module Base + Address 0x0003
7
R
W
Reset
LPDTDIS
0
6
5
4
3
2
0
0
0
0
0
0
0
0
0
0
1
0
LPSLR1
LPSLR0
0
0
= Unimplemented
Figure 18-6. LIN Slew Rate Mode Register (LPSLRM)
1. Read: Anytime
Write: Only in shutdown mode (LPE=0)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
679
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
Table 18-5. LPSLRM Field Description
Field
Description
7
LPDTDIS
TxD-dominant timeout disable Bit — This bit disables the TxD-dominant timeout feature. Disabling this feature
is only recommended for using the LIN Physical Layer for other applications than LIN protocol. It is only writable
in shutdown mode (LPE=0).
0 TxD-dominant timeout feature is enabled.
1 TxD-dominant timeout feature is disabled.
1-0
LPSLR[1:0]
Slew-Rate Bits — Please see section 18.4.2 for details on how the slew rate control works. These bits are only
writable in shutdown mode (LPE=0).
00 Normal Slew Rate (optimized for 20 kbit/s).
01 Slow Slew Rate (optimized for 10.4 kbit/s).
10 Fast Mode Slew Rate (up to 250 kbit/s). This mode is not compliant with the LIN Protocol (LIN electrical
characteristics like duty cycles, reference levels, etc. are not fulfilled). It is only meant to be used for fast data
transmission. Please refer to section 18.4.2.2 for more details on fast mode.Please note that an external
pullup resistor stronger than 1 kΩ might be necessary for the range 100 kbit/s to 250 kbit/s.
11 Reserved .
18.3.2.5
Reserved Register
Access: User read/write(1)
Module Base + Address 0x0004
R
W
Reset
7
6
5
4
3
2
1
0
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
x
x
x
x
x
x
x
x
= Unimplemented
Figure 18-7. Reserved Register
1. Read: Anytime
Write: Only in special mode
NOTE
This reserved register is designed for factory test purposes only, and is not
intended for general user access. Writing to this register when in special
mode can alter the module’s functionality.
Table 18-6. Reserved Register Field Description
Field
7-0
Reserved
Description
These reserved bits are used for test purposes. Writing to these bits can alter the module functionality.
MC9S12ZVM Family Reference Manual Rev. 1.5
680
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.3.2.6
LIN Status Register (LPSR)
Access: User read/write(1)
Module Base + Address 0x0005
R
7
6
5
4
3
2
1
0
LPDT
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
Reset
= Unimplemented
Figure 18-8. LIN Status Register (LPSR)
1. Read: Anytime
Write: Never, writes to this register have no effect
Table 18-7. LPSR Field Description
Field
Description
7
LPDT
LIN Transmitter TxD-dominant timeout Status Bit — This read-only bit signals that the LPTxD pin is still
dominant after a TxD-dominant timeout. As long as the LPTxD is dominant after the timeout the LIN transmitter
is shut down and the LPTDIF is set again after attempting to clear it.
0 If there was a TxD-dominant timeout, LPTxD has ceased to be dominant after the timeout.
1 LPTxD is still dominant after a TxD-dominant timeout.
18.3.2.7
LIN Interrupt Enable Register (LPIE)
Access: User read/write(1)
Module Base + Address 0x0006
7
R
W
Reset
6
LPDTIE
LPOCIE
0
0
5
4
3
2
1
0
0
0
0
0
0
0
0
0
0
0
0
0
= Unimplemented
Figure 18-9. LIN Interrupt Enable Register (LPIE)
1. Read: Anytime
Write: Anytime
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
681
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
Table 18-8. LPIE Field Description
Field
Description
7
LPDTIE
LIN transmitter TxD-dominant timeout Interrupt Enable —
0 Interrupt request is disabled.
1 Interrupt is requested if LPDTIF bit is set.
6
LPOCIE
LIN transmitter Overcurrent Interrupt Enable —
0 Interrupt request is disabled.
1 Interrupt is requested if LPOCIF bit is set.
MC9S12ZVM Family Reference Manual Rev. 1.5
682
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.3.2.8
LIN Interrupt Flags Register (LPIF)
Access: User read/write(1)
Module Base + Address 0x0007
7
R
W
Reset
6
LPDTIF
LPOCIF
0
0
5
4
3
2
1
0
0
0
0
0
0
0
0
0
0
0
0
0
= Unimplemented
Figure 18-10. LIN Interrupt Flags Register (LPIF)
1. Read: Anytime
Write: Writing ‘1’ clears the flags, writing a ‘0’ has no effect
Table 18-9. LPIF Field Description
Field
Description
7
LPDTIF
LIN Transmitter TxD-dominant timeout Interrupt Flag — LPDTIF is set to 1 when LPTxD is still dominant (0)
after tTDLIM of the falling edge of LPTxD. For protection, the transmitter is disabled. This flag can only be
cleared by writing a 1. Writing a 0 has no effect. Please make sure that LPDTIF=1 before trying to clear it.
Clearing LPDTIF is not allowed if LPDTIF=0 already. If the LPTxD is still dominant after clearing the flag, the
transmitter stays disabled and this flag is set again (see 18.4.4.2 TxD-dominant timeout Interrupt).
If interrupt requests are enabled (LPDTIE= 1), LPDTIF causes an interrupt request.
0 No TxD-dominant timeout has occurred.
1 A TxD-dominant timeout has occurred.
6
LPOCIF
LIN Transmitter Overcurrent Interrupt Flag — LPOCIF is set to 1 when an overcurrent event happens. For
protection, the transmitter is disabled. This flag can only be cleared by writing a 1. Writing a 0 has no effect.
Please make sure that LPOCIF=1 before trying to clear it. Clearing LPOCIF is not allowed if LPOCIF=0 already.
If the overcurrent is still present or LPTxD is dominant after clearing the flag, the transmitter stays disabled and
this flag is set again (see18.4.4.1 Overcurrent Interrupt).
If interrupt requests are enabled (LPOCIE= 1), LPOCIF causes an interrupt request.
0 No overcurrent event has occurred.
1 Overcurrent event has occurred.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
683
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.4
Functional Description
18.4.1
General
The LIN/HV Physical Layer module implements the physical layer of the LIN/HV interface. In the LIN
version, this physical layer can be driven by the SCI (Serial Communication Interface) module or directly
through the LPDR register.In the HV Phy version, the input can be routed to an internal timer to measure
the frequency and duty cycle of the PWM input signal. If required, the output can directly be controlled
by the LPDR register, e.g. to send diagnostic feedback.
18.4.2
Slew Rate and LIN Mode Selection
The slew rate can be selected for Electromagnetic Compatibility (EMC) optimized operation at 10.4 kbit/s
and 20 kbit/s as well as at fast baud rate (up to 250 kbit/s) for test and programming. The slew rate can be
chosen with the bits LPSLR[1:0] in the LIN Slew Rate Mode Register (LPSLRM). The default slew rate
corresponds to 20 kbit/s.
In the HV Phy version, the TxD-dominant timeout must be disabled (LPDTDIS=1) in order e.g. to transmit
a PWM pulse.
Changing the slew rate (LPSLRM Register) during transmission is not allowed in order to avoid unwanted
effects. To change the register, the LIN/HV Physical Layer must first be disabled (LPE=0). Once it is
updated, the LIN/HV Physical Layer can be enabled again.
NOTE
For 20 kbit/s and Fast Mode communication speeds, the corresponding slew
rate MUST be set; otherwise, the communication is not guaranteed
(violation of the specified LIN duty cycles). For 10.4 kbit/s, the 20 kbit/s
slew rate can be set but the EMC performance is worse. The up to 250 kbit/s
slew rate must be chosen ONLY for fast mode, not for any of the 10.4 kbit/s
or 20 kbit/s LIN compliant communication speeds.
18.4.2.1
10.4 kbit/s and 20 kbit/s
When the slew rate is chosen for 10.4 kbit/s or 20 kbit/s communication, a control loop is activated within
the module to make the rise and fall times of the LIN bus independent from VLINSUP and the load on the
bus.
18.4.2.2
Fast Mode (not LIN compliant)
Choosing this slew rate allows baud rates up to 250 kbit/s by having much steeper edges (please refer to
electricals). As for the 10.4 kbit/s and 20 kbit/s modes, the slope control loop is also engaged. This mode
is used for fast communication only, and the LIN electricals are not supported (for example, the LIN duty
cycles).
MC9S12ZVM Family Reference Manual Rev. 1.5
684
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
A stronger external pullup resistor might be necessary to sustain communication speeds up to
250 kbit/s. The signal on the LIN pin and the LPRxD signal might not be symmetrical for high baud rates
with high loads on the bus.
Please note that if the bit time is smaller than the parameter tOCLIM (please refer to electricals), then no
overcurrent is reported nor does an overcurrent shutdown occur. However, the current limitation is always
engaged in case of a failure.
18.4.3
Modes
Figure 18-11 shows the possible mode transitions depending on control bits, stop mode, and error
conditions.
18.4.3.1
Shutdown Mode
The LIN/HV Physical Layer is fully disabled. No wake-up functionality is available. The internal pullup
resistor is high ohmic only (330 kΩ) to maintain the LIN pin in the recessive state. LPTxD is not monitored
in this mode for a TxD-dominant timeout. All the registers are accessible.
Setting LPE causes the module to leave the shutdown mode and to enter the normal mode or receive only
mode (if RXONLY bit is set).
Clearing LPE causes the module to leave the normal or receive only modes and go back to shutdown mode.
18.4.3.2
Normal Mode
The full functionality is available. Both receiver and transmitter are enabled. The internal pullup resistor
can be chosen to be high ohmic (330 kΩ) if LPPUE = 0, or LIN compliant (34 kΩ) if LPPUE = 1.
If RXONLY is set, the module leaves normal mode to enter receive only mode.
If the MCU enters stop mode, the LIN/HV Physical Layer enters standby mode.
18.4.3.3
Receive Only Mode
Entering this mode disables the transmitter and immediately stops any on-going transmission. LPTxD is
not monitored in this mode for a TxD-dominant timeout.
The receiver is running in full performance mode in all cases.
To return to normal mode, the RXONLY bit must be cleared.
If the device enters stop mode, the module leaves receive only mode to enter standby mode.
18.4.3.4
Standby Mode with Wake-Up Feature
The transmitter of the LIN/HV Physical Layer is disabled and the receiver enters a low power mode.
NOTE
Before entering standby mode, please ensure that no transmission is
ongoing.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
685
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
If LPWUE is not set, no wake up feature is available and the standby mode has the same electrical
properties as the shutdown mode. This allows a low-power consumption of the device in stop mode if the
wake-up feature is not needed.
If LPWUE is set, the receiver is able to pass wake-up events to the SCI (Serial Communication Interface).
If the LIN/HV Physical Layer receives a dominant level longer than tWUFR followed by a rising edge, it
sends a pulse to the SCI which can generate a wake-up interrupt.
Once the device exits stop mode, the LIN/HV Physical Layer returns to normal or receive only mode
depending on the status of the RXONLY bit.
NOTE
Since the wake-up interrupt is requested by the SCI, the wake-up feature is
not available if LPRxD is not connected to the SCI..
The internal pullup resistor is selectable only if LPWUE = 1 (wake-up enabled). If LPWUE = 0, the
internal pullup resistor is not selectable and remains at 330 kΩ regardless of the state of the LPPUE bit.
If LPWUE = 1, selecting the 330 kΩ pullup resistor (LPPUE = 0) reduces the current consumption in
standby mode.
NOTE
The use of the LIN wake-up feature in combination with other non-LIN
device wake-up features (like a periodic time interrupt) must be handled
with care.
If the device leaves stop mode while the LIN bus is dominant, the LIN/HV
Physical Layer returns to normal or receive only mode and the LPRxD
signal is re-routed to the RxD pin of the SCI and triggers the edge detection
interrupt (if the interrupt’s priority of the hardware that awakes the MCU is
less than the priority of the SCI interrupt, then the SCI interrupt will execute
first). It is up to the software to decide what to do in this case because the
LIN/HV Physical Layer may not determine whether it was a valid wake-up
pulse.
MC9S12ZVM Family Reference Manual Rev. 1.5
686
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
&
&'
#
#
#
!
"!
# $ "!
#
!
"!
# $ "!
"! % % !
"!
"!
# $ "!
Figure 18-11. LIN/HV Physical Layer Mode Transitions
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
687
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.4.4
Interrupts
The interrupt vector requested by the LIN/HV Physical Layer is listed in Table 18-10. Vector address and
interrupt priority is defined at the MCU level.
The module internal interrupt sources are combined into a single interrupt request at the device level.
Table 18-10. Interrupt Vectors
Module Interrupt Source
LIN Interrupt (LPI)
18.4.4.1
Module Internal Interrupt
Source
Local Enable
LIN Txd-Dominant Timeout
Interrupt (LPDTIF)
LPDTIE = 1
LIN Overcurrent Interrupt
(LPOCIF)
LPOCIE = 1
Overcurrent Interrupt
The transmitter is protected against overcurrent. In case of an overcurrent condition occurring within a
time frame called tOCLIM starting from LPTxD falling edge, the current through the transmitter is limited
(the transmitter is not shut down). The masking of an overcurrent event within the time frame tOCLIM is
meant to avoid “false” overcurrent conditions that can happen during the discharging of the LIN bus. If an
overcurrent event occurs out of this time frame, the transmitter is disabled and the LPOCIF flag is set.
In order to re-enable the transmitter again, the following prerequisites must be met:
1) Overcurrent condition is over
2) LPTxD is recessive or the LIN/HV Physical Layer is in shutdown or receive only mode for a
minimum of a transmit bit time.
To re-enable the transmitter then, the LPOCIF flag must be cleared (by writing a 1).
NOTE
Please make sure that LPOCIF=1 before trying to clear it. It is not allowed
to try to clear LPOCIF if LPOCIF=0 already.
After clearing LPOCIF, if the overcurrent condition is still present or the LPTxD pin is dominant while
being in normal mode, the transmitter remains disabled and the LPOCIF flag is set again after a time to
indicate that the attempt to re-enable has failed. This time is equal to:
• minimum 1 IRC period (1 us) + 2 bus periods
• maximum 2 IRC periods (2 us) + 3 bus periods
If the bit LPOCIE is set in the LPIE register, an interrupt is requested.
Figure 18-12 shows the different scenarios for overcurrent interrupt handling.
MC9S12ZVM Family Reference Manual Rev. 1.5
688
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
! "#
$
% $
## &
! "#
$
% $
# "#
! "#
$
%
Figure 18-12. Overcurrent interrupt handling
18.4.4.2
TxD-dominant timeout Interrupt
NOTE
In order to perform PWM communication, the TxD-dominant timeout
feature must be disabled.
To protect the LIN bus from a network lock-up, the LIN Physical Layer implements a TxD-dominant
timeout mechanism. When the LPTxD signal has been dominant for more than tDTLIM the transmitter is
disabled and the LPDT status flag and the LPDTIF interrupt flag are set.
In order to re-enable the transmitter again, the following prerequisites must be met:
1) TxD-dominant condition is over (LPDT=0)
2) LPTxD is recessive or the LIN Physical Layer is in shutdown or receive only mode for a
minimum of a transmit bit time
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
689
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
To re-enable the transmitter then, the LPDTIF flag must be cleared (by writing a 1).
NOTE
Please make sure that LPDTIF=1 before trying to clear it. It is not allowed
to try to clear LPDTIF if LPDTIF=0 already.
After clearing LPDTIF, if the TxD-dominant timeout condition is still present or the LPTxD pin is
dominant while being in normal mode, the transmitter remains disabled and the LPDTIF flag is set after a
time again to indicate that the attempt to re-enable has failed. This time is equal to:
• minimum 1 IRC period (1 us) + 2 bus periods
• maximum 2 IRC periods (2 us) + 3 bus periods
If the bit LPDTIE is set in the LPIE register, an interrupt is requested.
Figure 18-13 shows the different scenarios of TxD-dominant timeout interrupt handling.
!
"!
!
!
#
!
"!
!
!
"!
Figure 18-13. TxD-dominant timeout interrupt handling
MC9S12ZVM Family Reference Manual Rev. 1.5
690
Freescale Semiconductor
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
18.5
18.5.1
Application Information
Module Initialization
The following steps should be used to configure the module before starting the transmission:
• In the LIN version, set the slew rate in the LPSLRM register to the desired transmission baud rate.
• In the HV Phy version, de-activate the dominant timeout feature in the LPSLRM register if needed.
• In most cases, the internal pullup should be enabled in the LPCR register.
• Perform the correct routing settings in the PIM module:
— In the LIN version, select the SCI as source, i.e. connect the TxD pin of the SCI to LPTxD, and
the RxD pin of the SCI to LPRxD.
— In the HV Phy version, connect LPRxD to the internal timer (control information) and if
required, connect the LPDR1 bit of the LPDR register to LPTxD (diagnostic feedback). If the
wake-up feature is required, the RxD pin of the SCI must also be connected to LPRxD.
• Select the transmit mode (Receive only mode or Normal mode) in the LPCR register.
• If the RxD pin of the SCI is connected to LPRxD, activate the wake-up feature in the LPCR register
if needed for the application (SCI active edge interrupt must also be enabled).
• Enable the LIN/HV Physical Layer in the LPCR register.
• Wait for a minimum of a transmit bit.
• Begin transmission if needed.
NOTE
It is not allowed to try to clear LPOCIF or LPDTIF if they are already
cleared. Before trying to clear an error flag, always make sure that it is
already set.
18.5.2
Interrupt handling in Interrupt Service Routine (ISR)
Both interrupts (TxD-dominant timeout and overcurrent) represent a failure in transmission. To avoid
more disturbances on the transmission line, the transmitter is de-activated in both cases. The interrupt
subroutine must take care of clearing the error condition and starting the routine that re-enables the
transmission. For that purpose, the following steps are recommended:
1. First, the cause of the interrupt must be cleared:
— The overcurrent will be gone after the transmitter has been disabled.
— The TxD-dominant timeout condition will be gone once the selected source for LPTxD has
turned recessive.
2. Clear the corresponding enable bit (LPDTIE or LPOCIE) to avoid entering the ISR again until the
flags are cleared.
3. Notify the application of the error condition (LIN Error handler) and leave the ISR.
In the LIN Error handler, the following sequence is recommended:
1. Disable the LIN/HV Physical Layer (LPCR) while re-configuring the transmission.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
691
Chapter 18 LIN/HV Physical Layer (S12LINPHYV3)
2.
3.
4.
5.
6.
7.
— If the receiver must remain enabled, set the LIN/HV Physical Layer into receive only mode
instead.
Do all required configurations (SCI, etc.) to re-enable the transmission.
Wait for a transmit bit (this is needed to successfully re-enable the transmitter).
Clear the error flag.
Enable the interrupts again (LPDTIE and LPOCIE).
Enable the LIN/HV Physical Layer or leave the receive only mode (LPCR register).
Wait for a minimum of a transmit bit before beginning transmission again.
If there is a problem re-enabling the transmitter, then the error flag will be set again during step 3 and the
ISR will be called again.
MC9S12ZVM Family Reference Manual Rev. 1.5
692
Freescale Semiconductor
Chapter 19
Flash Module (S12ZFTMRZ)
Table 19-1. Revision History
Revision
Number
Revision
Date
Sections
Affected
V02.03
12 Apr 2012
19.3
Corrected many typo.
Changed caution note
V02.04
17 May 2012
19.3.2.6
- Removed flag DFDIE
V02.05
11 Jul 2012
- Added explanation about when MGSTAT[1:0] bits are cleared,
Section 19.3.2.7
- Added note about possibility of reading P-Flash and EEPROM
simultaneously, Section 19.4.6
V02.06
18 Mar 2013
- Standardized nomenclature in references to memory sizes
V02.07
24 May 2013
- Revised references to NVM Resource Area to improve readability
V02.8
12 Jun 2013
- Changed MLOADU Section 19.4.7.12 and MLOADF Section 19.4.7.13
FCCOB1 to FCCOB2
19.1
Description of Changes
Introduction
The FTMRZ128K512 module implements the following:
• 128 KB of P-Flash (Program Flash) memory
• 512 bytes of EEPROM memory
The FTMRZ64K512 module implements the following:
• 64 KB of P-Flash (Program Flash) memory
• 512 bytes of EEPROM memory
The FTMRZ32K128 module implements the following:
• 32 KB of P-Flash (Program Flash) memory
• 128 bytes of EEPROM memory
The FTMRZ16K128 module implements the following:
• 16 KB of P-Flash (Program Flash) memory
• 128 bytes of EEPROM memory
The Flash memory is ideal for single-supply applications allowing for field reprogramming without
requiring external high voltage sources for program or erase operations. The Flash module includes a
memory controller that executes commands to modify Flash memory contents. The user interface to the
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
693
memory controller consists of the indexed Flash Common Command Object (FCCOB) register which is
written to with the command, global address, data, and any required command parameters. The memory
controller must complete the execution of a command before the FCCOB register can be written to with a
new command.
CAUTION
A Flash word or phrase must be in the erased state before being
programmed. Cumulative programming of bits within a Flash word or
phrase is not allowed.
The Flash memory may be read as bytes and aligned words. Read access time is one bus cycle for bytes
and aligned words. For misaligned words access, the CPU has to perform twice the byte read access
command. For Flash memory, an erased bit reads 1 and a programmed bit reads 0.
It is possible to read from P-Flash memory while some commands are executing on EEPROM memory. It
is not possible to read from EEPROM memory while a command is executing on P-Flash memory.
Simultaneous P-Flash and EEPROM operations are discussed in Section 19.4.6.
Both P-Flash and EEPROM memories are implemented with Error Correction Codes (ECC) that can
resolve single bit faults and detect double bit faults. For P-Flash memory, the ECC implementation
requires that programming be done on an aligned 8 byte basis (a Flash phrase). Since P-Flash memory is
always read by half-phrase, only one single bit fault in an aligned 4 byte half-phrase containing the byte
or word accessed will be corrected.
19.1.1
Glossary
Command Write Sequence — An MCU instruction sequence to execute built-in algorithms (including
program and erase) on the Flash memory.
EEPROM Memory — The EEPROM memory constitutes the nonvolatile memory store for data.
EEPROM Sector — The EEPROM sector is the smallest portion of the EEPROM memory that can be
erased. The EEPROM sector consists of 4 bytes.
NVM Command Mode — An NVM mode using the CPU to setup the FCCOB register to pass parameters
required for Flash command execution.
Phrase — An aligned group of four 16-bit words within the P-Flash memory. Each phrase includes two
sets of aligned double words with each set including 7 ECC bits for single bit fault correction and double
bit fault detection within each double word.
P-Flash Memory — The P-Flash memory constitutes the main nonvolatile memory store for applications.
P-Flash Sector — The P-Flash sector is the smallest portion of the P-Flash memory that can be erased.
Each P-Flash sector contains 512 bytes.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
694
Chapter 19 Flash Module (S12ZFTMRZ)
Program IFR — Nonvolatile information register located in the P-Flash block that contains the Version
ID, and the Program Once field.
19.1.2
19.1.2.1
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
EEPROM Features
The 128KB and 64KB derivatives include 512 bytes of EEPROM memory composed of one 512
bytes Flash block divided into 128 sectors of 4 bytes
The 32KB and 16KB derivatives includes 128 bytes of EEPROM memory composed of one 128
byte Flash block divided into 32 sectors of 4 bytes
Single bit fault correction and double bit fault detection within a word during read operations
Automated program and erase algorithm with verify and generation of ECC parity bits
Fast sector erase and word program operation
Protection scheme to prevent accidental program or erase of EEPROM memory
Ability to program up to four words in a burst sequence
19.1.2.3
•
•
•
P-Flash Features
The 128KB derivatives include one 128 KB Flash block divided into 256 sectors of 512 bytes
The 64K derivatives include one 64 KB Flash block divided into 128 sectors of 512 bytes
The 32K derivatives include one 32 KB Flash block divided into 64 sectors of 512 bytes
The 16K derivatives include one 16 KB Flash block divided into 32 sectors of 512 bytes
Single bit fault correction and double bit fault detection within a 32-bit double word during read
operations
Automated program and erase algorithm with verify and generation of ECC parity bits
Fast sector erase and phrase program operation
Ability to read the P-Flash memory while programming a word in the EEPROM memory
Flexible protection scheme to prevent accidental program or erase of P-Flash memory
19.1.2.2
•
Features
Other Flash Module Features
No external high-voltage power supply required for Flash memory program and erase operations
Interrupt generation on Flash command completion and Flash error detection
Security mechanism to prevent unauthorized access to the Flash memory
19.1.3
Block Diagram
The block diagrams of the Flash modules are shown in the following figures..
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
695
Chapter 19 Flash Module (S12ZFTMRZ)
Figure 19-1. FTMRZ128K512 Block Diagram
Flash
Interface
Command
Interrupt
Request
Error
Interrupt
Request
16bit
internal
bus
Registers
P-Flash
32Kx39
sector 0
sector 1
Protection
sector 255
Security
Bus
Clock
CPU
Clock
Divider FCLK
Memory
Controller
EEPROM
256x22
sector 0
sector 1
sector 127
MC9S12ZVM Family Reference Manual Rev. 1.5
696
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Figure 19-2. FTMRZ64K512 Block Diagram
Flash
Interface
Command
Interrupt
Request
Error
Interrupt
Request
16bit
internal
bus
Registers
P-Flash
16Kx39
sector 0
sector 1
Protection
sector 127
Security
Bus
Clock
CPU
Clock
Divider FCLK
Memory
Controller
EEPROM
256x22
sector 0
sector 1
sector 127
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
697
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-2. FTMRZ32K128 Block Diagram
Flash
Interface
Command
Interrupt
Request
Error
Interrupt
Request
16bit
internal
bus
Registers
P-Flash
8Kx39
sector 0
sector 1
Protection
sector 63
Security
Bus
Clock
CPU
Clock
Divider FCLK
Memory
Controller
EEPROM
64x22
sector 0
sector 1
sector 31
MC9S12ZVM Family Reference Manual Rev. 1.5
698
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-3. FTMRZ16K128 Block Diagram
Flash
Interface
Command
Interrupt
Request
Error
Interrupt
Request
16bit
internal
bus
Registers
P-Flash
4Kx39
sector 0
sector 1
Protection
sector 31
Security
Bus
Clock
CPU
Clock
Divider FCLK
Memory
Controller
EEPROM
64x22
sector 0
sector 1
sector 31
19.2
External Signal Description
The Flash module contains no signals that connect off-chip.
19.3
Memory Map and Registers
This section describes the memory map and registers for the Flash module. Read data from unimplemented
memory space in the Flash module is undefined. Write access to unimplemented or reserved memory space
in the Flash module will be ignored by the Flash module.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
699
Chapter 19 Flash Module (S12ZFTMRZ)
CAUTION
Writing to the Flash registers while a Flash command is executing (that is
indicated when the value of flag CCIF reads as ’0’) is not allowed. If such
action is attempted, the result of the write operation will be unpredictable.
Writing to the Flash registers is allowed when the Flash is not busy
executing commands (CCIF = 1) and during initialization right after reset,
despite the value of flag CCIF in that case (refer to Section 19.6 for a
complete description of the reset sequence).
.
Table 19-4. FTMRZ Memory Map
Global Address (in Bytes)
0x0_0000 – 0x0_0FFF
Size
(Bytes)
4,096
Description
Register Space
0x10_0000 – 0x10_01FF
512
EEPROM memory
0x1F_4000 – 0x1F_FFFF
49,152
NVM Resource Area(1) (see Figure 19-4)
0xFE_0000 – 0xFF_FFFF
131,072
P-Flash Memory
1. See NVM Resource area description in Section 19.4.4
19.3.1
Module Memory Map
The S12Z architecture places the P-Flash memory between global addresses 0xFE_0000 and 0xFF_FFFF
as shown in Table 19-5
The P-Flash memory map for each derivative size is shown in Figure 19-3.
Table 19-5. P-Flash Memory Addressing
Global Address
Size
(Bytes)
0xFE_0000 – 0xFF_FFFF
128 K
P-Flash Block
Contains Flash Configuration Field
(see Table 19-6)
0xFF_0000 – 0xFF_FFFF
64 K
P-Flash Block
Contains Flash Configuration Field
(see Table 19-6)
0xFF_8000 – 0xFF_FFFF
32 K
P-Flash Block
Contains Flash Configuration Field
(see Table 19-6)
0xFF_C000 – 0xFF_FFFF
16 K
P-Flash Block
Contains Flash Configuration Field
(see Table 19-6)
Description
MC9S12ZVM Family Reference Manual Rev. 1.5
700
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
The FPROT register, described in Section 19.3.2.9, can be set to protect regions in the Flash memory from
accidental program or erase. Three separate memory regions, one growing upward from global address
0xFF_8000 in the Flash memory (called the lower region), one growing downward from global address
0xFF_FFFF in the Flash memory (called the higher region), and the remaining addresses in the Flash
memory, can be activated for protection. The Flash memory addresses covered by these protectable
regions are shown in the P-Flash memory map. The higher address region is mainly targeted to hold the
boot loader code since it covers the vector space. Default protection settings as well as security information
that allows the MCU to restrict access to the Flash module are stored in the Flash configuration field as
described in Table 19-6.
Table 19-6. Flash Configuration Field
Global Address
Size
(Bytes)
0xFF_FE00-0xFF_FE07
8
Backdoor Comparison Key
Refer to Section 19.4.7.11, “Verify Backdoor Access Key Command,” and
Section 19.5.1, “Unsecuring the MCU using Backdoor Key Access”
0xFF_FE08-0xFF_FE091
2
Protection Override Comparison Key. Refer to Section 19.4.7.17, “Protection
Override Command”
0xFF_FE0A0xFF_FE0B(1)
2
0xFF_FE0C1
1
P-Flash Protection byte.
Refer to Section 19.3.2.9, “P-Flash Protection Register (FPROT)”
0xFF_FE0D1
1
EEPROM Protection byte.
Refer to Section 19.3.2.10, “EEPROM Protection Register (DFPROT)”
0xFF_FE0E1
1
Flash Nonvolatile byte
Refer to Section 19.3.2.11, “Flash Option Register (FOPT)”
0xFF_FE0F1
1
Flash Security byte
Refer to Section 19.3.2.2, “Flash Security Register (FSEC)”
Description
Reserved
1. 0xFF_FE08-0xFF_FE0F form a Flash phrase and must be programmed in a single command write sequence. Each byte
in the 0xFF_FE0A - 0xFF_FE0B reserved field should be programmed to 0xFF.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
701
Chapter 19 Flash Module (S12ZFTMRZ)
P-Flash START = 0xFE_0000
Flash Protected/Unprotected Region
96 KB
0xFF_8000
0xFF_8400
0xFF_8800
0xFF_9000
Protection
Fixed End
Flash Protected/Unprotected Lower Region
1, 2, 4, 8 KB
0xFF_A000
Flash Protected/Unprotected Region
8 KB (up to 29 KB)
Protection
Movable End
0xFF_C000
Protection
Fixed End
0xFF_E000
Flash Protected/Unprotected Higher Region
2, 4, 8, 16 KB
0xFF_F000
0xFF_F800
P-Flash END = 0xFF_FFFF
Flash Configuration Field
16 bytes (0xFF_FE00 - 0xFF_FE0F)
Figure 19-3. P-Flash Memory Map
MC9S12ZVM Family Reference Manual Rev. 1.5
702
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-7. Program IFR Fields
Global Address
Size
(Bytes)
0x1F_C000 – 0x1F_C007
8
Reserved
0x1F_C008 – 0x1F_C0B5
174
Reserved
0x1F_C0B6 – 0x1F_C0B7
2
Version ID(1)
0x1F_C0B8 – 0x1F_C0BF
8
Reserved
0x1F_C0C0 – 0x1F_C0FF
64
Program Once Field
Refer to Section 19.4.7.6, “Program Once Command”
Field Description
1. Used to track firmware patch versions, see Section 19.4.2
Table 19-8. Memory Controller Resource Fields (NVM Resource Area(1))
Global Address
Size
(Bytes)
0x1F_4000 – 0x1F_41FF
512
Reserved
0x1F_4200 – 0x1F_7FFF
15,872
Reserved
0x1F_8000 – 0x1F_97FF
6,144
Reserved
0x1F_9800 – 0x1F_BFFF
10,240
Reserved
0x1F_C000 – 0x1F_C0FF
256
P-Flash IFR (see Table 19-7)
0x1F_C100 – 0x1F_C1FF
256
Reserved.
0x1F_C200 – 0x1F_FFFF
15,872
Reserved.
Description
1. See Section 19.4.4 for NVM Resources Area description.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
703
Chapter 19 Flash Module (S12ZFTMRZ)
0x1F_4000
Reserved 512 bytes
0x1F_41FF
Reserved 15872 bytes
0x1F_8000
Reserved 6 KB
0x1F_97FF
Reserved 10 KB
0x1F_C000
P-Flash IFR 256 bytes
0x1F_C100
Reserved 16,128 bytes
Figure 19-4. Memory Controller Resource Memory Map (NVM Resources Area)
19.3.2
Register Descriptions
The Flash module contains a set of 24 control and status registers located between Flash module base +
0x0000 and 0x0017.
In the case of the writable registers, the write accesses are forbidden during Flash command execution (for
more detail, see Caution note in Section 19.3).
A summary of the Flash module registers is given in Figure 19-5 with detailed descriptions in the
following subsections.
Address
& Name
0x0000
FCLKDIV
0x0001
FSEC
0x0002
FCCOBIX
7
R
6
5
4
3
2
1
0
FDIVLCK
FDIV5
FDIV4
FDIV3
FDIV2
FDIV1
FDIV0
KEYEN1
KEYEN0
RNV5
RNV4
RNV3
RNV2
SEC1
SEC0
0
0
0
0
0
CCOBIX2
CCOBIX1
CCOBIX0
FDIVLD
W
R
W
R
W
Figure 19-5. FTMRZ128K512 Register Summary
MC9S12ZVM Family Reference Manual Rev. 1.5
704
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Address
& Name
0x0003
FPSTAT
0x0004
FCNFG
0x0005
FERCNFG
0x0006
FSTAT
0x0007
FERSTAT
0x0008
FPROT
0x0009
DFPROT
0x000A
FOPT
0x000B
FRSV1
0x000C
FCCOB0HI
0x000D
FCCOB0LO
0x000E
FCCOB1HI
0x000F
FCCOB1LO
0x0010
FCCOB2HI
R
7
6
5
4
3
2
1
0
FPOVRD
0
0
0
0
0
0
WSTATACK
0
ERSAREQ
FDFD
FSFD
W
R
CCIE
IGNSF
WSTAT[1:0]
W
R
0
0
0
0
0
0
0
SFDIE
W
R
0
CCIF
ACCERR
FPVIOL
0
0
MGBUSY
RSVD
0
0
MGSTAT1
MGSTAT0
DFDF
SFDIF
W
R
0
0
W
R
RNV6
FPOPEN
FPHDIS
FPHS1
0
0
FPHS0
FPLDIS
FPLS1
FPLS0
DPS3
DPS2
DPS1
DPS0
W
R
0
DPOPEN
W
R
NV7
NV6
NV5
NV4
NV3
NV2
NV1
NV0
0
0
0
0
0
0
0
0
CCOB15
CCOB14
CCOB13
CCOB12
CCOB11
CCOB10
CCOB9
CCOB8
CCOB7
CCOB6
CCOB5
CCOB4
CCOB3
CCOB2
CCOB1
CCOB0
CCOB15
CCOB14
CCOB13
CCOB12
CCOB11
CCOB10
CCOB9
CCOB8
CCOB7
CCOB6
CCOB5
CCOB4
CCOB3
CCOB2
CCOB1
CCOB0
CCOB15
CCOB14
CCOB13
CCOB12
CCOB11
CCOB10
CCOB9
CCOB8
W
R
W
R
W
R
W
R
W
R
W
R
W
Figure 19-5. FTMRZ128K512 Register Summary (continued)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
705
Chapter 19 Flash Module (S12ZFTMRZ)
Address
& Name
0x0011
FCCOB2LO
0x0012
FCCOB3HI
0x0013
FCCOB3LO
0x0014
FCCOB4HI
0x0015
FCCOB4LO
0x0016
FCCOB5HI
0x0017
FCCOB5LO
7
6
5
4
3
2
1
0
CCOB7
CCOB6
CCOB5
CCOB4
CCOB3
CCOB2
CCOB1
CCOB0
CCOB15
CCOB14
CCOB13
CCOB12
CCOB11
CCOB10
CCOB9
CCOB8
CCOB7
CCOB6
CCOB5
CCOB4
CCOB3
CCOB2
CCOB1
CCOB0
CCOB15
CCOB14
CCOB13
CCOB12
CCOB11
CCOB10
CCOB9
CCOB8
CCOB7
CCOB6
CCOB5
CCOB4
CCOB3
CCOB2
CCOB1
CCOB0
CCOB15
CCOB14
CCOB13
CCOB12
CCOB11
CCOB10
CCOB9
CCOB8
CCOB7
CCOB6
CCOB5
CCOB4
CCOB3
CCOB2
CCOB1
CCOB0
R
W
R
W
R
W
R
W
R
W
R
W
R
W
= Unimplemented or Reserved
Figure 19-5. FTMRZ128K512 Register Summary (continued)
19.3.2.1
Flash Clock Divider Register (FCLKDIV)
The FCLKDIV register is used to control timed events in program and erase algorithms.
Offset Module Base + 0x0000
7
R
6
5
4
3
2
1
0
0
0
0
FDIVLD
FDIVLCK
FDIV[5:0]
W
Reset
0
0
0
0
0
= Unimplemented or Reserved
Figure 19-6. Flash Clock Divider Register (FCLKDIV)
All bits in the FCLKDIV register are readable, bit 7 is not writable, bit 6 is write-once-hi and controls the
writability of the FDIV field in normal mode. In special mode, bits 6-0 are writable any number of times
but bit 7 remains unwritable.
MC9S12ZVM Family Reference Manual Rev. 1.5
706
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
CAUTION
The FCLKDIV register should never be written while a Flash command is
executing (CCIF=0).
Table 19-9. FCLKDIV Field Descriptions
Field
7
FDIVLD
Description
Clock Divider Loaded
0 FCLKDIV register has not been written since the last reset
1 FCLKDIV register has been written since the last reset
6
FDIVLCK
Clock Divider Locked
0 FDIV field is open for writing
1 FDIV value is locked and cannot be changed. Once the lock bit is set high, only reset can clear this bit and
restore writability to the FDIV field in normal mode.
5–0
FDIV[5:0]
Clock Divider Bits — FDIV[5:0] must be set to effectively divide BUSCLK down to 1 MHz to control timed events
during Flash program and erase algorithms. Table 19-10 shows recommended values for FDIV[5:0] based on
the BUSCLK frequency. Please refer to Section 19.4.5, “Flash Command Operations,” for more information.
Table 19-10. FDIV values for various BUSCLK Frequencies
BUSCLK Frequency
(MHz)
(1)
MIN
FDIV[5:0]
MAX(2)
BUSCLK Frequency
(MHz)
MIN1
MAX2
FDIV[5:0]
1.0
1.6
0x00
26.6
27.6
0x1A
1.6
2.6
0x01
27.6
28.6
0x1B
2.6
3.6
0x02
28.6
29.6
0x1C
3.6
4.6
0x03
29.6
30.6
0x1D
4.6
5.6
0x04
30.6
31.6
0x1E
5.6
6.6
0x05
31.6
32.6
0x1F
6.6
7.6
0x06
32.6
33.6
0x20
7.6
8.6
0x07
33.6
34.6
0x21
8.6
9.6
0x08
34.6
35.6
0x22
9.6
10.6
0x09
35.6
36.6
0x23
10.6
11.6
0x0A
36.6
37.6
0x24
11.6
12.6
0x0B
37.6
38.6
0x25
12.6
13.6
0x0C
38.6
39.6
0x26
13.6
14.6
0x0D
39.6
40.6
0x27
14.6
15.6
0x0E
40.6
41.6
0x28
15.6
16.6
0x0F
41.6
42.6
0x29
16.6
17.6
0x10
42.6
43.6
0x2A
17.6
18.6
0x11
43.6
44.6
0x2B
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
707
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-10. FDIV values for various BUSCLK Frequencies
BUSCLK Frequency
(MHz)
(1)
MAX
MIN
BUSCLK Frequency
(MHz)
FDIV[5:0]
(2)
1
MIN
MAX
FDIV[5:0]
2
18.6
19.6
0x12
44.6
45.6
0x2C
19.6
20.6
0x13
45.6
46.6
0x2D
20.6
21.6
0x14
46.6
47.6
0x2E
21.6
22.6
0x15
47.6
48.6
0x2F
22.6
23.6
0x16
48.6
49.6
0x30
23.6
24.6
0x17
49.6
50.6
0x31
24.6
25.6
0x18
25.6
26.6
0x19
1. BUSCLK is Greater Than this value.
2. BUSCLK is Less Than or Equal to this value.
19.3.2.2
Flash Security Register (FSEC)
The FSEC register holds all bits associated with the security of the MCU and Flash module.
Offset Module Base + 0x0001
7
R
6
5
4
KEYEN[1:0]
3
2
1
RNV[5:2]
0
SEC[1:0]
W
Reset
F(1)
F1
F1
F1
F1
F1
F1
F1
= Unimplemented or Reserved
Figure 19-7. Flash Security Register (FSEC)
1. Loaded from Flash configuration field, during reset sequence.
All bits in the FSEC register are readable but not writable.
During the reset sequence, the FSEC register is loaded with the contents of the Flash security byte in the
Flash configuration field at global address 0xFF_FE0F located in P-Flash memory (see Table 19-6) as
indicated by reset condition F in Figure 19-7. If a double bit fault is detected while reading the P-Flash
phrase containing the Flash security byte during the reset sequence, all bits in the FSEC register will be set
to leave the Flash module in a secured state with backdoor key access disabled.
MC9S12ZVM Family Reference Manual Rev. 1.5
708
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-11. FSEC Field Descriptions
Field
Description
7–6
Backdoor Key Security Enable Bits — The KEYEN[1:0] bits define the enabling of backdoor key access to the
KEYEN[1:0] Flash module as shown in Table 19-12.
5–2
RNV[5:2]
Reserved Nonvolatile Bits — The RNV bits should remain in the erased state for future enhancements.
1–0
SEC[1:0]
Flash Security Bits — The SEC[1:0] bits define the security state of the MCU as shown in Table 19-13. If the
Flash module is unsecured using backdoor key access, the SEC bits are forced to 10.
Table 19-12. Flash KEYEN States
KEYEN[1:0]
Status of Backdoor Key Access
00
DISABLED
01
DISABLED(1)
10
ENABLED
11
DISABLED
1. Preferred KEYEN state to disable backdoor key access.
Table 19-13. Flash Security States
SEC[1:0]
Status of Security
00
SECURED
01
SECURED(1)
10
UNSECURED
11
SECURED
1. Preferred SEC state to set MCU to secured state.
The security function in the Flash module is described in Section 19.5.
19.3.2.3
Flash CCOB Index Register (FCCOBIX)
The FCCOBIX register is used to indicate the amount of parameters loaded into the FCCOB registers for
Flash memory operations.
Offset Module Base + 0x0002
R
7
6
5
4
3
0
0
0
0
0
2
1
0
CCOBIX[2:0]
W
Reset
0
0
0
0
0
0
0
0
= Unimplemented or Reserved
Figure 19-8. FCCOB Index Register (FCCOBIX)
CCOBIX bits are readable and writable while remaining bits read 0 and are not writable.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
709
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-14. FCCOBIX Field Descriptions
Field
Description
2–0
CCOBIX[1:0]
Common Command Register Index— The CCOBIX bits are used to indicate how many words of the FCCOB
register array are being read or written to. See Section 19.3.2.13, “Flash Common Command Object Registers
(FCCOB)“,” for more details.
19.3.2.4
Flash Protection Status Register (FPSTAT)
This Flash register holds the status of the Protection Override feature.
Offset Module Base + 0x0003
R
7
6
5
4
3
2
1
0
FPOVRD
0
0
0
0
0
0
WSTATACK
0
0
0
0
0
0
0
1
W
Reset
= Unimplemented or Reserved
Figure 19-9. Flash Protection Status Register (FPSTAT)
All bits in the FPSTAT register are readable but are not writable.
Table 19-15. FPSTAT Field Descriptions
Field
Description
7
FPOVRD
Flash Protection Override Status — The FPOVRD bit indicates if the Protection Override feature is currently
enabled. See Section 19.4.7.17, “Protection Override Command” for more details.
0 Protection is not overridden
1 Protection is overridden, contents of registers FPROT and/or DFPROT (and effective protection limits
determined by their current contents) were determined during execution of command Protection Override
0
WSTATACK
Wait-State Switch Acknowledge — The WSTATACK bit indicates that the wait-state configuration is
effectively set according to the value configured on bits FCNFG[WSTAT] (see Section 19.3.2.5, “Flash
Configuration Register (FCNFG)”). WSTATACK bit is cleared when a change in FCNFG[WSTAT] is requested
by writing to those bits, and is set when the Flash has effectively switched to the new wait-state configuration.
The application must check the status of WSTATACK bit to make sure it reads as 1 before changing the
frequency setup (see Section 19.4.3, “Flash Block Read Access”).
0 Wait-State switch is pending, Flash reads are still happening according to the previous value of
FCNFG[WSTAT]
1 Wait-State switch is complete, Flash reads are already working according to the value set on
FCNFG[WSTAT]
19.3.2.5
Flash Configuration Register (FCNFG)
The FCNFG register enables the Flash command complete interrupt, control generation of wait-states and
forces ECC faults on Flash array read access from the CPU.
MC9S12ZVM Family Reference Manual Rev. 1.5
710
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Offset Module Base + 0x0004
7
R
6
5
0
ERSAREQ
CCIE
4
3
IGNSF
2
WSTAT[1:0]
1
0
FDFD
FSFD
0
0
W
Reset
0
0
0
0
0
0
= Unimplemented or Reserved
Figure 19-10. Flash Configuration Register (FCNFG)
CCIE, IGNSF, WSTAT, FDFD, and FSFD bits are readable and writable, ERSAREQ bit is read only, and
remaining bits read 0 and are not writable.
Table 19-16. FCNFG Field Descriptions
Field
Description
7
CCIE
Command Complete Interrupt Enable — The CCIE bit controls interrupt generation when a Flash command
has completed.
0 Command complete interrupt disabled
1 An interrupt will be requested whenever the CCIF flag in the FSTAT register is set (see Section 19.3.2.7)
5
ERSAREQ
Erase All Request — Requests the Memory Controller to execute the Erase All Blocks command and release
security. ERSAREQ is not directly writable but is under indirect user control. Refer to the Reference Manual for
assertion of the soc_erase_all_req input to the FTMRZ module.
0 No request or request complete
1 Request to:
a) run the Erase All Blocks command
b) verify the erased state
c) program the security byte in the Flash Configuration Field to the unsecure state
d) release MCU security by setting the SEC field of the FSEC register to the unsecure state as defined in
Table 19-11 of Section 19.3.2.2.
The ERSAREQ bit sets to 1 when soc_erase_all_req is asserted, CCIF=1 and the Memory Controller starts
executing the sequence. ERSAREQ will be reset to 0 by the Memory Controller when the operation is completed
(see Section 19.4.7.7.1).
4
IGNSF
Ignore Single Bit Fault — The IGNSF controls single bit fault reporting in the FERSTAT register (see
Section 19.3.2.8).
0 All single bit faults detected during array reads are reported
1 Single bit faults detected during array reads are not reported and the single bit fault interrupt will not be
generated
3–2
Wait State control bits — The WSTAT[1:0] bits define how many wait-states are inserted on each read access
WSTAT[1:0] to the Flash as shown on Table 19-17.Right after reset the maximum amount of wait-states is set, to be later reconfigured by the application if needed. Depending on the system operating frequency being used the number
of wait-states can be reduced or disabled, please refer to the Data Sheet for details. For additional information
regarding the procedure to change this configuration please see Section 19.4.3. The WSTAT[1:0] bits should not
be updated while the Flash is executing a command (CCIF=0); if that happens the value of this field will not
change and no action will take place.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
711
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-16. FCNFG Field Descriptions (continued)
Field
Description
1
FDFD
Force Double Bit Fault Detect — The FDFD bit allows the user to simulate a double bit fault during Flash array
read operations. The FDFD bit is cleared by writing a 0 to FDFD.
0 Flash array read operations will set the DFDF flag in the FERSTAT register only if a double bit fault is detected
1 Any Flash array read operation will force the DFDF flag in the FERSTAT register to be set (see
Section 19.3.2.7)
0
FSFD
Force Single Bit Fault Detect — The FSFD bit allows the user to simulate a single bit fault during Flash array
read operations and check the associated interrupt routine. The FSFD bit is cleared by writing a 0 to FSFD.
0 Flash array read operations will set the SFDIF flag in the FERSTAT register only if a single bit fault is detected
1 Flash array read operation will force the SFDIF flag in the FERSTAT register to be set (see Section 19.3.2.7)
and an interrupt will be generated as long as the SFDIE interrupt enable in the FERCNFG register is set (see
Section 19.3.2.6)
Table 19-17. Flash Wait-States control
WSTAT[1:0]
Wait-State configuration
00
ENABLED, maximum number of cycles(1)
01
reserved(2)
10
reserved2
11
DISABLED
1. Reset condition. For a target of 100MHz core frequency /
50MHz bus frequency the maximum number required is 1
cycle.
2. Value will read as 01 or 10, as written. In the current
implementation the Flash will behave the same as 00 (waitstates enabled, maximum number of cycles).
19.3.2.6
Flash Error Configuration Register (FERCNFG)
The FERCNFG register enables the Flash error interrupts for the FERSTAT flags.
Offset Module Base + 0x0005
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
SFDIE
W
Reset
0
0
0
0
0
0
0
0
= Unimplemented or Reserved
Figure 19-11. Flash Error Configuration Register (FERCNFG)
All assigned bits in the FERCNFG register are readable and writable.
MC9S12ZVM Family Reference Manual Rev. 1.5
712
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-18. FERCNFG Field Descriptions
Field
Description
0
SFDIE
Single Bit Fault Detect Interrupt Enable — The SFDIE bit controls interrupt generation when a single bit fault
is detected during a Flash block read operation.
0 SFDIF interrupt disabled whenever the SFDIF flag is set (see Section 19.3.2.8)
1 An interrupt will be requested whenever the SFDIF flag is set (see Section 19.3.2.8)
19.3.2.7
Flash Status Register (FSTAT)
The FSTAT register reports the operational status of the Flash module.
Offset Module Base + 0x0006
7
6
R
5
4
0
CCIF
ACCERR
FPVIOL
0
0
3
2
MGBUSY
RSVD
0
0
1
0
MGSTAT[1:0]
W
Reset
1
0
0(1)
01
= Unimplemented or Reserved
Figure 19-12. Flash Status Register (FSTAT)
1. Reset value can deviate from the value shown if a double bit fault is detected during the reset sequence (see Section 19.6).
CCIF, ACCERR, and FPVIOL bits are readable and writable, MGBUSY and MGSTAT bits are readable
but not writable, while remaining bits read 0 and are not writable.
Table 19-19. FSTAT Field Descriptions
Field
Description
7
CCIF
Command Complete Interrupt Flag — The CCIF flag indicates that a Flash command has completed. The
CCIF flag is cleared by writing a 1 to CCIF to launch a command and CCIF will stay low until command
completion or command violation.
0 Flash command in progress
1 Flash command has completed
5
ACCERR
Flash Access Error Flag — The ACCERR bit indicates an illegal access has occurred to the Flash memory
caused by either a violation of the command write sequence (see Section 19.4.5.2) or issuing an illegal Flash
command. While ACCERR is set, the CCIF flag cannot be cleared to launch a command. The ACCERR bit is
cleared by writing a 1 to ACCERR. Writing a 0 to the ACCERR bit has no effect on ACCERR.
0 No access error detected
1 Access error detected
4
FPVIOL
Flash Protection Violation Flag —The FPVIOL bit indicates an attempt was made to program or erase an
address in a protected area of P-Flash or EEPROM memory during a command write sequence. The FPVIOL
bit is cleared by writing a 1 to FPVIOL. Writing a 0 to the FPVIOL bit has no effect on FPVIOL. While FPVIOL
is set, it is not possible to launch a command or start a command write sequence.
0 No protection violation detected
1 Protection violation detected
3
MGBUSY
Memory Controller Busy Flag — The MGBUSY flag reflects the active state of the Memory Controller.
0 Memory Controller is idle
1 Memory Controller is busy executing a Flash command (CCIF = 0)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
713
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-19. FSTAT Field Descriptions (continued)
Field
2
RSVD
Description
Reserved Bit — This bit is reserved and always reads 0.
1–0
Memory Controller Command Completion Status Flag — One or more MGSTAT flag bits are set if an error
MGSTAT[1:0] is detected during execution of a Flash command or during the Flash reset sequence. The MGSTAT bits are
cleared automatically at the start of the execution of a Flash command. See Section 19.4.7, “Flash Command
Description,” and Section 19.6, “Initialization” for details.
19.3.2.8
Flash Error Status Register (FERSTAT)
The FERSTAT register reflects the error status of internal Flash operations.
Offset Module Base + 0x0007
R
7
6
5
4
3
2
0
0
0
0
0
0
1
0
DFDF
SFDIF
0
0
W
Reset
0
0
0
0
0
0
= Unimplemented or Reserved
Figure 19-13. Flash Error Status Register (FERSTAT)
All flags in the FERSTAT register are readable and only writable to clear the flag.
Table 19-20. FERSTAT Field Descriptions
Field
Description
1
DFDF
Double Bit Fault Detect Flag — The setting of the DFDF flag indicates that a double bit fault was detected in
the stored parity and data bits during a Flash array read operation or that a Flash array read operation returning
invalid data was attempted on a Flash block that was under a Flash command operation.(1) The DFDF flag is
cleared by writing a 1 to DFDF. Writing a 0 to DFDF has no effect on DFDF.(2)
0 No double bit fault detected
1 Double bit fault detected or a Flash array read operation returning invalid data was attempted while command
running. See Section 19.4.3, “Flash Block Read Access” for details
0
SFDIF
Single Bit Fault Detect Interrupt Flag — With the IGNSF bit in the FCNFG register clear, the SFDIF flag
indicates that a single bit fault was detected in the stored parity and data bits during a Flash array read operation
or that a Flash array read operation returning invalid data was attempted on a Flash block that was under a Flash
command operation. The SFDIF flag is cleared by writing a 1 to SFDIF. Writing a 0 to SFDIF has no effect on
SFDIF.
0 No single bit fault detected
1 Single bit fault detected and corrected or a Flash array read operation returning invalid data was attempted
while command running
1. In case of ECC errors the corresponding flag must be cleared for the proper setting of any further error, i.e. any new error will
only be indicated properly when DFDF and/or SFDIF are clear at the time the error condition is detected.
2. There is a one cycle delay in storing the ECC DFDF and SFDIF fault flags in this register. At least one NOP is required after
a flash memory read before checking FERSTAT for the occurrence of ECC errors.
MC9S12ZVM Family Reference Manual Rev. 1.5
714
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
19.3.2.9
P-Flash Protection Register (FPROT)
The FPROT register defines which P-Flash sectors are protected against program and erase operations.
Offset Module Base + 0x0008
7
6
R
5
4
3
2
1
0
RNV6
FPOPEN
FPHDIS
FPHS[1:0]
FPLDIS
FPLS[1:0]
W
Reset
F(1)
F1
F1
F1
F1
F1
F1
F1
= Unimplemented or Reserved
Figure 19-14. Flash Protection Register (FPROT)
1. Loaded from Flash configuration field, during reset sequence.
The (unreserved) bits of the FPROT register are writable Normal Single Chip Modewith the restriction
that the size of the protected region can only be increased(see Section 19.3.2.9.1, “P-Flash Protection
Restrictions,” and Table 19-25). All (unreserved) bits of the FPROT register are writable without
restriction in Special Single Chip Mode.
During the reset sequence, the FPROT register is loaded with the contents of the P-Flash protection byte
in the Flash configuration field at global address 0xFF_FE0C located in P-Flash memory (see Table 19-6)
as indicated by reset condition ‘F’ in Figure 19-14. To change the P-Flash protection that will be loaded
during the reset sequence, the upper sector of the P-Flash memory must be unprotected, then the P-Flash
protection byte must be reprogrammed. If a double bit fault is detected while reading the P-Flash phrase
containing the P-Flash protection byte during the reset sequence, the FPOPEN bit will be cleared and
remaining bits in the FPROT register will be set to leave the P-Flash memory fully protected.
Trying to alter data in any protected area in the P-Flash memory will result in a protection violation error
and the FPVIOL bit will be set in the FSTAT register. The block erase of a P-Flash block is not possible
if any of the P-Flash sectors contained in the same P-Flash block are protected.
Table 19-21. FPROT Field Descriptions
Field
Description
7
FPOPEN
Flash Protection Operation Enable — The FPOPEN bit determines the protection function for program or
erase operations as shown in Table 19-22 for the P-Flash block.
0 When FPOPEN is clear, the FPHDIS and FPLDIS bits define unprotected address ranges as specified by the
corresponding FPHS and FPLS bits
1 When FPOPEN is set, the FPHDIS and FPLDIS bits enable protection for the address range specified by the
corresponding FPHS and FPLS bits
6
RNV[6]
Reserved Nonvolatile Bit — The RNV bit should remain in the erased state for future enhancements.
5
FPHDIS
Flash Protection Higher Address Range Disable — The FPHDIS bit determines whether there is a
protected/unprotected area in a specific region of the P-Flash memory ending with global address 0xFF_FFFF.
0 Protection/Unprotection enabled
1 Protection/Unprotection disabled
4–3
FPHS[1:0]
Flash Protection Higher Address Size — The FPHS bits determine the size of the protected/unprotected area
in P-Flash memory as shown inTable 19-23. The FPHS bits can only be written to while the FPHDIS bit is set.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
715
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-21. FPROT Field Descriptions (continued)
Field
2
FPLDIS
1–0
FPLS[1:0]
Description
Flash Protection Lower Address Range Disable — The FPLDIS bit determines whether there is a
protected/unprotected area in a specific region of the P-Flash memory beginning with global address
0xFF_8000.
0 Protection/Unprotection enabled
1 Protection/Unprotection disabled
Flash Protection Lower Address Size — The FPLS bits determine the size of the protected/unprotected area
in P-Flash memory as shown in Table 19-24. The FPLS bits can only be written to while the FPLDIS bit is set.
Table 19-22. P-Flash Protection Function
Function(1)
FPOPEN
FPHDIS
FPLDIS
1
1
1
No P-Flash Protection
1
1
0
Protected Low Range
1
0
1
Protected High Range
1
0
0
Protected High and Low Ranges
0
1
1
Full P-Flash Memory Protected
0
1
0
Unprotected Low Range
0
0
1
Unprotected High Range
0
0
0
Unprotected High and Low Ranges
1. For range sizes, refer to Table 19-23 and Table 19-24.
Table 19-23. P-Flash Protection Higher Address Range
FPHS[1:0]
Global Address Range
Protected Size
00
0xFF_F800–0xFF_FFFF
2 KB
01
0xFF_F000–0xFF_FFFF
4 KB
10
0xFF_E000–0xFF_FFFF
8 KB
11
0xFF_C000–0xFF_FFFF
16 KB
Table 19-24. P-Flash Protection Lower Address Range
FPLS[1:0]
Global Address Range
Protected Size
00
0xFF_8000–0xFF_83FF
1 KB
01
0xFF_8000–0xFF_87FF
2 KB
10
0xFF_8000–0xFF_8FFF
4 KB
11
0xFF_8000–0xFF_9FFF
8 KB
All possible P-Flash protection scenarios are shown in Figure 19-15 . Although the protection scheme is
loaded from the Flash memory at global address 0xFF_FE0C during the reset sequence, it can be changed
by the user. The P-Flash protection scheme can be used by applications requiring reprogramming in
normal single chip mode while providing as much protection as possible if reprogramming is not required.
MC9S12ZVM Family Reference Manual Rev. 1.5
716
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
FPHDIS = 1
FPLDIS = 1
FPHDIS = 1
FPLDIS = 0
FPHDIS = 0
FPLDIS = 1
FPHDIS = 0
FPLDIS = 0
7
6
5
4
3
2
1
0
Scenario
0xFF_FFFF
Scenario
FPOPEN = 1
0xFF_8000
FPHS[1:0]
FPLS[1:0]
FLASH START
FPHS[1:0]
0xFF_8000
FPOPEN = 0
FPLS[1:0]
FLASH START
0xFF_FFFF
Unprotected region
Protected region with size
defined by FPLS
Protected region
not defined by FPLS, FPHS
Protected region with size
defined by FPHS
Figure 19-15. P-Flash Protection Scenarios
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
717
Chapter 19 Flash Module (S12ZFTMRZ)
19.3.2.9.1
P-Flash Protection Restrictions
In Normal Single Chip mode the general guideline is that P-Flash protection can only be added and not
removed. Table 19-25 specifies all valid transitions between P-Flash protection scenarios. Any attempt to
write an invalid scenario to the FPROT register will be ignored. The contents of the FPROT register reflect
the active protection scenario. See the FPHS and FPLS bit descriptions for additional restrictions.
Table 19-25. P-Flash Protection Scenario Transitions
To Protection Scenario(1)
From
Protection
Scenario
0
1
2
3
0
X
X
X
X
X
1
X
4
X
X
X
X
X
X
X
X
X
X
6
X
7
X
6
7
X
3
5
5
X
X
2
4
X
X
X
X
X
X
1. Allowed transitions marked with X, see Figure 19-15 for a definition of the scenarios.
19.3.2.10 EEPROM Protection Register (DFPROT)
The DFPROT register defines which EEPROM sectors are protected against program and erase
operations.
Offset Module Base + 0x0009
7
R
6
5
4
0
0
0
3
2
DPOPEN
1
0
F1
F1
DPS[3:0]
W
Reset
F(1)
0
0
0
F1
F1
= Unimplemented or Reserved
Figure 19-16. EEPROM Protection Register (DFPROT)
1. Loaded from IFR Flash configuration field, during reset sequence.
The (unreserved) bits of the DFPROT register are writable in Normal Single Chip mode with the
restriction that protection can be added but not removed. Writes in Normal Single Chip mode must
increase the DPS value and the DPOPEN bit can only be written from 1 (protection disabled) to 0
(protection enabled). If the DPOPEN bit is set, the state of the DPS bits is irrelevant. All DPOPEN/DPS
bit registers are writable without restriction in Special Single Chip Mode.
MC9S12ZVM Family Reference Manual Rev. 1.5
718
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
During the reset sequence, fields DPOPEN and DPS of the DFPROT register are loaded with the contents
of the EEPROM protection byte in the Flash configuration field at global address 0xFF_FE0D located in
P-Flash memory (see Table 19-6) as indicated by reset condition F in Table 19-27. To change the
EEPROM protection that will be loaded during the reset sequence, the P-Flash sector containing the
EEPROM protection byte must be unprotected, then the EEPROM protection byte must be programmed.
If a double bit fault is detected while reading the P-Flash phrase containing the EEPROM protection byte
during the reset sequence, the DPOPEN bit will be cleared and DPS bits will be set to leave the EEPROM
memory fully protected.
Trying to alter data in any protected area in the EEPROM memory will result in a protection violation error
and the FPVIOL bit will be set in the FSTAT register. Block erase of the EEPROM memory is not possible
if any of the EEPROM sectors are protected.
Table 19-26. DFPROT Field Descriptions
Field
Description
7
DPOPEN
EEPROM Protection Control
0 Enables EEPROM memory protection from program and erase with protected address range defined by DPS
bits
1 Disables EEPROM memory protection from program and erase
3–0
DPS[3:0]
EEPROM Protection Size — The DPS[3:0] bits determine the size of the protected area in the EEPROM
memory as shown inTable 19-27 .
Table 19-27. EEPROM Protection Address Range
DPS[3:0]
Global Address Range
Protected Size
0000
0x10_0000 – 0x10_001F
32 bytes
0001
0x10_0000 – 0x10_003F
64 bytes
0010
0x10_0000 – 0x10_005F
96 bytes
0011
0x10_0000 – 0x10_007F
128 bytes
0100
0x10_0000 – 0x10_009F
160 bytes
0101
0x10_0000 – 0x10_00BF
192 bytes
The Protection Size goes on enlarging in step of 32 bytes, for each DPS
value increasing of one.
.
.
.
1111
0x10_0000 – 0x10_01FF
512 bytes
19.3.2.11 Flash Option Register (FOPT)
The FOPT register is the Flash option register.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
719
Chapter 19 Flash Module (S12ZFTMRZ)
Offset Module Base + 0x000A
7
6
5
4
R
3
2
1
0
F1
F1
F1
F1
NV[7:0]
W
Reset
F(1)
F1
F1
F1
= Unimplemented or Reserved
Figure 19-17. Flash Option Register (FOPT)
1. Loaded from Flash configuration field, during reset sequence.
All bits in the FOPT register are readable but are not writable.
During the reset sequence, the FOPT register is loaded from the Flash nonvolatile byte in the Flash
configuration field at global address 0xFF_FE0E located in P-Flash memory (see Table 19-6) as indicated
by reset condition F in Figure 19-17. If a double bit fault is detected while reading the P-Flash phrase
containing the Flash nonvolatile byte during the reset sequence, all bits in the FOPT register will be set.
Table 19-28. FOPT Field Descriptions
Field
7–0
NV[7:0]
Description
Nonvolatile Bits — The NV[7:0] bits are available as nonvolatile bits. Refer to the device overview for proper
use of the NV bits.
19.3.2.12 Flash Reserved1 Register (FRSV1)
This Flash register is reserved for factory testing.
Offset Module Base + 0x000B
R
7
6
5
4
3
2
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
W
Reset
= Unimplemented or Reserved
Figure 19-18. Flash Reserved1 Register (FRSV1)
All bits in the FRSV1 register read 0 and are not writable.
19.3.2.13 Flash Common Command Object Registers (FCCOB)
The FCCOB is an array of six words. Byte wide reads and writes are allowed to the FCCOB registers.
MC9S12ZVM Family Reference Manual Rev. 1.5
720
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Offset Module Base + 0x000C
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[15:8]
W
Reset
0
0
0
0
Figure 19-19. Flash Common Command Object 0 High Register (FCCOB0HI)
Offset Module Base + 0x000D
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[7:0]
W
Reset
0
0
0
0
Figure 19-20. Flash Common Command Object 0 Low Register (FCCOB0LO)
Offset Module Base + 0x000E
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[15:8]
W
Reset
0
0
0
0
Figure 19-21. Flash Common Command Object 1 High Register (FCCOB1HI)
Offset Module Base + 0x000F
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[7:0]
W
Reset
0
0
0
0
Figure 19-22. Flash Common Command Object 1 Low Register (FCCOB1LO)
Offset Module Base + 0x0010
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[15:8]
W
Reset
0
0
0
0
Figure 19-23. Flash Common Command Object 2 High Register (FCCOB2HI)
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
721
Chapter 19 Flash Module (S12ZFTMRZ)
Offset Module Base + 0x0011
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[7:0]
W
Reset
0
0
0
0
Figure 19-24. Flash Common Command Object 2 Low Register (FCCOB2LO)
Offset Module Base + 0x0012
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[15:8]
W
Reset
0
0
0
0
Figure 19-25. Flash Common Command Object 3 High Register (FCCOB3HI)
Offset Module Base + 0x0013
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[7:0]
W
Reset
0
0
0
0
Figure 19-26. Flash Common Command Object 3 Low Register (FCCOB3LO)
Offset Module Base + 0x0014
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[15:8]
W
Reset
0
0
0
0
Figure 19-27. Flash Common Command Object 4 High Register (FCCOB4HI)
Offset Module Base + 0x0015
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[7:0]
W
Reset
0
0
0
0
Figure 19-28. Flash Common Command Object 4 Low Register (FCCOB4LO)
MC9S12ZVM Family Reference Manual Rev. 1.5
722
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Offset Module Base + 0x0016
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[15:8]
W
Reset
0
0
0
0
Figure 19-29. Flash Common Command Object 5 High Register (FCCOB5HI)
Offset Module Base + 0x0017
7
6
5
4
3
2
1
0
0
0
0
0
R
CCOB[7:0]
W
Reset
0
0
0
0
Figure 19-30. Flash Common Command Object 5 Low Register (FCCOB5LO)
19.3.2.13.1
FCCOB - NVM Command Mode
NVM command mode uses the FCCOB registers to provide a command code and its relevant parameters
to the Memory Controller. The user first sets up all required FCCOB fields and then initiates the
command’s execution by writing a 1 to the CCIF bit in the FSTAT register (a 1 written by the user clears
the CCIF command completion flag to 0). When the user clears the CCIF bit in the FSTAT register all
FCCOB parameter fields are locked and cannot be changed by the user until the command completes (as
evidenced by the Memory Controller returning CCIF to 1). Some commands return information to the
FCCOB register array.
The generic format for the FCCOB parameter fields in NVM command mode is shown in Table 19-29.
The return values are available for reading after the CCIF flag in the FSTAT register has been returned to
1 by the Memory Controller. The value written to the FCCOBIX field must reflect the amount of CCOB
words loaded for command execution.
Table 19-29 shows the generic Flash command format. The high byte of the first word in the CCOB array
contains the command code, followed by the parameters for this specific Flash command. For details on
the FCCOB settings required by each command, see the Flash command descriptions in Section 19.4.7.
Table 19-29. FCCOB - NVM Command Mode (Typical Usage)
CCOBIX[2:0]
Register
000
FCCOB0
001
010
Byte
FCCOB Parameter Fields (NVM Command Mode)
HI
FCMD[7:0] defining Flash command
LO
Global address [23:16]
HI
Global address [15:8]
LO
Global address [7:0]
HI
Data 0 [15:8]
LO
Data 0 [7:0]
FCCOB1
FCCOB2
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
723
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-29. FCCOB - NVM Command Mode (Typical Usage)
CCOBIX[2:0]
Register
011
FCCOB3
100
101
19.4
Byte
FCCOB Parameter Fields (NVM Command Mode)
HI
Data 1 [15:8]
LO
Data 1 [7:0]
HI
Data 2 [15:8]
LO
Data 2 [7:0]
HI
Data 3 [15:8]
LO
Data 3 [7:0]
FCCOB4
FCCOB5
Functional Description
19.4.1
Modes of Operation
The FTMRZ128K512 module provides the modes of operation normal and special . The operating mode
is determined by module-level inputs and affects the FCLKDIV, FCNFG, and DFPROT registers (see
Table 19-31).
19.4.2
IFR Version ID Word
The version ID word is stored in the IFR at address 0x1F_C0B6. The contents of the word are defined in
Table 19-30.
Table 19-30. IFR Version ID Fields
•
[15:4]
[3:0]
Reserved
VERNUM
VERNUM: Version number. The first version is number 0b_0001 with both 0b_0000 and 0b_1111
meaning ‘none’.
19.4.3
Flash Block Read Access
If data read from the Flash block results in a double-bit fault ECC error (meaning that data is detected to
be in error and cannot be corrected), the read data will be tagged as invalid during that access (please look
into the Reference Manual for details). Forcing the DFDF status bit by setting FDFD (see Section 19.3.2.5)
has effect only on the DFDF status bit value and does not result in an invalid access.
MC9S12ZVM Family Reference Manual Rev. 1.5
724
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
To guarantee the proper read timing from the Flash array, the FTMRZ128K512 FMU will control (i.e.
pause) the S12Z core accesses, considering that the MCU can be configured to fetch data at a faster
frequency than the Flash block can support. Right after reset the FTMRZ128K512 FMU will be configured
to run with the maximum amount of wait-states enabled; if the user application is setup to run at a slower
frequency the control bits FCNFG[WSTAT] (see Section 19.3.2.5) can be configured by the user to disable
the generation of wait-states, so it does not impose a performance penalty to the system if the read timing
of the S12Z core is setup to be within the margins of the Flash block. For a definition of the frequency
values where wait-states can be disabled please look into the Reference Manual.
The following sequence must be followed when the transition from a higher frequency to a lower
frequency is going to happen:
• Flash resets with wait-states enabled;
• system frequency must be configured to the lower target;
• user writes to FNCNF[WSTAT] to disable wait-states;
• user reads the value of FPSTAT[WSTATACK], the new wait-state configuration will be effective
when it reads as 1;
• user must re-write FCLKDIV to set a new value based on the lower frequency.
The following sequence must be followed on the contrary direction, going from a lower frequency to a
higher frequency:
• user writes to FCNFG[WSTAT] to enable wait-states;
• user reads the value of FPSTAT[WSTATACK], the new wait-state configuration will be effective
when it reads as 1;
• user must re-write FCLKDIV to set a new value based on the higher frequency;
• system frequency must be set to the upper target.
CAUTION
If the application is going to require the frequency setup to change, the value
to be loaded on register FCLKDIV will have to be updated according to the
new frequency value. In this scenario the application must take care to avoid
locking the value of the FCLKDIV register: bit FDIVLCK must not be set
if the value to be loaded on FDIV is going to be re-written, otherwise a reset
is going to be required. Please refer to Section 19.3.2.1, “Flash Clock
Divider Register (FCLKDIV) and Section 19.4.5.1, “Writing the FCLKDIV
Register.
19.4.4
Internal NVM resource
IFR is an internal NVM resource readable by CPU . The IFR fields are shown in Table 19-7.
The NVM Resource Area global address map is shown in Table 19-8.
19.4.5
Flash Command Operations
Flash command operations are used to modify Flash memory contents.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
725
Chapter 19 Flash Module (S12ZFTMRZ)
The next sections describe:
• How to write the FCLKDIV register that is used to generate a time base (FCLK) derived from
BUSCLK for Flash program and erase command operations
• The command write sequence used to set Flash command parameters and launch execution
• Valid Flash commands available for execution, according to MCU functional mode and MCU
security state.
19.4.5.1
Writing the FCLKDIV Register
Prior to issuing any Flash program or erase command after a reset, the user is required to write the
FCLKDIV register to divide BUSCLK down to a target FCLK of 1 MHz. Table 19-10 shows
recommended values for the FDIV field based on BUSCLK frequency.
NOTE
Programming or erasing the Flash memory cannot be performed if the bus
clock runs at less than 0.8 MHz. Setting FDIV too high can destroy the Flash
memory due to overstress. Setting FDIV too low can result in incomplete
programming or erasure of the Flash memory cells.
When the FCLKDIV register is written, the FDIVLD bit is set automatically. If the FDIVLD bit is 0, the
FCLKDIV register has not been written since the last reset. If the FCLKDIV register has not been written,
any Flash program or erase command loaded during a command write sequence will not execute and the
ACCERR bit in the FSTAT register will set.
19.4.5.2
Command Write Sequence
The Memory Controller will launch all valid Flash commands entered using a command write sequence.
Before launching a command, the ACCERR and FPVIOL bits in the FSTAT register must be clear (see
Section 19.3.2.7) and the CCIF flag should be tested to determine the status of the current command write
sequence. If CCIF is 0, the previous command write sequence is still active, a new command write
sequence cannot be started, and all writes to the FCCOB register are ignored.
19.4.5.2.1
Define FCCOB Contents
The FCCOB parameter fields must be loaded with all required parameters for the Flash command being
executed. The CCOBIX bits in the FCCOBIX register must reflect the amount of words loaded into the
FCCOB registers (see Section 19.3.2.3).
The contents of the FCCOB parameter fields are transferred to the Memory Controller when the user clears
the CCIF command completion flag in the FSTAT register (writing 1 clears the CCIF to 0). The CCIF flag
will remain clear until the Flash command has completed. Upon completion, the Memory Controller will
return CCIF to 1 and the FCCOB register will be used to communicate any results. The flow for a generic
command write sequence is shown in Figure 19-31.
MC9S12ZVM Family Reference Manual Rev. 1.5
726
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
START
Read: FCLKDIV register
Clock Divider
Value Check
FDIV
Correct?
no
no
Read: FSTAT register
yes
FCCOB
Availability Check
CCIF
Set?
yes
Read: FSTAT register
Note: FCLKDIV must be
set after each reset
Write: FCLKDIV register
no
CCIF
Set?
yes
Results from previous Command
Access Error and
Protection Violation
Check
ACCERR/
FPVIOL
Set?
no
yes
Write: FSTAT register
Clear ACCERR/FPVIOL 0x30
Write to FCCOBIX register
to indicate number of parameters
to be loaded.
Write to FCCOB register
to load required command parameter.
More
Parameters?
yes
no
Write: FSTAT register (to launch command)
Clear CCIF 0x80
Read: FSTAT register
Bit Polling for
Command Completion
Check
CCIF Set?
no
yes
EXIT
Figure 19-31. Generic Flash Command Write Sequence Flowchart
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
727
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.5.3
Valid Flash Module Commands
Table 19-31 present the valid Flash commands, as enabled by the combination of the functional MCU
mode (Normal SingleChip NS, Special Singlechip SS) with the MCU security state (Unsecured, Secured).
+
Table 19-31. Flash Commands by Mode and Security State
Unsecured
FCMD
Command
NS
Secured
SS(2)
NS
(1)
(3)
SS(4)
0x01
Erase Verify All Blocks
∗
∗
∗
∗
0x02
Erase Verify Block
∗
∗
∗
∗
0x03
Erase Verify P-Flash Section
∗
∗
∗
0x04
Read Once
∗
∗
∗
0x06
Program P-Flash
∗
∗
∗
0x07
Program Once
∗
∗
∗
0x08
Erase All Blocks
0x09
Erase Flash Block
∗
∗
∗
0x0A
Erase P-Flash Sector
∗
∗
∗
0x0B
Unsecure Flash
0x0C
Verify Backdoor Access Key
∗
0x0D
Set User Margin Level
∗
0x0E
Set Field Margin Level
0x10
Erase Verify EEPROM Section
∗
∗
∗
0x11
Program EEPROM
∗
∗
∗
0x12
Erase EEPROM Sector
∗
∗
∗
0x13
Protection Override
∗
∗
∗
∗
∗
∗
∗
∗
∗
∗
∗
∗
1. Unsecured Normal Single Chip mode
2. Unsecured Special Single Chip mode.
3. Secured Normal Single Chip mode.
4. Secured Special Single Chip mode.
MC9S12ZVM Family Reference Manual Rev. 1.5
728
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.5.4
P-Flash Commands
Table 19-32 summarizes the valid P-Flash commands along with the effects of the commands on the PFlash block and other resources within the Flash module.
Table 19-32. P-Flash Commands
FCMD
Command
0x01
Erase Verify All
Blocks
0x02
Erase Verify Block
0x03
Erase Verify PFlash Section
0x04
Read Once
0x06
Program P-Flash
0x07
Program Once
Program a dedicated 64 byte field in the nonvolatile information register in P-Flash block
that is allowed to be programmed only once.
0x08
Erase All Blocks
Erase all P-Flash (and EEPROM) blocks.
An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN
bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to
launching the command.
0x09
Erase Flash Block
Erase a P-Flash (or EEPROM) block.
An erase of the full P-Flash block is only possible when FPLDIS, FPHDIS and FPOPEN
bits in the FPROT register are set prior to launching the command.
0x0A
Erase P-Flash
Sector
0x0B
Unsecure Flash
0x0C
Verify Backdoor
Access Key
Supports a method of releasing MCU security by verifying a set of security keys.
0x0D
Set User Margin
Level
Specifies a user margin read level for all P-Flash blocks.
0x0E
Set Field Margin
Level
Specifies a field margin read level for all P-Flash blocks (special modes only).
0x13
Protection
Override
19.4.5.5
Function on P-Flash Memory
Verify that all P-Flash (and EEPROM) blocks are erased.
Verify that a P-Flash block is erased.
Verify that a given number of words starting at the address provided are erased.
Read a dedicated 64 byte field in the nonvolatile information register in P-Flash block that
was previously programmed using the Program Once command.
Program a phrase in a P-Flash block.
Erase all bytes in a P-Flash sector.
Supports a method of releasing MCU security by erasing all P-Flash (and EEPROM)
blocks and verifying that all P-Flash (and EEPROM) blocks are erased.
Supports a mode to temporarily override Protection configuration (for P-Flash and/or
EEPROM) by verifying a key.
EEPROM Commands
Table 19-33 summarizes the valid EEPROM commands along with the effects of the commands on the
EEPROM block.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
729
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-33. EEPROM Commands
FCMD
Command
0x01
Erase Verify All
Blocks
0x02
Erase Verify Block
Function on EEPROM Memory
Verify that all EEPROM (and P-Flash) blocks are erased.
Verify that the EEPROM block is erased.
0x08
Erase All Blocks
Erase all EEPROM (and P-Flash) blocks.
An erase of all Flash blocks is only possible when the FPLDIS, FPHDIS, and FPOPEN
bits in the FPROT register and the DPOPEN bit in the DFPROT register are set prior to
launching the command.
0x09
Erase Flash Block
Erase a EEPROM (or P-Flash) block.
An erase of the full EEPROM block is only possible when DPOPEN bit in the DFPROT
register is set prior to launching the command.
0x0B
Unsecure Flash
0x0D
Set User Margin
Level
Specifies a user margin read level for the EEPROM block.
0x0E
Set Field Margin
Level
Specifies a field margin read level for the EEPROM block (special modes only).
0x10
Erase Verify
EEPROM Section
Verify that a given number of words starting at the address provided are erased.
0x11
Program
EEPROM
Program up to four words in the EEPROM block.
0x12
Erase EEPROM
Sector
Erase all bytes in a sector of the EEPROM block.
0x13
Protection
Override
19.4.6
Supports a method of releasing MCU security by erasing all EEPROM (and P-Flash)
blocks and verifying that all EEPROM (and P-Flash) blocks are erased.
Supports a mode to temporarily override Protection configuration (for P-Flash and/or
EEPROM) by verifying a key.
Allowed Simultaneous P-Flash and EEPROM Operations
Only the operations marked ‘OK’ in Table 19-34 are permitted to be run simultaneously on the Program
Flash and EEPROM blocks. Some operations cannot be executed simultaneously because certain
hardware resources are shared by the two memories. The priority has been placed on permitting Program
Flash reads while program and erase operations execute on the EEPROM, providing read (P-Flash) while
write (EEPROM) functionality. Any attempt to access P-Flash and EEPROM simultaneously when it is
not allowed will result in an illegal access that will trigger a machine exception in the CPU (please look
into the Reference Manual for details). Please note that during the execution of each command there is a
period, before the operation in the Flash array actually starts, where reading is allowed and valid data is
returned. Even if the simultaneous operation is marked as not allowed the Flash will report an illegal access
only in the cycle the read collision actually happens, maximizing the time the array is available for reading.
MC9S12ZVM Family Reference Manual Rev. 1.5
730
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-34. Allowed P-Flash and EEPROM Simultaneous Operations
EEPROM
Program Flash
Read
Margin
Read2
Program
Sector
Erase
Read
OK(1)
OK
OK
OK
Mass
Erase2
Margin Read(2)
Program
Sector Erase
Mass Erase(3)
OK
1. Strictly speaking, only one read of either the P-Flash or EEPROM can occur
at any given instant, but the memory controller will transparently arbitrate PFlash and EEPROM accesses giving uninterrupted read access whenever
possible.
2. A ‘Margin Read’ is any read after executing the margin setting commands ‘Set
User Margin Level’ or ‘Set Field Margin Level’ with anything but the ‘normal’
level specified. See the Note on margin settings in Section 19.4.7.12 and
Section 19.4.7.13.
3. The ‘Mass Erase’ operations are commands ‘Erase All Blocks’ and ‘Erase
Flash Block’
19.4.7
Flash Command Description
This section provides details of all available Flash commands launched by a command write sequence. The
ACCERR bit in the FSTAT register will be set during the command write sequence if any of the following
illegal steps are performed, causing the command not to be processed by the Memory Controller:
• Starting any command write sequence that programs or erases Flash memory before initializing the
FCLKDIV register
• Writing an invalid command as part of the command write sequence
• For additional possible errors, refer to the error handling table provided for each command
If a Flash block is read during execution of an algorithm (CCIF = 0) on that same block, the read operation
may return invalid data resulting in an illegal access (as described on Section 19.4.6).
If the ACCERR or FPVIOL bits are set in the FSTAT register, the user must clear these bits before starting
any command write sequence (see Section 19.3.2.7).
CAUTION
A Flash word or phrase must be in the erased state before being
programmed. Cumulative programming of bits within a Flash word or
phrase is not allowed.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
731
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.7.1
Erase Verify All Blocks Command
The Erase Verify All Blocks command will verify that all P-Flash and EEPROM blocks have been erased.
Table 19-35. Erase Verify All Blocks Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB0
0x01
Not required
Upon clearing CCIF to launch the Erase Verify All Blocks command, the Memory Controller will verify
that the entire Flash memory space is erased. The CCIF flag will set after the Erase Verify All Blocks
operation has completed. If all blocks are not erased, it means blank check failed, both MGSTAT bits will
be set.
Table 19-36. Erase Verify All Blocks Command Error Handling
Register
Error Bit
ACCERR
FPVIOL
FSTAT
19.4.7.2
Error Condition
Set if CCOBIX[2:0] != 000 at command launch
None
MGSTAT1
Set if any errors have been encountered during the reador if blank check failed .
MGSTAT0
Set if any non-correctable errors have been encountered during the read or if
blank check failed.
Erase Verify Block Command
The Erase Verify Block command allows the user to verify that an entire P-Flash or EEPROM block has
been erased.
Table 19-37. Erase Verify Block Command FCCOB Requirements
Register
FCCOB0
FCCOB1
FCCOB Parameters
0x02
Global address [23:16] to
identify Flash block
Global address [15:0] to identify Flash block
Upon clearing CCIF to launch the Erase Verify Block command, the Memory Controller will verify that
the selected P-Flash or EEPROM block is erased. The CCIF flag will set after the Erase Verify Block
operation has completed.If the block is not erased, it means blank check failed, both MGSTAT bits will be
set.
MC9S12ZVM Family Reference Manual Rev. 1.5
732
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-38. Erase Verify Block Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 001 at command launch
ACCERR
Set if an invalid global address [23:0] is supplied see Table 19-5)
FPVIOL
FSTAT
19.4.7.3
None
MGSTAT1
Set if any errors have been encountered during the read or if blank check failed.
MGSTAT0
Set if any non-correctable errors have been encountered during the read or if
blank check failed.
Erase Verify P-Flash Section Command
The Erase Verify P-Flash Section command will verify that a section of code in the P-Flash memory is
erased. The Erase Verify P-Flash Section command defines the starting point of the code to be verified and
the number of phrases.
Table 19-39. Erase Verify P-Flash Section Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB0
0x03
Global address [23:16] of
a P-Flash block
FCCOB1
Global address [15:0] of the first phrase to be verified
FCCOB2
Number of phrases to be verified
Upon clearing CCIF to launch the Erase Verify P-Flash Section command, the Memory Controller will
verify the selected section of Flash memory is erased. The CCIF flag will set after the Erase Verify P-Flash
Section operation has completed. If the section is not erased, it means blank check failed, both MGSTAT
bits will be set.
Table 19-40. Erase Verify P-Flash Section Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 010 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied see Table 19-5)
Set if a misaligned phrase address is supplied (global address [2:0] != 000)
FSTAT
Set if the requested section crosses a the P-Flash address boundary
FPVIOL
None
MGSTAT1
Set if any errors have been encountered during the read or if blank check failed.
MGSTAT0
Set if any non-correctable errors have been encountered during the read or if
blank check failed.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
733
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.7.4
Read Once Command
The Read Once command provides read access to a reserved 64 byte field (8 phrases) located in the
nonvolatile information register of P-Flash. The Read Once field is programmed using the Program Once
command described in Section 19.4.7.6. The Read Once command must not be executed from the Flash
block containing the Program Once reserved field to avoid code runaway.
Table 19-41. Read Once Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB0
0x04
Not Required
FCCOB1
Read Once phrase index (0x0000 - 0x0007)
FCCOB2
Read Once word 0 value
FCCOB3
Read Once word 1 value
FCCOB4
Read Once word 2 value
FCCOB5
Read Once word 3 value
Upon clearing CCIF to launch the Read Once command, a Read Once phrase is fetched and stored in the
FCCOB indexed register. The CCIF flag will set after the Read Once operation has completed. Valid
phrase index values for the Read Once command range from 0x0000 to 0x0007. During execution of the
Read Once command, any attempt to read addresses within P-Flash block will return invalid data.
8
Table 19-42. Read Once Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 001 at command launch
ACCERR
Set if command not available in current mode (see Table 19-31)
Set if an invalid phrase index is supplied
FSTAT
FPVIOL
19.4.7.5
None
MGSTAT1
Set if any errors have been encountered during the read
MGSTAT0
Set if any non-correctable errors have been encountered during the read
Program P-Flash Command
The Program P-Flash operation will program a previously erased phrase in the P-Flash memory using an
embedded algorithm.
CAUTION
A P-Flash phrase must be in the erased state before being programmed.
Cumulative programming of bits within a Flash phrase is not allowed.
MC9S12ZVM Family Reference Manual Rev. 1.5
734
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-43. Program P-Flash Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB0
0x06
Global address [23:16] to
identify P-Flash block
FCCOB1
Global address [15:0] of phrase location to be programmed(1)
FCCOB2
Word 0 program value
FCCOB3
Word 1 program value
FCCOB4
Word 2 program value
FCCOB5
Word 3 program value
1. Global address [2:0] must be 000
Upon clearing CCIF to launch the Program P-Flash command, the Memory Controller will program the
data words to the supplied global address and will then proceed to verify the data words read back as
expected. The CCIF flag will set after the Program P-Flash operation has completed.
Table 19-44. Program P-Flash Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 101 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied see Table 19-5)
Set if a misaligned phrase address is supplied (global address [2:0] != 000)
FSTAT
FPVIOL
19.4.7.6
Set if the global address [17:0] points to a protected area
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
Program Once Command
The Program Once command restricts programming to a reserved 64 byte field (8 phrases) in the
nonvolatile information register located in P-Flash. The Program Once reserved field can be read using the
Read Once command as described in Section 19.4.7.4. The Program Once command must only be issued
once since the nonvolatile information register in P-Flash cannot be erased. The Program Once command
must not be executed from the Flash block containing the Program Once reserved field to avoid code
runaway.
Table 19-45. Program Once Command FCCOB Requirements
CCOBIX[2:0]
FCCOB0
FCCOB Parameters
0x07
Not Required
FCCOB1
Program Once phrase index (0x0000 - 0x0007)
FCCOB2
Program Once word 0 value
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
735
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-45. Program Once Command FCCOB Requirements
CCOBIX[2:0]
FCCOB Parameters
FCCOB3
Program Once word 1 value
FCCOB4
Program Once word 2 value
FCCOB5
Program Once word 3 value
Upon clearing CCIF to launch the Program Once command, the Memory Controller first verifies that the
selected phrase is erased. If erased, then the selected phrase will be programmed and then verified with
read back. The CCIF flag will remain clear, setting only after the Program Once operation has completed.
The reserved nonvolatile information register accessed by the Program Once command cannot be erased
and any attempt to program one of these phrases a second time will not be allowed. Valid phrase index
values for the Program Once command range from 0x0000 to 0x0007. During execution of the Program
Once command, any attempt to read addresses within P-Flash will return invalid data.
Table 19-46. Program Once Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 101 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid phrase index is supplied
Set if the requested phrase has already been programmed(1)
FSTAT
FPVIOL
None
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
1. If a Program Once phrase is initially programmed to 0xFFFF_FFFF_FFFF_FFFF, the Program Once command will
be allowed to execute again on that same phrase.
19.4.7.7
Erase All Blocks Command
The Erase All Blocks operation will erase the entire P-Flash and EEPROM memory space.
Table 19-47. Erase All Blocks Command FCCOB Requirements
Register
FCCOB0
FCCOB Parameters
0x08
Not required
Upon clearing CCIF to launch the Erase All Blocks command, the Memory Controller will erase the entire
Flash memory space and verify that it is erased. If the Memory Controller verifies that the entire Flash
memory space was properly erased, security will be released. During the execution of this command
(CCIF=0) the user must not write to any Flash module register. The CCIF flag will set after the Erase All
Blocks operation has completed.
MC9S12ZVM Family Reference Manual Rev. 1.5
736
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-48. Erase All Blocks Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 000 at command launch
ACCERR
Set if command not available in current mode (see Table 19-31)
FPVIOL
FSTAT
19.4.7.7.1
Set if any area of the P-Flash or EEPROM memory is protected
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
Erase All Pin
The functionality of the Erase All Blocks command is also available in an uncommanded fashion from the
soc_erase_all_req input pin on the Flash module. Refer to the Reference Manual for information on
control of soc_erase_all_req.
The erase-all function requires the clock divider register FCLKDIV (see Section 19.3.2.1) to be loaded
before invoking this function using soc_erase_all_req input pin. Please refer to the Reference Manual for
information about the default value of FCLKDIV in case direct writes to register FCLKDIV are not
allowed by the time this feature is invoked. If FCLKDIV is not properly set the erase-all operation will not
execute and the ACCERR flag in FSTAT register will set. After the execution of the erase-all function the
FCLKDIV register will be reset and the value of register FCLKDIV must be loaded before launching any
other command afterwards.
Before invoking the erase-all function using the soc_erase_all_req pin, the ACCERR and FPVIOL flags
in the FSTAT register must be clear. When invoked from soc_erase_all_req the erase-all function will
erase all P-Flash memory and EEPROM memory space regardless of the protection settings. If the posterase verify passes, the routine will then release security by setting the SEC field of the FSEC register to
the unsecure state (see Section 19.3.2.2). The security byte in the Flash Configuration Field will be
programmed to the unsecure state (see Table 19-11). The status of the erase-all request is reflected in the
ERSAREQ bit in the FCNFG register (see Section 19.3.2.5). The ERSAREQ bit in FCNFG will be cleared
once the operation has completed and the normal FSTAT error reporting will be available as described
inTable 19-49.
At the end of the erase-all sequence Protection will remain configured as it was before executing the eraseall function. If the application requires programming P-Flash and/or EEPROM after the erase-all function
completes, the existing protection limits must be taken into account. If protection needs to be disabled the
user may need to reset the system right after completing the erase-all function.
Table 19-49. Erase All Pin Error Handling
Register
FSTAT
Error Bit
Error Condition
ACCERR
Set if command not available in current mode (see Table 19-31)
MGSTAT1
Set if any errors have been encountered during the erase verify operation, or
during the program verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the erase verify
operation, or during the program verify operation
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
737
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.7.8
Erase Flash Block Command
The Erase Flash Block operation will erase all addresses in a P-Flash or EEPROM block.
Table 19-50. Erase Flash Block Command FCCOB Requirements
Register
FCCOB0
FCCOB1
FCCOB Parameters
Global address [23:16] to
identify Flash block
0x09
Global address [15:0] in Flash block to be erased
Upon clearing CCIF to launch the Erase Flash Block command, the Memory Controller will erase the
selected Flash block and verify that it is erased. The CCIF flag will set after the Erase Flash Block
operation has completed.
Table 19-51. Erase Flash Block Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 001 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if the supplied P-Flash address is not phrase-aligned or if the EEPROM
address is not word-aligned
FSTAT
FPVIOL
19.4.7.9
Set if an invalid global address [23:0] is supplied
Set if an area of the selected Flash block is protected
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
Erase P-Flash Sector Command
The Erase P-Flash Sector operation will erase all addresses in a P-Flash sector.
Table 19-52. Erase P-Flash Sector Command FCCOB Requirements
Register
FCCOB0
FCCOB1
FCCOB Parameters
0x0A
Global address [23:16] to identify
P-Flash block to be erased
Global address [15:0] anywhere within the sector to be erased.
Refer to Section 19.1.2.1 for the P-Flash sector size.
Upon clearing CCIF to launch the Erase P-Flash Sector command, the Memory Controller will erase the
selected Flash sector and then verify that it is erased. The CCIF flag will be set after the Erase P-Flash
Sector operation has completed.
MC9S12ZVM Family Reference Manual Rev. 1.5
738
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-53. Erase P-Flash Sector Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 001 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied see Table 19-5)
Set if a misaligned phrase address is supplied (global address [2:0] != 000)
FSTAT
FPVIOL
Set if the selected P-Flash sector is protected
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
19.4.7.10 Unsecure Flash Command
The Unsecure Flash command will erase the entire P-Flash and EEPROM memory space and, if the erase
is successful, will release security.
Table 19-54. Unsecure Flash Command FCCOB Requirements
Register
FCCOB0
FCCOB Parameters
0x0B
Not required
Upon clearing CCIF to launch the Unsecure Flash command, the Memory Controller will erase the entire
P-Flash and EEPROM memory space and verify that it is erased. If the Memory Controller verifies that
the entire Flash memory space was properly erased, security will be released. If the erase verify is not
successful, the Unsecure Flash operation sets MGSTAT1 and terminates without changing the security
state. During the execution of this command (CCIF=0) the user must not write to any Flash module
register. The CCIF flag is set after the Unsecure Flash operation has completed.
Table 19-55. Unsecure Flash Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 000 at command launch
ACCERR
Set if command not available in current mode (see Table 19-31)
FSTAT
FPVIOL
Set if any area of the P-Flash or EEPROM memory is protected
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
19.4.7.11 Verify Backdoor Access Key Command
The Verify Backdoor Access Key command will only execute if it is enabled by the KEYEN bits in the
FSEC register (see Table 19-12). The Verify Backdoor Access Key command releases security if usersupplied keys match those stored in the Flash security bytes of the Flash configuration field (see Table 19-
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
739
Chapter 19 Flash Module (S12ZFTMRZ)
6). The Verify Backdoor Access Key command must not be executed from the Flash block containing the
backdoor comparison key to avoid code runaway.
Table 19-56. Verify Backdoor Access Key Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB0
0x0C
Not required
FCCOB1
Key 0
FCCOB2
Key 1
FCCOB3
Key 2
FCCOB4
Key 3
Upon clearing CCIF to launch the Verify Backdoor Access Key command, the Memory Controller will
check the FSEC KEYEN bits to verify that this command is enabled. If not enabled, the Memory
Controller sets the ACCERR bit in the FSTAT register and terminates. If the command is enabled, the
Memory Controller compares the key provided in FCCOB to the backdoor comparison key in the Flash
configuration field with Key 0 compared to 0xFF_FE00, etc. If the backdoor keys match, security will be
released. If the backdoor keys do not match, security is not released and all future attempts to execute the
Verify Backdoor Access Key command are aborted (set ACCERR) until a reset occurs. The CCIF flag is
set after the Verify Backdoor Access Key operation has completed.
Table 19-57. Verify Backdoor Access Key Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 100 at command launch
Set if an incorrect backdoor key is supplied
ACCERR
FSTAT
Set if backdoor key access has not been enabled (KEYEN[1:0] != 10, see
Section 19.3.2.2)
Set if the backdoor key has mismatched since the last reset
FPVIOL
None
MGSTAT1
None
MGSTAT0
None
19.4.7.12 Set User Margin Level Command
The Set User Margin Level command causes the Memory Controller to set the margin level for future read
operations of the P-Flash or EEPROM block.
Table 19-58. Set User Margin Level Command FCCOB Requirements
Register
FCCOB0
FCCOB1
FCCOB Parameters
0x0D
Global address [23:16] to identify Flash
block
Global address [15:0] to identify Flash block
MC9S12ZVM Family Reference Manual Rev. 1.5
740
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-58. Set User Margin Level Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB2
Margin level setting.
Upon clearing CCIF to launch the Set User Margin Level command, the Memory Controller will set the
user margin level for the targeted block and then set the CCIF flag.
NOTE
When the EEPROM block is targeted, the EEPROM user margin levels are
applied only to the EEPROM reads. However, when the P-Flash block is
targeted, the P-Flash user margin levels are applied to both P-Flash and
EEPROM reads. It is not possible to apply user margin levels to the P-Flash
block only.
Valid margin level settings for the Set User Margin Level command are defined in Table 19-59.
Table 19-59. Valid Set User Margin Level Settings
FCCOB2
Level Description
0x0000
Return to Normal Level
0x0001
User Margin-1 Level(1)
0x0002
User Margin-0 Level(2)
1. Read margin to the erased state
2. Read margin to the programmed state
Table 19-60. Set User Margin Level Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 010 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied see Table 19-5)
Set if an invalid margin level setting is supplied
FSTAT
FPVIOL
None
MGSTAT1
None
MGSTAT0
None
NOTE
User margin levels can be used to check that Flash memory contents have
adequate margin for normal level read operations. If unexpected results are
encountered when checking Flash memory contents at user margin levels, a
potential loss of information has been detected.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
741
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.7.13 Set Field Margin Level Command
The Set Field Margin Level command, valid in special modes only, causes the Memory Controller to set
the margin level specified for future read operations of the P-Flash or EEPROM block.
Table 19-61. Set Field Margin Level Command FCCOB Requirements
Register
FCCOB Parameters
FCCOB0
Global address [23:16] to identify Flash
block
0x0E
FCCOB1
Global address [15:0] to identify Flash block
FCCOB2
Margin level setting.
Upon clearing CCIF to launch the Set Field Margin Level command, the Memory Controller will set the
field margin level for the targeted block and then set the CCIF flag.
NOTE
When the EEPROM block is targeted, the EEPROM field margin levels are
applied only to the EEPROM reads. However, when the P-Flash block is
targeted, the P-Flash field margin levels are applied to both P-Flash and
EEPROM reads. It is not possible to apply field margin levels to the P-Flash
block only.
Valid margin level settings for the Set Field Margin Level command are defined in Table 19-62.
Table 19-62. Valid Set Field Margin Level Settings
FCCOB2
Level Description
0x0000
Return to Normal Level
0x0001
User Margin-1 Level(1)
0x0002
User Margin-0 Level(2)
0x0003
Field Margin-1 Level1
0x0004
Field Margin-0 Level2
1. Read margin to the erased state
2. Read margin to the programmed state
MC9S12ZVM Family Reference Manual Rev. 1.5
742
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-63. Set Field Margin Level Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 010 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied see Table 19-5)
Set if an invalid margin level setting is supplied
FSTAT
FPVIOL
None
MGSTAT1
None
MGSTAT0
None
CAUTION
Field margin levels must only be used during verify of the initial factory
programming.
NOTE
Field margin levels can be used to check that Flash memory contents have
adequate margin for data retention at the normal level setting. If unexpected
results are encountered when checking Flash memory contents at field
margin levels, the Flash memory contents should be erased and
reprogrammed.
19.4.7.14 Erase Verify EEPROM Section Command
The Erase Verify EEPROM Section command will verify that a section of code in the EEPROM is erased.
The Erase Verify EEPROM Section command defines the starting point of the data to be verified and the
number of words.
Table 19-64. Erase Verify EEPROM Section Command FCCOB Requirements
Register
FCCOB0
FCCOB Parameters
0x10
Global address [23:16] to
identify the EEPROM
block
FCCOB1
Global address [15:0] of the first word to be verified
FCCOB2
Number of words to be verified
Upon clearing CCIF to launch the Erase Verify EEPROM Section command, the Memory Controller will
verify the selected section of EEPROM memory is erased. The CCIF flag will set after the Erase Verify
EEPROM Section operation has completed. If the section is not erased, it means blank check failed, both
MGSTAT bits will be set.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
743
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-65. Erase Verify EEPROM Section Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 010 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied
Set if a misaligned word address is supplied (global address [0] != 0)
FSTAT
Set if the requested section breaches the end of the EEPROM block
FPVIOL
None
MGSTAT1
Set if any errors have been encountered during the read or if blank check failed.
MGSTAT0
Set if any non-correctable errors have been encountered during the read or if
blank check failed.
19.4.7.15 Program EEPROM Command
The Program EEPROM operation programs one to four previously erased words in the EEPROM block.
The Program EEPROM operation will confirm that the targeted location(s) were successfully programmed
upon completion.
CAUTION
A Flash word must be in the erased state before being programmed.
Cumulative programming of bits within a Flash word is not allowed.
Table 19-66. Program EEPROM Command FCCOB Requirements
Register
FCCOB0
FCCOB Parameters
0x11
Global address [23:16] to
identify the EEPROM block
FCCOB1
Global address [15:0] of word to be programmed
FCCOB2
Word 0 program value
FCCOB3
Word 1 program value, if desired
FCCOB4
Word 2 program value, if desired
FCCOB5
Word 3 program value, if desired
Upon clearing CCIF to launch the Program EEPROM command, the user-supplied words will be
transferred to the Memory Controller and be programmed if the area is unprotected. The CCOBIX index
value at Program EEPROM command launch determines how many words will be programmed in the
EEPROM block. The CCIF flag is set when the operation has completed.
MC9S12ZVM Family Reference Manual Rev. 1.5
744
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
Table 19-67. Program EEPROM Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] < 010 at command launch
Set if CCOBIX[2:0] > 101 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is supplied
Set if a misaligned word address is supplied (global address [0] != 0)
FSTAT
Set if the requested group of words breaches the end of the EEPROM block
FPVIOL
Set if the selected area of the EEPROM memory is protected
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
19.4.7.16 Erase EEPROM Sector Command
The Erase EEPROM Sector operation will erase all addresses in a sector of the EEPROM block.
Table 19-68. Erase EEPROM Sector Command FCCOB Requirements
Register
FCCOB0
FCCOB1
FCCOB Parameters
0x12
Global address [23:16] to identify
EEPROM block
Global address [15:0] anywhere within the sector to be erased.
See Section 19.1.2.2 for EEPROM sector size.
Upon clearing CCIF to launch the Erase EEPROM Sector command, the Memory Controller will erase the
selected Flash sector and verify that it is erased. The CCIF flag will set after the Erase EEPROM Sector
operation has completed.
Table 19-69. Erase EEPROM Sector Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != 001 at command launch
Set if command not available in current mode (see Table 19-31)
ACCERR
Set if an invalid global address [23:0] is suppliedsee Table 19-5
Set if a misaligned word address is supplied (global address [0] != 0)
FSTAT
FPVIOL
Set if the selected area of the EEPROM memory is protected
MGSTAT1
Set if any errors have been encountered during the verify operation
MGSTAT0
Set if any non-correctable errors have been encountered during the verify
operation
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
745
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.7.17 Protection Override Command
The Protection Override command allows the user to temporarily override the protection limits, either
decreasing, increasing or disabling protection limits, on P-Flash and/or EEPROM, if the comparison key
provided as a parameter loaded on FCCOB matches the value of the key previously programmed on the
Flash Configuration Field (see Table 19-6). The value of the Protection Override Comparison Key must
not be 16’hFFFF, that is considered invalid and if used as argument will cause the Protection Override
feature to be disabled. Any valid key value that does not match the value programmed in the Flash
Configuration Field will cause the Protection Override feature to be disabled. Current status of the
Protection Override feature can be observed on FPSTAT FPOVRD bit (see Section 19.3.2.4, “Flash
Protection Status Register (FPSTAT)).
Table 19-70. Protection Override Command FCCOB Requirements
Register
FCCOB0
FCCOB Parameters
0x13
FCCOB1
Protection Update Selection
[1:0] See Table 19-71
Comparison Key
FCCOB2
reserved
New FPROT value
FCCOB3
reserved
New DFPROT value
Table 19-71. Protection Override selection description
Protection Update
Selection code [1:0]
Protection register selection
bit 0
Update P-Flash protection
0 - keep unchanged (do not update)
1 - update P-Flash protection with new FPROT value loaded on FCCOB
bit 1
Update EEPROM protection
0 - keep unchanged (do not update)
1 - update EEPROM protection with new DFPROT value loaded on FCCOB
If the comparison key successfully matches the key programmed in the Flash Configuration Field the
Protection Override command will preserve the current values of registers FPROT and DFPROT stored in
an internal area and will override these registers as selected by the Protection Update Selection field with
the value(s) loaded on FCCOB parameters. The new values loaded into FPROT and/or DFPROT can
reconfigure protection without any restriction (by increasing, decreasing or disabling protection limits). If
the command executes successfully the FPSTAT FPOVRD bit will set.
If the comparison key does not match the key programmed in the Flash Configuration Field, or if the key
loaded on FCCOB is 16’hFFFF, the value of registers FPROT and DFPROT will be restored to their
original contents before executing the Protection Override command and the FPSTAT FPOVRD bit will
be cleared. If the contents of the Protection Override Comparison Key in the Flash Configuration Field is
left in the erased state (i.e. 16’hFFFF) the Protection Override feature is permanently disabled. If the
command execution is flagged as an error (ACCERR being set for incorrect command launch) the values
of FPROT and DFPROT will not be modified.
MC9S12ZVM Family Reference Manual Rev. 1.5
746
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
The Protection Override command can be called multiple times and every time it is launched it will
preserve the current values of registers FPROT and DFPROT in a single-entry buffer to be restored later;
when the Protection Override command is launched to restore FPROT and DFPROT these registers will
assume the values they had before executing the Protection Override command on the last time. If contents
of FPROT and/or DFPROT registers were modified by direct register writes while protection is overridden
these modifications will be lost. Running Protection Override command to restore the contents of registers
FPROT and DFPROT will not force them to the reset values.
Table 19-72. Protection Override Command Error Handling
Register
Error Bit
Error Condition
Set if CCOBIX[2:0] != (001, 010 or 011) at command launch.
Set if command not available in current mode (see Table 19-31).
Set if protection is supposed to be restored (if key does not match or is invalid) and
Protection Override command was not run previously (bit FPSTAT FPOVRD is 0),
so there are no previous valid values of FPROT and DFPROT to be re-loaded.
ACCERR
Set if Protection Update Selection[1:0] = 00 (in case of CCOBIX[2:0] = 010 or 011)
FSTAT
Set if Protection Update Selection[1:0] = 00, CCOBIX[2:0] = 001 and a valid
comparison key is loaded as a command parameter.
19.4.8
FPVIOL
None
MGSTAT1
None
MGSTAT0
None
Interrupts
The Flash module can generate an interrupt when a Flash command operation has completed or when a
Flash command operation has detected an ECC fault.
Table 19-73. Flash Interrupt Sources
Interrupt Source
Flash Command Complete
ECC Single Bit Fault on Flash Read
Global (CCR)
Mask
Interrupt Flag
Local Enable
CCIF
(FSTAT register)
CCIE
(FCNFG register)
I Bit
SFDIF
(FERSTAT register)
SFDIE
(FERCNFG register)
I Bit
NOTE
Vector addresses and their relative interrupt priority are determined at the
MCU level.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
747
Chapter 19 Flash Module (S12ZFTMRZ)
19.4.8.1
Description of Flash Interrupt Operation
The Flash module uses the CCIF flag in combination with the CCIE interrupt enable bit to generate the
Flash command interrupt request. The Flash module uses the SFDIF flag in combination with the SFDIE
interrupt enable bits to generate the Flash error interrupt request. For a detailed description of the register
bits involved, refer to Section 19.3.2.5, “Flash Configuration Register (FCNFG)”, Section 19.3.2.6, “Flash
Error Configuration Register (FERCNFG)”, Section 19.3.2.7, “Flash Status Register (FSTAT)”, and
Section 19.3.2.8, “Flash Error Status Register (FERSTAT)”.
The logic used for generating the Flash module interrupts is shown in Figure 19-32.
CCIE
CCIF
Flash Command Interrupt Request
SFDIE
SFDIF
Flash Error Interrupt Request
Figure 19-32. Flash Module Interrupts Implementation
19.4.9
Wait Mode
The Flash module is not affected if the MCU enters wait mode. The Flash module can recover the MCU
from wait via the CCIF interrupt (see Section 19.4.8, “Interrupts”).
19.4.10 Stop Mode
If a Flash command is active (CCIF = 0) when the MCU requests stop mode, the current Flash operation
will be completed before the MCU is allowed to enter stop mode.
19.5
Security
The Flash module provides security information to the MCU. The Flash security state is defined by the
SEC bits of the FSEC register (see Table 19-13). During reset, the Flash module initializes the FSEC
register using data read from the security byte of the Flash configuration field at global address
0xFF_FE0F. The security state out of reset can be permanently changed by programming the security byte
assuming that the MCU is starting from a mode where the necessary P-Flash erase and program commands
are available and that the upper region of the P-Flash is unprotected. If the Flash security byte is
successfully programmed, its new value will take affect after the next MCU reset.
The following subsections describe these security-related subjects:
• Unsecuring the MCU using Backdoor Key Access
• Unsecuring the MCU in Special Single Chip Mode using BDM
MC9S12ZVM Family Reference Manual Rev. 1.5
748
Freescale Semiconductor
Chapter 19 Flash Module (S12ZFTMRZ)
•
Mode and Security Effects on Flash Command Availability
19.5.1
Unsecuring the MCU using Backdoor Key Access
The MCU may be unsecured by using the backdoor key access feature which requires knowledge of the
contents of the backdoor keys (four 16-bit words programmed at addresses 0xFF_FE00-0xFF_FE07). If
the KEYEN[1:0] bits are in the enabled state (see Section 19.3.2.2), the Verify Backdoor Access Key
command (see Section 19.4.7.11) allows the user to present four prospective keys for comparison to the
keys stored in the Flash memory via the Memory Controller. If the keys presented in the Verify Backdoor
Access Key command match the backdoor keys stored in the Flash memory, the SEC bits in the FSEC
register (see Table 19-13) will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF are
not permitted as backdoor keys. While the Verify Backdoor Access Key command is active, P-Flash
memory and EEPROM memory will not be available for read access and will return invalid data.
The user code stored in the P-Flash memory must have a method of receiving the backdoor keys from an
external stimulus. This external stimulus would typically be through one of the on-chip serial ports.
If the KEYEN[1:0] bits are in the enabled state (see Section 19.3.2.2), the MCU can be unsecured by the
backdoor key access sequence described below:
1. Follow the command sequence for the Verify Backdoor Access Key command as explained in
Section 19.4.7.11
2. If the Verify Backdoor Access Key command is successful, the MCU is unsecured and the
SEC[1:0] bits in the FSEC register are forced to the unsecure state of 10
The Verify Backdoor Access Key command is monitored by the Memory Controller and an illegal key will
prohibit future use of the Verify Backdoor Access Key command. A reset of the MCU is the only method
to re-enable the Verify Backdoor Access Key command. The security as defined in the Flash security byte
(0xFF_FE0F) is not changed by using the Verify Backdoor Access Key command sequence. The backdoor
keys stored in addresses 0xFF_FE00-0xFF_FE07 are unaffected by the Verify Backdoor Access Key
command sequence. The Verify Backdoor Access Key command sequence has no effect on the program
and erase protections defined in the Flash protection register, FPROT.
After the backdoor keys have been correctly matched, the MCU will be unsecured. After the MCU is
unsecured, the sector containing the Flash security byte can be erased and the Flash security byte can be
reprogrammed to the unsecure state, if desired. In the unsecure state, the user has full control of the
contents of the backdoor keys by programming addresses 0xFF_FE00-0xFF_FE07 in the Flash
configuration field.
19.5.2
Unsecuring the MCU in Special Single Chip Mode using BDM
A secured MCU can be unsecured in special single chip mode using an automated procedure described in
Section 19.4.7.7.1, “Erase All Pin”, For a complete description about how to activate that procedure please
refer to the Reference Manual. Alternatively, a similar (non-automated) procedure to unsecure the MCU
in special single chip mode can be done by using the following method to erase the P-Flash and EEPROM
memory:
1. Reset the MCU into special single chip mode
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
749
Chapter 19 Flash Module (S12ZFTMRZ)
2. Delay while the BDM executes the Erase Verify All Blocks command write sequence to check if
the P-Flash and EEPROM memories are erased
3. Send BDM commands to disable protection in the P-Flash and EEPROM memory
4. Execute the Erase All Blocks command write sequence to erase the P-Flash and EEPROM
memory. Alternatively the Unsecure Flash command can be executed, if so the steps 5 and 6 below
are skipped.
5. After the CCIF flag sets to indicate that the Erase All Blocks operation has completed, reset the
MCU into special single chip mode
6. Delay while the BDM executes the Erase Verify All Blocks command write sequence to verify that
the P-Flash and EEPROM memory are erased
If the P-Flash and EEPROM memory are verified as erased, the MCU will be unsecured. All BDM
commands will now be enabled and the Flash security byte may be programmed to the unsecure state by
continuing with the following steps:
7. Send BDM commands to execute the Program P-Flash command write sequence to program the
Flash security byte to the unsecured state
8. Reset the MCU
19.5.3
Mode and Security Effects on Flash Command Availability
The availability of Flash module commands depends on the MCU operating mode and security state as
shown in Table 19-31.
19.6
Initialization
On each system reset the flash module executes an initialization sequence which establishes initial values
for the Flash Block Configuration Parameters, the FPROT and DFPROT protection registers, and the
FOPT and FSEC registers. The initialization routine reverts to built-in default values that leave the module
in a fully protected and secured state if errors are encountered during execution of the reset sequence. If a
double bit fault is detected during the reset sequence, both MGSTAT bits in the FSTAT register will be set.
CCIF is cleared throughout the initialization sequence. The Flash module holds off all CPU access for a
portion of the initialization sequence. Flash reads are allowed once the hold is removed. Completion of the
initialization sequence is marked by setting CCIF high which enables user commands.
If a reset occurs while any Flash command is in progress, that command will be immediately aborted. The
state of the word being programmed or the sector/block being erased is not guaranteed.
MC9S12ZVM Family Reference Manual Rev. 1.5
750
Freescale Semiconductor
Appendix A
MCU Electrical Specifications
A.1
General
This section contains the most accurate electrical information for the qualified derivatives S12ZVML128,
S12ZVMC128, S12ZVML64, S12ZVMC64 and S12ZVML32 available at the time of publication.
The specifications relating to the S12ZVML31, S12ZVM32 and S12ZVM16 options are preliminary.
A.1.1
Parameter Classification
The electrical parameters shown in this supplement are guaranteed by various methods. To give the
customer a better understanding the following classification is used and the parameters are tagged
accordingly in the tables where appropriate.
NOTE
This classification is shown in the column labeled “C” in the parameter
tables where appropriate.
•
•
•
•
•
P: These parameters are guaranteed during production testing on each individual device.
M: These parameters are characterized at 175°C and tested in production over an ambient
temperature range of -40°C to 150°C with appropriate guard banding to guarantee operation at
175°C.
C: These parameters are achieved in design characterization by measuring a statistically relevant
sample size across process variations.
T: These parameters are achieved by design characterization on a small sample size from typical
devices under typical conditions unless otherwise noted. All values shown in the typical column
are within this category.
D: These parameters are derived mainly from simulations.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
751
Appendix A MCU Electrical Specifications
Table A-1. Power Supplies
Mnemonic
Nominal Voltage
Description
VDD
1.8 V
VSS1
0V
Ground pin for 2.8V flash supply voltage generated by on chip voltage regulator
VSS2
0V
Ground pin for 1.8V core supply voltage generated by on chip voltage regulator
VDDF
2.8 V
2.8V flash supply voltage generated by on chip voltage regulator
VDDX1 (1)
5.0 V
5V power supply output for I/O drivers generated by on chip voltage regulator
VSSX1
0V
Ground pin for I/O drivers
VDDX2
5.0 V
5V power supply output for I/O drivers generated by on chip voltage regulator
VDDA
5.0 V
5V Power supply for the analog-to-digital converter and for the reference circuit of the
internal voltage regulator
VSSA
0V
Ground pin for VDDA analog supply
LGND
0V
Ground pin for LIN physical interface
HD
12 V
GDU Highside Drain. Also used as LIN supply, VLINSUP.
VSUP
12 V/18 V
VDDC
5V
Power supply output for external CANPHY device
VLS_OUT
11 V
GDU voltage regulator output for low side FET-predriver power supply.
VSSB
0V
Ground pin for boost supply.
HVGND
0V
Ground pin for HVIO interface
1.8V core supply voltage generated by on chip voltage regulator
External power supply for voltage regulator
1. All VDDX pins are internally connected by metal
NOTE
VDDA is connected to VDDX pins by diodes for ESD protection such that
VDDX must not exceed VDDA by more than a diode voltage drop. VSSA
and VSSX are connected by anti-parallel diodes for ESD protection.
A.1.2
Pins
There are 4 groups of functional pins.
A.1.2.1
General Purpose I/O Pins (GPIO)
The I/O pins have a level in the range of 4.5V to 5.5V. This class of pins is comprised of all port I/O pins,
BKGD and the RESET pins.
A.1.2.2
High Voltage Pins
These consist of the LIN, BST, HD, VCP, CP, VLS_OUT, VLS[2:0], VBS[2:0], HG[2:0], HS[2:0],
LG[2:0] pins. These pins are intended to interface to external components operating in the automotive
battery range. They have nominal voltages above the standard 5V I/O voltage range.
MC9S12ZVM Family Reference Manual Rev. 1.5
752
Freescale Semiconductor
Appendix A MCU Electrical Specifications
A.1.2.3
Oscillator
If the designated EXTAL and XTAL pins are configured for external oscillator operation then these pins
have a nominal voltage of 1.8 V.
A.1.2.4
TEST
This pin is used for production testing only. The TEST pin must be tied to ground in all applications.
A.1.3
Current Injection
Power supply must maintain regulation within operating VDDX or VDD range during instantaneous and
operating maximum current conditions. Figure A-1. shows a 5 V GPIO pad driver and the on chip voltage
regulator with VDDX output. It shows also the power and ground pins VSUP, VDDX, VSSX and VSSA.
Px represents any 5 V GPIO pin. Assume Px is configured as an input. The pad driver transistors P1 and
N1 are switched off (high impedance). If the voltage Vin on Px is greater than VDDX a positive injection
current Iin will flow through diode D1 into VDDX node. If this injection current Iin is greater than ILoad,
the internal power supply VDDX may go out of regulation. Ensure the external VDDX load will shunt
current greater than maximum injection current. This is the greatest risk when the MCU is not consuming
power; e.g., if no system clock is present, or if the clock rate is very low which would reduce overall power
consumption.
Figure A-1. Current Injection on GPIO Port if Vin > VDDX
VSUP
Voltage Regulator
VBG
+
_
ISUP
Pad Driver
P2
IDDX
VDDX
ILoad
C
Load
Iin
P1
D1
Iin
Px
N1
Vin > VDDX
VSSX
VSSA
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
753
Appendix A MCU Electrical Specifications
A.1.4
Absolute Maximum Ratings
Absolute maximum ratings are stress ratings only. A functional operation outside these ranges is not
guaranteed. Stress beyond these limits may affect the reliability or cause permanent damage of the device.
This device contains circuitry protecting against damage due to high static voltage or electrical fields;
however, it is advised that normal precautions be taken to avoid application of any voltages higher than
maximum-rated voltages to this high-impedance circuit. Reliability of operation is enhanced if unused
inputs are tied to an appropriate logic voltage level.
Table A-2. Absolute Maximum Ratings
Num
Rating
Symbol
Min
Max
Unit
1
Voltage regulator and LINPHY supply voltage
VSUP
-0.3
42
V
2
DC voltage on LIN
VLIN
-32
42
V
3
Core logic supply voltage
VDD
-0.3
2.16
V
4
Flash supply voltage
VDDF
-0.3
3.6
V
5
FET-Predriver High-Side Drain
VHD
-0.3
42
V
6
FET-Predriver Bootstrap Capacitor Connection
VVBS
-0.3
42
V
VHG
-5
42
V
VHS
-5
42
V
VVLS_OUT
-0.3
42
V
VVLS
-0.3
42
V
VLG
-5
42
V
Gate(1)
7
FET-Predriver High-Side
8
FET-Predriver High-Side Source(1)
9
Generated FET-Predriver Low-Side Supply
10
FET-Predriver Low-Side Supply Inputs
Gate(1)
11
FET-Predriver Low-Side
12
FET-Predriver Low-Side Source(1)
VLS
-5
42
V
13
FET-Predriver Charge Pump Output
VCP
-0.3
42
V
14
FET-Predriver Charge Pump Input
VVCP
-0.3
42
V
15
FET-Predriver Boost Converter Connection
VBST
-0.3
42
V
16
FET-Predriver Boost Converter Ground
VVSSB
-0.3
0.3
V
17
Voltage Regulator Ballast Connection
VBCTL
-0.3
42
V
18
Supplies VDDA, VDDC, VDDX
VVDDACX
-0.3
6
V
19
Base connection of bipolar for CANPHY supply
VBCTLC
-0.3
42
V
20
Voltage difference VDDX to VDDA(2)
ΔVDDX
–0.3
0.3
V
21
Voltage difference VSSX to VSSA
ΔVSSX
–0.3
0.3
V
22
Digital I/O input voltage
VIN
–0.3
6.0
V
VILV
–0.3
2.16
V
VTEST
–0.3
10.0
V
ID
–25
+25
mA
IEVDD1
-80
+25
mA
IDL
–25
+25
mA
23
EXTAL, XTAL
24
TEST input
(3)
pins(4)
25
Instantaneous current. Single pin limit for all digital I/O
26
Instantaneous maximum current on EVDD1
27
Instantaneous maximum current. Single pin limit for EXTAL, XTAL
MC9S12ZVM Family Reference Manual Rev. 1.5
754
Freescale Semiconductor
Appendix A MCU Electrical Specifications
Table A-2. Absolute Maximum Ratings
28
Storage temperature range
T
stg
1. Negative limit for pulsed operation only
2. VDDX and VDDA must be shorted
3. EXTAL, XTAL pins configured for external oscillator operation only
4. All digital I/O pins are internally clamped to VSSX and VDDX, or VSSA and VDDA.
A.1.5
–65
°C
155
ESD Protection and Latch-up Immunity
All ESD testing is in conformity with CDF-AEC-Q100 stress test qualification for automotive grade
integrated circuits. During the device qualification ESD stresses were performed for the Human Body
Model (HBM) and the Charged-Device Model.
A device will be defined as a failure if after exposure to ESD pulses the device no longer meets the device
specification. Complete DC parametric and functional testing is performed per the applicable device
specification at room temperature followed by hot temperature, unless specified otherwise.
For better immunity to ESD events, the external diode and test point for the BST pin should be located at
a distance from the device to increase the track length to the BST pin.
Table A-3. ESD and Latch-up Test Conditions
Model
Human Body
ChargedDevice
Spec
JESD22-A114
JESD22-C101
Description
Symbol
Value
Unit
Series Resistance
R
1500
Ω
Storage Capacitance
C
100
pF
Number of Pulses per pin
positive
negative
-
1
1
Series Resistance
R
0
Ω
Storage Capacitance
C
4
pF
Latch-up for 5V
GPIOs
Minimum Input Voltage Limit
-2.5
V
Maximum Input Voltage Limit
+7.5
V
Latch-up for
HD/VCP/
BST/LIN/
BCTL/BCTLC
Minimum Input Voltage Limit
-7
V
Maximum Input Voltage Limit
+27
V
Latch-up for
HG,HS
Minimum Input Voltage Limit
-5
V
Maximum Input Voltage Limit (VBS=10V)
15
V
Latch-up for
LG,LS
Minimum Input Voltage Limit
-5
V
Maximum Input Voltage Limit (VLS=10V)
15
V
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
755
Appendix A MCU Electrical Specifications
Table A-4. ESD Protection and Latch-up Characteristics
Num
C
1
C
Rating
Symbol
Min
Max
Unit
Human Body Model (HBM):
-LIN versus LGND
-all other pins
VHBM
VHBM
+/-6
+/-2
-
KV
2
C
Charged-Device Model (CDM): Corner Pins
VCDM
+/-750
-
V
3
C
Charged-Device Model (CDM): All other pins
VCDM
+/-500
-
V
4
C
Direct Contact Discharge IEC61000-4-2 with and with out 220pF
capacitor (R=330, C=150pF):
LIN versus LGND
VESDIEC
+/-6
-
KV
5
C
Latch-up Current of 5V GPIOs at T=125°C
positive
negative
ILAT
+100
-100
-
mA
Latch-up Current (VCP, BST, LIN, HD, HS, HG, LG, LS) T=125°C
positive
negative
ILAT
+100
-100
-
mA
Latch-up Current of 5V GPIOs at 27°C
positive
negative
ILAT
+200
-200
-
mA
Latch-up Current (VCP, BST, LIN, HD, HS, HG, LG, LS) T= 27°C
positive
negative
ILAT
+200
-200
-
mA
6
C
7
C
8
C
A.1.6
Recommended Capacitor Values
Table A-5. Recommended Capacitor Values (nominal component values)
Num
Characteristic
Symbol
Typical
Unit
1
VDDX decoupling capacitor
(1) (2)
CVDDX1,2
100-220
nF
2
VDDA decoupling capacitor (1)
CVDDA
100-220
nF
CVDD5
4.7-10
μF
CVLS0,1,2
100-220
nF
CVLS
4.7-10
μF
CVDD
100-220
nF
CVDDF
100-220
nF
CLIN
220
pF
3
VDDX stability capacitor
(3) (4)
(1) (5)
4
VLS decoupling capacitor
5
VLS stability capacitor (3) (6)
6
VDD decoupling capacitor (1)
7
VDDF decoupling capacitor
8
(1)
LIN decoupling capacitor
(1)
1. X7R ceramic
2. One capacitor per VDDX pin
3. 4.7μF ceramic or 10μF tantalum
4. Can be placed anywhere on the 5V supply node (VDDA, VDDX)
5. One capacitor per each VLS[2:0] pin
6. Can be placed anywhere on the VLS node
MC9S12ZVM Family Reference Manual Rev. 1.5
756
Freescale Semiconductor
Appendix A MCU Electrical Specifications
A.1.7
Operating Conditions
This section describes the operating conditions of the device. Unless otherwise noted these conditions
apply to the following electrical parameters.
NOTE
Please refer to the temperature rating of the device with regards to the
ambient temperature TA and the junction temperature TJ. For power
dissipation calculations refer to Section A.1.8, “Power Dissipation and
Thermal Characteristics”.
Table A-6. Operating Conditions
Num
Rating
Symbol
Min
Typ
Max
Unit
1
Voltage regulator and LINPHY supply voltage(1)
VSUP
3.5
12
40
V
2
Voltage difference VDDX to VDDA
ΔVDDX
–0.1
—
0.1
V
3
Voltage difference VSSX to VSSA
ΔVSSX
–0.1
—
0.1
V
4
Oscillator
fosc
4
—
16
MHz
Bus
-40°C < Tj < 150°C
150°C < Tj < 175°C (Temp option W only)
fbus
(4)
—
—
50
40
MHz
Bus frequency without flash wait states
-40°C < Tj < 150°C
150°C < Tj < 175°C (Temp option W only)
fWSTAT
—
—
25
20
MHz
5
6
frequency(2)
7a
Operating junction temperature range
Operating ambient temperature range(3) (option V)
T
J
T
–40
–40
—
—
125
105
°C
7b
Operating junction temperature range
Operating ambient temperature range(3) (option M)
TJ
TA
–40
–40
—
—
150
125
°C
7c
Operating junction temperature range
Operating ambient temperature range(3) (option W)
T
J
TA
–40
–40
—
—
175
150
°C
A
1. Normal operating range is 5.5 V - 18 V. Continuous operation at 40 V is not allowed. Only Transient Conditions (Load Dump)
single pulse tmax 4.85V
Partial Drive IOH = –2 mA
Full Drive IOH = –20mA
VOH
VDDX – 0.8
—
—
V
8b
C Output high voltage (EVDD1), VDDX > 4.85V
Full Drive IOH = –10mA
VOH
VDDX – 0.1
—
—
V
9
M Output low voltage (All GPIO except EVDD1)
IOL = +4mA
V
—
—
0.8
V
10
M Output low voltage (EVDD1) Partial drive IOL = +2mA
or Full drive IOL = +20mA
VOL
—
—
0.8
V
11
D Maximum allowed continuous current on EVDD1
IEVDD1
-20
—
10
mA
12
M Over-current Detect Threshold EVDD1
IOCD
-80
—
-40
mA
13
M Internal pull up current (All GPIO except RESET)
VIH min > input voltage > VIL max
IPUL
-10
—
-130
μA
14
M Internal pull up resistance (RESET pin)
RPUL
2.5
5
10
KΩ
15
M Internal pull down current, VIH min > Vin > VIL max
IPDH
10
—
130
μA
16
D Input capacitance
Cin
—
7
—
pF
17a
T Injection current(2) Single pin limit (all GPIO pins)
Total device limit, sum of all injected currents
IICS
IICP
–2.5
–25
—
2.5
25
mA
17b
T Injection current single pin (HG,HS,LG,LS pins)(3)
IICS
–2.5
—
2.5
mA
in
in
DDX
DDX
I
in
SSX
SSX
in
OL
1. Pins in high impedance input mode. Maximum leakage current occurs at maximum operating temperature. Current
decreases by approximately one-half for each 8°°C to 12°°C in the temperature range from 50°C to 125°C.
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
761
Appendix A MCU Electrical Specifications
2. For better ADC accuracy, the application should avoid current injection into pin PAD8/VREFH. Refer to Section A.1.3,
“Current Injection” for more details
3. For better ADC accuracy, the application should avoid current injection into pin HS0 and HG0 during ADC conversions. This
can be achieved by correct synchronization of ADC and FET switching..
This following tables describe the timing characteristics of I/O pins.
Table A-11. Pin Timing Characteristics (Junction Temperature From -40°C To +175°C)
Conditions are 4.5 V < VDDX< 5.5 V unless otherwise noted. I/O Characteristics for all GPIO pins (defined in A.1.2.1/A-752).
Num C
Rating
Symbol
Min
Typ
Max
Unit
1
M Port P, S, AD interrupt input pulse filtered
(STOP mode )
tP_MASK
—
—
3
μs
2
M Port P, S, AD interrupt input pulse passed
(STOP mode )
tP_PASS
10
—
—
μs
3
D Port P, S, AD interrupt input pulse filtered (STOP) in
number of bus clock cycles of period 1/fbus
nP_MASK
—
—
3
4
D Port P, S, AD interrupt input pulse passed (STOP) in
number of bus clock cycles of period 1/fbus
nP_PASS
4
—
—
5
D IRQ pulse width, edge-sensitive mode (STOP) in
number of bus clock cycles of period 1/fbus
nIRQ
1
—
—
6
D RESET pin input pulse filtered
RP_MASK
—
—
12
ns
7
D RESET pin input pulse passed
RP_PASS
18
—
—
ns
A.1.10
HV Physical Interface Characteristics
The HV Physical Interface specification is included in the LINPHY electrical section.
A.1.11
Supply Currents
This section describes the current consumption characteristics of the device as well as the conditions for
the measurements.
A.1.11.1
Measurement Conditions
Current is measured on VSUP. VDDX is connected to VDDA. It does not include the current to drive
external loads. Unless otherwise noted the currents are measured in special single chip mode and the CPU
code is executed from RAM. For Run and Wait current measurements PLL is on and the reference clock
is the IRC1M trimmed to 1MHz. For the junction temperature range from -40°C to +150°C the bus
frequency is 50MHz. For the temperature range from +150°C to +175°C, the bus frequency is 40MHz.
Table A-12, Table A-13 and Table A-14 show the configuration of the CPMU module and the peripherals
for Run, Wait and Stop current measurement.
MC9S12ZVM Family Reference Manual Rev. 1.5
762
Freescale Semiconductor
Appendix A MCU Electrical Specifications
Table A-12. CPMU Configuration for Pseudo Stop Current Measurement
CPMU REGISTER
Bit settings/Conditions
CPMUCLKS
PLLSEL=0, PSTP=1, CSAD=0,
PRE=PCE=RTIOSCSEL=1
COPOSCSEL[1:0]=01
CPMUOSC
OSCE=1, Quartz oscillator fEXTAL=4MHz
CPMURTI
RTDEC=0, RTR[6:4]=111, RTR[3:0]=1111
CPMUCOP
WCOP=1, CR[2:0]=111
Table A-13. CPMU Configuration for Run/Wait and Full Stop Current Measurement
CPMU REGISTER
Bit settings/Conditions
CPMUSYNR
VCOFRQ[1:0]= 3,SYNDIV[5:0] = 49
CPMUPOSTDIV
POSTDIV[4:0]=0
CPMUCLKS
PLLSEL=1, CSAD=0
CPMUOSC
OSCE=0,
Reference clock for PLL is fref=firc1m trimmed to 1MHz
API settings for STOP current measurement
CPMUAPICTL
APIEA=0, APIFE=1, APIE=0
CPMUACLKTR
trimmed to >=20Khz
CPMUAPIRH/RL
set to 0xFFFF
Table A-14. Peripheral Configurations for Run & Wait Current Measurement
Peripheral
Configuration
SCI
Continuously transmit data (0x55) at speed of 19200 baud
SPI
Configured to master mode, continuously transmit data (0x55) at 1Mbit/s
ADC
The peripheral is configured to operate at its maximum specified frequency and to
continuously convert voltages on a single input channel
MSCAN
Configured in loop back mode with a bit rate of 500kbit/s.
DBG
The module is disabled, as in typical final applications
PTU
The module is enabled, bits TG1EN and TG0EN are set. PTUFRE is also set to generate
automatic reload events.
PMF
The module is configured with a modulus rate of 10 kHz
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
763
Appendix A MCU Electrical Specifications
Table A-14. Peripheral Configurations for Run & Wait Current Measurement
Peripheral
Configuration
TIM
The peripheral is configured to output compare mode,
GDU
LDO enabled. Charge pump enabled. Current sense0 enabled. Boost disabled. No
output activity (too load dependent)
COP & RTI
Enabled
BATS
Enabled
LINPHY
connected to SCI and continuously transmit data (0x55) at speed of 19200 baud
Table A-15. Run and Wait Current Characteristics
Conditions see Table A-13 and Table A-14, VSUP=18 V
Num
C
Rating
Symbol
Min
Typ
Max
Unit
1
P
Run Current, -40°C < TJ < 150°C, fbus= 50MHz
ISUPR
—
53
66
mA
2
P
Wait Current, -40°C < TJ < 150°C, fbus= 50MHz
ISUPW
—
42
50
mA
3
M
Run Current, TJ =175×°C, fbus= 40MHz
ISUPR
—
45
55
mA
4
M
Wait Current, TJ = 175°C, fbus= 40MHz
ISUPW
—
36
45
mA
Min
Typ
Max
Unit
Table A-16. Stop Current Characteristics
Conditions are: VSUP=12 V
Num
Rating(1)
C
Symbol
Stop Current all modules off
1
P
TA = TJ= -40°C
ISUPS
—
12
25
μA
2
P
TA = TJ= 150°C
ISUPS
—
200
1050
μA
3
C
TA = TJ = 25°C
ISUPS
—
15
30
μA
4
C
TA = TJ = 85°C
ISUPS
—
80
—
μA
25
35
μA
Stop Current API enabled & LINPHY in standby
5
T
TA = TJ = 25°C
ISUPS
—
1. If MCU is in STOP long enough then TA = TJ . Die self heating due to stop current can be ignored.
Table A-17. Pseudo Stop Current Characteristics
Conditions are: VSUP=12V, API, COP & RTI enabled
Num
C
1
C
A.1.12
Rating
TJ = 25°C
Symbol
Min
Typ
Max
Unit
ISUPPS
—
265
300
μA
ADC Calibration Configuration
The reference voltage VBG is measured under the conditions shown in Table A-18. The values stored in
the IFR are the average of eight consecutive conversions at Tj=150 °C and eight consecutive conversions
MC9S12ZVM Family Reference Manual Rev. 1.5
764
Freescale Semiconductor
Appendix A MCU Electrical Specifications
at Tj=-40 °C. The code is executed from RAM. The result is programmed to the IFR, otherwise there is no
flash activity.
Table A-18. Measurement Conditions
Description
Symbol
Value
Unit
Regulator Supply Voltage at VSUP
VSUP
5
V
Supply Voltage at VDDX and VDDA
VDDX,A
5
V
ADC reference voltage high
VRH
5
V
ADC reference voltage low
VRL
0
V
ADC clock
fATDCLK
2
MHz
ADC sample time
tSMP
4
ADC clock cycles
Bus clock frequency
fbus
48
MHz
Junction temperature
Tj
-40 and 150
°C
MC9S12ZVM Family Reference Manual Rev. 1.5
Freescale Semiconductor
765
Appendix A MCU Electrical Specifications
MC9S12ZVM Family Reference Manual Rev. 1.5
766
Freescale Semiconductor
Appendix B
CPMU Electrical Specifications (VREG, OSC, IRC, PLL)
B.1
VREG Electrical Specifications.
Table B-1. Voltage Regulator Electrical Characteristics
(Junction Temperature From –40°C To +175°C unless otherwise stated)
Note: VDDA and VDDX must be shorted on the application board.
Num
C
1
M
2
M
3
4a
4b
M
C
M
Characteristic
Symbol
Min
Typical
Max
Unit
Input Voltages
VSUP
3.5
—
40
V
Output Voltage Core
Full Performance Mode
Reduced Power Mode (stop mode)
VDD
1.72
—
1.84
1.6
1.98
—
V
V
Output Voltage Flash
Full Performance Mode
Reduced Power Mode (stop mode)
VDDF
2.6
—
2.82
1.6
2.9
—
V
V
VDDX
4.85
4.50
3.13
2.5
5.0
5.0
—
5.5
5.15
5.15
5.15
5.75
V
V
V
V
VDDX
4.80
4.50
3.13
2.5
4.95
4.95
—
5.5
5.10
5.10
5.10
5.75
V
V
V
V
VDDX
—
50
80
mV
IDDX
0
—
70
mA
IDDX
0
0
0
—
—
—
55
20
5
mA
mA
mA
Load Current VDDX(2)(3) without external PNP
Full Performance Mode 3.5V
工商网监
湘ICP备2023018690号
